1. Introduction

Biotechnology regulatory compliance auditing in Australia refers to the systematic examination of a biotechnology organisation's operations, facilities, records, products, research activities, quality systems and regulatory obligations to determine whether they comply with applicable Australian laws, regulatory standards and technical requirements.

It applies to organisations engaged in:

Development and manufacture of biological medicines, vaccines, cell therapies and gene therapies.

Genetic engineering and genetically modified organisms (GMOs).

Clinical trials and biological research.

Manufacture of biological products and laboratory testing.

Importation, storage, distribution and supply of therapeutic goods.

Agricultural biotechnology and dealings with genetically modified crops or microorganisms.

An important legal distinction: Australia does not have one universal biotechnology auditing statute or a single auditing standard applicable to every biotech organisation. The relevant framework depends on the product, technology, activity and regulator. Audits may be conducted by regulators, independent auditors, sponsors, customers or an organisation's own quality assurance team.

The principal regulatory authorities include the Therapeutic Goods Administration (TGA), the Office of the Gene Technology Regulator (OGTR), the National Association of Testing Authorities (NATA), and, where applicable, the Department of Agriculture, Fisheries and Forestry and state or territory authorities.

2. Principal Australian laws and auditing standards

The applicable requirements depend on whether the biotechnology activity concerns therapeutic products, GMOs, clinical research, laboratory testing or agricultural biotechnology.

Legal status matters: PIC/S GMP requirements can have legal force through the Australian manufacturing-principles framework. By contrast, ISO standards and internal audit procedures are not automatically statutory obligations for every biotech company. Their application depends on legislation, accreditation, licences, contracts and the specific regulated activity.

The TGA states that PIC/S Guide to GMP PE 009-17, dated 25 August 2023, applies from 1 September 2025, with specified exceptions and a phased transition for certain sterile-manufacturing changes.

Therapeutic Goods Administration (TGA)+1

3. Regulatory authorities and their audit functions

'Serious concerns' over TGA's decision making on landmark psilocybin, MDMA ruling - ABC News

A. Therapeutic Goods Administration (TGA)

The TGA oversees therapeutic goods, including applicable biologicals, vaccines, medicines and gene or cell therapies. Its compliance activities can include GMP inspections, assessment of manufacturer compliance, review of documentation, investigations and enforcement.

Auditors examine manufacturing licences, batch records, deviations, sterility assurance, contamination control, validation, product release and recall readiness.

Therapeutic Goods Administration (TGA)+1

The role of other agencies in the National Gene Technology Scheme

B. Office of the Gene Technology Regulator (OGTR)

The OGTR administers the national gene technology scheme. Compliance reviews may examine licence conditions, authorised dealings, containment facilities, staff training, GMO inventories, transport, disposal and incident reporting.

Dealings with GMOs must fall within a permitted category, such as an exemption, notifiable low-risk dealing or applicable authorisation or licence.

Office of the Gene Technology Regulator+1

NATA is Australia's leading accreditation organisation - NATA

C. National Association of Testing Authorities (NATA)

NATA provides accreditation services for laboratories and other technical facilities. Where ISO/IEC 17025 or another accreditation standard applies, audits evaluate technical competence, equipment calibration, method validation, staff competence, sample traceability and the reliability of results.

Our Members and Partners – Centre for Invasive Species Solutions

D. Department of Agriculture, Fisheries and Forestry (DAFF)

Relevant to agricultural biotechnology, biosecurity risks, imports, quarantine and regulated biological materials. The applicable audit or inspection obligations depend on the material and activity involved.

DAFF+1

4. Core standards for biotech compliance auditing

4.1 Good Manufacturing Practice (GMP)

GMP is central to audits of biotechnology manufacturing facilities producing regulated medicines and biological products.

Key areas include:

Quality management: approved procedures, independent quality oversight and management review.

Personnel: training, qualifications, hygiene and defined responsibilities.

Premises and equipment: cleanroom qualification, environmental monitoring, maintenance and calibration.

Manufacturing controls: approved production instructions, in-process testing and prevention of mix-ups.

