This is a ready-to-use audit plan and supplier notification package for an on-site GMP audit of a materials, API, excipient, contract manufacturing, contract testing, or contract service supplier. Replace every <<FILL: ...>> placeholder with your own specifics, set your document numbers and dates, and route it through your normal document control, review, and approval. A worked filled specimen follows the template. Verify each cited regulation against the current published source before you rely on it. This template is an educational reference for you to adapt to your own quality system, products, and regulatory context; it is not legal, regulatory, or professional advice.
Document control header
| Field | Entry |
|---|---|
| Document title | On-Site GMP Supplier Audit Plan |
| Audit reference number | <<FILL: audit ID, e.g. SUP-AUD-2026-018>> |
| Version | <<FILL: version, e.g. 1.0>> |
| Issue date | <<FILL: date>> |
| Prepared by | <<FILL: lead auditor name and role>> |
| Approved by | <<FILL: QA approver name and role>> |
| Governing procedure | <<FILL: SOP-ID for supplier qualification and audit>> |
| Confidentiality | <<FILL: e.g. Confidential, issued under CDA dated ...>> |
1. Supplier and site identification
Identify the legal entity and the physical site. Audits are of sites, not of companies. A supplier with three plants can be excellent at one and unqualified at another.
| Field | Entry |
|---|---|
| Supplier legal name | <<FILL: legal entity name>> |
| Site address to be audited | <<FILL: full street address, city, country>> |
| Site registration or licence numbers | <<FILL: FDA establishment identifier, EU manufacturing authorisation, local licence, or "not applicable">> |
| Corporate parent and other sites in scope of supply | <<FILL: parent, and any sister sites that touch this supply chain>> |
| Materials or services supplied to us | <<FILL: item names, item codes, grades>> |
| Activities actually performed at this site | <<FILL: e.g. API final step and purification, micronisation, release testing, secondary packaging>> |
| Activities NOT performed here (performed elsewhere or subcontracted) | <<FILL: e.g. starting material synthesis at a second site; sterility testing subcontracted>> |
| Our internal supplier ID and current status | <<FILL: vendor number, current approved / conditional / new>> |
| Quality agreement in force | <<FILL: QAG number and effective date, or "none, to be executed">> |
| Last audit of this site | <<FILL: date, type, outcome, open findings>> |
The “activities actually performed here” row does more work than it looks. If the supplier’s own site master file says a step happens here but the flow diagram shows it going out to a third party, you have found your first line of inquiry before you have left home.
2. Audit type
Tick one. The type sets the depth, the announcement notice, and how you will behave if the supplier tries to redirect you.
| Type | Select | Trigger for this audit | Behaviour it implies |
|---|---|---|---|
| Qualification (initial) | <<FILL: X or blank>> | New supplier or new material from an existing supplier, before approval | Full quality system plus the specific process; the result gates approval |
| Periodic (re-qualification) | <<FILL>> | Risk-based interval reached | Focus on changes since last audit, prior findings, current performance data |
| For-cause | <<FILL>> | Quality event, complaint trend, recall, OOS pattern, regulatory action at the supplier | Tight scope on the failure mode; resist a general system tour |
| Pre-approval / readiness | <<FILL>> | Ahead of a regulatory filing or technology transfer | Scoped to the process and data package that will be filed |
| Remote / documentary | <<FILL>> | Travel constraint or low-risk supplier | Records and interviews only; state in the report that no floor walk occurred |
Selected type: <<FILL: type>>. Trigger and justification: <<FILL: two sentences, e.g. "Three receipt OOS results in twelve months on item X" or "Interval reached under risk tier 1">>.
Announcement: <<FILL: announced with N weeks notice / short notice of N days / unannounced under quality agreement clause N>>.
3. Scope and objective
Write this as one paragraph a stranger can read. Vague scope produces a shallow walk-through.
