Auditing Principles and Audit Program Management
Domain 2 - Auditing Principles and Audit Program Management
This domain tests the distinction between running individual audits and managing an audit programme. Items target ISO 19011 principles, risk-based scheduling, auditor competence and independence, finding classification, and the CAPA loop after the closing meeting.
Core rules
- ISO 19011 principles: integrity, fair presentation, due professional care, confidentiality, independence, an evidence-based approach, and a risk-based approach.
- An audit is a systematic, independent, documented process for obtaining objective evidence and evaluating it against audit criteria. It is not consultancy; an auditor who designed the process should not later audit it as an independent reviewer.
- The audit programme is a set of planned audits with objectives, scope, criteria, frequency, methods, auditor selection, and resources. Frequency should follow risk: product criticality, prior findings, complaints, changes, and regulatory exposure.
- Findings are graded against a pre-defined scheme - typically critical (direct patient risk or systemic fraud), major (system failure), minor (isolated lapse), and observation. The scheme must be applied consistently.
- The report states objective evidence, the requirement, and the gap. Corrective actions are agreed with the auditee, and effectiveness is verified later - closure is not the receipt of a reply.
Worked example
A contract packer had two major findings last year and has not been audited since. A narrow-therapeutic-index product is being added. Risk scoring gives high product criticality, high prior performance risk, and a significant change. Programme response: bring the audit forward, extend scope to the new line, and add a desk review of change control six months later. A low-risk supplier with three clean audits and no changes may move to a longer cycle with a questionnaire in the interim.
Traps that cost marks
- Confusing a finding with an observation, or grading everything major.
- Auditing your own department, which breaches independence even if you are technically competent.
- Closing a CAPA because a document arrived, without verifying implementation.
- Writing opinion ("the lab is careless") instead of evidence ("three of ten balances had expired calibration labels").
- Treating an internal audit and a regulatory inspection as interchangeable; the criteria and authority differ.