Pharma audit plans need a living risk picture
Some pharma audit programs are calendars dressed up as risk management. Sites and suppliers rotate on fixed cycles, scores get refreshed annually, and the plan looks defensible. Then a supplier quietly changes a crystallization step, dissolution drifts, and the next scheduled audit is eighteen months away.
The revised ICH Q9(R1) guideline makes clear that this approach no longer holds up. It calls on companies to manage subjectivity in risk scoring, to match formality to the level of uncertainty and complexity, and to treat loss of product availability as a patient risk, not only a supply-chain problem (ICH Q9(R1)). For executives, the takeaway is simple: the audit plan should be the output of a living (continuous) process that changes as the facts change.
Start with the decision, not the register
“Assess site risk” is too vague to act on. A useful assessment answers a specific question: what should we audit next, how deeply, and why? Organize risk in linked layers (enterprise, product and process, supplier, and event or change) so that a supplier issue touching a critical step flows into the product view and, if serious, the site audit plan.
Write the risk as a causal chain
“Supplier risk: medium” tells an auditor nothing. A defensible entry traces the full path: failure mode, cause, product effect, patient or supply consequence, existing controls, and evidence those controls work. That chain tells you where to audit. If incoming identity testing would not catch a change in particle size, the audit belongs at the supplier’s change control process, not the receiving dock.
Treat scores as a guide to judgment
Severity, likelihood, and detectability scores help set priorities but cannot replace judgment. Four disciplines keep them honest:
- Do not average away severity. A low probability does not make a serious patient impact a minor concern.
- Do not confuse detection with prevention. A release test that might catch a defect does nothing to stop it from occurring.
- Justify any drop in residual risk. If the score falls after controls, name the control and how its performance is verified.
- Flag uncertainty openly. A new supplier or unfamiliar technology warrants scrutiny even when likelihood looks low.
The guideline is explicit that resource constraints should not be used to justify lower formality (ICH Q9(R1)).
Combine signals before you rank
Strong audit plans combine data streams rather than relying on the last audit report: deviation and OOS trends, CAPA recurrence, change controls, supplier performance, and data-integrity signals. One late shipment may be logistics. Late shipments plus unexplained material variability and weak change notification point to a control failure. A suspiciously low deviation count may signal under-reporting, not health.
Re-plan on triggers, not dates
Maintain a risk-based review cycle and let defined triggers override it: a repeat deviation, a supplier or site change, a technology transfer, a failed CAPA, or a new sole-source vulnerability. An assessment reviewed last month can be obsolete after a major change.
Set audit priority on several factors
A single ranking should never become the schedule on its own. Weigh patient consequences, evidence of control decline, uncertainty, changes since the last audit, supplier criticality and substitutability, and repeat findings. Match depth to risk: high-risk areas warrant raw record review, operator interviews, and CAPA verification, while stable areas need routine confirmation. A “low-risk” supplier still deserves close oversight if it performs a critical step you cannot see into.
Scale the method to the organization
Small companies should concentrate on a few suppliers and CDMOs that could materially affect quality. Large networks should hunt for common causes across sites without letting enterprise averages hide a high-risk location. Biologics programs need added focus on contamination control, cold chain, and consistency across technology transfers.
The real test A risk assessment is truly living when a new signal changes a decision, such as deepening an audit, adding a control, or moving resources, and the organization can show why. Hold your audit program to that standard.
