Log: Supplier Audit CAPA Tracking to Closure

This is a ready-to-use tracking register for driving supplier audit findings from the report to verified closure. Replace every <<FILL: ...>> placeholder with your own specifics, set your document numbers and dates, and route the completed register through your normal document control and records retention. A worked filled specimen follows the template. Verify each cited regulation against the current published source before you rely on it. This template is an educational reference for you to adapt to your own quality system, products, and regulatory context; it is not legal, regulatory, or professional advice. Finding a problem is the easy half. The audit only pays for itself if the supplier fixes the cause, and if somebody on your side checks that the fix worked. An audit file full of reports with no follow-up evidence is, on its own, a finding against you.

Register control

Field	Entry
Register reference	`<<FILL: e.g. LOG-SQ-007>>`
Version	`<<FILL>>`
Owner	`<<FILL: role, e.g. Supplier Quality Lead>>`
Governing procedure	`<<FILL: SOP-ID for supplier audit and CAPA>>`
Review frequency	`<<FILL: e.g. monthly at the supplier quality review>>`
Escalation route for overdue items	`<<FILL: role or forum, and the trigger>>`
Retention	`<<FILL: period, aligned to the audit report>>`

Part A. Finding and response tracking

One row per finding. Never one row per audit; a rolled-up “audit closed” line hides the finding that never actually got answered.

Ref	Audit ref	Supplier and site	Finding no.	Grade	Finding summary	Report issued	Response due	Response received	Reviewer	Review outcome	Review date
`<<FILL: 001>>`	`<<FILL>>`	`<<FILL>>`	`<<FILL>>`	`<<FILL: Critical / Major / Minor>>`	`<<FILL: one line>>`	`<<FILL: date>>`	`<<FILL: date>>`	`<<FILL: date>>`	`<<FILL: name>>`	`<<FILL: Accepted / Rejected / Partially accepted>>`	`<<FILL: date>>`
`<<FILL: 002>>`
`<<FILL: 003>>`

Part B. The supplier’s response, unpacked

Break the response into its four parts and record each separately. A supplier that submits one paragraph containing all four is, more often than not, submitting only one of them.

Ref	Correction (what contained it now)	Root cause (why it happened)	Corrective action (prevents recurrence of this cause)	Preventive action (prevents it elsewhere)	Action owner at supplier	CA due	PA due	Actions complete (date)	Evidence of completion
`<<FILL: 001>>`	`<<FILL>>`	`<<FILL>>`	`<<FILL>>`	`<<FILL: or "not warranted", with reason>>`	`<<FILL: name and role>>`	`<<FILL>>`	`<<FILL>>`	`<<FILL>>`	`<<FILL: document reference we actually received and read>>`
`<<FILL: 002>>`

Term	What it means here	Test to apply
Correction	Fixes the specific instance. Reworks the batch, re-signs the record, quarantines the lot, re-tests the material	Does it deal with anything beyond the individual instance? If yes, it is not a correction, it is a corrective action
Root cause	The systemic reason the failure was possible	Would removing this cause prevent the failure regardless of who performs the task on which day?
Corrective action	Removes or controls the root cause so this cause cannot produce the failure again	Is it about the system, the process design, the record, the supervision, or the control, rather than about a person?
Preventive action	Applies the learning to other products, lines, systems or sites where the same cause exists	Was a search actually performed for the same exposure elsewhere, and is its result recorded?

Part C. Reviewer evaluation and the rejection criteria

Ref	Response adequate?	Reason if rejected	Returned to supplier (date)	Revised response due	Revised response received	Final outcome
`<<FILL: 001>>`	`<<FILL: Yes / No>>`	`<<FILL: cite the rejection criterion below>>`	`<<FILL>>`	`<<FILL>>`	`<<FILL>>`	`<<FILL: Accepted / Escalated>>`

Criteria for rejecting a weak response

Reject and return the response, with the reason stated, when any of the following apply. Say which criterion you are invoking, so the supplier can see what a sufficient answer looks like.

