This is a ready-to-use on-site fieldwork checklist for a GMP audit of a materials, API, excipient, contract manufacturing, contract testing, or contract service supplier. Replace every <<FILL: ...>> placeholder with your own specifics, delete the areas that do not apply to what the site actually does, and route the completed version through your normal document control and records retention. A worked filled specimen follows the template. Verify each cited regulation against the current published source before you rely on it. This template is an educational reference for you to adapt to your own quality system, products, and regulatory context; it is not legal, regulatory, or professional advice.
A checklist is a memory aid, not a script. Working down it in order and ticking boxes produces a shallow audit. Use it to make sure nothing in scope went unexamined, and let the threads you open take you off it. Everything you tick must be backed by something you actually saw.
How to use this checklist
| Field | Meaning |
|---|---|
| Verify | The specific question the auditor is answering. Not a topic, a question. |
| Evidence to request | What you ask for by name. Ask for the record, not the assurance. |
| P / F / NA | Pass, Fail, or Not Applicable. Not Applicable requires a written reason in Notes. |
| Notes | The record identifier, version, date, entry and the observation. This column is what makes the checklist evidence rather than a tick sheet. |
Fail does not mean finding. A Fail on this sheet means the evidence did not support the requirement at the moment you looked. Whether it becomes a finding, and at what grade, is decided at the team caucus against your classification procedure, after you have confirmed spread and checked whether you missed a control.
The triangulation rule
For every item that matters, cross three independent sources and look for where they disagree:
- What the procedure says. The SOP, master batch record, protocol, specification, or validation report.
- What people say happens. The operator, the analyst, the warehouse supervisor. Ask the person who does the task, not only the manager who owns the SOP.
- What the records prove happened. Executed records, logbooks, audit trails, raw data, calibration certificates, training files.
Findings live in the gap between any two of those. The SOP requires triplicate sampling; the analyst describes taking one; the logbook records one. That is a finding, and you found it because you crossed the lines instead of reading down one of them. Where a checklist row below is important, record all three sources in the Notes column, not just the one that was easiest to get.
The auditor-chosen record rule
Every record examined against this checklist must be selected by the audit team, not offered by the supplier. Name the record: “show me the batch record for lot <<FILL: lot>>” rather than “show me a batch record”. Where you have no lot number to work from, ask for the log or the index first, then pick from it in front of the host.
Draw your picks from four places:
- Records tied to a problem you already know about, from your own receipt data, complaints, or the supplier’s disclosures.
- The most recent record of its type, which tests the current state rather than the historical one.
- A record from the middle of the period, chosen at random from the index.
- The record the supplier is least keen to produce. Note any delay, and note it in the report.
If any record examined was supplier-selected, mark it in Notes. It still has value, but it cannot support a conclusion about the population.
Section 1. Quality system and management responsibility
| # | Verify | Evidence to request | P / F / NA | Notes |
|---|---|---|---|---|
| 1.1 | The quality unit has authority to reject material and to stop production, and does not report to the function it polices | Organisation chart with names, quality unit job descriptions, an example where quality overruled production | ||
| 1.2 | Management review happens at a defined frequency and produces decisions, not minutes only | Last two management review packs and the action list with owners, dates and closure status | ||
| 1.3 | Quality metrics are defined, tracked against thresholds, and acted on when a threshold is breached | Metric definitions, the last four periods of data, one example of an action triggered by a metric | ||
| 1.4 | The quality policy and quality manual describe the system that actually operates | Quality manual, and one process traced from the manual down to the operating procedure | ||
| 1.5 | Prior audit and inspection findings, internal and external, are tracked to closure with effectiveness verified | Findings register, and the closure evidence for two findings the auditor selects | ||
| 1.6 | Self-inspection is performed on schedule, covers the whole system over its cycle, and produces real findings | Self-inspection schedule, last two reports, and the coverage map | ||
| 1.7 | The site notifies customers of quality events affecting their product as agreed | The quality agreement clause, and the notification record for the last event that met the threshold | ||
| 1.8 | Product quality reviews or annual reviews are completed on time and reach conclusions | The most recent review for our item, with its conclusions and any actions |
A site with a self-inspection programme that has never raised a major finding is either the best site you will ever audit or is not looking. Ask which.
