CASP Module 17, Section 4: Internal Audit Templates and Frequency
MODULE 17: MASTERING QUALITY, COMPLIANCE, AND ACCREDITATION

Section 4: Internal Audit Templates and Frequency

Develop practical skills in creating targeted internal audit tools (checklists, tracers) based on accreditation standards and establish a sustainable schedule for ongoing self-monitoring.

SECTION 17.4

Internal Audit Templates and Frequency

Building Your Pharmacy’s “Mock Survey”: From Checklists to Continuous Readiness.

17.4.1 The “Why”: From “Panic and Prepare” to “Continuous Readiness”

In the previous sections, we built our Quality Management System (QMS). We created the Roadmap (Gap Analysis, Sec 17.1), assembled the Engine (PDSA/RCA/CAPA, Sec 17.2), and designed the Fuel System (Incident Reporting, Sec 17.3). This section, Section 17.4, provides the Dashboard and Diagnostics. It is the system of “check engine lights” that tells us if everything is truly working as designed.

For a pharmacy without a QMS, accreditation is a cyclical, panic-driven event. Six months before the surveyor is scheduled to arrive, a “tiger team” is assembled to frantically update P&Ps, retrain staff, and clean the pharmacy. For three years, the pharmacy operates on its own, and then for six months, it operates “for the survey.” This is a massive, stressful, and inefficient waste of resources. It also misses the entire point of accreditation.

An accredited specialty pharmacy operates in a state of “Continuous Readiness.” This is the ultimate goal. It means that if a surveyor from URAC, ACHC, or The Joint Commission walked in your door, unannounced, on any given Tuesday, you would calmly hand them your clipboard and say, “Welcome. Where would you like to start?” This level of confidence is not an attitude; it is the result of a system. That system is your Internal Audit Program.

Your Internal Audit Program is your own, in-house “mock survey.” It is a schedule of ongoing self-monitoring where you and your team play the role of the surveyor, auditing your own processes against the standards with a critical eye. Why? Because you are not just checking boxes. You are hunting for the most dangerous gap in any QMS: the “Paper vs. Practice” Gap.

As we discussed in Section 17.1, this is the #1 reason pharmacies fail surveys. They have a beautiful P&P (the “paper”) that says, “All pharmacists will document a comprehensive clinical review for every new patient.” But in reality (the “practice”), the pharmacists are busy and just check a box. Your internal audit is the mechanism you use to find this gap *first*. A surveyor is impressed by a pharmacy that finds its own flaws; they are not impressed by a pharmacy that claims to have none. Your internal audit log, filled with findings and the corresponding CAPAs (Sec 17.2), is not a list of failures. It is proof of a healthy, functioning QMS.

This section is the masterclass on how to build this program. We will develop the practical tools—the checklists and tracer templates—that are built directly from your Gap Analysis. We will then establish a sustainable, intelligent schedule for using them, transforming your operation from one that reacts to audits to one that thrives on them.

Pharmacist Analogy: The Pre-Flight Check vs. The Simulator Check-Ride

As an advanced pharmacist, your role is not just to “fly the plane” (dispense prescriptions) but to ensure the *entire system* of flight is safe. Your internal audit program is modeled directly on aviation safety.

1. The Checklist Audit (The “Pre-Flight Check”):

Before every single flight, the pilot and co-pilot perform a “pre-flight check.” They don’t do this from memory. They use a physical, laminated checklist. “Check fuel levels? Check.” “Test flaps? Check.” “Verify navigation? Check.” This is a simple, low-effort, high-frequency audit. Its purpose is to catch simple, static failures before they become catastrophic.

This is your Checklist Audit. This is your “Daily Refrigerator Temp Log,” your “Weekly Eyewash Station Check,” or your “Monthly Crash Cart Audit.” It is a simple, “yes/no” audit of a static item or process. It is essential for ensuring the *tools* of your trade are safe and ready.

2. The Tracer Audit (The “Full-Simulator Check-Ride”):

Every 6-12 months, that same pilot must go into a full-motion flight simulator for a “check-ride” with an FAA inspector. The inspector doesn’t just ask them to “check the flaps.” They present a scenario: “You are at 30,000 feet. Your left engine is on fire, and the weather at your destination just dropped to zero visibility. Go.”

This is your Tracer Audit. You are the inspector. You don’t just audit one thing; you audit one patient’s entire journey (the “scenario”). “This is a new Oncology patient. Their referral was unreadable, the PA was denied, and they reported a side effect. Go.” You then “trace” that patient’s chart through every step—Intake, PA, Clinical Review, Shipping, Follow-up—to see if your *system* (your P&Ps and your team) handled all those complex variables correctly. This is the ultimate test of your QMS, and it’s what surveyors from ACHC and TJC do all day long.