#	Rejection criterion	What it looks like	What to ask for instead
R1	Correction dressed up as corrective action	”The affected lot was quarantined and the record was completed.” That fixes the instance and nothing else	Ask what allowed the gap to occur, and what change prevents the next instance. The correction stays, but it does not close the finding
R2	Root cause that stops at human error	”Operator failed to record the second verification.” That is the event restated, not its cause	Ask why the step was missable. Was the record usable, was the sequence practical, was the check timed against a competing priority, was the workload survivable, was supervision present? Push until the answer describes the system
R3	Retraining as a standalone fix	”The operator was retrained and the SOP was re-issued.” Retraining is a frequently criticised response in inspection findings, precisely because on its own it changes nothing about the system that allowed the gap to happen	Accept retraining only as a supporting action alongside a change to the process, the record, the control or the supervision. Retraining alone never closes a major or a critical
R4	Root cause not supported by evidence	A cause asserted with no investigation record, no data, and no test of alternative explanations	Ask for the investigation: what was examined, what was ruled out, and on what evidence
R5	Corrective action does not address the stated root cause	Root cause names an equipment design issue; the action is a new checklist	Ask how the action removes or controls the cause that was named. Either the cause or the action is wrong
R6	Scope of the response is narrower than the scope of the finding	Finding covered three of eight change records; response addresses only the one we cited by name	Ask for the response to cover the population the finding described, and for a search of the same exposure elsewhere
R7	No impact assessment on material already supplied	The response fixes the future and is silent on the lots we already hold	Ask for a documented assessment of every lot supplied in the affected period, with a disposition
R8	Dates with no owner, or owners with no dates	”Ongoing”, “as soon as possible”, “QA”	Ask for a named person and a calendar date for each action
R9	No effectiveness check for a major or critical	Actions listed, closure proposed on completion	Ask for a defined metric, a review point far enough out to see enough events, and the evidence that will be examined
R10	Effectiveness check that cannot fail	”Confirm the SOP was revised.” That measures the action, not the outcome	Ask for a measure of the failure not recurring, taken over a defined number of events or a defined period

Rejecting a response is not a hostile act, and framing it well matters. Return it with the criterion named and one sentence of what would satisfy it. Suppliers who receive “not accepted” with no explanation resubmit the same content in different words, and two months disappear.

Part D. Effectiveness verification and closure

Closure rule. Minors may close on completion of the corrective action with evidence. Majors and criticals close only on verified effectiveness. Completion of an action is not evidence that the problem stopped.

Ref	Grade	Effectiveness check defined as	Metric or acceptance criterion	Events or period required	Effectiveness check due	Verification method	Verification evidence reviewed	Verified by	Verification date	Outcome	Closure date
`<<FILL: 001>>`	`<<FILL>>`	`<<FILL: what will be measured>>`	`<<FILL: what result is acceptable>>`	`<<FILL: e.g. next 10 batches, or 6 months>>`	`<<FILL: date>>`	`<<FILL: see table below>>`	`<<FILL: the actual documents or data examined>>`	`<<FILL: name>>`	`<<FILL>>`	`<<FILL: Effective / Not effective, reopened>>`	`<<FILL>>`

Verification methods, in ascending order of strength

Method	When it is enough	Limitation
Supplier self-declaration	Minor findings only, where the risk is documentation-level	Proves nothing about the outcome; the weakest form and never sufficient for a major
Document review of the completed action	Minor findings, or as the first step for a major	Shows the action was done, not that it worked
Data review over a defined period, sent by the supplier	Majors where the failure produces a measurable signal, such as deviation rate, excursion count, or reconciliation results	Depends on the supplier’s own data being trustworthy, which the audit may have questioned
Verification against our own data	Strong where the failure shows up in what we receive, such as incoming test results or CoA discrepancies	Only works for failures that reach us
Focused remote review with live records or screen share	Majors, and criticals where travel is not immediately possible	Cannot see the floor
On-site verification, at the next audit or a dedicated visit	Criticals, and any major where the failure was on the floor rather than on paper	Cost and schedule

Choose the method by what the failure was. A finding about a record that was completed at end of shift cannot be verified by reading a revised SOP; it is verified by reading the records made since the change.