Objective: <<FILL: one sentence, e.g. "Determine whether the site can reliably supply sterile-filtered drug substance intermediate meeting our specification, to support initial qualification for commercial supply.">>
In scope: <<FILL: name the process areas, systems, and record types, e.g. "Quality system and management responsibility; the manufacturing suite and equipment used for our item; materials management and warehousing including cold storage; QC chemistry and microbiology including the chromatography data system and its audit trails; deviation, OOS, complaint, change control and CAPA systems for the period <<FILL: from>> to <<FILL: to>>; the supplier's control of its own subcontractors for <<FILL: outsourced step>>.">>
Explicitly out of scope: <<FILL: e.g. "Products and lines not associated with our material; the site's environmental and occupational safety programs; financial and commercial terms; the supplier's second site at <<FILL: location>>, which will be covered separately under audit <<FILL: ID>>.">> Anything excluded here must be stated the same way in the report, so nobody later reads the report as broader assurance than it is.
Period covered by record review: <<FILL: from date>> to <<FILL: to date>>.
4. Audit standard and criteria
The standard is the ruler. A finding measured against nothing is an opinion. List only criteria that genuinely apply to what this site does, and confirm the current version of each before issue.
| Criterion | Citation | Why it applies here |
|---|---|---|
| US cGMP for finished pharmaceuticals, testing and approval or rejection of components, drug product containers, and closures | 21 CFR 211.84 | Governs our obligation to examine and test incoming materials from this supplier |
| US cGMP general framework | 21 CFR Parts 210 and 211 | We remain accountable for material quality regardless of origin |
| ICH Q7 (2000), Good Manufacturing Practice Guide for Active Pharmaceutical Ingredients | Section 7 covers materials management and evaluation of suppliers; the guide as a whole applies to API manufacture | <<FILL: applicable where the site manufactures or handles API or intermediates>> |
| ICH Q10 (2008), Pharmaceutical Quality System | Elements addressing management of outsourced activities and purchased materials | Supports our duty to verify supplier capability before use and monitor it over the lifecycle |
| EudraLex Volume 4, Chapter 5 (Production) and Chapter 7 (Outsourced Activities) | EU GMP Part I | <<FILL: applicable where material or service supports an EU-supplied product>> |
| Quality agreement | <<FILL: QAG number, effective date, clauses in scope>> | Defines the responsibilities we will test against |
| Supplier’s own procedures | Named per finding during fieldwork | A finding that cites the supplier’s own SOP removes the “your bar was unfair” argument |
| Compendial or product-specific requirements | <<FILL: e.g. relevant monograph, our specification number and version>> | Defines the acceptance criteria for the supplied item |
| Finding classification reference | PIC/S PI 040-1, Guidance on Classification of GMP Deficiencies (in force 1 January 2019) | The three-grade GMP scheme we apply; described in our own wording in the classification procedure |
| Generic audit management practice | ISO 19011:2026, guidelines for auditing management systems (published May 2026, superseding ISO 19011:2018; confirm the edition in force with ISO before citing it in an issued document, as this template does not track later revisions) | Referenced for audit programme practice only, and never reproduced here. Note that it works in conformity and nonconformity terms and leaves the grading convention to the auditing organisation, so it does not supply the critical, major and minor GMP grades; grading in this audit follows the GMP scheme, not ISO 19011 |
Combination products note, include only if relevant: where the supplier provides a device constituent or performs a device-constituent operation, purchasing controls sit under the FDA Quality Management System Regulation (21 CFR Part 820), effective 2 February 2026, which incorporates ISO 13485:2016 by reference so purchasing requirements run through clause 7.4; the legacy 21 CFR 820.50 section is reserved. Keep this to a single line in the criteria table unless the audit is genuinely device-constituent focused.
