Remote or On-Site: What an Audit Can Actually Verify

Audit programmes spent two years learning what a screen can and cannot do. The lesson is worth keeping, because it is more specific than "remote is worse". Remote verification is deeper than a site visit on records, and blind on everything the eyes are for. The programmes that work treat the two as different instruments rather than as substitutes.

What lives in records, and travels well

Most of what an audit verifies is documentary. Batch traceability from raw material to drum. Deviation files and their closure logic. Validation summaries and their dates. Training records. The quality system's procedures and the evidence that they are followed rather than filed.

These verify better remotely than on site. A reviewer with screen share can read twelve deviation files in an hour; a reviewer in a conference room reads four, and the site chooses which four. The remote format, handled properly, reduces the supplier's ability to curate, because the reviewer names the files.

Data integrity is the strongest case for remote work. The check that matters is specific: one raw chromatography file with its audit trail, the user list from the data system, the integration history of a run. A site that can produce these on screen within minutes has a functioning system. One that needs a week to assemble them has told you something the visit would have taken three days to reveal. The data integrity expectations are record-based by nature, which makes them ideal remote material.

What only the eyes get

What the visit adds	Why documents miss it
Material flow and segregation	Diagrams describe intention, floors show practice
Equipment condition	Maintenance records describe the service, not the gasket
Housekeeping and storage	Quarantine areas are easy to describe, hard to fake
Behaviour around the process	Whether operators reach for the procedure or for memory
The general state of the site	Whether the place is run or maintained for visitors

The last row is not sentiment. A site that is run has a texture that documents cannot produce: labels that match reality, aisles that work, a laboratory where the logbooks are in use rather than in sequence. An auditor who has walked fifty sites recognises it in ten minutes, and no remote session reproduces it.

Behaviour is the subtler signal. An operator asked how a deviation is raised who reaches for the procedure and walks you through it is describing a system. One who describes it from memory, fluently, is describing a habit, and the difference matters when the procedure and the habit diverge.

The hybrid, done honestly

The working arrangement is a remote records phase followed by a focused visit. The audit plan states which questions each phase answers, and the report says which evidence came from where. That last discipline is what keeps the report honest: a finding about material flow that rests on a video call is a weaker finding than one that rests on the floor, and the report should say so.

The visit can then be shorter and better aimed. Instead of three days covering everything thinly, it covers the warehouse, the production floor and the laboratory bench, with the paperwork already read. Sites prefer it, auditors get more per hour, and the report is sharper on exactly the things the screen cannot carry.

What the paperwork already told you

Before any audit, three documents do much of the work. The certificate chain, verified rather than accepted, as described in the note on verifying CEP and GMP certificates. The third-party laboratory evidence, with its own scope, covered in the note on what a third-party report does and does not cover. And the site's own quality manual, which describes the system the audit will test against.

Reading those first turns the visit from an exploration into a verification, and it moves hours from the site to the desk, which is where they are cheaper.

Does the report expire?

A report describes a configuration. Ownership changes, key departures, campaign changes and major repairs each move the site away from the one that was audited, and the re-audit interval should be a decision rather than a calendar. Three years is a common default; it is a poor answer for a site that changed hands in year two.

The strongest signal in any report is not the findings. It is the closure: findings accepted without argument, actions with dates, and evidence at the next cycle that the fix held. A relationship where every finding is a negotiation is telling you something, and the PIC/S inspection guidance, the European GMP text and the ICH quality guidelines all treat the closure of findings as the point of the exercise.

Where this leaves a supply-chain partner

We host both formats and say plainly which is appropriate for which question: records questions remotely, floor questions on site. We send the raw records rather than the summaries when a remote review asks for them, because a summary is a position and a record is an answer.

One question decides the format for a given supplier: which of your answers so far have been documents, and which have been descriptions? Where the second list is long, buy the plane ticket.

Running the records phase properly

The remote phase earns its depth from specificity. "Send your deviation SOP" produces a document. "Show us the last three deviations raised on the line that made our batch, closed and open, with their investigation records" produces a system. The difference in what the two requests verify is close to the difference between the audit and the brochure.

