# Common Biosafety Program Gaps Found in Audits and How to Fix Them The single most common biosafety audit finding in a microbiology laboratory is a training gap. Staff are doing the work correctly, or close to it, but the laboratory cannot produce a training record that ties each person to each hazard, each procedure, and each date. Auditors ask for three things: a training matrix, evidence of completion, and evidence of competency assessment. If any one of those three is missing, the finding is written before the auditor leaves the bench. The first thing to check, therefore, is your training documentation against your actual staff roster. Pull the roster for every person who has touched the microbiology bench, the specimen receiving area, or the biological safety cabinet in the past twelve months. Then pull the training file for each of those people. The mismatch between those two lists is usually where the audit starts, and it is usually where the most findings originate. This article walks through the recurring biosafety audit findings in the order auditors encounter them, explains the mechanism behind each failure, gives you a diagnostic sequence you can follow bench by bench, and closes with corrective actions and prevention practices that keep findings closed. ## Why the Same Findings Recur in Almost Every Audit ![Comparison of undocumented activity, dead documentation, and unassigned responsibility with the confirming check and fix for each.](/article-images/illustrations/biosafety-audit-findings-failure-mechanisms.webp) A [biosafety program](/knowledge/diagnostics/emerging-tech/biosafety-program-implementation-a-roadmap-for-diagnostic-laboratories) is not a binder. It is a set of activities that produce measurable outcomes. A useful way to see this comes from the public health logic model, which divides an intervention into inputs, activities, and outcomes. Applied to biosafety, inputs are staffing and budget, activities are risk assessments, routine surveillance, training, and incident response, and outcomes are reported exposures, injuries, compliance status, and stakeholder satisfaction [1]. Most laboratories that fail audits have concentrated their effort on the input side. They have a written manual, a designated biosafety officer, and a committee. The activities and outcomes sides are thin, and audits are designed to detect exactly that thinness. The audit itself is a structured observation exercise. In one certification program modeled on ISO 15189, ISO 15190, and the World Health Organization Laboratory Safety Manual, approved auditors reviewed documents and records, observed operations, and asked open-ended questions to clarify what they saw. A laboratory needed a score of at least 90 percent to be recommended for certification. In that program, 26 of 134 authorized laboratories had been audited within a four-month window, and performance was strongest in test result and [data management](/blog/guides/data-management-basics-principles-processes-and-best-practices) while other domains lagged [2]. The pattern is instructive. Laboratories tend to be strong wherever documentation is naturally generated by daily work and weak wherever a deliberate program activity is required, such as training, surveillance, and risk assessment. Understanding biosafety audit findings causes requires looking at three failure mechanisms that recur across essentially every finding category: 1. **Activity exists but is not documented.** The bench technologist was trained by the supervisor in 2023. No record exists. The finding is written because audits evaluate evidence, not memory. 2. **Documentation exists but activity stopped.** The training matrix was built for an accreditation visit two years ago and has not been touched since. Staff hired after that date appear nowhere. 3. **The activity is delegated to a person or unit that does not know it is responsible.** The classic example is point-of-care testing performed outside the laboratory, where biosafety decisions default to whoever happens to run the test that day. Each mechanism has a different fix, and the sections below separate them. ## Start Here: A Bench-Level Diagnostic Sequence ![Seven-step bench diagnostic sequence from staff roster to asking three staff members to describe spill and exposure procedures.](/article-images/illustrations/biosafety-audit-findings-bench-diagnostic-sequence.webp) Before you respond to any specific finding, run this sequence. It takes about an hour and it reproduces the logic of most biosafety audits. 1. **Pull the staff roster** for everyone with laboratory access, including students, float staff, and contractors. 2. **Pull the training matrix** and compare it to the roster. Flag anyone hired, transferred, or promoted within the last twelve months. 3. **Pull the biosafety risk assessment file** and check the date of the last review for each procedure on the microbiology bench, including blood culture processing, mycobacterial work, fungal cultures, and specimen accessioning. 