Section 2. Documentation and records control
| # | Verify | Evidence to request | P / F / NA | Notes |
|---|---|---|---|---|
| 2.1 | Only current, approved versions of documents are in use at the point of work | Two documents seen on the floor checked against the document control index in front of you | ||
| 2.2 | Documents are periodically reviewed and the review has a defined trigger and interval | Document index with review dates, and the list of documents currently overdue for review | ||
| 2.3 | Superseded and obsolete documents are withdrawn and cannot be used by mistake | Withdrawal records for the last revision of a document you name; check the floor for uncontrolled copies | ||
| 2.4 | Good documentation practice is followed in executed records: contemporaneous entry, no obliteration, corrections signed and dated with a reason | Ten consecutive pages of an executed record chosen by the auditor | ||
| 2.5 | Controlled forms and blank record pages are issued and reconciled so unused or spoiled copies cannot circulate | Blank form issuance log and reconciliation for the most recent batch | ||
| 2.6 | Records are retained for the defined period, are retrievable, and are protected from loss or damage | Retention schedule, and retrieval of one record from the earliest year still in scope, timed | ||
| 2.7 | Electronic records have defined retention, backup, and restoration that has been tested | Backup schedule, the last restoration test record | ||
| 2.8 | Batch records are reviewed by a second person and by the quality unit before disposition, with evidence of what the review examined | The most recent released batch record for our item, with its review signatures and any review checklist |
Section 3. Premises, utilities and equipment
| # | Verify | Evidence to request | P / F / NA | Notes |
|---|---|---|---|---|
| 3.1 | Facility layout and flows of personnel, material and waste prevent mix-up and cross-contamination | Site layout drawing walked against the actual route, in process order | ||
| 3.2 | Classified areas hold their classification, with monitoring and pressure differentials as designed | Room classification records, pressure differential trends, the last requalification report | ||
| 3.3 | Utilities that contact product are qualified and monitored: water, clean steam, compressed gases | Water system sampling data for the last twelve months including any excursions and their investigations | ||
| 3.4 | Equipment used for our item is qualified, and the qualification covers the way it is actually used | Qualification summary and the current configuration for one named piece of equipment on the floor | ||
| 3.5 | Preventive maintenance is performed on schedule and overdue items are visible and controlled | PM schedule, overdue list, and the PM record for one machine you saw running | ||
| 3.6 | Calibration is current for instruments that control or record critical parameters, with defined tolerances | Calibration master list, and the certificate for one gauge you point at on the floor | ||
| 3.7 | Out-of-tolerance calibration results trigger an impact assessment on product made since the last good calibration | The most recent out-of-tolerance event and its impact assessment | ||
| 3.8 | Cleaning of shared equipment is validated, and changeover is controlled | Cleaning validation summary, the changeover record for the last product change on shared equipment | ||
| 3.9 | Equipment status labelling on the floor matches the system of record | Walk and compare five status labels against the logbook or system | ||
| 3.10 | Computerised equipment is on the validated system inventory and its GxP classification is justified | System inventory with classification and rationale |
Section 4. Materials management and warehousing
| # | Verify | Evidence to request | P / F / NA | Notes |
|---|---|---|---|---|
| 4.1 | Incoming materials are identified, sampled and tested or otherwise verified before release for use | Receipt through release records for one incoming lot the auditor names | ||
| 4.2 | Quarantine is effective, physically or by a controlled system, so unreleased material cannot be used | Walk the quarantine area, and attempt a system query to see whether a quarantined lot can be dispensed | ||
| 4.3 | Certificates of analysis from the site’s own suppliers are reviewed against specification, not filed unread | The last three CoAs received, with review evidence and the specification they were checked against | ||
| 4.4 | Reliance on a supplier CoA in place of full testing is justified, and identity is confirmed on each lot received | The CoA reliance justification and the identity test records for the last three lots | ||
