Form: Audit Evidence Working Paper

This is a ready-to-use working paper for capturing audit evidence on the floor. Replace every <<FILL: ...>> placeholder with your own specifics, set your document numbers and dates, and route the completed form through your normal records retention. A worked filled specimen follows the template. Verify each cited regulation against the current published source before you rely on it. This template is an educational reference for you to adapt to your own quality system, products, and regulatory context; it is not legal, regulatory, or professional advice. The working paper is the raw evidence behind an audit report. Everything in the report should be traceable to a row on this form, captured at the moment it was seen. Auditors who plan to write it all up that evening produce reports full of “documentation was inconsistent” instead of “logbook CL-204, entries 12 to 18 March 2026, 9 of 14 missing the second signature required by SOP-CLN-007 rev 4 step 6.2”. The difference is not memory. It is whether you wrote down the identifier while you were standing there.

Form control

Each auditor keeps their own sheets and initials their own rows. Do not pool observations onto one sheet written by whoever had the pen; attribution matters if a finding is later challenged.

The evidence log

One row per observation. A row is created whether or not the observation becomes a finding, because the observations that turned out to be fine are what show the audit had coverage.

Disposition values

Nothing may enter the audit report unless it appears on a working paper row with a disposition of PF or PF-CONF. That single rule kills the two worst report defects at once: findings invented at the writing desk, and findings that first appear after the closing meeting.

Field definitions

Rules for completing this form

1. Capture at the moment of observation, with full identifiers. Not at the coffee break, not that evening. A record identifier you did not write down is a record you cannot cite, and the supplier’s help in reconstructing it later is not evidence.
2. Write what you saw, not what you concluded. “Nine of fourteen entries have no second signature” is an observation. “Cleaning verification is not being performed” is a conclusion, and it may be wrong: the verification might happen and be recorded elsewhere. Separate the two so that if your inference collapses, the fact survives.
3. Always record the denominator. Three deviations without impact assessment means something different when three of three were examined than when three of forty were. The denominator is what establishes spread, and spread is what drives the grade.
4. Cite both bars. The external requirement and the supplier’s own procedure. Get the supplier’s SOP number and revision while you are still standing in the area, because retrieving it later takes an hour and sometimes produces a different revision.
5. Raise it on the floor and record that you did. The “raised with host” column is what lets the lead auditor state at the closing meeting that nothing is a surprise, and lets the report state the same thing truthfully.
6. Do not write the fix. Root cause and corrective action belong to the supplier. An auditor who writes “they should add a second verification step” has stopped auditing and started consulting, and has weakened both the finding and the supplier’s ownership of it.
7. Do not erase or overwrite. If an observation is later shown to be wrong, add a new row or annotate with a single-line strikethrough, your initials and the date, and state what evidence changed it. Working papers follow the same documentation practice as any other GxP record.
8. Photography and copying follow the site policy. Where photography is prohibited, transcribe the entry verbatim with its identifiers and note in the row that the entry was transcribed. Where the supplier provides a copy, record the copy reference in the row.
9. One auditor, one sheet, own initials. Attribution survives challenge; pooled notes do not.
10. Close every OPEN row before the closing meeting. An unresolved OPEN either becomes a PF, becomes a WD with the resolving evidence recorded, or is reported as an item the audit could not conclude on.

Retention of working papers

Working papers are retained with the audit report and for the same period. They are the evidence that the audit examined what it claims to have examined. An audit file containing a report and no working papers cannot demonstrate that anything was actually seen, and an audit file whose working papers were destroyed after the report was issued is worse than one that never had them.

Sheet certification

Filled specimen

A completed sheet from an illustrative on-site audit of a contract sterile fill-finish supplier. Company, records, people and dates are invented for teaching purposes.

Form control: FRM-QA-052 rev 3. Audit SUP-AUD-2026-018, Northvale Sterile Services Ltd, Cork. Audit dates 19 to 20 May 2026. Auditor: P. Raghavan, initials PR. Sheet 2 of 3.

Sheet certification: 7 rows. PF or PF-CONF: 013, 015, 017. OPEN at end of audit: none; ref 014 was resolved by ref 015. Completed by P. Raghavan, 20 May 2026. Reviewed by lead auditor K. Ferreira, 20 May 2026.

Three things in this sheet are worth copying. First, rows 011, 012 and 016 are Pass observations, and they belong on the paper. They are what proves the audit went into the system rather than around it, and they are the reason nobody can later claim the data integrity review was superficial.

Second, look at the sequence 014 to 015. Ref 014 was a soft observation with an explanation from the site that sounded reasonable. The auditor did not accept the explanation; he requested the evidence that would test it and left the row OPEN. The evidence came back at 14:10 and turned an “explained” observation into a confirmed finding on a lot we had actually received. That is what OPEN is for.

Third, notice how narrow the observations are. Ref 017 says the investigation record contains no supporting evidence. It does not say the analyst did not make an error, and it does not say the result was falsified. If the supplier later produces an interview record that was misfiled, the finding weakens but the auditor is not exposed, because the auditor only ever claimed what was in the record at the time it was read.

Common inspection findings this form prevents

• Audit findings written as opinions with no record identifier, version or date, so the supplier cannot act on them and a challenge collapses them.
• Findings that appear for the first time in the report, never raised with the supplier during the audit.
• Audit files containing a report but no underlying evidence, so no one can demonstrate what was examined.
• Working papers destroyed or discarded after the report was issued, leaving the report unsupported.
• Findings with no denominator, so spread and therefore grade cannot be justified or defended.
• Findings citing a regulation but never the supplier’s own procedure, allowing the supplier to argue the bar was invented.
• Observations rewritten from memory at the end of the day, with identifiers that turn out not to exist.
• An audit that recorded only problems, with no evidence of the areas examined and found acceptable, so coverage cannot be shown.
• A potential finding explained away on the floor and never tested against evidence, because there was no mechanism to leave it open.

How to adapt this form

1. Set the form number and retention to your own records schedule, and confirm that working papers are retained for the same period as the audit report.
2. If your auditors work on tablets, keep the same columns but make the record identifier and denominator fields mandatory so a row cannot be saved without them.
3. Add a column for photograph or attachment reference if your sites permit photography; keep the transcription rule for sites that do not.
4. For remote or documentary audits, replace “raised with host on the floor” with “raised on the call, with date and time”, and add a column for the file name and hash or version of any electronic evidence received.
5. Add a column for quality agreement clause if most of your audits test contractual commitments; it saves cross-referencing later.
6. Keep the disposition values short and defined. Auditors invent their own codes when the list does not fit, and then nobody can total the potential findings.
7. Carry every PF and PF-CONF row into Report: On-Site GMP Supplier Audit and grade it with SOP: GxP Audit Finding Classification and Grading. Use this form alongside Checklist: On-Site GMP Supplier Audit Fieldwork, which drives coverage while this form captures the evidence. The method behind both is described in how to conduct a supplier or GMP audit.