4. **Walk the bench and observe** three procedures end to end. Note where personal protective equipment (PPE) use, waste handling, and spill response differ from the written procedure. 5. **Check the biological safety cabinet certification stickers** and the last respirator fit test records if respirators are used anywhere in the department. 6. **Check immunization and medical surveillance records** for currency, particularly tuberculosis screening where applicable. 7. **Ask three staff members** to describe the spill procedure and the exposure procedure. Do not coach them. Their answers are your audit result. Anything that fails one of these seven checks will fail the audit. Fix it before the auditor arrives and most of your report will already be clean. ## Troubleshooting Table of Common Biosafety Audit Findings | Audit finding (symptom) | Likely cause | How to confirm | Fix | |--|--|--|--| | No training record for current staff | Training happened informally and was never documented | Compare staff roster to training file entries by name and date | Build a training matrix keyed to job role, document every session, and require supervisor sign-off | | New hires absent from training records | Onboarding checklist omits biosafety | Check onboarding paperwork for staff hired in the last year | Add biosafety training to day-one onboarding with a defined deadline | | Training content is identical for every role | No needs assessment was ever performed | Review curriculum for role-specific content | Perform a training needs assessment by role and rebuild the curriculum against identified hazards [3] | | Risk assessment file is one generic document | Template was copied and never tailored | Check whether specific agents, procedures, and routes of exposure are named | Rewrite as a procedure-level risk assessment with named agents and controls | | Risk assessment last reviewed years ago | No review cycle was ever assigned | Check document control dates | Assign annual review with a named owner and a calendar trigger | | PPE compliance is inconsistent on the bench | PPE not stocked at point of use, or policy conflicts with workflow | Observe bench work unannounced | Move PPE dispensing to the point of use and align policy with actual workflow | | Biological safety cabinet missing or uncertified | Procurement treated the cabinet as optional equipment | Check certification stickers and service records | Certify annually, or restrict work until a certified cabinet is available | | No spill or exposure drill records | Emergency plan exists on paper only | Ask staff to describe the spill procedure | Run and document drills at a defined interval with corrective feedback | | Shipping training absent | Infectious substance shipping regulations not seen as a lab responsibility | Ask who packages Category B specimens and where their certificate is | Assign certified IATA-based training to every shipper [4] | | Point-of-care sites have no biosafety oversight | Responsibility never formally assigned | Trace who made the last biosafety decision at an off-lab site | Assign oversight to the biosafety officer and microbiologist with written authority [5] | | Medical surveillance incomplete | Program exists but enrollment is not tracked | Compare the high-exposure roster to surveillance records | Build an enrollment list tied to risk assessment conclusions | | Incident and exposure reports are sparse | Near misses are not reported, not that none occurred | Compare report volume to bench activity | Create a no-blame reporting pathway and feed summaries to leadership [1] | ## Gap 1: Training Is Incomplete, Undocumented, or Stale This is the most common category of biosafety audit finding, and the mechanism behind it is straightforward. Microbiology biosafety training is usually delivered in three informal ways: a verbal walk-through from the supervisor, a slide deck shown at orientation, and an occasional re-reading of the safety manual. None of these produces evidence. The audit, meanwhile, is an evidence exercise. The scale of the problem is well documented. In a cross-sectional study of clinical laboratory professionals, only 18.5 percent of participants had received biosafety training, even though compliance with basic work habits such as mechanical pipette use (95.1 percent) and handwashing (96.3 to 98.8 percent) was high [6]. This contrast is the signature of the mechanism. Workers follow the habits they learned at the bench from their peers, but structured, documented, role-specific training never reaches them. The shipping example makes the point even more sharply. In a national survey of institutions in Pakistan, only 1.29 percent of surveyed institutions offered training on the International Air Transport Association (IATA) regulations for shipping infectious substances and biological specimens [4]. Shipping is an area where a single improperly packaged specimen creates a transport incident, yet it is almost universally treated as someone else's training problem. ### How to fix the training gap The corrective sequence that works is the one described in the safety training literature: assess training needs, develop a training life cycle, determine the tools required, and continuously improve the program, with leadership engagement treated as critical rather than optional [3]. In practical bench terms: 1. **Build the matrix by role, not by person.