Three request types carry most of the weight. The trace walk: from the customer's batch number back to raw material receipts, through the batch record, with each link named. The data pull: one raw chromatography file with its audit trail, one user list, one integration history. The closure sample: deviations and complaints from the last year with their effectiveness checks, or the absence of the checks stated plainly.

Each request is answerable on screen in minutes by a site that lives in its own records. The sites that need a week to assemble them have told you something, and the telling is itself the finding.

The frameworks that shape these expectations are public: the European GMP annexes for computerised systems and records, the ICH Q7 guidance for the supplier-facing responsibilities, and the PIC/S guidance for how inspectors actually read records. A site familiar with any of the three will not be surprised by the requests.

Spending the site visit well

The visit's hours should go where the screen cannot: the warehouse, the production floor at a working moment rather than a prepared one, the laboratory bench, and the walkthrough of material flow from receipt to dispatch. An hour in the warehouse answers questions that a week of document review cannot: how quarantine actually looks, whether rejected material is physically separated, and whether the labels on the drums match the system that describes them.

Timing is part of the method. A walk-through at shift change shows the site's normal state; a visit scheduled around the audit shows the site's best state. Both are information, and only one of them is the information the report needs.

The closing session matters more in a hybrid format than in a full visit, because it is where the two phases are reconciled. Findings that rest on the records phase and questions the visit resolved should be labelled as such, so that the reader of the report knows which evidence came from which instrument.

One closing question is worth asking every time: what would you fix first if the budget appeared tomorrow? Sites answer that question honestly, and the answer is usually the finding the report would have taken three days to write.

Grading findings and closing them

A finding's grade should describe its effect, not its embarrassment. Critical findings affect the material's suitability; major findings affect the system's ability to prevent that; minor findings are departures without a plausible path to the product. The grading matters because it decides the response time and the depth of the corrective action, and because a report where everything is major has told the reader the auditor's temperament rather than the site's condition.

The closure is where the audit's value is realised. An action with a date, an owner and evidence is a closed loop; an action described as "to be reviewed" is a sentence. Two audit cycles of the same site should show the earlier findings closed and the later ones fewer in the same category, and a programme that shows neither is producing paperwork.

The customer's own file records the audit and its outcome. Where an audit found a major issue that was closed, the file is stronger than one that records no findings at all, because the second raises the question of whether anybody looked hard enough.

What to do with a report that is three years old

Read the findings, then read the site's history since. Ownership, key personnel, campaign mix and major equipment all change what the report describes. Where nothing has changed, an old report is usable evidence with a stated date. Where a lot has changed, the report is a baseline rather than an assessment, and the gap should be closed before the next critical shipment rather than after it.

Frequently asked questions

What can a remote audit verify as well as a site visit?

Anything that lives in a record: batch traceability, deviation handling, validation documentation, data integrity spot checks, training records and the quality system's paperwork. Done well, the remote review of records is deeper than a walk-through, because the reviewer sees more documents per hour.

What can only be verified on site?

Material flow, physical segregation, equipment condition, housekeeping, the behaviour of people around the process, and the general answer to whether the site looks run. None of these appears in a document, and all of them predict problems that documents miss.

Is a hybrid audit acceptable?

It has become the normal arrangement: records reviewed remotely, then a shorter site visit focused on what the records cannot show. The scope of each part should be stated in the audit plan so that the report is honest about what was verified how.

How is data integrity checked remotely?

By requesting specific records rather than summaries: a raw file with its audit trail, a user list from the chromatography system, the integration history of one disputed-looking run. The specificity is the point; summaries can be assembled, systems cannot.

Does an audit report expire?

The report does not, but its relevance does. A site that has changed ownership, key personnel or its main product campaigns since the audit is not the site that was audited, and the interval between audits should reflect that rather than a fixed calendar.

What is the strongest signal in an audit report?

The findings that were accepted without argument and fixed with evidence. A report full of disagreements tells you about the relationship; a report with dated, closed actions tells you about the site.