To continue our series on lessons from our actual audit work, we wanted to look at a few finished reports to see where teams’ self-directed internal audits sometimes fall short (based on blind spots our external auditors identify).
Much of the time, it boils down to documentation that’s too shallow to demonstrate actual practice. An approved procedure tells you what’s supposed to happen. A training record tells you someone was trained. A document index tells you what’s been filed. But somewhat often, we find that teams stop there. They don’t go deeper to demonstrate in writing that a process holds up when something fails, responsibilities shift, or work moves between systems.
A review can verify every document it touches and still leave the connections between them untested, and a longer checklist won’t really fix that. What helps, and what often makes its way into our recommendations and remediation plans, is a clear line from the requirement to the procedure, to the activity, to the evidence behind the conclusion.
We pulled a few examples from our audit reports to unpack this a bit:
A sterile-manufacturing supplier assessment
An eTMF audit
A routine GCP investigator-site audit
Each shows a spot where a deeper review surfaced something a document-by-document check could (and did) miss. We’re not suggesting internal audit teams routinely miss these. They’re places worth checking, and each one comes with a practical way to check it.
Learn more and get in touch if you need audit support now or in the future. We’re in the midst of 2027 audit planning for many teams right now.
Learn more and get in touch if you need audit support now or in the future. We’re in the midst of 2027 audit planning for many teams right now.
Get our free audit planning Excel workbook here.
1. A routine is documented, but the failure response is assumed
In a sterile-filling supplier assessment we recently conducted, our auditors examined glove-integrity testing within a restricted-access barrier system (RABS). The question wasn’t only whether testing happened. The procedure didn’t require initiating a deviation after a failed post-use integrity inspection, even though managers described an investigation as the expected response.
That’s a different problem from missing equipment or untrained staff. The team in this case knew what it intended to do. It’s just that the controlled instruction just didn’t reliably trigger it.
Our auditors got there by pairing the procedure review with questions about how operations were expected to respond and by observing filling operations, including shift changes and stopper additions (rather than relying on documents alone).
To test this in your own audit, pick a failure condition and trace what happens next. What triggers escalation? Who evaluates the event? What record captures the decision? Compare those answers with the approved instruction. In an aseptic process, a successful routine run doesn’t tell you how a failed barrier-integrity result will be handled.
To test this yourself, pick a failure condition and trace what happens next.
What triggers escalation?
Who evaluates the event?
What record captures the decision?
Compare those answers with the approved instruction. In an aseptic process, a successful routine run doesn’t tell you how a failed barrier-integrity result will be handled.
2. The result traces electronically, but not across the full record chain
The same assessment used a batch CoA to direct the lab review.
Auditors found an analytical sequence in the electronic records that was missing from the paper equipment logbook. Because the electronic records were clear, the report didn’t identify a significant impact on product quality from that instance. It still documented the traceability gap.
That order matters! A record inconsistency shouldn’t automatically become a claim that a result is invalid. It should lead to a supported assessment of what’s missing, why it matters, and whether the issue extends further.
The auditors found the gap by following one batch-related data set across both electronic and paper records, rather than reviewing each record system separately.
For your own audit, start with a reported result and reconcile its supporting records across every system used to produce it. Investigate mismatches before you classify their impact. In the write-up, keep the evidence, the control weakness, and the product-impact conclusion separate.
For your own assessment here, start with a reported result and reconcile its supporting records across every system used to produce it. Investigate mismatches before you classify their impact. In the write-up, keep the evidence, the control weakness, and the product-impact conclusion separate.
3. Late filing may start upstream of the person filing
A recent sponsor/CRO eTMF audit covered study-, country-, and site-level documentation, as well as the TMF plan, contractual responsibilities, quality control processes, and staff roles.