** Rows are staff. Columns are hazards and procedures. Each cell states the required training and competency assessment. 2. **Anchor the curriculum to a documented hazard inventory.** The training should map to hazards identified in the workplace, not to a generic deck [3]. 3. **Codify the knowledge expectations.** One academic health institution used a focus group of safety specialists to develop a list of 50 basic health and safety items that any safety specialist should know, including biosafety essentials, and used that list as the basis for formal cross-training. Staff responded positively and compliance improved across the institution [7]. A numbered list of expected knowledge items is one of the cheapest and most durable training controls available. 4. **Assess competency, not just attendance.** A signature on an attendance sheet is not a competency record. Direct observation of the trained task, signed and dated, is. 5. **Re-train on change, not just on schedule.** Any new agent, new instrument, new procedure, or revised risk assessment triggers targeted re-training for affected staff. ## Gap 2: The Biosafety Risk Assessment Is Missing, Generic, or Not Revisited The biosafety risk assessment is the engine of the entire program. Every downstream control, including PPE selection, containment level, immunization requirements, and training content, should trace back to a written assessment of the agent, the procedure, and the routes of exposure. When auditors find a missing or generic risk assessment, they treat every downstream control as unsupported, which multiplies the finding count. Three versions of this finding appear repeatedly: - **No assessment exists at all.** Work proceeds on custom and habit. - **A single generic document covers the whole laboratory.** It names no agents, no procedures, and no specific controls, so it cannot support any specific decision. - **The assessment was written once and never reviewed.** New instrumentation, new test menus, and new organisms are invisible to it. The mechanism is usually resource-based rather than attitude-based. Risk assessment feels like a documentation project with no bench payoff, so it gets deferred, and deferral compounds until the file is years old. ### How to fix the risk assessment gap A procedure-level risk assessment answers five questions in writing: what agent, what procedure, what routes of exposure, what controls are in place, and what residual risk remains. Write one for each microbiology bench activity. Specimen accessioning, plate reading, subculture, identification and susceptibility setup, mycobacterial processing, and fungal culture each get their own entry because their exposure routes differ. Two practices reduce the maintenance burden dramatically: - **Automate the inventory.** A recurring problem in research-adjacent laboratories is inconsistent documentation of the biological materials in use. Software approaches now exist that unify documentation of genetic parts and genetically modified organisms, automate biological risk evaluations, and maintain a shared up-to-date inventory for the team [8]. Even in a [clinical microbiology](/knowledge/diagnostics/microbiology/clinical-microbiology-from-specimen-collection-to-pathogen-identification) setting, the underlying principle holds: maintain a live, shared inventory of agents and materials, and hang the risk assessments on it. - **Assign a review cycle with a named owner.** An annual review with a calendar trigger and a signature line converts the risk assessment from a document into an activity, which is what the logic model framework demands [1]. The importance of this activity extends beyond the main laboratory. A survey of laboratories in Ontario found that biosafety principles, including risk assessment and containment of biohazardous agents, can serve as the foundation for policies guiding safe point-of-care testing, yet specific biosafety guidance for testing performed outside laboratories is generally lacking [5]. Your risk assessment process should be written so it can be applied wherever specimens are handled, not only inside the main laboratory walls. ## Gap 3: PPE, Biological Safety Cabinets, and Engineering Controls Fall Short Engineering controls fail audits in two distinct ways. The first is absence. The second is presence without verification, which auditors detect quickly through certification stickers, service records, and direct observation. The absence pattern is severe in under-resourced settings and instructive everywhere. In the cross-sectional study cited above, only 61.7 percent of laboratory professionals consistently used protective barriers, and access to biological safety cabinets was limited, with only 18.5 percent reporting access [6]. An onsite audit of nine tertiary hospital microbiology laboratories in Nigeria and Ghana assessing fungal diagnostic capacity