This is a ready-to-use risk assessment for building an audit universe and turning it into a defensible, risk-based audit frequency, rather than an annual schedule that repeats last year’s list out of habit. Replace every <<FILL: ...>> placeholder with your own specifics. A worked filled specimen follows the template. Verify each cited regulation against the current source before you rely on it. This is educational reference to adapt to your own organization; it is not legal or regulatory advice.
Document control header
| Field | Entry |
|---|---|
| Document title | Audit Universe Scope and Frequency Risk Assessment |
| Document number | <<FILL: reference, e.g. RA-AUD-2026-01>> |
| Version | <<FILL: version>> |
| Assessment date | <<FILL: date>> |
| Assessed by | <<FILL: audit program owner, with quality unit co-review>> |
| Cycle covered | <<FILL: e.g. calendar year 2027>> |
1. Purpose
This assessment builds the complete list of GxP areas, systems, and processes the internal audit (self-inspection) program is responsible for covering, the audit universe, and scores each one on a common, documented basis so the resulting audit frequency is a risk decision the program can defend, not a number nobody can explain later.
2. Scope
Covers every GxP area at <<FILL: SITE / ORGANIZATION>>: manufacturing and packaging areas, QC laboratory disciplines, warehousing and distribution, computerized systems, facilities and utilities, and the QMS processes that sit above any single area (deviations, CAPA, change control, training, document control, supplier management). It does not itself schedule specific audit dates; the resulting frequency bands feed the annual schedule in <<FILL: SOP-ID or pack reference for the audit program>>.
3. Responsibilities
| Role | Responsibility |
|---|---|
| Audit program owner | Builds and maintains the audit universe list, facilitates scoring, proposes the resulting frequency bands |
| Area management | Provides the operational input each score depends on: complexity, automation, recent deviation and finding history |
| Quality unit | Reviews and can override any score, approves the final frequency assignment, resolves disagreement |
| Senior management | Receives the resulting schedule and its risk basis through management review |
4. Methodology
Score every entry in the audit universe against the same five factors on a 1 (lowest) to 5 (highest) scale. Sum the five scores into a total from 5 to 25, and let the total set a default frequency band. The area being scored does not set its own score unchallenged; a score set only by the area under review is a conflict of interest in exactly the way an auditor auditing their own work would be.
5. Scoring scales
5.1 The five factors
| Factor | 1 (lowest) | 3 (moderate) | 5 (highest) |
|---|---|---|---|
| Patient / product impact | No direct product-quality link | Indirect link to product quality | Direct link to a released batch or patient-administered product |
| Data integrity exposure | Paper-only, low reprocessing risk | Mixed paper/electronic | Fully electronic, reprocessable, or otherwise open to manipulation |
| Process complexity and automation | Simple, few manual steps | Moderate manual steps and interfaces | Highly complex, many manual judgment calls or system interfaces |
| Deviation and finding history | No significant deviations or findings in the last cycle | Occasional deviations, minor findings only | Frequent or major/critical deviations or findings in the last cycle |
| Time since last audit / current regulatory attention | Recently audited, no current regulatory focus | Audited within the standard cycle | Overdue for audit, or currently drawing fresh regulatory or guidance attention |
5.2 Frequency bands
| Band | Total score | Default frequency |
|---|---|---|
| High | 20-25 | Annually; every 6 months for the highest-scoring areas |
| Medium | 12-19 | Every 18 to 24 months |
| Low | 5-11 | Every 24 to 36 months |
6. Audit universe and scoring
| # | Area / system | Patient impact | DI exposure | Complexity | History | Time / attention | Total | Band | Frequency | Rationale (one line) |
|---|---|---|---|---|---|---|---|---|---|---|
<<FILL: 1>> | <<FILL: e.g. Aseptic fill-finish>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
<<FILL: 2>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
<<FILL: add every area the operation runs, including corporate QMS processes considered on their own>> |
A blank cell here, an area of the real operation with no row at all, is exactly the gap this assessment exists to prevent.
7. Rescoring triggers
An area’s score is not fixed for the cycle. Rescore, and adjust the band and schedule if it changes, on any of the following:
- A significant deviation, recall, or complaint trend in the area since the last score.
- A new product, modality, or significant process change introduced into the area.
