thebench.bio #1 Ecosystem for the Bio-Tech Industry
All Quality Assurance questions

Question 18 of 20 Advanced Practical

How would you design an audit program for a fast-growing company with limited QA capacity?

Short answer

Rank every internal area and supplier by risk to patient and product, using data such as criticality, history and change, and set audit frequency and depth by that rank. Cover the whole GMP scope over a defined cycle, use remote or paper assessment for low risk, and report gaps to management.

Why

EU GMP Chapter 9 requires self inspections of personnel, premises, equipment, documentation, production, QC, distribution, complaints and recalls, and self inspection itself, following a pre-arranged programme by competent people working independently. ICH Q7 asks for regular internal audits on an approved schedule. ICH Q10 extends the quality system to outsourced activities and purchased materials, with suitability assessed before use and performance monitored afterwards.

None of this says every area every year, which leaves room for risk-based design. Score each area and supplier on criticality, such as sterile operations and active substance suppliers high, office supplies low, then adjust for history, recent changes, inspection findings and volume. High risk gets annual or more frequent on-site audits.

Medium risk gets a longer cycle. Low risk gets questionnaires or certificate review. Track the program against plan and show coverage across the cycle, so nothing is permanently skipped.

Use qualified auditors from other departments or contractors to add capacity, while keeping independence. Fast growth adds risk, so new sites, new suppliers and new processes deserve an audit early. The design fails when risk scores are set once and never updated, or when capacity limits are hidden instead of reported to management as a resourcing decision.

How to work it through

  1. List every internal area, contractor and supplier in GMP scope.
  2. Score each for impact on product and patient, then adjust for history, change and recent findings.
  3. Set audit type and frequency from the score, with on-site audits for the highest risk.
  4. Build a cycle that covers the full Chapter 9 scope over a defined period.
  5. Add capacity through trained cross-functional auditors or contractors while keeping independence.
  6. Report plan versus actual and unmet risk to management review.

An example

A company grows from 1 site and 40 suppliers to 3 sites and 120 suppliers with two auditors, each able to do about 25 audits a year. Scoring puts 12 suppliers and 6 internal areas in the high tier, 30 suppliers in medium and the rest low. High tier gets annual on-site audits, which uses 18 audits.

Medium tier is on a three-year cycle, which is 10 a year. That leaves 22 audits for new suppliers, for cause audits and the internal areas on a two-year cycle. Low-tier suppliers get questionnaires.

The gap of 8 audits a year goes to management review with a request for a contract auditor.

Where the answer stops holding

Risk scores rely on data that may be thin for new suppliers, so early audits fill the gap. A low-risk label can hide a supplier that changed without notice. Remote assessments miss what an auditor would see on the floor, so they suit only genuinely low-risk cases.

A strong answer covers

  • Risk ranking from criticality, history and change
  • Frequency and audit type set by risk
  • Full GMP scope covered over a defined cycle
  • Extra capacity without losing independence
  • Gaps escalated to management review

Common mistakes

  • Auditing everything on the same annual schedule until the team is overwhelmed.
  • Setting risk scores once and never updating them after changes or findings.
  • Hiding the capacity gap instead of making it a management decision.