found that a functional class II biological safety cabinet was present at only 2 of 9 sites (22.2 percent), standard operating procedures at 1 of 9 (11.1 percent), and a designated trained mycology person at 1 of 9 (11.1 percent) [9]. When a hazard like mould culture, which produces enormous aerosol loads, is handled without a certified cabinet and without a written procedure, the audit finding writes itself. The presence-without-verification pattern is more common in well-resourced laboratories. The cabinet is in the room. The sticker expired two years ago. The airflow alarm was muted because it kept going off. Each of these is a discrete, easily written finding. ### How to fix engineering control gaps 1. **Inventory every biological safety cabinet** with location, class, certification date, and next due date. Post the next due date on the cabinet itself. 2. **Certify on schedule.** Annual certification is the widely followed standard for cabinets in active use. A cabinet past its due date is, for audit purposes, a cabinet that does not exist. 3. **Match the procedure to the cabinet.** Activities with high aerosol potential, such as vortexing, grinding, and manipulation of mould cultures, belong in a certified class II cabinet. If no certified cabinet exists for that work, the work is paused or relocated. This is a hard line and auditors respect it when you hold it. 4. **Fix PPE at the point of use.** Noncompliance with protective barriers frequently reflects logistics, not attitude. Gloves and gowns stocked outside the room are gloves and gowns not worn. Stock them where the work happens. 5. **Write the procedure where the practice is missing.** The near-total absence of standard operating procedures in the fungal diagnostics audit [9] shows how one missing document type cascades into findings on practice, training, and equipment use simultaneously. A short safety note on this point: never perform aerosol-generating manipulations of cultures outside primary containment, and treat any cabinet with a failed certification or active airflow alarm as out of service until it is re-certified. Working around a non-functional cabinet converts a documentation gap into a genuine exposure risk. ## Gap 4: Medical Surveillance and Immunization Programs Are Weak Medical surveillance is the audit area where laboratories most often mistake policy for a program. The policy says staff handling specific agents will be enrolled in surveillance. The audit asks for the enrollment list, the completion dates, and the follow-up records. The data show how wide the gap runs. In the cross-sectional study of laboratory professionals, only 43.2 percent of participants had received appropriate immunizations and only 34.6 percent demonstrated adherence to emergency preparedness expectations [6]. On the surveillance side, a survey of latent tuberculosis infection among healthcare course students in a highly endemic setting found a non-compliance rate above 40 percent with tuberculin skin testing even among individuals at higher risk, including those with documented recent test conversion, which affected 17.3 percent of those completing the study. Non-compliance was associated with not being vaccinated against tuberculosis, with an odds ratio of 3.33 [10]. The mechanism here is instructive for any laboratory: surveillance programs fail when participation is voluntary, unscheduled, and disconnected from the person's assigned duties. ### How to fix the surveillance gap 1. **Derive the enrollment roster from the risk assessment.** Everyone whose risk assessment entry identifies exposure to a surveilled hazard goes on the list. The list is the program. 2. **Track enrollment explicitly.** A spreadsheet with names, hazard assignments, test or immunization due dates, and completion records is sufficient. What fails audits is the absence of the list, not the format. 3. **Schedule follow-up at enrollment, not afterward.** Convert passive invitation into scheduled appointments with escalation for non-response. 4. **Document declination.** Where a staff member declines immunization or testing, a signed declination record demonstrates the program functioned even though the individual opted out. ## Gap 5: Emergency Preparedness and Incident Response Exist on Paper Only Auditors test emergency preparedness the same way every time: they ask staff. A plan in a binder that no bench technologist can describe is a finding. The documentation pattern is consistent with the training data. Where only 34.6 percent of laboratory professionals demonstrated adherence to emergency preparedness expectations [6], the underlying cause is usually that the plan was written by someone who no longer works in the laboratory and never rehearsed with the people who do. The fix is drill-based. Run a chemical and biological spill drill, a specimen release drill, and an exposure response drill on a defined schedule. Document the drill, the staff response, the gaps identified, and the corrective actions taken. Feed the incident and drill data upward. The logic model framework emphasizes collecting and displaying biosafety program activity data, including incident response, on a monthly basis so leadership and safety committees can grasp the scope of program activities [1]. A laboratory that can show leadership a monthly count of drills, near-miss reports, and corrective actions has converted emergency preparedness from a document into a functioning activity, and auditors can see the difference in the first ten minutes. ## Gap 6: Documentation and Records Cannot Survive an Audit Documentation findings cluster into four types: 1. **Missing documents.