Risk-based audit schedules and periodic review of examinations

Auditing in the medical laboratory is more than a regulatory obligation – it is a critical tool for safeguarding patients. When poorly targeted, audits can provide reassurance on paper while failing to uncover risks that directly affect clinical care. For example, an audit may confirm that refrigerator temperature logs are signed off each day yet fail to consider whether excursions in storage conditions have impacted reagent stability and therefore patient results. Similarly, a review might check that staff have signed acknowledgements of standard operating procedures, while overlooking persistent failures in the laboratory information system that delay the reporting of critical results. Compliance alone does not guarantee patient safety.

The shift to risk-based auditing reflects the requirements of ISO 15189:2022, which mandates internal audits and periodic review of examinations, and ISO 22367:2020, which frames monitoring and control measures in proportion to the potential risk of patient harm; we have discussed these documents throughout our series on risk so far. Together, these standards move the purpose of audit beyond documenting conformity and towards systematically identifying and addressing the areas of greatest risk.

This article explores how laboratories can achieve that in practice. We examine how to design audit schedules proportionate to clinical risk, how to conduct meaningful periodic reviews of examinations, and how to evaluate residual risk in the context of patient safety.