If the effectiveness check fails: reopen the finding, record the reason, require a new root cause rather than a new action on the old cause, and reassess the supplier’s status. A failed effectiveness check on a major is itself information about the supplier’s quality system.

Part E. Consequence for supplier status and audit interval

Closing findings changes nothing if the supplier’s standing never moves. Complete this section for every audit, including audits with no findings.

Field	Entry
Audit reference	`<<FILL>>`
Findings raised	`<<FILL: critical / major / minor counts>>`
Findings closed	`<<FILL: count and date all closed>>`
Findings open at status review	`<<FILL: refs, grades, and current step>>`
Supplier status before the audit	`<<FILL>>`
Supplier status after closure	`<<FILL: Approved / Conditionally approved / Suspended / Disapproved>>`
Conditions attached, if any	`<<FILL: e.g. increased incoming testing until effectiveness verified>>`
Audit interval before	`<<FILL>>`
Audit interval after	`<<FILL>>`
Basis for the interval change	`<<FILL: what in the findings or the response drove it>>`
Additional controls applied on our side, and when they lift	`<<FILL: e.g. 100 percent incoming CCI testing until ref 001 effectiveness verified, then reverts to skip-lot>>`
Approved-vendor list updated (date and by whom)	`<<FILL>>`
Decision record	`<<FILL: review board or QA decision reference>>`
Next audit scheduled	`<<FILL: date and type>>`

Interval logic, as a default to adapt:

Outcome	Typical effect on interval
No findings, or minors only, closed on time	Interval maintained or extended within the risk tier
Majors closed with verified effectiveness	Interval maintained, next audit scoped to include the closed findings
Majors with slow or rejected responses	Interval shortened, follow-up scoped to the same areas
Critical finding	Interval shortened, on-site verification required, supplier status conditional or suspended until effectiveness is verified
Effectiveness check failed	Interval shortened and status reassessed; do not simply reissue the same corrective action

Part F. Register health metrics

Reviewed at <<FILL: forum and frequency>>. These measure your follow-up, not the supplier.

Metric	Definition	Target	Current
Responses received by due date	Count on time divided by count due	`<<FILL>>`	`<<FILL>>`
Responses rejected at first review	Count rejected divided by count received	`<<FILL: a very low number can mean weak review, not strong suppliers>>`	`<<FILL>>`
Findings closed on effectiveness rather than completion, majors and criticals	Count verified divided by count closed	100 percent	`<<FILL>>`
Findings open beyond `<<FILL: days>>`	Count	`<<FILL>>`	`<<FILL>>`
Audits where supplier status or interval changed as a result	Count divided by audits with majors or criticals	`<<FILL>>`	`<<FILL>>`
Effectiveness checks that failed	Count	Tracked, not targeted	`<<FILL>>`

The second metric is the one people misread. A programme that accepts every response first time is usually not reviewing them.

Filled specimen

A completed extract for two findings from an illustrative audit of a contract sterile fill-finish supplier. Company, records, people and dates are invented for teaching purposes.

