Pharma IT Insights
My Suggestion for a Revised Eudralex vol. 4, Chapter 9: Self Inspection
By Torben Elhauge
September 29, 2026
Author’s note: This article reflects the author’s professional opinion on how EudraLex Volume 4, Chapter 9 could be modernised. The proposed structure and requirements are suggestions only and should not be interpreted as representing the position of EMA, the European Commission, or the GMDP Inspectors Working Group. At the time of writing, no concept paper or draft revised Chapter 9 has been published.
EMA’s GMDP Inspectors Working Group has targeted Q4 2028 for delivering a revised text of Chapter 9 (Self-Inspection) to the European Commission, as part of its January 2026 – December 2028 work plan. That is a confirmed revision with, as of today, no published concept paper or draft: the direction has not been set yet.
Chapter 9 is one of the few chapters in EudraLex Volume 4 that has not been touched since the current GMP guide structure was put in place. A short, thirty-year-old text with almost no reference to risk, continual improvement or management ownership.
Written ahead of that Q4 2028 target, this insight offers my own suggestion for a modern document, with a particular focus on giving companies clearer guidance on how to run both internal and external audits.
What does Chapter 9 look like today?
The current chapter contains:
- Princple: Self inspections should monitor GMP compliance
- Section 9.1: Lists areas to be examined against a pre-arranged program.
- Section 9.2: Should be done be carried out independently by “competent persons (Internal or external)”
- Section 9.3: Must be recorded (observations, corrective measures and follow-up on actions).
That is essentially the whole chapter.
It predates the modern vocabulary of Quality Risk Management, CAPA, management review and quality culture that now runs through the rest of the GMP guide and external audits is not mentioned.
Why Chapter 9 needs more than a light touch
Reading Chapter 9 is not in line with the rest of Eudralex vol. 4, especially regarding the points below.
- The title is outdated No one in the pharma world talks about “Self inspection” everyone calls it internal audit.
- The layout screams “Outdated”. It reads like exactly what it is: a page carried over unchanged from the printed Eudralex vol. 4 book. The text still carries its original page number, 59. If chapter 9 had been a GMP document, it was not in line with the ALCOA++ principles as outlined in chapter 4, it is not complete as only page 59 is included.
- Not all chapters are specifically included as areas to be audited. Chapter 1 and 7 and the more general annexes (annex 1, 13, 15, 16, 19 and 20) is not listed.
- No risk-based audit frequency, everything is covered by “a pre-arranged programme,” with no room for adjusting frequency or depth based on the criticality or recent performance of an area.
- The chapter asks for “proposals for corrective measures” but says nothing about root cause analysis, CAPA effectiveness checks or timelines for closure.
- Self-inspection findings are not required to feed into management review, so there is no formal mechanism to ensure resources follow the findings.
- No guidance on auditing CDMOs/CROs and other suppliers is given.
- Guidance how remote and hybrid audits, now routine since 2020, should be conducted and documented is not given.
- No guidance on how the company should qualify internal and external auditors is given.
- No mention of quality culture or continual improvement. The principle is framed purely as compliance monitoring, not as a driver of improvement.
My suggestions for a revised Chapter 9
I would rename the chapter “Internal and External Audits” to reflect current sector language.
Getting ready for the revision
In outline, a company preparing for the revision should already:
- Separate internal audit and external/supplier audit into two clearly defined programmes with their own procedures.
- Move to a risk-based audit schedule, using product/process criticality, past findings and change activity to set frequency.
- Define competences needed to be qualified as an auditor including the requirement for being independent, including for staff who audit their own site.
- Build a documented link between audit findings and management review, with resource decisions recorded.
- Strengthen CAPA requirements attached to audit findings, including root cause analysis and effectiveness checks.
- Formalise expectations for remote and hybrid audits of CDMOs, CROs and other critical suppliers.
