Internal Audit Program Plan, Schedule, and Report Template

This is a ready-to-use internal audit program pack. It holds five linked documents in one place: the program plan, the risk-based annual schedule, the per-area audit plan and checklist, the audit report, and the CAPA tracking and effectiveness section. Replace every <<FILL: ...>> placeholder with your own specifics, set your own document numbers and dates, and route the pack through your normal document control, review, and approval. A worked filled specimen of one audit report follows the template so you can see how a completed version reads. Verify each cited regulation against the current source before you rely on it. Using this template does not by itself create compliance; the program only works if the audits actually happen on schedule, the findings are honest, and the CAPAs close with evidence.

Document control header

1. Purpose and program objective

This program establishes how <<FILL: SITE / ORGANIZATION>> plans, performs, reports, and closes internal audits, also called self-inspections. The objective is to confirm that the quality system, the facilities, the equipment, the computerized systems, and the documented practices conform to GMP and to the company’s own procedures, and to find and fix gaps before a regulatory inspection, a customer audit, or a quality event finds them.

A self-inspection program is an explicit GMP expectation. EU GMP Chapter 9 requires self-inspections on a defined schedule to monitor implementation and compliance and to propose corrective measures. The US framework reaches the same place through 21 CFR 211.22, which makes the quality unit responsible for procedures and oversight, and through the ICH Q10 expectation of management review fed by internal audit results. The program here is risk based: areas that carry more risk to product quality, to patient safety, or to data integrity are audited more often and in more depth.

2. Scope

This program covers all GxP areas, systems, and processes at <<FILL: SITE / ORGANIZATION>>, including but not limited to: quality management system elements (deviations, CAPA, change control, complaints, recalls, training, document control, supplier management); manufacturing and packaging, including aseptic processing where applicable; quality control laboratories (chemistry, microbiology, stability); warehousing, distribution, and cold chain; computerized systems and data integrity, including audit trail review; facilities and utilities (water systems, HVAC, compressed gases, environmental monitoring); validation and qualification programs; and, for combination products, the drug-led and device-constituent controls that fall under the site’s quality system.

The program does not cover external supplier audits, which run under <<FILL: supplier audit procedure number>>, or regulatory inspections, which run under <<FILL: inspection management procedure number>>. Self-inspection findings may feed those programs.

3. Roles and responsibilities

4. Auditor qualification and independence

An audit is only as trustworthy as the people who run it, so qualification and independence are controlled, not assumed.

4.1 Auditor qualification criteria

The Internal Audit Lead maintains an approved auditor roster with the qualification status and the areas each auditor is cleared to audit. A person who falls below the continuing-competence threshold is re-qualified before leading again.

4.2 Independence rule

An auditor must not audit their own work, their own department, or any area where a reporting relationship would compromise objectivity. For small sites where independence is hard to achieve, acceptable alternatives include cross-site auditors, corporate auditors, or qualified external contract auditors. The independence basis for each audit is recorded on the audit plan. This protects the program from the most common credibility attack an inspector makes: that the auditor had a reason to look away.

5. Risk-based annual schedule

The schedule sets the audit frequency for each area by risk, then is approved before the year starts. Every GxP area is audited at least once within the defined cycle; higher-risk areas are audited more often.

5.1 Risk rating inputs

Rate each area using factors such as: direct impact on product quality and patient safety, sterility or contamination risk, data integrity exposure, complexity and degree of automation, history of deviations and findings, regulatory focus and recent guidance, time since the last audit, and significant change (new equipment, new product, reorganization).

Unscheduled (for-cause) audits are triggered by a serious deviation, a recurring finding, a regulatory signal, a major change, or a complaint trend, and are added during the year.

5.2 Annual schedule table

Schedule changes are controlled. A slipped audit is documented with a reason and a new date; repeated slips of high-risk audits are escalated to the Head of Quality.

6. Audit process

Target timelines (adjust to your QMS):

7. Per-area audit plan and checklist (template)

Use one plan per audit. Build the checklist from the applicable regulations and SOPs for the area; the rows below are a starting frame to adapt, not a fixed list.