| 4.5 | Storage conditions match the label and specification, and are monitored with alarms that go somewhere | Temperature and humidity records for the storage areas holding our item, plus the last excursion | ||
| 4.6 | Cold chain and controlled temperature storage are mapped and requalified | Mapping report and requalification date for the unit holding our material | ||
| 4.7 | Stock rotation, retest and expiry dates are enforced by the system | A query for material past retest date, and its disposition | ||
| 4.8 | Dispensing is controlled: correct material, correct weight, verified, recorded contemporaneously | Observe a dispensing operation, then read its record | ||
| 4.9 | Rejected material is segregated and destroyed or returned under control | Rejection register and the disposition record for the last rejected lot | ||
| 4.10 | Material traceability runs from receipt through to the finished lot supplied to us | Trace one of our received lots backward to the incoming raw material lots that made it |
Section 5. Production and process control
| # | Verify | Evidence to request | P / F / NA | Notes |
|---|---|---|---|---|
| 5.1 | Production follows an approved master record, and the executed record matches what you observe on the line | Observe a live operation for at least <<FILL: minutes>> minutes, then read the record for that same operation | ||
| 5.2 | Critical process parameters are defined, controlled, and recorded within the validated range | Process validation summary and the batch data for one lot against the validated ranges | ||
| 5.3 | In-process controls are performed at the required frequency by qualified people | In-process check records for the observed batch, with the operator’s training record | ||
| 5.4 | Line clearance is performed and verified between batches and products | Line clearance record for the last changeover, plus observation of one if it occurs | ||
| 5.5 | Yield and reconciliation limits are defined, and out-of-limit yields are investigated | Yield data for the last ten batches of our item, and the investigation for any out-of-limit result | ||
| 5.6 | Reprocessing and rework, if performed, are approved case by case with impact assessed | The reprocessing register, and the most recent record if any | ||
| 5.7 | Batch records are completed contemporaneously, not reconstructed at the end of the shift | Compare entry times in the record against the process timeline and the equipment or system logs | ||
| 5.8 | Environmental and personnel monitoring in classified areas is performed as designed and excursions are investigated with product impact assessed | EM data for the period, and the investigation for the three most recent excursions | ||
| 5.9 | Aseptic process simulations, where the site fills sterile product, are current, at the right scale and frequency, and any failures were investigated | Media fill reports for the last cycle covering the line used for our product | ||
| 5.10 | Time limits between process stages are defined and respected | Hold time data for the observed batch against the validated limits |
Section 6. Packaging and labelling
| # | Verify | Evidence to request | P / F / NA | Notes |
|---|---|---|---|---|
| 6.1 | Label reconciliation is performed and unreconciled quantities are investigated | Reconciliation record for the most recent packaging run of our item | ||
| 6.2 | Only the correct printed materials are issued to the line, with a controlled issue and return | Label issuance record for a named batch, checked against the batch record | ||
| 6.3 | Online code and label verification systems are qualified and challenged | Qualification record and the challenge test performed at line setup | ||
| 6.4 | Line clearance before packaging removes all previous printed material | Observe a line clearance, or read the record and check the area | ||
| 6.5 | Printed material is checked against an approved master artwork, and artwork changes are controlled | Artwork approval record for the current version, and the last artwork change control | ||
| 6.6 | Serialisation or track and trace data, where applicable, are complete and reconcile | Serialisation reconciliation record for a named batch | ||
| 6.7 | Rejected or damaged labels and packaging are destroyed under control | Destruction record for the last rejected quantity |
Section 7. QC laboratory, including data integrity and audit trails
This is where the paper you rely on is manufactured. Give it disproportionate time.