Contamination control: microbial, particulate and cross-contamination risks, particularly for sterile products.

Documentation: complete batch manufacturing records, controlled procedures and attributable corrections.

Deviation management: investigation of failures, root-cause analysis and corrective and preventive action (CAPA).

Batch certification and release: documented evidence that each batch meets the applicable requirements.

The current Australian PIC/S framework and TGA guidance are the principal starting points for defining the audit criteria.

Therapeutic Goods Administration (TGA)+1

4.2 Quality risk management

Risk-based auditing prioritises issues that could affect patient safety, product identity, purity, potency, efficacy or sterility.

For example, a facility producing a sterile cell therapy should generally devote more audit attention to aseptic processing, contamination controls and chain of identity than to low-risk administrative processes.

A defensible risk assessment should consider:

Severity of potential harm.

Likelihood of failure.

Ability to detect a failure before product release.

Previous deviations, complaints and inspection findings.

Effectiveness of existing controls.

Risk-based auditing does not permit a company to disregard a mandatory legal requirement simply because it assigns that requirement a low risk score.

4.3 Supplier and outsourced-activity audits

Biotechnology companies often outsource testing, raw-material production, sterilisation, storage, logistics or parts of manufacturing.

The audit should determine whether:

Suppliers are appropriately qualified.

Written agreements define responsibilities.

Critical subcontractors are assessed.

Audit findings are evaluated and closed.

The product's specifications and applicable regulatory obligations remain satisfied.

PIC/S GMP specifically addresses outsourced activities and the control of suppliers and contractors. TGA guidance also discusses assessment and approval of third-party audit reports.

Therapeutic Goods Administration (TGA)+1

4.4 GMO containment and licence compliance

An OGTR-related audit should establish whether the organisation is conducting only authorised activities and complying with the conditions governing those activities.

Typical audit evidence includes:

GMO licence or dealing classification.

Risk assessment and risk-management documentation.

Facility certification or containment arrangements, where applicable.

Access controls and training records.

Inventory, movement and disposal records.

Incident and non-compliance reporting.

Evidence that licence conditions have been reviewed after operational changes.

Under the Gene Technology Act 2000, section 146 provides a power to issue directions in specified circumstances where there are reasonable grounds to believe a licence holder is non-compliant and the statutory conditions for intervention are met.

Federal Register of Legislation+1

5. Standard biotechnology regulatory audit procedure

A compliant audit programme should move from defining the applicable law to verifying evidence, correcting deficiencies and confirming that corrective actions work.

Step 1 — Define the regulatory scope

Identify product classification, applicable legislation, manufacturing licences, GMO approvals, accreditation conditions and relevant standards.

Step 2 — Prepare an audit plan

Specify the audit scope, criteria, sites, responsible auditors, sampling approach, timetable and risk priorities.

Step 3 — Collect objective evidence

Review procedures, training records, electronic data, batch files, laboratory results, supplier assessments, environmental monitoring and interviews.

Step 4 — Classify findings

Categorise deficiencies according to their regulatory significance, potential harm and applicable reporting or escalation requirements.

Step 5 — Investigate root causes

Determine whether the failure arose from inadequate procedures, poor training, equipment defects, supplier failures, ineffective oversight or data-integrity weaknesses.

Step 6 — Implement CAPA

Assign corrective actions, owners, deadlines and evidence requirements. Assess whether affected batches, research activities or materials require quarantine, notification or other action.

Step 7 — Verify effectiveness and close

Independently test whether corrective actions prevented recurrence. Keep the final report, supporting evidence and management approval in the audit record.

Audit findings: practical classification

These labels are a useful internal scheme, not a universal Australian statutory classification. Actual regulatory classification and mandatory responses depend on the applicable law, GMP framework, licence conditions and circumstances.

6. Case laws relevant to Australian biotech compliance audits

Australian courts do not provide a single comprehensive body of case law setting out every technical requirement for biotech auditing. The most useful authorities concern GMO regulation, therapeutic-goods enforcement, statutory interpretation and the legality of administrative decisions.