A proposed structure for the chapter
Mirroring the way the new Chapter 4 is structured, the revised Chapter 9 could be organised as:
- Principles: audits exist to verify GMP compliance and drive continual improvement, with frequency and depth set by risk, and findings formally linked to CAPA and management review.
- Audit types
- Internal audit: a company’s own, independent examination of its sites, systems and processes against a risk-based programme.
- External / supplier audit: audits of CDMOs, CROs and other critical suppliers, including how and when remote or hybrid audits may be used in place of a facility tour.
- Auditor qualification: minimum competence, training and independence requirements for both internal and external auditors, including staff who audit their own site.
- Auditing: the lifecycle an individual audit follows, from planning through to closure and documentation.
- Planning: defining the scope, depth and objective of the audit, and the technique appropriate to it (for example documentation review, facility tour, or tracing a process/batch through the full system), proportional to risk.
- Auditing: conducting the audit against its plan, gathering objective evidence and recording observations as they arise.
- Closing meeting: presenting findings to the auditee, confirming factual accuracy and agreeing next steps before the audit is closed.
- Follow-up: tracking corrective actions to completion and verifying that they have been effective.
- Documentation: recording the audit itself, its findings and corrective actions, and maintaining auditor qualification records for both internal and external auditors.
How would this affect audit practice?
- Two visible programmes instead of one. Companies would need to formally separate and document internal and external/supplier audit programmes, each with its own risk-based schedule.
- Stronger CAPA linkage. Audit findings would need traceable root cause analysis and effectiveness checks, not just a corrective action list.
- Governance visibility. Audit outcomes would have to be demonstrably discussed at management review, closing the current gap between self-inspection and resource allocation.
Final thoughts
Chapter 9 is short today because audit practice was simpler when it was written. EMA’s three-year work plan[1] confirms a revision is coming by end 2028, and restructuring it around risk-based frequency, separated internal and external programmes, and a real link to management review would bring it in line with the rest of the modernised guide.
Will we see an EMA/ICH guideline on internal audit?
Not within Chapter 9, in my view, and not from EMA alone. Chapter 9 should state what is required, not walk through how to audit step by step, so a checklist belongs elsewhere.
The better home is a dedicated ICH guideline, alongside ICH Q9(R1) and Q10. Audit methodology is a shared process question across regions, not an EU-specific GMP requirement, so it fits ICH’s remit better than EudraLex. Today the gap is filled only by industry references[2], [3],[4], and no ICH guideline is listed for development. The EDQM’s OMCL Network already runs a comparable risk-based audit methodology for laboratory self-inspection[5], scoped to labs rather than manufacturers, but a working precedent nonetheless.
If you would like to discuss how to prepare your internal and external audit programmes for this direction of travel, or want a gap assessment against the points raised here, get in touch with Pharma IT.
💡Want to learn more?
If you want to strengthen your internal and supplier audit programmes, Pharma IT’s experienced GMP consultants can help you assess gaps, develop risk-based audit schedules and improve the link between audit findings, CAPA and management review.
References
[1] EMA, GMDP Inspectors Working Group, “The 3-year work plan for the Inspectors Working Group,” January 2026 – December 2028.
[2] ISO 19011, “Guidelines for auditing management systems.”
[3] APIC/CEFIC, “GMP Auditing Guide” for active pharmaceutical ingredients.
[4] IPEC-PQG, “Good Manufacturing Practices Audit Guideline for Pharmaceutical Excipients” (2008).
[5] EDQM/OMCL Network, PA/PH/OMCL (20) 21 R1, “Risk-based Auditing Approach,” together with the network’s standard aide-memoire for mutual joint audits.
About the author
Torben Elhauge is Director of CMC in Pharma IT and Experienced pharmaceutical professional with 25+ years in analytical chemistry, API development, and regulatory documentation. Skilled in project management, workshop facilitation, and RFP processes, with extensive work coordinating CRO/CMO collaborations and tech transfers. Combines deep API knowledge with the ability to translate scientific needs into clear requirements and drive successful platform selection and process improvement projects.