- An acquisition, reorganization, or new site bringing the area under scope for the first time.
- A material regulatory signal: new guidance, a warning letter theme affecting the area’s process type, or a peer-site inspection finding in a comparable area.
- A multi-year adverse trend surfacing in the annual product quality review for a product the area supports.
8. Residual disagreement and approval
| Field | Entry |
|---|---|
| Areas where area management and the quality unit disagreed on a score | <<FILL: list, or "none">> |
| Resolution and final score | <<FILL>> |
| Approved frequency schedule reference | <<FILL: schedule document number>> |
| Role | Name | Signature | Date |
|---|---|---|---|
| Audit program owner | <<FILL>> | ||
| Quality unit approver | <<FILL>> |
9. References
EU GMP Chapter 9 (Self Inspection), for the requirement that self-inspections run at intervals set by a pre-arranged program. ICH Q9, Quality Risk Management, for the risk-based approach this scoring model applies to audit scheduling. ICH Q10, Pharmaceutical Quality System, for internal audit as part of process performance and product quality monitoring. 21 CFR 211.22, for the quality unit’s responsibility and authority that this schedule ultimately supports.
Confirm the current version of each reference before issue.
10. Revision history
| Version | Date | Author | Summary of change |
|---|---|---|---|
<<FILL: 1.0>> | <<FILL: date>> | <<FILL: author>> | Initial issue. |
Filled specimen
The following shows six rows scored for an example mid-size biologics site, so you can see the level of detail expected. The site, scores, and rationale are illustrative; replace them with your own.
| # | Area / system | Patient impact | DI exposure | Complexity | History | Time / attention | Total | Band | Frequency | Rationale |
|---|---|---|---|---|---|---|---|---|---|---|
| 1 | Aseptic fill-finish | 5 | 4 | 5 | 4 | 3 | 21 | High | Annual | Direct sterility risk; one major deviation last cycle |
| 2 | QC chromatography lab | 4 | 5 | 4 | 4 | 4 | 21 | High | Annual | Release testing; audit trail review is a known industry focus area |
| 3 | Change control (QMS process) | 4 | 3 | 3 | 3 | 3 | 16 | Medium | 18 months | One long-open change control found in last self-audit cycle |
| 4 | Warehouse and distribution | 3 | 2 | 2 | 2 | 2 | 11 | Low | 30 months | Stable process, no significant findings in three cycles |
| 5 | Training administration | 2 | 2 | 2 | 2 | 2 | 10 | Low | 36 months | Low complexity, clean history |
| 6 | LIMS (computerized system) | 3 | 5 | 4 | 3 | 4 | 19 | Medium (near high) | 18 months | High DI exposure; recently expanded scope to a new instrument interface |
Rescoring note: row 3 (change control) is flagged for rescoring at the next quarterly review rather than waiting for the full annual cycle, because the self-audit finding referenced in the rationale (a nine-month-open change control awaiting revalidation) is exactly the kind of history-factor signal this model is built to catch early.
Common inspection findings this assessment prevents
- An audit schedule with no documented basis, so a reviewer cannot tell whether a low-frequency area is genuinely low risk or was simply never looked at closely.
- A high-risk area’s audit quietly skipped for a year with no rationale on record.
- Scores set entirely by the area under review, producing a universe where the busiest or most defensive area always rates itself low risk.
- An audit universe that omits smaller or newer areas entirely, because nobody added them when they came into scope.
- A frequency model that was set once at program launch and never revisited as the business changed.
How to adapt this assessment
- Build the universe list first from your actual operation, not from a generic template list; a cell and gene therapy site needs rows for chain-of-identity and vein-to-vein logistics, a combination-product site needs rows for the device-constituent quality system.
- Set your own factor weights if a straight sum does not reflect your risk priorities; a weighted sum (for example, doubling the patient-impact factor) is a defensible variation as long as the weighting is documented and applied consistently.
- Route disagreements between area management and the quality unit through section 8 rather than letting a score go unresolved.
- Re-run this assessment on a fixed cycle (annually is typical) and whenever a rescoring trigger in section 7 fires.
- Feed the resulting bands directly into the annual schedule in Internal Audit Program Plan, Schedule, and Report Template, and use it as the frequency basis discussed in QMS Self-Audit: Evaluating Your Pharmaceutical Quality Management System.