A Few More Insights From Our Recent Audit Reports
Following up on our most-read trends report with fresh takeaways from the same dataset.
About once a quarter (and more often if possible), we’ll be publishing an analysis of the trends we’re seeing in our audit work for clients, so (if you’re a paid subscriber) you can learn and act proactively on what we’re finding across the industry.
Our first audit-trends write-up quickly became one of our most-read Insider Newsletter articles. (A big welcome to the 30+ people who graduated to a paid subscription after it went out.)
Read it here if you missed it:
The strong response confirmed what we suspected: QA and RA leaders want to know not just what regulators are publishing in warning letters, but what auditors are actually finding on the ground right now.
So, we’ve gone back to the same dataset of audits from late spring through summer 2025—GMP vendor audits, internal QMS reviews, supplier qualifications, mock FDA pre-approval inspections, and GCP investigator site audits—and pulled out a second layer of insights. Think of it as the companion guide to our first report, which highlighted the big-ticket themes: documentation and change control, training execution, investigation timeliness, equipment readiness, supplier oversight, APRs, lab practices, and complaint handling.
This follow-up looks at the seams and subtleties we noticed across those same engagements: where ownership broke down between departments, where “done” wasn’t defined, where ambiguity in documents drove repeat errors, and how inspection readiness gaps tended to cluster near scale-up.
What follows are the most interesting additional lessons from this audit set—insights you can use to sharpen your own oversight before inspectors see them first.
Before we jump in, it’s worth noting that several FDA staff members are among our readers. That means these aren’t just industry takeaways—they’re also potential inspection focus points. The more regulators are tuned into these patterns, the more urgent it becomes for firms to close them.
1. Gaps tend to cluster at “system hand-offs,” not within single SOPs
Across reports, the most stubborn issues didn’t live inside a single procedure—they appeared between procedures/owners.
A few examples included:
Deviations/changes ↔ management review: late investigations and retroactive extensions weren’t consistently escalated or trended at management review.
Lab execution ↔ QA review: OOS signals were sometimes noticed only at second-level review, weeks after testing (too late to preserve samples/states).
Vendor usage ↔ vendor qualification: a service actually in use (e.g., translation for complaints) wasn’t on the approved vendor list or covered by a privacy/quality agreement.
Utilities checks ↔ how checks are verified: water-loop “UV verified” entries existed, but how status was confirmed wasn’t defined or consistently known by operators.
Most findings here are preventable by clarifying ownership at the seam (who checks what, when, and how—and who escalates if it slips).
We often suggest adding an “owner at the interface” line to SOPs for any activity that crosses departments (e.g., QA reviewer for lab audit-trail checks; Quality Ops liaison for water/utility verifications).
Also, consider requiring a link from each overdue deviation/change to a management-review entry (so slippage is visible and acted on, not just explained).
2. “Done” wasn’t defined, so effectiveness checks went missing
When changes closed the same day they were implemented (or closed without attached proof), our auditors called out the absence of objective evidence and pre-set success criteria (e.g., “no related deviations in 3 batches,” “≥90% pass rate on retraining”).
We suggest adding a required field in change forms: “Effectiveness criteria (defined pre-implementation).” Require data uploads before closure.
Also, if you have a somewhat mature reporting system in place, configure it to track “changes reopened after closure” as a KPI—it’s a telltale sign of weak effectiveness checks—super important KPI.
3. Ambiguity in documents drove repeat defects
This sometimes turns up and it’s particularly insidious. Where terms were undefined (e.g., labels like “Redundant”), we saw inconsistent execution and review. Similar ambiguity showed up in training matrices (titles with asterisks rather than named individuals) and org charts that weren’t under document control.
A few suggestions here:
Replace any category labels with plain-language definitions/examples in SOPs and forms.
Tie every training requirement to named individuals (LMS groups can still be role-based, but evidence should resolve to people, not titles).
Put org charts under change control and cross-reference them in training/authorization SOPs.
4. Inspection readiness gaps clustered near scale-up
Perhaps unsurprisingly, readiness issues spiked at facilities approaching inspection or expansion. Multiple findings around HVAC/EM PQs, cleaning validation completion, raw-material qualifications, serialization readiness, and DI/water verification cropped up here.
Two specific details repeatedly signaled risk:
Balance checks using a single weight far from typical working range (no bracketing).
Clean equipment observed uncovered between uses.
We recommend many firms roll all pre-inspection tasks into a single readiness plan with owners, due dates, and proof-of-closure links reviewed at management review. This isn’t done as often as you might assume.
Also, a couple of granular suggestions:
Standardize bracketing weights in daily checks (and start using them if you aren’t already). Add a one-line rationale in the log (“weights selected to bracket X–Y g range”).