5. Audit team, roles, and independence
| Name | Organisation and role | Audit role | Areas owned during this audit | Qualification record |
|---|---|---|---|---|
<<FILL>> | <<FILL: e.g. Quality Assurance>> | Lead auditor | Quality system, findings classification, report | <<FILL: auditor qualification record ID>> |
<<FILL>> | <<FILL>> | Co-auditor | <<FILL: e.g. production and materials management>> | <<FILL>> |
<<FILL>> | <<FILL>> | Technical SME | <<FILL: e.g. QC laboratory and data integrity>> | <<FILL>> |
<<FILL>> | <<FILL>> | Auditor in training (observer) | Observes only, does not lead lines of questioning unsupervised | <<FILL: training record ID>> |
Independence statement. Each team member confirms in writing, on the auditor qualification and independence record, that they hold no interest that could bias the outcome of this audit. Specifically: no member owns the commercial relationship with this supplier, negotiated or holds signature authority over its contract or pricing, holds a personal or financial interest in the supplier, has been employed by the supplier within <<FILL: number>> years, or reports to a function whose objectives depend on this supplier remaining approved. A purchasing or supply chain representative may attend as an observer but does not author findings, does not grade them, and does not sign the report. Declarations are filed as <<FILL: record ID or file location>>.
Language and interpreting: <<FILL: audit language; if an interpreter is used, state who provides them and that the auditor may request an independent interpreter for record review>>.
6. Advance document request list
Send with the notification. Ask for these <<FILL: number, commonly 10 to 20>> working days before arrival. Where the supplier will not release a document off site, request that it be available in the audit room on day one and say so in writing, so an “unavailable” answer on the day is visible.
| # | Document requested | Why we want it | Received (date) |
|---|---|---|---|
| 1 | Site quality manual and current organisation chart with names | Establishes the quality unit’s independence and reporting line | <<FILL>> |
| 2 | Site master file or equivalent facility description | Confirms what is actually performed here | <<FILL>> |
| 3 | List of products and services, and the process flow for our item | Anchors the trace | <<FILL>> |
| 4 | Index of the SOPs governing the in-scope areas (titles, numbers, current versions, effective dates) | Lets us pick which SOPs to read, rather than being handed a selection | <<FILL>> |
| 5 | Regulatory inspection history for this site: dates, agencies, outcomes and status of commitments, to the extent shareable | Shows what regulators have already found | <<FILL>> |
| 6 | Prior third-party or customer audit reports and current status of open findings, to the extent shareable | Tests whether findings actually close | <<FILL>> |
| 7 | Deviation, OOS, complaint, change control and CAPA logs for <<FILL: period>>, filtered to our item or the in-scope process | The fastest route to how the system behaves under stress | <<FILL>> |
| 8 | Validation and qualification status summary: process validation, cleaning validation, computerised systems, critical equipment and utilities | Shows what is qualified and what is overdue | <<FILL>> |
| 9 | Training matrix and current training status for the in-scope areas | Tests whether the people doing critical steps are qualified | <<FILL>> |
| 10 | List of subcontracted or outsourced activities relevant to our supply, with the supplier’s approval status for each | Our supply chain does not stop at their gate | <<FILL>> |
| 11 | Copies of the last <<FILL: number>> certificates of analysis issued to us, with the supporting raw data references | Lets us trace backward from paper we already hold | <<FILL>> |
| 12 | Stability, trending or process capability summaries for our item | Detects drift the CoAs alone will not show | <<FILL>> |
| 13 | <<FILL: additional request specific to this audit>> | <<FILL>> | <<FILL>> |
Requested documents not provided by <<FILL: date>> will be recorded in the audit report as not made available, with the supplier’s stated reason.
