We recently published our comprehensive guide to annual audit planning. This is the compressed companion version: seven things to do this quarter to prep for next year if you haven’t solidified your plan yet.
As we noted in our other guide, the reason we push teams to kick off next year’s audit planning in Q3 comes down to the calendar math. If your first 2027 audits are in January, agendas are drafted and approved in Q4, when approvals are slow and many sites are closed. That means everything January depends on gets decided in October, which makes September the last real month to do the thinking.
Each item below has a “done when” so you can tell whether you’ve actually finished it or just feel like you have.
Download our free Excel audit planning workbook if you haven’t already:
1. Reconcile your audit universe for next year
First things first: pull every auditable relationship or other auditing need into a single list before you decide anything. Your approved supplier list, your quality agreement register, CMO and CRO contracts, contract labs, your internal sites, and last year’s audit schedule and reports.
If you run clinical programs, add TMF and eClinical vendors.
You might find that some sources “agree” with each other. That could be a supplier on the ASL with no quality agreement. You might have quality agreements for suppliers nobody has audited in years. Or you might have added vendors mid-year that never made it onto a schedule.
Each of those is a purchasing control or supplier evaluation observation sitting in plain sight, and finding them in August or September is a much better experience than finding them during an inspection.
It’s done when: you have one list, you know where every line came from, and the gaps between sources are written down rather than quietly reconciled. Get our free workbook to use for this exact task.
2. Close out this year before you start planning next year
Two things to figure out now rather than in December.
First, which of this year’s audits are going to slip into next year? An audit that slides from Q4 2026 into Q1 2027 doesn’t disappear. It lands on top of a quarter you’ve already committed, and Q1 is the quarter with the least room in it. Better to know in August that you’re carrying three audits forward.
Second, are the CAPAs from your last round of audits actually verified as closed? An open CAPA that nobody has verified is a finding in itself, and it’s also a reason to put that supplier back on the 2027 list, regardless of where their interval sits.
It’s done when: you know your realistic 2026 completion number and you’ve flagged any unverified CAPAs from prior audits.
3. Classify by risk and write down the reason
We usually suggest applying your normal audit intervals first. Anything whose audit frequency comes due in 2027 goes on the list.
Then apply the things that override the interval. A few common ones include:
Quality events traceable to a supplier
A change in ownership, site, process, or where a material is made
New material, expanded scope, or first commercial supply
Regulatory action against them.
Open CAPAs
No audit on record at all
Then (and this is the part people skip), put the reason next to each line. Not a category code! A short sentence a stranger could read. That column is the written record of your risk-based decision, and it’s what someone will ask about when they want to know why the supplier behind your last three deviations wasn’t on the schedule.
It’s done when: every audit on the list has a reason attached, and none of the reasons are “we always do this one.”
4. Decide what you’re not auditing, and get it on the record
A lot of programs have more candidates than budget. The deferral is a decision whether you make it or not. The question is whether you make it in September, deliberately, with a reason, or in March, by running out of time.
A simple way to do this is to go through your suppliers that didn’t make the 2027 list and note why. Low criticality? Audited recently with no findings? Questionnaire in lieu of an on-site? No material change since last time?
And if the answer for some of them is budget, write that down too, because that belongs in a management review conversation rather than a scheduling one.
It’s done when: you could pick any three suppliers on your ASL that aren’t on the 2027 schedule and explain the omission without hesitating.
5. If you need to, get a number in front of finance while the budget is still being built
August through October is when most companies are building next year’s budget. That’s the window where an audit program is a line item. By November, it’s often an exception request, and exception requests get trimmed.
Rough math is fine at this stage for many of the teams we work with. Total audit days times a blended day rate, plus an average travel figure per on-site audit.
It’s done when: someone in finance has seen a number for 2027 audit support and hasn’t been surprised by it.
6. Refresh your site contacts and read your quality agreements
Quality staff obviously turn over like any other department, and the contact who hosted an audit back in 2025 has a decent chance of being gone. Confirm you have the person who can actually approve an audit date, not the commercial contact. Name, title, direct phone, email, time zone. Note the working language and whether an interpreter will be needed, as this affects who can conduct the audit.
While you’re in the file, check what the quality agreement says about audit rights, how many audit days you’re entitled to per year, and the notice period. Some agreements we’ve seen require 60 or 90 days of notice, which quietly rules out Q1 for anything you haven’t already asked for.
It’s done when: every line has a live contact and you know which sites have a notice period that constrains scheduling.
7. Name the auditors you want back, and start the conversation
If you ran audits this year, pull the auditors' names from those reports and add them to the schedule. Then decide line by line: retain the same person, rotate someone new in, or leave it open and let availability, location, and cost decide.
There’s no universal right answer on retention. Continuity means the auditor already knows the site, the systems, and what was left open last time. Rotation means someone asks the questions the returning auditor stopped asking. Both are defensible under the right circumstances.
What isn’t really defensible is deciding in January, because by then the auditors you had in mind are usually committed. This is the one item on this list with a hard external deadline attached, and it’s the reason we push clients toward October rather than year-end.
It’s done when: every line is marked retain, rotate, or open, and your resourcing partner knows which names matter to you.
If you’d rather not run this alone
Send us the list, and we’ll take it from there! One proposal can cover your whole program if you prefer — however, many audits are on it, and you can add to it or drop from it as your risk assessment moves through the year.
How much of the running we do is your call. We can contact the sites, negotiate and confirm dates, build and circulate agendas, manage CV review and approval, run the audits, and keep the master schedule current. Or you can keep the site relationships, and we can work through you on availability and scheduling.
Our auditors are former FDA investigators and industry quality professionals, we cover GMP, GCP, GLP, GCLP, CSV, pharmacovigilance, and quality system audits worldwide, and every engagement carries our Total Quality Guarantee.
If we ran your audits in 2026, contact your project manager, and we’ll hand your own data back to you, so you’re marking up last year’s list instead of starting from a blank sheet. If you haven’t worked with us before, get in touch and tell us roughly what you’re planning. A rough audit count, the GxP mix, and the geographies are enough for us to tell you what’s realistic. We respond within one business day.
You don’t need all seven of these finished to start the conversation. But you do want them finished before October.
We’ve had quite a few conversations about everything auditing. Check them out if you haven’t already:
Thermo Fisher Scientific’s Director of Corporate Quality, David Festa, gives some advice on approaching supplier audits:
NubGenix’s Founder and CEO, Divya Gowdar, discusses the pitfalls and lessons learned on the front lines of audit and inspection readiness throughout the FDA-regulated industries:
And it’s an oldie, but a goodie, our conversation about the ins and outs of FDA PAIs with former FDA investigator, Chris Smith:
Who is The FDA Group?
The FDA Group helps life science organizations rapidly access the industry's best consultants, contractors, and candidates. Our resources assist in every stage of the product lifecycle, from clinical development to commercialization, with a focus on Quality Assurance, Regulatory Affairs, and Clinical Operations.
With thousands of resources worldwide, hundreds of whom are former FDA, we meet your precise resourcing needs through a fast, convenient talent selection process supported by a Total Quality Guarantee. Learn more and schedule a call with us to see if we’re a fit to help you access specialized professionals and execute your projects on time and on budget.