Part A

Ref	Audit ref	Supplier	Finding	Grade	Summary	Report issued	Response due	Response received	Reviewer	Outcome	Review date
001	SUP-AUD-2026-018	Northvale Sterile Services, Cork	01	Major	Crimp cap supplier changed under a like-for-like route with no requalification and no customer notification	26 May 2026	16 Jun 2026	15 Jun 2026	K. Ferreira	Rejected, then accepted on resubmission	19 Jun 2026
002	SUP-AUD-2026-018	Northvale Sterile Services, Cork	03	Minor	Two of fourteen crimp force verification entries completed at end of shift rather than at the time of check	26 May 2026	25 Jun 2026	23 Jun 2026	K. Ferreira	Accepted	26 Jun 2026

Part B, ref 001, first submission

Element	Supplier’s first response
Correction	Vendor B crimp caps quarantined. Reverted to Vendor A stock for current production.
Root cause	”Change control coordinator incorrectly classified the change as like-for-like.”
Corrective action	”Coordinator retrained on SOP-QA-018. SOP-QA-018 re-issued to all change control staff.”
Preventive action	Not stated.
Effectiveness check	Not stated.

Part C, ref 001, review

Rejected on 19 June 2026, citing criteria R2, R3, R6, R7 and R9. Returned with the following, verbatim from the reviewer’s letter:

The correction is accepted and should remain in place. The response is not accepted for closure, for five reasons. (R2) “Coordinator incorrectly classified the change” restates the event. We asked why the classification was possible: does the change control form present the exclusion in SOP-QA-018 section 6.4 at the point of classification, does a second person check the classification, and is there any system control that stops a primary container closure component change from taking the like-for-like route? (R3) Retraining and re-issue do not change any of those things, and cannot close a major on their own. (R6) The finding covered two of three like-for-like changes reviewed, including CC-25-121 on stopper grade. The response addresses only CC-25-088. (R7) Four lots we received failed container closure integrity testing after implementation and three further lots remain in our quarantine. We require a documented impact assessment for every lot filled with Vendor B caps. (R9) A major requires an effectiveness check with a metric and a review point. A sufficient response would tell us what will be measured, over how many changes, and what result would show the classification failure has not recurred.

Part B, ref 001, revised submission received 08 July 2026

Element	Supplier’s revised response
Correction	As before, plus all Vendor B caps in stock segregated pending requalification.
Root cause	The change control form allows the initiator to select a classification route with no reference to the SOP-QA-018 exclusion list, and no second-person or quality approval of the classification is required before the route is set. Investigation reviewed all 34 changes in the period; of 11 initiated by three different coordinators using the like-for-like route, 3 involved product-contact or container closure components, showing the exposure is not specific to one person.
Corrective action	The exclusion list from SOP-QA-018 section 6.4 embedded as a mandatory question set in the change control form, with the like-for-like route locked out when any exclusion is answered yes. Quality unit approval of the classification made mandatory before route selection is final. Both live from 30 July 2026.
Preventive action	All 34 changes in the period re-reviewed; the 3 misrouted changes reopened under the correct route. Retrospective requalification of crimp force settings for the Vendor B component completed, report QUAL-26-019.
Impact assessment	All 14 lots filled with Vendor B caps assessed, report IMP-26-008. Four lots rejected at our incoming testing, three in our quarantine released after CCI testing on an increased sampling plan, seven lots supplied to other customers assessed as conforming on retained sample CCI testing.
Owner and dates	J. Halloran, Head of Quality Systems. Corrective actions complete 30 July 2026. Preventive actions complete 24 July 2026.
Effectiveness check	Review of the first 20 changes classified after 30 July 2026: acceptance criterion is zero changes involving a product-contact or container closure component routed as like-for-like, and 100 percent of classifications carrying quality unit approval. Review due once 20 changes have accumulated, expected by 31 October 2026.

Accepted 14 July 2026.