7. Risk-based agenda
Allocate hours by risk, not by organisational chart. Rate each area by the impact a failure there would have on our product and patient, and by how much uncertainty we still carry about it, then spend the hours on high impact and high uncertainty.
| Area | Impact if it fails (H/M/L) | Our current uncertainty (H/M/L) | Hours allocated |
|---|---|---|---|
<<FILL: e.g. Sterile filtration and aseptic handling>> | <<FILL>> | <<FILL>> | <<FILL>> |
<<FILL: e.g. QC laboratory data integrity>> | <<FILL>> | <<FILL>> | <<FILL>> |
<<FILL: e.g. Warehousing and cold chain>> | <<FILL>> | <<FILL>> | <<FILL>> |
<<FILL: e.g. Change control>> | <<FILL>> | <<FILL>> | <<FILL>> |
Time allocation rule. At least 60 percent of on-site time is reserved for the floor and for records, not for presentations. Supplier slide decks are capped at the opening meeting plus any single technical briefing genuinely needed to understand a process. If the supplier returns a revised agenda that fills the day with presentations, the lead auditor restores the floor and record time before the audit proceeds. Record review happens with the auditor selecting the records.
Day 1
| Time | Activity | Who (auditor) | Supplier participants required | Location |
|---|---|---|---|---|
<<FILL: 08:30>> | Site safety induction and gowning | All | EHS | <<FILL>> |
<<FILL: 09:00>> | Opening meeting: introductions, scope, criteria, agenda, confidentiality and photography policy, how findings will be raised as we go, safety rules. Capped at 40 minutes | Lead | Site head, QA head, in-scope function heads | Audit room |
<<FILL: 09:40>> | Quality system overview and management responsibility: quality unit independence, management review outputs, quality metrics | Lead | QA head | Audit room |
<<FILL: 10:30>> | Floor walk 1: <<FILL: area, e.g. warehouse, dispensing, and the manufacturing suite for our item>>, following the material flow in process order | Lead + co-auditor | Production and warehouse supervisors | Floor |
<<FILL: 12:30>> | Break | |||
<<FILL: 13:15>> | Record review block 1: <<FILL: e.g. executed batch records for the auditor-selected lots>> | Co-auditor | Records coordinator, batch record owner | Audit room |
<<FILL: 15:00>> | QC laboratory walk and chromatography data system session: audit trail configuration, access roles, review-by-exception evidence, one live trace | SME | QC manager, system administrator, an analyst who runs the method | Laboratory |
<<FILL: 17:00>> | Team caucus: consolidate the evidence log, agree potential findings, plan day 2 based on what day 1 opened up | All | None | Audit room |
<<FILL: 17:30>> | Daily feedback to host: state the potential findings raised so far. No surprises | Lead | QA host | Audit room |
Day 2
| Time | Activity | Who (auditor) | Supplier participants required | Location |
|---|---|---|---|---|
<<FILL: 08:30>> | Deviations, OOS, complaints, recalls and CAPA: auditor-selected events from the supplied log | Lead | QA investigations owner | Audit room |
<<FILL: 10:30>> | Change control and validation status: sample changes affecting our item, and the qualification status of the equipment and systems seen on day 1 | Co-auditor | Change control owner, validation lead | Audit room |
<<FILL: 12:00>> | Break | |||
<<FILL: 12:45>> | Training and personnel: qualification of the specific operators and analysts observed on day 1 | SME | Training coordinator | Audit room |
<<FILL: 14:00>> | Outsourced activities and the supplier’s own supplier controls | Lead | QA supplier management | Audit room |
<<FILL: 15:00>> | Open block, deliberately unallocated, for threads opened on day 1 and any re-verification on the floor | All | On call | As needed |
<<FILL: 16:00>> | Team caucus: finalise findings, draft grades, draft conclusion | All | None | Audit room |
<<FILL: 16:45>> | Closing meeting: restate scope and criteria, present findings by grade worst first, hear the supplier’s response, state the preliminary conclusion and the CAPA timeline | Lead | Site head, QA head, function heads | Audit room |
Keep the open block. An agenda with no slack forces the team to abandon the most interesting thread of the audit in order to stay on schedule.