** No written procedure for a bench activity that clearly requires one. 2. **Uncontrolled documents.** Multiple versions of the same procedure in circulation, or procedures with no revision date or approval signature. 3. **Records that cannot be retrieved.** Training logs, cabinet certifications, and incident reports that exist somewhere but cannot be produced within minutes. 4. **Documents that describe a laboratory that no longer exists.** Procedures naming retired instruments, departed staff, or discontinued test menus. The certification audit model shows what auditors actually do with documents. In the Zimbabwe certification program, auditors reviewed laboratory documents and records, observed operations, and asked open-ended questions to clarify both. Scoring against the checklist, drawn from ISO 15189, ISO 15190, and the WHO Laboratory Safety Manual, produced results where most audited laboratories achieved strong ratings overall while specific domains lagged [2]. The lesson for documentation is that auditors cross-check documents against observation. A procedure that describes a workflow the bench does not follow is worse than no procedure, because it demonstrates that document control is decorative. ### How to fix documentation gaps - Assign a single owner for each controlled document, with revision dates and approval signatures. - Retire or archive superseded versions physically, not just in theory. - Reconcile the procedure manual against the current test menu and instrument list once a year. - Store training, certification, and incident records in one retrievable system with a defined backup. ## Gap 7: Biosafety Oversight Does Not Extend Beyond the Main Laboratory This is the fastest-growing category of findings and the one most laboratories discover for the first time during an audit. Work with biological material now happens in satellite sites, point-of-care locations, and shipping areas, and the biosafety program frequently has no formal reach into any of them. The Ontario survey quantified the problem. For point-of-care-style tests conducted within laboratories, the biosafety officer or microbiologist was involved in biosafety decisions in 95 percent of microbiology laboratories. For point-of-care testing conducted outside the laboratory, that figure fell to 27 percent, with decisions instead made largely by infection prevention and control staff and point-of-care laboratory staff [5]. The mechanism is an unassigned responsibility. Nobody wrote down who owns biosafety at the off-site draw station, so ownership defaulted to whoever was present, and the audit correctly identifies an oversight gap. A second satellite activity with chronic oversight failure is specimen shipping. The Pakistan survey found that only 1.29 percent of surveyed institutions offered any training in shipping infectious substances [4], meaning the overwhelming majority of institutions ship regulated materials with untrained packagers. Every improperly packaged shipment is simultaneously a safety event, a compliance event, and, when discovered, an audit finding. ### How to fix the oversight gap 1. **Map every location and activity** where biological material is handled outside the main microbiology bench, including phlebotomy sites, point-of-care instruments, courier areas, and shipping stations. 2. **Assign each mapped activity** a named biosafety owner in writing. 3. **Extend the risk assessment format** to those sites, scaled to their simpler workflows [5]. 4. **Certify your shippers.** Identify every person who packages biological specimens and put them through IATA-aligned training on a recertification cycle [4]. 5. **Include satellite sites in the audit walkthrough.** The auditor will go there. You should have gone first. ## Gap 8: Program Structure, Staffing, and Governance Are Underbuilt When auditors trace findings back to their root cause, they often land on program structure. A committee that never meets cannot review risk assessments. A biosafety officer with no dedicated time cannot deliver the activities the program paper promises. A laboratory can have immaculate bench technique and still generate structural findings because the program lacks the staffing and governance to function as a program. The benchmarking data make the pattern visible. In a national survey of Institutional Biosafety Committees (IBCs) and biosafety programs, 57 percent of institutions reported one or more full-time employees dedicated to supporting the IBC, compared with 86, 85, and 83 percent of institutions reporting