7.1 Audit plan header

7.2 Checklist (adapt rows per area)

Every “No” or partial answer becomes a candidate finding. Record the specific record, batch, screen, or observation so the finding rests on evidence, not opinion.

8. Finding classification

Classify each finding by its actual or potential impact on product quality, patient safety, or data integrity. Consistent classification is what lets the program prioritize and what an inspector checks for honesty.

A pattern of minors across areas can roll up to a major or critical systemic finding; the report must call that out rather than logging them as isolated minors.

9. Audit report template

9.1 Executive summary

<<FILL: 3-6 sentences: scope covered, overall state, count of findings by class, any item needing immediate management attention.>>

9.2 Scope covered and not covered

<<FILL: what was examined, what was deliberately excluded and why, any access limitations.>>

9.3 Findings

9.4 Positive observations

<<FILL: practices worth keeping or spreading; an honest report records strengths, not only gaps.>>

9.5 Conclusion and follow-up

<<FILL: overall conclusion, whether a follow-up audit is needed, and the date the next audit of this area is due.>>

Sign-off:

10. CAPA tracking to closure

Each finding above the observation class generates a CAPA tracked in the CAPA log until it is closed with effectiveness evidence. The audit is not closed while CAPAs remain open.

Closure rule: a finding closes only when the action is complete, evidence is attached, and effectiveness is confirmed (for example, the next set of records shows the control now holds). Closing on a promise rather than on evidence is the failure mode inspectors catch most often.

11. Escalation

12. Program effectiveness metrics

Review these at management review. The point is to show the program finds real gaps and closes them, not to chase a clean scorecard by underreporting.

13. Records and retention

Audit plans, checklists, reports, CAPA records, and the auditor roster are retained per <<FILL: retention schedule, e.g. life of product plus N years>>. Records are controlled, access-restricted, and available for management review and regulatory inspection.

Worked specimen

The following is a completed audit report and its CAPA tracking, using the fictional company Acme Bio. All names, numbers, and dates are illustrative.

Audit report (filled)

Executive summary: The audit examined access control, audit trail configuration, and the routine audit trail review practice for CDS-01. Access control and system qualification were in good order. Two findings were raised: one major (audit trail review was not performed at the defined frequency for two analytical sequences) and one minor (a controlled SOP was past its periodic review date). No critical findings. No data integrity falsification was found. One finding needs management attention because it touches release data.

Scope covered: user access list and leaver removal, audit trail enablement and configuration, the documented audit trail review for ten sampled analytical sequences from Feb to Apr 2026, the review SOP, and training records. Not covered: the instrument qualification of the attached HPLCs, which is audited separately under IA-2026-11.

Findings:

Positive observations: leaver access was removed within one working day in all sampled cases, well inside the SOP target; the CDS administrator kept a clear configuration baseline record.

Conclusion: The system is fundamentally under control, but the audit trail review gap on release-supporting data is a real risk and must be corrected and shown effective. A follow-up verification of F1 is required. Next scheduled audit of this area: May 2027.

CAPA tracking (filled)

Regulations this supports

• EU GMP Part I, Chapter 9 (Self Inspection)
• EU GMP Part I, Chapter 1 (Pharmaceutical Quality System) and Chapter 6 (Quality Control)
• EU GMP Annex 11 (2011), Computerised Systems
• 21 CFR 211.22 (responsibilities of the quality control unit) and 21 CFR 211.180 / 211.198 (records and complaint handling) where relevant to audited areas
• 21 CFR Part 11 (electronic records and signatures)
• ICH Q10 (Pharmaceutical Quality System), including internal audit and management review
• ICH Q9(R1) (2022; FDA-adopted 2023), Quality Risk Management, for the risk-based schedule
• FDA Data Integrity and Compliance with Drug CGMP guidance (2018)
• MHRA “GxP” Data Integrity guidance (2018)
• PIC/S PI 041, Good Practices for Data Management and Integrity
• For combination products, 21 CFR Part 4 (current good manufacturing practice for combination products), where the audited area covers a device constituent under the drug-led quality system

This pack pairs with your CAPA record form and your deviation record form; keep finding IDs, CAPA IDs, and the audit ID linked so the trail is reconstructable from the schedule to closure.