Running an Internal Audit Programme With a Small Team

The standard advice on an internal audit programme assumes a quality department rather than a small team. Most manufacturers in Bahrain do not have one. They have a quality manager, possibly an assistant, and a production team that already has a job.

An internal audit programme built for a small team looks different from the textbook version, and it works. What it cannot do is rest on one person, because the one structural requirement — that nobody audits their own area — is the requirement a single-auditor programme automatically breaks.

At a glance

• Minimum viable programme: three trained people across different functions.
• Non-negotiable rule: nobody audits the area they are responsible for.
• Realistic frequency: one area per month, not the whole site quarterly.
• What to write: short reports with real findings, not long reports with none.
• The failure mode: the quality manager auditing everything, including their own work.

Why one auditor is not a programme

A programme run by one person has a permanent blind spot exactly where that person’s own responsibilities sit. If the quality manager audits document control, and the quality manager owns document control, the finding that would have been raised never is.

This is not a matter of integrity. It is that people cannot see the assumptions they work inside. The auditor who notices that a form has no space for the verification signature is almost always the one who does not use that form daily.

The second problem is continuity. An internal audit programme built around one person in a small team stops when they leave, and small sites lose people at least as often as large ones.

The three-person model

Three people, each auditing outside their own responsibility, cover the whole site between them. None needs to be a full-time auditor. Each needs a day of preparation and half a day of auditing per assignment, a few times a year.

The cross-function element is a benefit rather than a compromise. An engineer auditing production asks questions a production supervisor would never think to ask, because the engineer has not absorbed the assumptions.

A twelve-month internal audit programme a small team can run

One area per month, chosen so that each audit examines something the previous weeks generated enough evidence to test.

• January — document control and the register.
• February — materials receipt, quarantine and release.
• March — production records for one product family.
• April — cleaning and changeover.
• May — training records against recent revisions.
• June — equipment calibration and maintenance status.
• July — deviations raised in the first half of the year.
• August — storage conditions and stock rotation.
• September — complaints and how they were closed.
• October — change control across the year to date.
• November — supplier approval and material specifications.
• December — follow-up on findings raised since January.

Twelve half-days across a year, spread across three people. That is four half-days each — genuinely achievable in a small operation, and it produces a complete audit record covering every area.

What a small-site audit report should contain

Short. One page is normal. What matters is that it contains real findings.

• What was audited, when, and by whom.
• What was sampled, specifically — record numbers, not “records were reviewed”.
• What was found, stated as requirement, evidence and gap.
• Who owns each corrective action and by when.
• Verification of findings from the previous audit.

That last line is where most small programmes fail. Findings get raised, actions get agreed, and nobody checks. An audit that verifies the last one’s findings is worth more than a longer report that starts fresh each time.

The report that says nothing found

A report with no findings is not a good result. It is a signal that the audit was not searching, and an external assessor reads it exactly that way.

Small sites sometimes worry that recording findings makes them look worse. The opposite is true. Reports that log genuine problems, genuine fixes and proof the fixes stuck are the most persuasive material a small site possesses. A year of clean reports at a site that has changed equipment, staff and suppliers is not credible.

What trained means here

Not a qualification. A method. An auditor needs to be able to define what they are checking against and decide what to sample and why. They gather evidence somebody else could verify, write a finding that cannot be argued away, and check afterwards that the fix held.

That is what cGMP internal auditor training in Bahrain covers. At a small site, three people usually cannot be released at the same time. The online cGMP internal auditor training then lets each work at their own pace. The cGMP foundation course grounds the wider team in why the controls being audited exist. IAS also publishes a training schedule for Bahrain for sites that would rather book a scheduled session.

What the programme does for the certificate

Two things, both practical.

It finds your gaps before an assessor does, which moves work off the certification critical path and onto your own schedule.

And it answers the question external auditors reliably ask: who conducts your internal audits, and how do you know they are competent? A site naming three trained people across different functions, with a schedule and closed findings behind it, answers in one sentence. A small team whose internal audit programme is one person auditing everything spends considerably longer on the same question.

What to do in your first three audits

Sites starting from nothing usually ask what to audit first. The answer is not “everything, lightly”.

Audit one — pick the area where an error would hurt most

For most sites that is materials: receipt, quarantine and release. Sample five recent receipts and follow each through to the batch it was used in. You will learn more about your own system in half a day than a month of reading procedures would teach.

Audit two — follow the thread the first audit exposed

Almost every first audit surfaces something adjacent. If material release records were incomplete, look at how the release decision is made and who is authorised. Audits that follow a thread find more than audits that jump to an unrelated area.

Audit three — verify the first two

Go back to the findings you raised, look at records created since the corrective action, and decide honestly whether the change held. This is the audit small sites most often skip and the one that establishes whether your programme is real.

Three habits worth adopting from the start. Write the finding before you leave the area, while the evidence is in front of you. Reference specifics — record numbers, dates, revisions — rather than describing generally. And agree the corrective action owner at the time, not afterwards by email.

None of that requires a quality department. An internal audit programme in a small team requires three people, a schedule and the willingness to write down what you actually find.

Quick definitions

• Auditor independence: not auditing the function you are responsible for.
• Audit programme: the schedule ensuring every area is covered over a period.
• Sample: the specific records or observations examined, chosen deliberately.
• Finding: requirement, evidence, and the distance between them.
• Corrective action owner: the named person accountable for closing it.
• Verification: confirming afterwards that the action worked.
• Cross-function auditing: auditing outside your own department.
• Audit trail (programme sense): the record showing every area was covered.

Why manufacturers in Bahrain work with IAS

• Certification and internal auditor training scoped together, which suits sites building both at once.
• Training designed to work for teams of three or four rather than assuming a quality department.
• The framework printed on the document itself, leaving buyers nothing to infer.
• A written quotation before any commitment, and scoping that obliges you to nothing.
• Open to every manufacturing, processing and handling operation, not only pharma and food.

One thing to keep separate: assessment and training sit with IAS; permission to run a plant and permission to sell sit with regulatory authorities. The two do not overlap.

Small-site programmes are scoped around what the team can realistically sustain; contacting IAS opens that discussion, and the Bahrain service index lists the other services available locally.