equivalent support for the IACUC, the IRB, and other comparator committees [11]. Biosafety infrastructure is, across institutions, thinner than the parallel oversight structures it sits beside. Auditors know this pattern and probe it directly by asking who performs each required program activity and how much of their time is allocated to it. The fix is not always hiring. Often it is the honest quantification of the program's activities and a deliberate decision by leadership about which activities will be resourced. The logic model approach exists precisely for this conversation. By presenting inputs, activities, and outcomes data to leadership each month, the program makes the case that prevention activities, which succeed invisibly when nothing bad happens, require defined resources [1]. Even a modestly staffed program with a documented monthly activity report audits better than a larger program whose activity exists only in memory. ## Rare Findings: Personnel Reliability and Regulatory Framework Gaps Two findings appear in audits of high-containment and specialized facilities and are worth recognizing so you can distinguish them from routine gaps. **Personnel reliability gaps.** Facilities working with biological select agents and toxins face an insider-threat dimension that routine clinical laboratories do not. The National Biodefense Analysis and Countermeasures Center implemented a Personnel Reliability Program (PRP) to enable active staff participation in biosafety and biosecurity culture, maintain regulatory compliance, and address insider risk, building on the required security risk assessment with ongoing suitability evaluation [12]. If your facility operates at [biosafety level](/knowledge/diagnostics/emerging-tech/biosafety-levels-1-4-a-comparative-framework-for-diagnostic-laboratory-design) 3 or above or handles select agents, auditors will examine whether a suitability and ongoing-evaluation mechanism exists beyond the initial background check. The corrective action is a written reliability program with defined evaluation intervals, staff responsibilities, and a reporting pathway that staff themselves can use to sustain the culture. **Regulatory and framework gaps.** At the national level, gap analyses can reveal structural weaknesses no individual laboratory can fix alone. A systematic comparison of Brazilian high- and maximum-containment laboratory regulations against United States and international frameworks found notable gaps and inconsistencies, with decentralized governance and variable adherence to commonly accepted compliance standards [13]. A laboratory operating under such a framework cannot resolve the national gap, but it can prepare for the audit consequence: auditors in such environments apply international benchmarks, and a laboratory that has already benchmarked itself against recognized standards will fare better than one that only meets the local minimum. ## How to Fix Biosafety Audit Findings: The Corrective Action Sequence Once findings are in hand, the corrective sequence determines whether they close permanently or recur at the next audit. Auditors check two things: whether the specific finding was corrected, and whether the root cause was addressed. Findings that recur are treated as evidence of a nonfunctioning corrective action system, which is itself a bigger finding. 1. **Classify each finding** by the failure mechanism from earlier in this article. Undocumented activity, dead documentation, and unassigned responsibility each take different fixes. 2. **Write a corrective action with an owner and a date.** "Improve training" is not an action. "Complete role-specific training matrices for all 23 microbiology staff by March 31, owned by the supervisor of bench operations" is. 3. **Fix the root cause, not the artifact.** If the training record was missing because onboarding does not include biosafety, adding the missing signatures fixes one person. Rewriting the onboarding checklist fixes the class of finding. 4. **Verify with evidence.** A closed finding requires an objective record: the signed matrix, the drill log, the certification sticker photograph, the updated risk assessment with review date. 5. **Feed the results upward.** Summarize the finding count, the closure rate, and the outstanding items in the monthly program report to leadership and the safety committee [1]. This converts the audit from an inspection into a measurable program outcome. 6. **Look for the pattern across findings.** A single audit that produces findings in training, surveillance, and emergency preparedness is usually telling you one thing: the program's activities have no owner and no cycle. One governance fix can close a family of findings. An enterprise view helps here. In a survey of medical laboratory professionals in Harare, knowledge of enterprise risk management, a holistic approach to identifying and mitigating risks including biosafety and biosecurity breaches, was strongly correlated with the presence of an organizational risk culture, with a correlation coefficient of 0.735 [14]. The practical translation is that corrective actions stick in laboratories where risk management is understood as an organizational habit rather than a departmental chore. ## Prevention Practices That Keep Findings Closed Prevention is cheaper than correction, and the practices below are the ones that auditors consistently read as evidence of a mature program. **Run a self-audit on the auditor's schedule.