Auditing

The role of auditing in regulatory compliance

A GxP audit is not a formality: it is a risk management tool. Conducted correctly, an internal audit identifies compliance gaps before an inspector does, allowing organisations to act in a controlled and timely manner.

Pharmaceutical, medical device and biotechnology companies have a regulatory obligation to maintain an internal audit programme as part of their quality management system. But beyond formal compliance, audits are the most effective way to verify that processes documented in SOPs are actually executed day-to-day.

Types of audits we conduct

Internal audits (First-party)

We evaluate your organisation's quality management system against applicable requirements (GMP, GDP, GLP, GCP, ISO 13485, etc.). We identify findings, classify them by criticality and develop a corrective action plan.

Technology vendor audits (Second-party)

Software, cloud system and IT service providers are now a critical part of the regulated supply chain. We audit your vendors to verify that their quality and security controls are adequate for use in GxP environments. This includes:

• SaaS and cloud system providers (AWS, Azure, LIMS vendors).
• Electronic signature service providers.
• Software development and maintenance outsourcing.

Data audits

Specific review of audit trails, electronic records and data management practices to verify compliance with ALCOA+ principles and data integrity guidelines.

Regulatory inspection preparation

We simulate an FDA, EMA or national agency inspection to identify weaknesses before the real visit. Includes document review, staff interviews and system analysis. We deliver a findings report with a prioritised action plan.

Methodology

Our audits follow ISO 19011 (guidelines for auditing management systems) adapted to the pharmaceutical regulatory context. The process includes:

1. Planning: Definition of audit scope, criteria and programme.
2. Pre-audit document review: Analysis of SOPs, records and available evidence before the visit.
3. Execution: Interviews, process observation and record review on-site or remotely.
4. Audit report: Findings classified by criticality (critical, major, minor, observation), with regulatory references and recommendations.
5. Follow-up: Verification of corrective action closure.

Our audit team

All our auditors have prior experience in the regulated industry — not just in consulting — and have participated both in internal audits and in real regulatory inspections. They know the language of inspectors because they have been on both sides of the table.