| # | Verify | Evidence to request | P / F / NA | Notes |
|---|---|---|---|---|
| 7.1 | Test methods used for our item are validated or verified for use at this site | Method validation or compendial verification report for the method on our specification | ||
| 7.2 | Analytical instruments are qualified and their qualification is current | Qualification records for the instrument that produced a result on a CoA you hold | ||
| 7.3 | System suitability is met before results are reported, and failures are handled, not repeated until they pass | Sequence data for a named run, with all injections including failed system suitability | ||
| 7.4 | Audit trails are enabled for all GxP systems, cannot be disabled by ordinary users, and capture who, what, when, and old and new values | System configuration screen viewed live, and the audit trail settings for the chromatography data system | ||
| 7.5 | Audit trail review is performed, at a defined frequency tied to data criticality, and produces documented outcomes including no-finding reviews | Review records for the last three periods, with evidence of what was examined | ||
| 7.6 | A specific result traces backward from the certificate of analysis to the raw data, the instrument and the analyst | Trace one result the auditor names, all the way down, in the system, live | ||
| 7.7 | The audit trail for that traced result shows no unexplained re-integration, re-injection, aborted run, renamed or deleted file, or processing outside the system | The audit trail for the traced sequence, read on screen, covering the full window around the result | ||
| 7.8 | Access rights are role-based, unique to individuals, reviewed periodically, and no shared or generic accounts are in use for GxP entry | User list with roles and last review, plus observation of who is logged in on the floor | ||
| 7.9 | Administrator rights are held outside the group that generates the data, or the arrangement is controlled and monitored | Administrator account list and the control over it | ||
| 7.10 | System date and time are synchronised to a controlled source and cannot be changed by users | Time synchronisation configuration and the audit trail entries for any clock change | ||
| 7.11 | Out-of-specification results follow a defined investigation process, and invalidation of a result requires assignable cause | The last five OOS investigations, with attention to any result invalidated | ||
| 7.12 | Manual integration is procedurally controlled, justified per instance, and reviewed | Manual integration justification records, and one chromatogram where it was applied | ||
| 7.13 | Reference standards and reagents are qualified, in date, and traceable | Standard register and the certificate for the standard used in the traced result | ||
| 7.14 | Stability data supporting the retest or expiry date we rely on exist and are current | Stability protocol and the most recent data for our item | ||
| 7.15 | Sample retention meets the defined quantity, condition and period | Retain sample store, and the retention record for a named lot | ||
| 7.16 | Microbiological testing, where performed, follows validated methods with growth promotion and negative controls documented | Sterility or bioburden test records for a named lot, with the controls | ||
| 7.17 | Paper and hybrid records are controlled: printouts are attributable, complete, and linked to the electronic raw data | One hybrid record examined against its electronic original |
Never assess data integrity on paper alone. Open at least one audit trail per system in scope, on the screen, with the auditor holding the mouse or watching the administrator’s every click.
Section 8. Deviations, OOS, complaints, recalls and CAPA
| # | Verify | Evidence to request | P / F / NA | Notes |
|---|---|---|---|---|
| 8.1 | Deviations are raised promptly, classified consistently, and the classification is justified | Deviation log for the period, plus the three the auditor selects | ||
| 8.2 | Investigations establish a root cause supported by evidence, not a restatement of the event | The two most serious deviations affecting our item | ||
| 8.3 | Product impact is assessed for every event that could affect a lot supplied to us, and the assessment reaches a disposition | Impact assessments in the selected deviations, and the disposition of the affected lots | ||
| 8.4 | Events are closed within the defined timeframe, and overdue events are visible and escalated | Ageing report for open deviations and investigations | ||
| 8.5 | Complaints are logged, investigated, trended, and linked back to the batch | Complaint log for the period, plus the investigation for any complaint on our product | ||
| 8.6 | Recall procedure exists, defines responsibilities and timelines, and has been tested | Recall procedure and the last mock recall record with its reconciliation and timing | ||
| 8.7 | CAPA actions have owners, due dates, and are completed | CAPA register with ageing, and the closure package for two CAPAs the auditor selects | ||
| 8.8 | Effectiveness checks are defined for significant CAPAs, with a metric and a review point, and are actually performed | The effectiveness check for a CAPA closed at least six months ago | ||
| 8.9 | Repeat events are detected: the same failure recurring does not simply generate a new deviation each time | Trend analysis across the deviation log, and the site’s own repeat-event criteria | ||
| 8.10 | Events at the site that affect our product were notified to us as the quality agreement requires | Cross-check the deviation log against the notifications we actually received |
Item 8.10 is the one auditors skip and regret. Read their event log with your own notification file open beside it.