This section will teach you how to build the simple “pre-flight checklist” *and* the complex “full-simulator” tracer, and how to schedule them to ensure you are always ready to fly safely.

17.4.2 The “What”: Deconstructing the Types of Internal Audits

Before you can build a schedule, you must understand your tools. “Internal Audit” is a broad term. In an accredited pharmacy, it breaks down into three distinct types of tools, each with a different purpose, frequency, and owner. You must master all three.

The 3 Tools in Your Internal Audit Toolkit

Audit Type Checklist Audit (or “Process Audit”) Tracer Audit (or “Patient Audit”) P&P Audit (or “Document Audit”)
Core Question “Is this thing (or static task) compliant right now?” “Did this patient’s journey follow all our clinical and operational processes correctly?” “Is this written document (our P&P) compliant with the current accreditation standards?”
Analogy The Pilot’s “Pre-Flight Checklist.” The Pilot’s “Full-Simulator Check-Ride.” The Engineer’s “Blueprint Review.”
What It Audits A static item or a single, discrete task. (e.g., fridge temps, log signatures, hood cleaning, license expirations). A dynamic, multi-step process. It follows a single “unit of work” (a patient, a prescription, a complaint) from start to finish. A static document. It compares your written P&P, line-by-line, against the accreditation standard.
Typical Frequency High: Daily, Weekly, or Monthly. Medium: Monthly (a few) or Quarterly (many). Low: Annually, or when standards change.
Performed By Staff, Lead Tech, or Pharmacist (the “owner” of the task). Quality Manager, Pharmacist Lead, or a cross-functional “Mock Survey Team.” Quality Manager, Pharmacist Lead, and the P&P “owner.”
Primary Goal Ensure ongoing safety and compliance of basic, foundational tasks. Find “Paper vs. Practice” gaps and complex, multi-step system failures. Ensure your “blueprint” is correct before you build or train. (This is part of your Gap Analysis).
Accreditor (All) Expected as part of daily operations. (ACHC / TJC) This is their primary survey methodology. (URAC) This is their primary “desktop review” methodology.

17.4.3 Masterclass: Building Your Internal Audit Toolkit (The Templates)

This is the practical, “how-to” portion of this section. We will now build a set of templates for each of the three audit types. These templates are your starting point. You will copy, paste, and adapt them to fit your pharmacy’s specific P&Ps and your chosen accreditation standards (URAC, ACHC, or TJC).

Tool 1: The P&P Audit Tool (Your “Blueprint Review”)

This is the first audit you must perform. You cannot audit your practice until you are certain your paper is correct. This tool is, in essence, a more granular version of your initial Gap Analysis (Sec 17.1). You will use this tool every year (or when standards are updated) to ensure your P&Ps remain compliant.

Playbook: P&P Audit Template (Annual Review)

P&P Under Review: __________________ (e.g., “P&P #8.1: Patient Complaint Management”)

P&P Owner: __________________ (e.g., “Quality Manager”)

Date of Review: __________________

Accreditation Standard (e.g., URAC PM-05) Standard Requirement (Verbatim) P&P Section that Addresses This Compliant? (Y/N/P) Gap / Finding / Comments Action Required (Links to CAPA)
URAC PM-05 (a) “Must have a documented process for logging all patient complaints…” Section 3.1: “Logging Complaints” Y P&P references the Complaint Log. None.
URAC PM-05 (b) “Must acknowledge receipt of the complaint to the patient within 3 business days…” Section 4.2: “Patient Contact” N CRITICAL GAP: Our P&P says “within 5 days.” This does not meet the URAC standard. CAPA-2025-010: Revise P&P 8.1, Section 4.2 to “3 business days” and re-train all staff.
URAC PM-05 (c) “Must resolve the complaint and communicate resolution within 30 calendar days…” Section 5.1: “Resolution” Y P&P meets this standard. None.
URAC PM-05 (d) “Must aggregate and trend complaint data quarterly for the QMC…” (Not Found) N CRITICAL GAP: Our P&P describes how to handle a complaint, but not how to track and trend the data. CAPA-2025-011: Add “Section 7: Data Aggregation & QMC Reporting” to P&P 8.1.

Tool 2: The Checklist Audit Tool (Your “Pre-Flight Check”)

This is your high-frequency tool for monitoring static items. The key here is simplicity and speed. It must be a “Yes/No” or “Pass/Fail” format. If the answer is “No” or “Fail,” it must trigger an immediate, documented corrective action (which can be a simple note on the log itself).