8. Pre-read list
Reviewed by the team before travel, with the reviewer named so nobody assumes somebody else read it.
| Item | Reviewer | Reviewed (date) | Focus questions it generated |
|---|---|---|---|
| Site quality manual and organisation chart | <<FILL>> | <<FILL>> | <<FILL>> |
| Site master file or facility description | <<FILL>> | <<FILL>> | <<FILL>> |
| Process flow for our item | <<FILL>> | <<FILL>> | <<FILL>> |
| Supplier regulatory history | <<FILL>> | <<FILL>> | <<FILL>> |
| Prior audit reports and open finding status | <<FILL>> | <<FILL>> | <<FILL>> |
| Our own performance data on this supplier: receipt OOS, CoA discrepancies, complaints, deviations attributable to their material, on-time-in-full, rejected lots | <<FILL>> | <<FILL>> | <<FILL>> |
| Current quality agreement and any open issues raised under it | <<FILL>> | <<FILL>> | <<FILL>> |
| Supplier’s completed quality questionnaire | <<FILL>> | <<FILL>> | <<FILL>> |
Focus questions carried into fieldwork:
<<FILL: question tied to a specific pre-read observation>><<FILL>><<FILL>>
9. Records and events the team intends to trace
Name three to five before you arrive. These are auditor-chosen, drawn from the pre-read and from our own performance data, not from anything the supplier offers on the day. Naming them in the plan means the supplier cannot claim later that the request was out of scope, and it means the team cannot quietly drop the hard one.
| # | Record or event to trace | Why this one | Trace direction | Owner |
|---|---|---|---|---|
| 1 | <<FILL: e.g. Lot 24-0417, which failed our incoming identity test on 03 Feb 2026>> | <<FILL: known problem in our own data>> | Backward from our receipt result to their raw data and release decision | <<FILL: auditor>> |
| 2 | <<FILL: e.g. Deviation DEV-25-118 referenced on the CoA for lot 24-0602>> | <<FILL: supplier disclosed it, we have never seen the investigation>> | Forward from the event to the impact assessment and the disposition of affected lots | <<FILL>> |
| 3 | <<FILL: e.g. Most recently released lot at the time of the audit, identified on the day>> | Tests the current state, not the historical one | Forward from dispensing to release | <<FILL>> |
| 4 | <<FILL: e.g. The chromatographic result supporting assay on lot 24-0417, down to the raw data file and instrument audit trail>> | Data integrity test of the paper we rely on | Backward from the certificate of analysis to raw data | <<FILL>> |
| 5 | <<FILL: e.g. Change control CC-25-044, a change to the drying step notified to us in Aug 2025>> | Tests whether change notification obligations under the quality agreement were met | Forward from change request to validation and to customer notification | <<FILL>> |
At least one trace must be completed end to end, forward or backward, through the most critical process in scope. A trace abandoned halfway is reported as such.
10. Logistics and site rules
| Item | Agreed arrangement |
|---|---|
| Audit room, table, network access, printing or screen share | <<FILL>> |
Records coordinator who can retrieve documents within <<FILL: minutes>> | <<FILL: name>> |
| Photography and copying policy | <<FILL: e.g. photography prohibited; evidence captured as transcribed record IDs and entries; supplier to provide copies of named records>> |
| Access to electronic systems for viewing (read-only account or over-the-shoulder with the system owner) | <<FILL>> |
| Escort arrangements and floor access limits | <<FILL>> |
| Confidentiality agreement in force | <<FILL: CDA reference and date>> |
| Safety induction, gowning, and any restricted areas | <<FILL>> |
| Interpreter, if required | <<FILL>> |
Friction in record retrieval is the single largest time sink on an audit. Agreeing a named coordinator and a retrieval expectation in the plan is what stops “that person is in a meeting” from consuming an afternoon.