Section 9. Change control
| # | Verify | Evidence to request | P / F / NA | Notes |
|---|---|---|---|---|
| 9.1 | Changes affecting product, process, equipment, materials, suppliers, systems or facilities go through change control before implementation | Change log for the period, and the record for a change you can see was implemented | ||
| 9.2 | Change classification is justified, and low-impact routes are not used for changes that affect validated state or product-contact components | All changes routed as minor or like-for-like in the period, examined against the site’s own criteria | ||
| 9.3 | Impact assessment covers validation, regulatory filings, stability, specifications, and customer commitments | The assessment section of the two most significant changes | ||
| 9.4 | Actions arising from a change are completed before the change is closed | Closure package for one implemented change | ||
| 9.5 | Customers are notified of changes that require notification under the quality agreement, before implementation | The customer notification section of every change in the period that touched our item | ||
| 9.6 | Emergency or temporary changes have a defined route, a time limit, and are converted or reversed | Temporary change register and any change open beyond its stated limit | ||
| 9.7 | Post-change verification confirms the change achieved what it intended | Verification evidence for a change implemented at least three months ago |
Section 10. Training and personnel
| # | Verify | Evidence to request | P / F / NA | Notes |
|---|---|---|---|---|
| 10.1 | People performing critical steps for our item are trained and qualified for those specific steps | Training records for the named individuals whose signatures appear in the batch record you reviewed | ||
| 10.2 | Training on a procedure precedes performing it, with the effective date respected | Compare training completion dates against the SOP effective date and the first executed use | ||
| 10.3 | Training effectiveness is assessed, not just attendance recorded | The assessment method and results for one critical procedure | ||
| 10.4 | GMP and data integrity training is given on induction and refreshed at a defined interval | Curriculum and completion status for the in-scope departments | ||
| 10.5 | Aseptic personnel are qualified through gowning qualification and periodic requalification, where applicable | Gowning qualification records for the operators observed | ||
| 10.6 | Staffing levels and shift patterns permit the procedures to be followed as written | Observed workload against the procedure timings, and any deviation trend tied to shift or workload | ||
| 10.7 | Job descriptions exist for GxP roles and match what the people actually do | Job description for the quality unit head, checked against the organisation chart | ||
| 10.8 | Contractors and temporary staff are trained and qualified to the same standard | Training records for any contractor working in the in-scope area |
Section 11. Validation and qualification status
| # | Verify | Evidence to request | P / F / NA | Notes |
|---|---|---|---|---|
| 11.1 | A validation master plan or equivalent defines what is validated, to what extent, and on what basis | Current plan and its revision date | ||
| 11.2 | The process used for our item is validated, with the validation covering the current process, scale and equipment | Process validation report and any change since it was issued | ||
| 11.3 | Ongoing process verification or continued process verification is in place, with data trended | The most recent periodic evaluation for our item | ||
| 11.4 | Cleaning validation covers the products and equipment trains relevant to our material, including any worst case | Cleaning validation report and the residue limit basis | ||
| 11.5 | Computerised systems supporting our item are validated for their intended use, with the validation current after changes | Validation summary and the change history for the chromatography data system or MES | ||
| 11.6 | Qualification of critical equipment and utilities is complete and periodic review or requalification is on schedule | Qualification status list with overdue items highlighted | ||
| 11.7 | Deviations raised during validation were resolved and did not silently lower the acceptance criteria | The deviation section of one validation report | ||
| 11.8 | Nothing critical is running on an expired, provisional or conditional qualification status | The overdue and conditional list, cross-checked against the equipment used for our lots |
Section 12. Outsourced activities and the supplier’s own supplier controls
Your supply chain does not stop at their gate. A site that is excellent in every other section and buys a critical starting material from an unqualified source has moved your risk, not removed it.