Playbook: Checklist Audit Template (Example 1: Monthly Eyewash Station Log)

Month/Year: __________________

Instructions: Test each station weekly. Sign and date. If “Fail,” document corrective action and notify manager immediately.

Station Location Test Item Week 1 (Date:__) Week 2 (Date:__) Week 3 (Date:__) Week 4 (Date:__)
Dispensing (EW-01) Water Flow (Pass/Fail) Pass Pass Fail Pass
Initials RK RK RK RK
Compounding (EW-02) Water Flow (Pass/Fail) Pass Pass Pass Pass
Initials SJ SJ SJ SJ
Corrective Action Log:

Date: (Date from Week 3) Station: EW-01 Finding: No water flow.
Corrective Action: Notified maintenance. Plunger was stuck. Maintenance fixed same day. Re-tested, now “Pass.”
Signature: RK

Playbook: Checklist Audit Template (Example 2: Quarterly Pharmacist License Verification)

Quarter: ____ (e.g., Q4 2025) Performed By: __________________

Instructions: For all active pharmacists (RPh) and technicians (CPhT), verify license status via the primary source (State Board of Pharmacy website). Attach printout of verification to this form.

Employee Name License # License Type Board Website Status (Active/Probation/Expired) Expiration Date Compliant? (Y/N)
Rich Kiser RPh12345 Pharmacist Active 12/31/2026 Y
Sara Jones CPhT6789 Technician Active 06/30/2027 Y
Mike Smith RPh00123 Pharmacist Expired 09/30/2025 N
Corrective Action Log:

Finding: Mike Smith’s license expired 10/01/2025.
Corrective Action (Immediate): Mike Smith immediately removed from all clinical/dispensing duties. Notified HR and Director. This is a Sentinel Event, triggering a full RCA/CAPA to find out why our 30-day alert system failed.
Signature: [Quality Manager]

Tool 3: The Tracer Audit Tool (Your “Full-Simulator Check-Ride”)

This is your most powerful, comprehensive tool. It is a deep-dive audit of a single patient’s chart. You are “tracing” their journey through your pharmacy, comparing every single documented event against your P&Ps and the accreditation standards. This is a monthly or quarterly task for the Quality Manager or Pharmacist Lead. You should plan on 30-60 minutes *per tracer*.

This tool is created *after* you have completed your Gap Analysis and written your P&Ps. The questions below are examples. You must customize this tool to audit *your own P&Ps*.

How to Select Patients for a Tracer Audit

Do not just pick your 5 easiest, most compliant patients. A surveyor will specifically ask for complex cases. Your internal audit should do the same. A good monthly tracer “batch” of 5 patients would be:

  • 1 New Patient (High-Risk): A new-to-therapy Oncology or transplant patient.
  • 1 New Patient (Complex Intake): A patient with a PA denial that required an appeal.
  • 1 Established Patient (Adherence Issue): A refill patient who shows poor adherence on their last call.
  • 1 Established Patient (Cold Chain): A refill patient for a high-cost, cold-chain drug (e.g., Humira, Enbrel).
  • 1 Discharged Patient: A patient who was discharged (e.g., Hep C cure, death, transferred out) to audit your discharge P&P.
Masterclass Template: The Patient Tracer Audit Tool

Patient MRN: _______________ Date of Audit: _______________ Auditor: _______________