11. Acceptance criteria for this plan
The plan is fit to issue when all of the following are true. Check them before the notification goes out, not after the audit.
| # | Criterion | Met (Y/N) |
|---|---|---|
| 1 | Scope and objective are one paragraph, unambiguous, and state what is explicitly out of scope | <<FILL>> |
| 2 | The audit standard is named with citations, and every criterion listed genuinely applies to the activities performed at this site | <<FILL>> |
| 3 | At least 60 percent of on-site time is reserved for the floor and records rather than presentations | <<FILL>> |
| 4 | The team includes the technical SME the scope demands, and every member has a current qualification record | <<FILL>> |
| 5 | Every team member has signed the independence declaration, and no member owns the commercial relationship | <<FILL>> |
| 6 | Three to five specific records or events to trace are named, chosen by the audit team from the pre-read and our own performance data | <<FILL>> |
| 7 | The advance document request was issued at least <<FILL: number>> working days ahead and its receipt is tracked | <<FILL>> |
| 8 | The pre-read has a named reviewer per item and has produced written focus questions | <<FILL>> |
| 9 | The agenda contains an unallocated open block on the final day | <<FILL>> |
| 10 | The audit type is stated with its trigger, and the depth matches that type | <<FILL>> |
12. Distribution and approval
| Recipient | Organisation | Purpose |
|---|---|---|
<<FILL: supplier QA contact>> | Supplier | Notification and preparation |
<<FILL: audit team>> | Us | Execution |
<<FILL: material owner or technical lead>> | Us | Awareness of scope |
<<FILL: QA management>> | Us | Approval and oversight |
| Role | Name | Signature | Date |
|---|---|---|---|
| Lead auditor (author) | <<FILL>> | ||
| QA approver | <<FILL>> |
Filled specimen
A completed extract for an illustrative contract sterile fill-finish supplier. The company, site, numbers and dates are invented for teaching purposes; replace them with your own.
Header: Audit reference SUP-AUD-2026-018, version 1.0, issued 12 May 2026 by K. Ferreira, Lead Auditor, Supplier Quality. Approved by D. Osei, Associate Director QA. Governing procedure SOP-QA-041.
Supplier and site: Northvale Sterile Services Ltd, Unit 4 Kilmore Industrial Park, Cork, Ireland. Activities performed at this site: aseptic fill-finish of our drug product into 2 mL vials, terminal visual inspection, secondary packaging, and QC release testing for appearance, container closure integrity and sterility. Not performed here: drug substance manufacture (our own site), and endotoxin testing, which Northvale subcontracts to Brackenfield Analytical Ltd. Current status: conditionally approved since the 2024 qualification audit. Quality agreement QAG-2024-031, effective 06 September 2024. Last audit 18 to 19 September 2024, qualification type, two majors and four minors, all closed.
Audit type: For-cause, combined with the scheduled periodic re-qualification. Trigger: four container closure integrity failures at our incoming inspection between November 2025 and March 2026, all on lots filled on line FL-02, and one customer complaint of a loose crimp. Announced, three weeks notice, with a written statement that line FL-02 must be available for observation during a live fill.
Objective: Determine whether Northvale’s aseptic fill and container closure control on line FL-02 is capable of consistently delivering integral sealed vials, and whether the quality system detected and acted on the crimp failures, to support a decision on continued approval.
In scope: Quality system and management responsibility; line FL-02 including capping and crimping, the crimp force control, and the associated environmental monitoring; container closure integrity testing in QC including the method, the instrument, and its data; deviations, OOS, complaints and CAPA relating to seal integrity from 01 October 2025 to 30 April 2026; change control on line FL-02 over the same period; training of the FL-02 capping operators; the control of Brackenfield Analytical as a subcontractor.
Explicitly out of scope: Lines FL-01 and FL-03; products other than ours; lyophilisation, which we do not use; site EHS programs; commercial terms.
Criteria: 21 CFR 211.84 for our incoming obligations; 21 CFR Parts 210 and 211; EudraLex Volume 4 Chapter 5 and Chapter 7; ICH Q10 for outsourced activity management; quality agreement QAG-2024-031 clauses 5 (change notification), 8 (deviations affecting our product) and 11 (subcontracting); our specification SPEC-DP-0072 rev 3; Northvale’s own SOPs, cited per finding; PIC/S PI 040 for grading.