** Take the diagnostic sequence in this article, run it quarterly, and file the results. An auditor who arrives and finds dated self-audit records with closed corrective actions has very little left to write. **Keep the monthly activity report.** Record risk assessments performed, training sessions delivered, drills run, incidents and near misses reported, and corrective actions closed. Present it to leadership monthly [1]. This single artifact demonstrates that the program produces activities and outcomes, not just documents. **Make training self-maintaining.** Tie every new agent, instrument, and procedure change to a training trigger in the change-control process, so training currency follows operational change automatically [3]. **Maintain a live biological inventory.** Whether managed on paper or with dedicated software, a current inventory of the agents and materials in use keeps risk assessments anchored to reality and makes annual review a reconciliation task rather than a rewrite [8]. **Extend the program outward deliberately.** Review satellite sites, shipping practices, and point-of-care locations on the same annual cycle as the main bench [5]. **Invest in cross-training.** Codifying a defined list of knowledge expectations for biosafety and safety staff, as one academic institution did with a 50-item list, builds the bench depth that keeps the program functioning when any single person is absent [7]. **Write the pandemic lesson down.** The COVID-19 experience showed that biosafety programs must pivot their tasks in three directions: activities that shrink temporarily, activities that must continue for safety and compliance, and activities that surge in volume and novelty. Programs that cataloged their tasks during that experience now hold a template for the next disruption [15]. If your program has never documented its continuity plan, that is a prevention gap waiting for the next audit or the next emergency, whichever arrives first. ## Common Mistakes and Limitations - **Mistaking the absence of incidents for the presence of safety.** Within the biosafety profession, on a good day nothing bad happens, which makes the value of prevention hard to demonstrate [1]. Auditors do not accept a clean incident log as evidence of a functioning program. They look for the activities that prevent incidents. - **Fixing documents instead of practice.** Rewriting the procedure so it matches what the bench actually does, then assessing whether that practice should change, is the correct order. Rewriting only the document guarantees the finding recurs. - **Treating training as an orientation event.** One-time orientation decays. Training needs a lifecycle with scheduled refreshers, change-triggered updates, and competency assessment [3]. - **Ignoring who owns biosafety decisions at satellite sites.** Unassigned ownership is the root cause of most point-of-care and shipping findings [5]. - **Assuming a written plan satisfies emergency preparedness.** Auditors ask staff, not binders. Undrilled plans read as absent plans. - **Letting surveillance depend on voluntary participation.** Compliance with medical surveillance collapses when participation is unscheduled and disconnected from assigned duties [10]. - **Overloading a single biosafety officer without dedicated support.** The staffing benchmark data show biosafety programs routinely carry less support than parallel oversight committees [11]. An overloaded officer produces exactly the thin activity record audits detect. - **A limitation on scope.** The quantitative examples in this article come from studies in specific regions and facility types, including resource-limited settings and high-containment research environments. Your laboratory's baseline will differ. Individual corrective decisions, especially those involving immunization requirements, respiratory protection, and select agent handling, need review by your institution's biosafety officer and occupational health program for your specific agents, procedures, and regulatory context. ## Frequently Asked Questions ### What is the most common biosafety audit finding? The most common finding is incomplete or undocumented training. Staff frequently perform work safely but the laboratory cannot produce a training matrix, completion records, or competency assessments that tie each person to each hazard, and auditors evaluate evidence rather than recollection. ### What causes biosafety audit findings to recur year after year? Recurrence almost always means the root cause was never addressed. Three mechanisms account for most repeat findings: activity that exists but is not documented, documentation that exists but activity that stopped, and responsibility assigned to no