Case 1: Fidge v Pfizer Australia Pty Ltd [2024] FCA 161

Court: Federal Court of Australia
Date: 1 March 2024

Facts: The applicant alleged that Pfizer and Moderna COVID-19 vaccines were, or contained, genetically modified organisms and should have been licensed under the Gene Technology Act 2000.

Legal issue: The Court considered the scope of the Gene Technology Act, the relationship between gene technology regulation and other therapeutic-goods legislation, and whether the applicant had standing to seek an injunction.

Decision: Rofe J allowed the applications for summary dismissal. The Court held, in substance, that the Act regulates specified dealings with GMOs posing biosafety risks and operates within a broader regulatory framework. The applicant did not establish the required standing.

CaseChat AU+1

Significance for auditing:

Compliance teams must identify the correct statutory regime rather than assuming every biotechnology product is governed by the same legislation.

An audit must distinguish the product itself from regulated dealings with a GMO.

Regulatory classifications should be supported by scientific evidence, statutory definitions and documented legal analysis.

Limitation: This was not a judgment establishing a general GMP audit checklist, nor should it be treated as a ruling that every mRNA product is exempt from all gene technology requirements.

Case 2: Medtronic Australasia Pty Ltd — Federal Court penalty proceedings, 2024

Court: Federal Court of Australia
Regulator: TGA

The TGA reports that Medtronic Australasia Pty Ltd was ordered to pay $22 million in penalties in 2024 for unlawfully supplying the Infuse Bone Graft Kit.

Therapeutic Goods Administration (TGA)

Legal significance: Although this is a therapeutic-goods enforcement example rather than a pure biotech audit case, it demonstrates the potential financial consequences of failures involving regulated medical products and supply obligations.

Audit lessons:

Verify that the product's regulatory status and supply conditions are satisfied.

Reconcile approved product indications, labelling, promotional representations and distribution arrangements.

Maintain evidence that relevant regulatory controls were checked before supply.

Escalate suspected unlawful supply rather than treating it solely as an internal quality issue.

Limitation: The case should not be cited as establishing a particular technical GMP requirement unless the relevant judgment or reasons expressly support that proposition.

Case 3: Ogle v Strickland (1987) 13 FCR 306

Court: Federal Court of Australia

Principle: This case is relevant to standing and the circumstances in which a person may have a sufficient legal interest to challenge public decision-making.

It was considered in Fidge v Pfizer Australia Pty Ltd in relation to the applicant's argument that his professional role supported standing.

CaseChat AU+1

Significance for audit governance: Where a company challenges a regulator's decision, or where a third party seeks to challenge a regulatory outcome, the right to bring proceedings cannot simply be assumed. The relevant statutory review provisions and standing requirements must be examined.

This authority does not establish a substantive biotech auditing standard.

Case 4: Minister for Immigration and Citizenship v Li [2013] HCA 18

Court: High Court of Australia

Principle: The High Court explained the legal concept of unreasonableness in administrative decision-making.

Application to biotech regulation: If a regulator makes an adverse decision following an inspection, such as a decision affecting a licence or approval, judicial review may raise questions about whether the decision was legally authorised and whether the relevant legal standards were met.

The case does not mean that a company can overturn an unfavourable inspection finding merely because it disagrees with the auditor. The legal basis, statutory powers, evidence and applicable review grounds matter.

Case 5: Plaintiff S157/2002 v Commonwealth [2003] HCA 2

Court: High Court of Australia

Principle: The case is a leading authority on jurisdictional error and the limits of statutory provisions that seek to restrict judicial review.

Application: Where a biotech regulator exercises statutory powers, the decision must remain within the authority conferred by law. Depending on the circumstances, a material failure to comply with a statutory condition may raise a jurisdictional-error issue.

Limitation: This is a general public-law authority, not a ruling on GMP audit procedures or biological manufacturing standards.

Case-law synthesis

The last three authorities are general administrative-law cases. They should be used to explain review principles, not represented as direct holdings on biotechnology auditing. For a formal legal submission, verify the full judgments and pinpoint paragraphs before relying on any proposition.

