Both audits and assessments have a place in a company’s oversight of their operations.  

Audits generally are more detailed and formal, and may tend to focus on particular areas of concern. It’s very important that audits are tied to a specific standard.  An audit should reference the requirements from a law, regulation, guidance, or other recognized standard. Often, the audit may reference all the requirements and expectations of a particular subject area.  Audit observations should specifically cite the deficiencies from the law, regulation, guidance or standard.  Audits should be considered formal actions of the company, and recorded within a company’s quality system with a formal quality record.  Audits are generally given special treatment by FDA and other regulators under what is called the “self-audit privilege.”  Although not binding, when companies embrace regular, formal audits – and act in good faith to fix identified problems, FDA and other regulators tend to not review those audits during inspections creating an incentive for companies to look deeply and closely at their operations.

Assessments are generally more informal, and can be designed for a number of related purposes.  Assessments are typically designed to help a company or operations understand particular areas of risk across a broader set of topics, so that the organization can determine what actions to take, what areas of risk to focus on first, and communicate needs to executive management for funding and resources.  Assessments are more informative than demanding immediate correction. They can and should help executive management with focus on action, and with identifying resources, such as expert consultant support, to help the company with risk reduction.