Process Step Audit Question / “Look-For” (Linked to P&P / Standard) Compliant? (Y/N/NA) Findings / Gap Description (The “Paper vs. Practice” Gap)
1. Patient Intake & Referral Referral source and date/time of receipt documented? (P&P 2.1) Y
Referral reviewed for completeness/legibility within 4 business hours? (P&P 2.2) Y Received 9:05 AM, reviewed 10:15 AM.
All required patient demographics, allergies, and comorbidities documented? (P&P 2.3) N GAP: Patient’s allergies were documented (“NKA”), but the “Comorbidities” field was left blank. P&P 2.3 requires this to be “None” or a list.
Standardized Patient Intake Script followed and documented? (P&P 2.5) P Partial. Intake note exists, but does not mention patient’s “preferred contact method” as required by the script.
Patient-specific needs assessed (e.g., language barrier, disability)? (URAC PM-01) Y “English” documented.
Initial financial assistance / copay assistance screening performed? (P&P 3.1) Y Patient screened and enrolled in manufacturer copay card.
2. Benefits & Prior Auth Benefits Investigation (BI) completed within 24 hours? (P&P 3.2) Y BI complete.
PA status identified? (This patient required PA). Y PA required.
PA submitted and tracked per P&P? (P&P 3.5) Y PA submitted 10/25, approved 10/27. All documented.
Patient notified of their financial responsibility (copay) before first fill? (URAC PM-03) N CRITICAL GAP: Patient was notified of their $50 copay *after* the drug was shipped, during the welcome call. P&P and URAC require this *before* dispensing.
3. Pharmacist Clinical Review (First Fill) Documented clinical review by an RPh exists? (P&P 4.1) Y Pharmacist note present.
Prospective DUR (DDI, duplicate therapy, dose) documented? (P&P 4.2) Y “No significant DDIs found.”
Dose verified against diagnosis and labs (e.g., CrCl)? (ACHC PHARM 3-2B) N GAP: Pharmacist note does not mention CrCl or renal dosing, which is required for this drug per our PMP.
Patient assessed for adherence barriers (e.g., cost, beliefs)? (P&P 5.1) P Copay was discussed, but no other barriers (e.g., “forgetfulness”) were assessed in the note.
Patient-specific Care Plan developed? (ACHC PHARM 3-1B) Y Care Plan created.
Initial adherence/side effect counseling (education) provided and documented? (URAC PM-02) Y Note: “Counseled pt on nausea and administration.”
Patient enrolled in the correct PMP (Patient Management Program)? Y Patient tagged “Oncology PMP.”
4. Dispensing & Shipping Drug dispensed using barcode verification? (P&P 6.1) Y Verified in dispensing log.
Cold chain: Validated 48-hr cooler used? Temp indicator included? (P&P 7.3) Y All documented in shipping log.
Patient notified of shipment and delivery date? (P&P 7.5) Y Note: “Informed pt of 10/28 delivery via FedEx.”
5. Patient Follow-up (Refill) Scheduled follow-up call made prior to next refill? (PMP-Onc-01) Y Call note from 11/20.
Adherence assessed using %PDC or patient-stated? (PMP-Onc-01) Y “Pt states 30/30 doses taken.”
Side effects / adverse events reassessed? (PMP-Onc-01) N GAP: Follow-up note only says “Pt ok, no issues.” PMP script requires *specific questions* about nausea, fatigue, etc.
Clinical or non-clinical issues identified and escalated? (P&P 5.5) NA No issues identified.
Care Plan updated based on follow-up? (ACHC PHARM 3-1B) NA No changes needed.

17.4.4 Masterclass: Establishing a Sustainable Audit Schedule (Frequency)

You have your templates. Now you must create a schedule. A common mistake is to be overly ambitious. If you create a schedule that requires 40 hours of auditing per week, it will be abandoned by month two. Your schedule must be sustainable, risk-based, and assign clear ownership.

The best model is a “pyramid” of frequency. The most frequent audits (daily) are the fastest and are performed by all staff. The least frequent audits (quarterly/annually) are the most complex and are performed by leadership (like you and the QMC).

The Audit Pyramid: A Sustainable Schedule

ANNUAL (The “Dress Rehearsal”)

Who: QMC / Leadership Team
What: A full, comprehensive “Mock Survey.” All P&Ps are reviewed. A large batch (10-20) of complex tracers are performed. All incident data from the year is analyzed.
Goal: To simulate the real survey and create the next year’s Quality Improvement Plan.

QUARTERLY (The “Trend Analysis”)

Who: Quality Management Committee (QMC)
What: Aggregate and trend all data from the monthly/weekly/daily audits. Review all patient complaints, all CAPAs, and all near-miss reports.
Goal: To find systemic weaknesses and trends. (e.g., “Our monthly tracers show we are 30% non-compliant on X.”). This meeting generates the high-level PDSA projects.

MONTHLY (The “Deep Dive”)

Who: Quality Manager / Pharmacist Lead (You)
What: The complex audits. Perform 3-5 Patient Tracers. Audit 100% of patient complaints. Review all high-risk P&Ps.
Goal: To find “Paper vs. Practice” gaps and feed data *up* to the QMC.

WEEKLY (The “Compliance Check”)

Who: Lead Technician / Pharmacist on duty
What: Review of key logs. (e.g., “Check all daily temp logs for missing signatures,” “Audit 5 random dispensing labels,” “Check eyewash station log”).
Goal: To ensure basic, foundational tasks are not being missed.

DAILY (The “Pre-Flight Check”)

Who: All Staff (as part of opening/closing)
What: The “must-do” safety items. (e.g., “Record refrigerator temps,” “Check e-fax queue,” “Clean counters/hoods”).
Goal: To ensure the *environment* is safe before any patient care begins.

Masterclass Table: The Sustainable Internal Audit Schedule

This table translates the pyramid into an actionable schedule. This is a document you would present to your QMC for approval.