Team: K. Ferreira, Lead (auditor qualification record AQ-0031). M. Lindqvist, co-auditor, sterile operations (AQ-0047). P. Raghavan, technical SME, container closure integrity and analytical data (AQ-0052). All three signed independence declarations on 12 May 2026, filed as AQ-IND-2026-018. R. Byrne, Supply Chain, initially proposed for the team, was excluded because he negotiated the 2025 supply contract extension; he did not attend.
Records to trace, chosen before travel:
| # | Record | Why | Direction |
|---|---|---|---|
| 1 | Lot NS-25-1142, one of the four CCI failures at our receipt on 08 January 2026 | Known failure in our own data | Backward from our result to their batch record, crimp force data, EM, and release decision |
| 2 | Northvale deviation DEV-25-206, referenced on the CoA for lot NS-25-1142 | Disclosed but never shared with us | Forward from the event to impact assessment and lot disposition |
| 3 | The live fill on FL-02 observed during the audit, plus its executed record the following morning | Tests current state | Forward, real time |
| 4 | The CCI result supporting release of lot NS-26-0031, down to instrument raw data and audit trail | Data integrity test on the paper we rely on | Backward from CoA |
| 5 | Change control CC-25-088, a change of crimp tooling supplier in October 2025 | Sits exactly on the failure timeline, and we were never notified | Forward from request to validation to customer notification |
Time allocation: 16 on-site hours total. Presentations capped at 40 minutes (opening) plus a 30-minute FL-02 process briefing, 70 minutes in all, which is 7.3 percent of the 960 available minutes. Floor and record time 11.5 hours, 72 percent. Acceptance criterion 3 met.
Item 5 is the one that mattered. A crimp tooling change in October 2025, followed by seal failures from November 2025, with no change notification to us despite quality agreement clause 5, was visible in the pre-read before anyone got on a plane. That is what planning buys.
Common inspection findings this plan prevents
- Supplier audits performed with no written plan, so scope, criteria and team qualification cannot be reconstructed afterwards.
- An audit report whose conclusion covers activities the audit never actually examined, because scope exclusions were never written down.
- Findings that cite no requirement, because the audit criteria were never defined before fieldwork.
- Audits led by a person who owns the commercial relationship with the supplier, with no independence declaration on file.
- A for-cause audit that drifted into a general system tour and never examined the failure that triggered it.
- Agendas dominated by supplier presentations, with the report unable to show that any floor observation or record review took place.
- Records examined were only those the supplier offered, with no evidence of auditor-selected sampling.
- Re-audit of a site with prior findings where the plan shows no follow-up on whether those findings actually stayed closed.
- No pre-read of the company’s own performance data, so an audit was conducted while three receipt failures sat unexamined in the requester’s own system.
How to adapt this plan
- Set the audit reference, governing procedure and approver in the header, and match the confidentiality wording to your CDA.
- Rewrite section 1 to name the exact activities performed at the site. If you cannot fill the “not performed here” row, you are not ready to issue the plan.
- Trim the criteria table in section 4 to what genuinely applies. An excipient supplier audit does not need every ICH Q7 reference; a contract testing lab audit needs your specification and method transfer records more than it needs Chapter 5.
- Reset the agenda to your real duration. For a one-day audit, keep the opening cap, the floor block, one record block, the caucus and the closing, and drop the rest; for a three-day audit, add a second open block rather than a third day of scheduled sessions.
- Replace the trace list in section 9 with records drawn from your own incoming, complaint and deviation data. If you have no such data because the supplier is new, use their most recent lot, their most recent deviation, and their most recent change.
- Adjust the independence rule in section 5 to your organisation’s structure, and keep the purchasing-relationship exclusion explicit.
- Confirm every citation in section 4 against the current published version before issue, and delete the combination-product line if no device constituent is involved.
- Feed the outcome into your supplier qualification decision and approved-vendor status per SOP: Supplier and Vendor Qualification, and grade any findings using SOP: GxP Audit Finding Classification and Grading. The fieldwork method behind this plan is described in how to conduct a supplier or GMP audit.