one in particular. Fix the mechanism, not the individual artifact, or the finding returns. ### How do I fix a biosafety audit finding quickly? Write a corrective action with a named owner, a deadline, and an objective evidence requirement. Correct the specific deficiency, then fix the process that allowed it, such as adding biosafety to the onboarding checklist or assigning an annual risk assessment review cycle with a calendar trigger. ### How often should a biosafety risk assessment be reviewed? Review it annually at minimum, and additionally whenever a new agent, instrument, procedure, or test menu change affects exposure routes. Assign a named owner and a calendar trigger so review is an activity rather than an intention. ### What training does a microbiology laboratory staff member need? Role-specific training covering the hazards and procedures that person actually performs, including specimen handling, biological safety cabinet use, spill and exposure response, and shipping of infectious substances if they package specimens. Training should be documented, competency-assessed by direct observation, and refreshed on a defined schedule or when procedures change. ### Who is responsible for biosafety at point-of-care testing sites? Responsibility should be formally assigned in writing, and the evidence suggests it frequently is not. Biosafety decisions at point-of-care sites are best owned by the biosafety officer and the microbiologist, with site-level staff trained and the sites included in the program's risk assessment and audit cycle. ### How can I prepare for a biosafety audit in one day? Run the seven-step diagnostic sequence: reconcile the staff roster against training records, check risk assessment review dates, observe three procedures end to end, verify cabinet certifications, check surveillance and immunization currency, and ask three staff members to describe the spill and exposure procedures without coaching. Fix or document whatever fails. ### How do I demonstrate biosafety program value to leadership? Present a monthly report of program activities and outcomes, including risk assessments completed, training delivered, drills run, incidents and near misses reported, and corrective actions closed. Framing the program in inputs, activities, and outcomes makes prevention visible even when nothing bad happens, which is the program's normal and successful state. ## Sources 1. [Articulating Biosafety Program Activities in the Context of a Simplified Public Health Logic Model.](https://pubmed.ncbi.nlm.nih.gov/42205887/) 2. [Implementation of the COVID-19 laboratory testing certification program (CoLTeP), Zimbabwe, 2021.](https://pubmed.ncbi.nlm.nih.gov/36284574/) 3. [Establishing and Maintaining a Safety Training Program at Scientific Institutions.](https://pubmed.ncbi.nlm.nih.gov/42643102/) 4. [Enhancing Compliance: Tailored Training on IATA Regulations for Shipping Infectious Substances and Biological Specimens for Targeted Cohorts in Pakistan.](https://pubmed.ncbi.nlm.nih.gov/42205886/) 5. [Point-of-Care Testing Biosafety Decisions: An Investigation Summary Illustrating Current Decision-Making Process in Ontario, Canada.](https://pubmed.ncbi.nlm.nih.gov/39039897/) 6. [Biosafety Management Practices Among Clinical Laboratory Professionals in Debre Berhan Town Governmental Hospitals, Ethiopia: A Cross-Sectional Study.](https://pubmed.ncbi.nlm.nih.gov/39872910/) 7. [A Means of Codifying Safety Cross-Training Knowledge Expectations for Biosafety Professionals.](https://pubmed.ncbi.nlm.nih.gov/36895578/) 8. [GMOCU: Digital Documentation, Management, and Biological Risk Assessment of Genetic Parts.](https://pubmed.ncbi.nlm.nih.gov/38263723/) 9. [Diagnostic Capacity for Fungal Infections in Tertiary Hospitals in Nigeria and Ghana - An Onsite Baseline Audit of 9 Sites.](https://pubmed.ncbi.nlm.nih.gov/39611082/) 10. [Non-compliance with health surveillance is a matter of Biosafety: a survey of latent tuberculosis infection in a highly endemic setting.](https://pubmed.ncbi.nlm.nih.gov/22021753/) 11. [The Evolving Landscape of Institutional Biosafety Committees and Biosafety Programs: Results from a National Survey on Organizational Structure, Resources, and Practices.](https://pubmed.ncbi.nlm.nih.gov/36032060/) 12. [Implementation of a personnel reliability program as a facilitator of biosafety and biosecurity culture in BSL-3 and BSL-4 laboratories.](https://pubmed.ncbi.nlm.nih.gov/23745523/) 13. [Comparison of Brazilian High- and Maximum-Containment Laboratories Biosafety and Biosecurity Regulations to Legal Frameworks in the United States and Other Countries: Gaps and Opportunities.](https://pubmed.ncbi.nlm.nih.gov/38434103/) 14. [Evaluating the Knowledge, Attitudes and Practices of Medical Laboratory Professionals Towards Implementing Enterprise Risk Management in Harare, Zimbabwe: A Cross-Sectional Study.](https://pubmed.ncbi.nlm.nih.gov/40524718/) 15. [Pivoting the Biosafety Program in Response to COVID-19: Recommendations of Key Services and Tasks to Consider for the Next Pandemic.](https://pubmed.ncbi.nlm.nih.gov/36779201/)