Part D

Ref	Grade	Effectiveness check	Criterion	Due	Method	Evidence reviewed	Verified by	Date	Outcome	Closed
001	Major	First 20 changes classified after 30 Jul 2026	Zero misrouted product-contact changes; 100 percent with quality approval	31 Oct 2026	Focused remote review, live in the supplier’s change system with screen share, plus our own incoming CCI data	Change log 30 Jul to 22 Oct 2026 (23 changes), 6 selected at random by us and opened live; our incoming CCI results for 9 lots received since August, all conforming	K. Ferreira	28 Oct 2026	Effective	28 Oct 2026
002	Minor	Not required for a minor	Completion evidence only	n/a	Document review	Revised logbook FL02-CF-11 pages for 10 shifts after the change, showing time-of-check entry; revised SOP-PRD-044 rev 4	K. Ferreira	26 Jun 2026	Complete	26 Jun 2026

Part E

Field	Entry
Findings raised	0 critical, 2 major, 3 minor
Findings closed	5, all closed by 28 October 2026
Status before	Conditionally approved
Status after closure	Approved, with condition C4 retained (advance notification of any FL-02 change)
Interval before	24 months
Interval after	18 months, next audit on-site and scoped to include change control and container closure integrity
Additional controls on our side	100 percent incoming CCI testing from 26 May 2026, reverted to the standard sampling plan on 28 October 2026 when the effectiveness check verified
Approved-vendor list updated	30 October 2026, by R. Whelan, Supplier Quality
Decision record	SQRB-2026-031
Next audit scheduled	November 2027, on-site

The whole value of this register sits in one place: the rejection on 19 June. The first response would have closed the finding on paper. The coordinator was retrained, the SOP was re-issued, and a file note would have said “closed”. What actually changed the risk was the second response, where the form itself was made incapable of routing a container closure change the wrong way, and where the supplier went and found the other two changes that had already gone wrong. Nothing in the first submission would have stopped this from happening again next quarter with a different coordinator.

Note also that the effectiveness check took four months to become verifiable, because 20 changes had to accumulate before the measure meant anything. That is normal, and it is why the interval control on our side stayed on until 28 October rather than lifting when the actions completed on 30 July.

Common inspection findings this log prevents

Audit reports on file with no evidence that the supplier ever responded.
Findings closed on completion of the action, with no check that the problem stopped recurring.
Retraining and SOP re-issue accepted as the corrective action for a major, a frequently criticised response in inspection findings because it leaves the underlying system exactly as it was.
Root causes recorded as human error with no systemic investigation behind them.
Supplier responses accepted that address only the specific record cited, leaving the population the finding described untouched.
No assessment of material already supplied during the affected period, so lots in your own stock were never evaluated.
Corrective actions with no named owner or no calendar date, tracked as “ongoing” indefinitely.
Findings open past their due date with no escalation and no visible ageing.
Audit outcomes that never changed the supplier’s approved status, audit interval, or incoming control, so the audit programme has no consequence.
Effectiveness checks that measure whether the action was completed rather than whether the failure recurred.
An effectiveness check that failed and was quietly closed with a second action on the same unproven root cause.

How to adapt this log

Set the response and completion timelines in Part A to the commitments in your own procedure and quality agreements, and make sure the quality agreement actually obliges the supplier to those timelines.
Keep the four-part split in Part B even if your supplier submits a single narrative. Filling the four cells separately is what exposes a response that contains only a correction.
Adjust the rejection criteria in Part C to your own language, but keep R1, R2, R3, R7 and R9. Those five carry most of the weight.
Set the closure rule in Part D to your risk appetite, and keep effectiveness verification mandatory for majors and criticals. If you allow a documented exception, require it to be approved by the quality unit and recorded in the row.
Choose verification methods by failure type, not by convenience. A floor-based failure verified only by reading a revised procedure is not verified.
Make Part E mandatory before an audit can be marked closed. If your system can close an audit without a status decision, the feedback loop into the approved-vendor list will quietly stop working.
If you run this in a spreadsheet or a quality system rather than on paper, keep the ageing and the overdue view visible by default. A register nobody looks at between audits is a filing cabinet.
Feed the outcome into SOP: Supplier and Vendor Qualification for the status and interval decision, take the findings from Report: On-Site GMP Supplier Audit, and use Template: CAPA Effectiveness Check to design a check that can actually fail. The method behind this register is described in how to conduct a supplier or GMP audit.