| # | Verify | Evidence to request | P / F / NA | Notes |
|---|---|---|---|---|
| 12.1 | All activities the site outsources that touch our material are identified, including testing, sterilisation, storage, transport and calibration | The outsourced activity register, cross-checked against the process flow for our item | ||
| 12.2 | Each outsourced provider is qualified before use, with a documented basis proportionate to risk | Qualification file for the provider of the most critical outsourced step | ||
| 12.3 | A written agreement defines responsibilities for each outsourced GMP activity | The agreement with that provider, and the clause covering the specific work | ||
| 12.4 | The site audits or otherwise monitors its critical providers on a risk-based interval | The audit report or monitoring record for the provider, and the interval justification | ||
| 12.5 | The site’s own supplier approval list is current, and purchasing cannot buy critical materials outside it | The approved list, and a test: ask what the system does if a buyer raises an order against an unapproved source | ||
| 12.6 | Incoming materials from the site’s own suppliers are verified, not accepted on paper alone | Identity test records and the CoA reliance justification for a critical raw material | ||
| 12.7 | Changes at the site’s own suppliers are captured and assessed | The last supplier change notification received by the site and what was done with it | ||
| 12.8 | Subcontracting beyond the first tier is either prohibited by agreement or controlled and visible | The agreement clause, and evidence of who actually performs the step | ||
| 12.9 | Performance of the site’s own providers is monitored, with quality events fed back | Provider performance record or scorecard for the period | ||
| 12.10 | Where an outsourced provider handles our material or its data, that arrangement is permitted under our quality agreement | Our quality agreement clause on subcontracting, checked against reality |
Fieldwork completion record
| Field | Entry |
|---|---|
| Audit reference | <<FILL>> |
| Supplier and site | <<FILL>> |
| Sections applied | <<FILL: list, with the reason for any section marked NA in full>> |
| Traces completed end to end | <<FILL: which, and in which direction>> |
| Records examined that were auditor-chosen | <<FILL: count>> of <<FILL: total examined>> |
| Systems whose audit trail was opened on screen | <<FILL>> |
| Items marked Fail | <<FILL: item numbers>> |
| Items unable to assess, and why | <<FILL>> |
| Completed by | <<FILL: name, signature, date>> |
| Working papers reference | <<FILL>> |
Acceptance criteria for fieldwork
| # | Criterion | Met (Y/N) |
|---|---|---|
| 1 | Every item marked Pass has a record identifier or an observation in Notes. A bare tick is not evidence | <<FILL>> |
| 2 | Every item marked NA has a written reason | <<FILL>> |
| 3 | At least one full trace was completed, forward or backward, through the most critical process in scope | <<FILL>> |
| 4 | At least one audit trail was opened on screen for every computerised system in scope | <<FILL>> |
| 5 | The majority of records examined were auditor-chosen, and any supplier-selected record is marked as such | <<FILL>> |
| 6 | Every item that matters was triangulated across procedure, person and record | <<FILL>> |
| 7 | Every potential finding is backed by a named record and the specific requirement it may breach | <<FILL>> |
| 8 | Every potential finding was raised with the host on the floor, so the closing meeting holds no surprises | <<FILL>> |
| 9 | Time actually spent on the floor and in records was at least 60 percent of on-site time | <<FILL>> |
Filled specimen
An extract of a completed checklist for an illustrative contract sterile fill-finish supplier, showing the level of detail the Notes column needs. Company, records and dates are invented for teaching purposes.
| # | Verify | P / F / NA | Notes |
|---|---|---|---|
| 5.1 | Executed record matches observed operation | P | Observed capping on line FL-02, 19 May 2026, 10:15 to 11:25. Batch NS-26-0114. Compared against MBR-FL02 rev 7 and the executed record read at 14:40 the same day. Sequence and in-process checks matched what was performed. Auditor-selected batch, chosen from the day’s production schedule on arrival. |
| 7.4 | Audit trails enabled and not disabled by ordinary users | P | Chromatography data system, configuration screen viewed live with system administrator T. Nolan, 20 May 2026 09:20. Audit trail active at project level, “disable audit trail” greyed out for the Analyst and Reviewer roles, available only to the System Administrator role held by two named IT staff. Confirmed old and new values captured on a test edit shown on screen. |
| 7.5 | Audit trail review performed at defined frequency with documented outcomes | F | SOP-QC-030 rev 4 section 7.2 requires audit trail review of every release sequence before the result is reported. Reviewed the review records for the sequences supporting lots NS-26-0031, NS-26-0072 and NS-26-0114. All three review forms signed, but each records only “audit trail reviewed, no issues”. No record of what was examined, no entry counts, no filter or query named. Asked reviewer A. Cronin (QC) what she looks at: she described opening the sequence audit trail and scanning for re-integrations, which is more than the form captures but not what the SOP specifies. Triangulation: SOP requires a documented review; the person describes a real but undocumented method; the record proves only that a box was ticked. Raised with host on floor at 11:05, 20 May 2026. |