Audit / Task Frequency Primary Owner Audit Tool Used Purpose (Risk Mitigation)
Refrigerator/Freezer Temp Logs Daily (x2) Staff Tech Temp Log (Checklist) Prevents drug loss (Cold Chain).
Room Air/Humidity Logs Daily Staff Tech Room Log (Checklist) Ensures USP <659> compliance.
Eyewash Station Test Weekly Lead Tech Eyewash Log (Checklist) Ensures staff safety (OSHA).
Review of all Temp Logs for Gaps Weekly Pharmacist Lead Log Audit (Checklist) Ensures 100% completion of daily tasks.
Hood / Cleanroom Cleaning Daily & Monthly Compounding Tech Cleaning Log (Checklist) Ensures USP <797> compliance.
Patient Tracer Audits Monthly Quality Manager / CASP Patient Tracer Tool Finds “Paper vs. Practice” gaps. This is your mock survey.
Patient Complaint Log Audit Monthly Quality Manager Checklist Audit Ensures all complaints are logged and resolved per P&P.
License Verification Audit Monthly (new hires) & Quarterly (all) HR / Q-Mgr License Log (Checklist) Prevents unlicensed staff from practicing (Critical).
QMC Data Aggregation Quarterly QMC Data Dashboard Identifies systemic trends and assigns QIPs.
P&P “High Risk” Review Quarterly QMC P&P Audit Tool Reviews P&Ps for Med Errors, Complaints, Recalls.
Full “Mock Survey” Annually Leadership Team All Tools Ensures “Continuous Readiness” for survey.
Full P&P Manual Review Annually All P&P Owners P&P Audit Tool Ensures all P&Ps are up-to-date with standards.

17.4.5 Closing the Loop: What to Do With a “Finding”

This is the final, and most critical, concept. You have run your audit, and you have found a gap. A “Pass/Fail” checklist failed. A tracer audit found 5 “No”s. You are not done. An audit finding is not a final step; it is the first step in the quality improvement cycle.

An internal audit finding IS an “Incident Report.”

This is the key insight that connects your entire QMS. A gap you find during your own internal audit must be treated with the same seriousness as a “Near Miss” reported by a technician. It must be logged in your Incident Reporting System (Sec 17.3) and managed by the same process.

This prevents “audit data” from living in a separate, dead-end spreadsheet. It feeds all your data—proactive audits and reactive incidents—into one central system. This is how you achieve true Root-Cause Tracking.

The “Internal Audit to Action” Flowchart

This flowchart shows how to “close the loop” on every finding, connecting all the sections of this module into one unified system.

The Internal Audit “Closed-Loop” Process

1. INTERNAL AUDIT PERFORMED (Sec 17.4)

You conduct your (Daily/Weekly/Monthly) Checklist or Tracer audit.

2. “FINDING” (GAP) IDENTIFIED

A “No” or “Fail” is documented. (e.g., “Tracer shows RPh did not document renal dosing check.”).

3. LOG IN INCIDENT REPORTING SYSTEM (Sec 17.3)

This gap is logged as a “Near Miss” or “Unsafe Condition” (Event Type: “Internal Audit Finding”). This feeds your central database.

4. QMC / MANAGER TRIAGES THE FINDING

Is this a one-time human error, or is it a systemic trend?

PATH A: SYSTEMIC GAP

The gap is high-risk or a “Paper vs. Practice” failure (e.g., “RPh note missing CrCl check”).

TRIGGER: RCA (Sec 17.2)

Why did the RPh skip this? Is the EMR form confusing? Is the P&P unclear?”

ACTION: CAPA (Sec 17.2)

(PA): “Add ‘CrCl’ as a *required field* in the EMR form.”

PATH B: ISOLATED, SIMPLE GAP

The finding is a simple, isolated event (e.g., “Eyewash log was missed on Tuesday”).

ACTION: SIMPLE CORRECTION

Document the “on-the-spot” fix. (e.g., “Tech B was reminded of weekly task. Log is now complete.”).

TRACK: AGGREGATE (Sec 17.3)

The incident is still logged. If the *same* simple gap happens 10 more times, the QMC will see the *trend* and upgrade it to a Path A problem.

This “closed-loop” process is the hallmark of a mature Quality Management System. As a Certified Advanced Specialty Pharmacist, you are not just a participant in this system; you are its architect and its most important auditor. You are the one who designs the clinical tracers, who has the expertise to spot the “Paper vs. Practice” gaps, and who has the authority to lead the RCAs and PDSAs that fix them. This is how you build a pharmacy that is not just accredited, but one that is truly safe and continuously ready.