7. Legal consequences of audit failures

A failed audit does not automatically result in prosecution or cancellation of a licence. The consequences depend on the seriousness of the finding, the governing statute, the regulator's powers and the organisation's response.

Potential consequences include:

Corrective action requirements: Remediation of deficient quality systems or manufacturing processes.

Manufacturing restrictions: Restrictions, suspension or other action affecting relevant manufacturing authorisations or GMP clearances.

Product recall or supply restrictions: Where the product presents a quality or safety concern, or statutory requirements otherwise justify action.

GMO enforcement: Directions or other statutory action for relevant breaches of gene technology requirements.

Civil or criminal proceedings: Where the conduct satisfies the elements of an applicable offence or civil penalty provision.

Commercial consequences: Loss of customers, supplier approval, accreditation or contractual eligibility.

The TGA's published compliance framework identifies possible responses ranging from education and additional documentation to inspections, recall action, suspension or cancellation of relevant approvals, and investigation or enforcement.

Therapeutic Goods Administration (TGA)+1

8. Practical compliance checklist for an Australian biotech company

Use this as a starting point for an internal gap assessment, adapting it to the organisation's products and activities.

Self-assessment

0 of 16 reviewed

Regulatory authorisations

Product classification and applicable regulator documented

Required manufacturing licences, registrations and approvals verified

GMO dealings and licence conditions checked where applicable

Quality management

Current approved SOPs and controlled documents maintained

Deviations, complaints, CAPA and change controls managed

Internal audit programme and management review documented

Manufacturing and laboratory controls

Equipment qualification and calibration current

Methods validated or verified as required

Environmental monitoring and contamination controls reviewed

Batch records and release decisions traceable

Suppliers and records

Critical suppliers qualified and periodically assessed

Outsourced activities controlled through written agreements

Electronic records, audit trails and data integrity protected

Readiness and remediation

Recall and incident-response procedures tested

Audit findings assigned to responsible owners and deadlines

CAPA effectiveness verified and evidence retained

Reset checklistCopy checklist

This is an indicative internal checklist, not a regulator-approved certification or a substitute for checking each applicable legal requirement.

9. Recommended compliance framework

A sound Australian biotech compliance programme should integrate five elements:

Legal register: A current record of applicable legislation, licences, regulatory guidance and standards.

Risk-based audit schedule: Audit frequency and depth determined by product and process risks, regulatory obligations and prior findings.

Independent quality assurance: Auditors with appropriate technical competence and sufficient independence from the activities being assessed.

Documented remediation: Root-cause investigations, CAPA ownership, deadlines and effectiveness verification.

Regulatory readiness: Reliable records and procedures for inspections, adverse events, product defects, recalls and relevant notifications.

The strongest programme combines statutory compliance with a demonstrable quality culture. A company should be able to show not merely that procedures exist, but that staff follow them, exceptions are investigated and controls work in practice.

10. Official legal and regulatory sources

For primary-source research, start with these materials:

Therapeutic Goods Administration — PIC/S GMP compliance guidance.

Therapeutic Goods Administration (TGA)

Federal Register of Legislation — Therapeutic Goods Act 1989.

Federal Register of Legislation

Office of the Gene Technology Regulator — GMO approval process.

Office of the Gene Technology Regulator

Federal Register of Legislation — Gene Technology Act 2000.

Federal Register of Legislation+1

TGA — Published court actions and penalties.

Therapeutic Goods Administration (TGA)

Conclusion: Australian biotech regulatory auditing is a risk-based but legally grounded process. For medicinal biotechnology, GMP and the Therapeutic Goods Act are central; for dealings with GMOs, the Gene Technology Act and applicable authorisations are essential. Case law helps explain statutory scope, enforcement and judicial review, but technical audit criteria must be taken from the applicable legislation, standards and regulator guidance.

A useful next step is to prepare a biotechnology regulatory audit matrix for Australia, mapping each legal provision to the audit evidence required, responsible personnel, non-compliance risks and corrective actions for your specific biotech activity.