| 9.2 | Change classification justified, low-impact route not used for validated-state changes | F | Change log 01 Jan 2025 to 30 Apr 2026 requested and reviewed, 34 entries. Eight examined, auditor-selected: the three most recent, the three touching line FL-02, and two chosen at random from the index. Three used the “like for like, no qualification required” route. Two of those three, CC-25-088 (crimp cap supplier change, implemented 27 Oct 2025) and CC-25-121 (stopper supplier grade change, implemented 14 Jan 2026), involved primary container closure components, which SOP-QA-018 rev 5 section 6.4 excludes from that route. Raised with QA head at 15:30, 20 May 2026; accepted on the spot. |
| 12.2 | Outsourced provider qualified before use | P | Endotoxin testing subcontracted to Brackenfield Analytical Ltd. Qualification file AQ-SUP-019 reviewed: 2024 on-site audit report, current agreement dated 03 Mar 2024, method transfer report MT-2024-06, and annual performance review dated 12 Feb 2026. Provider was audited before first use in June 2024, and first sample sent 22 July 2024. Sequence confirmed by comparing the audit date against the first sample submission record. |
| 12.5 | Purchasing cannot buy critical materials outside the approved list | F | Approved supplier list ASL rev 22 reviewed. Asked materials manager to demonstrate what the ERP does when a purchase requisition is raised against a non-approved vendor for a GMP material. The system issued a warning message that the buyer can acknowledge and proceed; it is not a hard block, and there is no quality approval step in the workflow. Two GMP purchase orders in the period, PO-25-4471 and PO-26-0233, were placed against vendors added to the ASL after the order date. Raised with host at 16:10, 20 May 2026. |
Read item 7.5 again. The Pass would have been easy: the reviews exist, they are signed, they are on time. What turns it into a Fail is triangulation. The procedure demanded a documented review, the reviewer described a genuine method, and the record proved only that somebody signed. Nothing in the file would have shown that gap. You have to ask the person.
Item 12.5 shows the other technique worth stealing: do not ask whether a control exists, ask them to demonstrate it in front of you. “Show me what the system does” found a soft warning where the SOP implied a hard block.
Common inspection findings this checklist prevents
- Audit checklists returned with ticks and no evidence, so no one can reconstruct what was actually examined.
- Records reviewed during an audit consisted only of examples the supplier selected.
- Audit files showing that data integrity was assessed by reading procedures, with no audit trail ever opened.
- Whole system areas within the stated scope that the audit record shows were never examined, with no reason given.
- Findings raised with no record identifier or requirement, so the supplier’s corrective action addresses nothing specific.
- Deviations at the supplier that affected supplied material and were never notified, undetected because the auditor never compared the supplier’s event log to the notifications actually received.
- Outsourced activities two tiers down the supply chain that were never identified, qualified or audited.
- Training records that show attendance but no assessment, and training completed after the person first performed the task.
- Changes to product-contact components routed as like-for-like with no requalification and no customer notification.
- Audits with no on-site observation recorded, so the report cannot show that anything was verified on the floor.
How to adapt this checklist
- Delete whole sections that do not apply. A contract testing laboratory audit uses sections 1, 2, 3, 7, 8, 9, 10, 11 and 12; sections 4, 5 and 6 mostly fall away. An excipient supplier audit needs 4 and 5 heavily and section 7 in proportion to what they test.
- Add product-specific rows. For a sterile fill-finish supplier, expand section 5 with contamination control strategy, gowning, interventions and media fill design. For a cell or gene therapy service provider, add chain of identity and chain of custody, donor eligibility documentation, and cryogenic storage and transfer controls to sections 4 and 5.
- Set the observation duration in item 5.1 and any thresholds in the acceptance criteria to your own procedure.
- Insert rows for every clause in your quality agreement that you intend to test, so contractual commitments are audited rather than assumed.
- Where the audit is for-cause, mark the rows tied to the failure mode as mandatory and treat the rest as coverage. Do not let a for-cause audit dissolve into a general system tour.
- Keep the Notes column wide in your printed or electronic version. If auditors cannot write a record identifier, a version, a date and an observation into it, they will write “OK” instead, and the checklist stops being evidence.
- Capture each potential finding on Form: Audit Evidence Working Paper as you go, carry it into Report: On-Site GMP Supplier Audit, and grade it with SOP: GxP Audit Finding Classification and Grading. The fieldwork method behind this checklist is described in how to conduct a supplier or GMP audit.