Report: On-Site GMP Supplier Audit

This is a ready-to-use audit report for an on-site GMP audit of a materials, API, excipient, contract manufacturing, contract testing, or contract service supplier. Replace every <<FILL: ...>> placeholder with your own specifics, set your document numbers and dates, and route it through your normal document control, review, and approval. A worked filled specimen follows the template. Verify each cited regulation against the current published source before you rely on it. This template is an educational reference for you to adapt to your own quality system, products, and regulatory context; it is not legal, regulatory, or professional advice. The report is the deliverable that outlives the visit. It is read by people who were not there: your own management deciding whether to use the supplier, an inspector examining how well you oversee your supply chain, and the supplier’s team building the corrective actions. Write it so a stranger can state the risks and the basis for your recommendation without asking you a question.

1. Administrative header

2. Scope and objective

Objective: <<FILL: one sentence stating what this audit set out to determine and for what decision>>

In scope: <<FILL: the process areas, systems, record types and period actually examined>>

Explicitly out of scope: <<FILL: what was not examined and why>>

Period covered by record review: <<FILL: from>> to <<FILL: to>>

Changes from the approved plan: <<FILL: none, or state what changed and why, e.g. "The microbiology laboratory session was shortened by 90 minutes because the QC micro manager was unavailable; the area was covered by record review only.">>

State scope exclusions plainly. A report that reads as broad assurance when the audit examined one line and one product is the kind of document that damages you later.

3. Audit standard and criteria

The audit was conducted against the following. Confirm the current version of each before relying on this report.

4. Audit team and supplier attendees

Audit team

Independence: each team member declared no conflict of interest in the outcome of this audit; declarations are filed as <<FILL: record reference>>. <<FILL: state any person excluded from the team and why, e.g. a commercial owner of the relationship>>

Supplier attendees

Requested attendees not available: <<FILL: none, or name the role, the sessions affected, and the supplier's stated reason. This matters; record it.>>

5. Areas and processes covered

Show depth. A reader must be able to tell the difference between a walk-through and an audit. Name the rooms, the lines, the systems, the record types and the specific records examined.

Traces completed

Sampling basis: <<FILL: state how records were chosen, e.g. "All records examined were selected by the audit team from the supplier's event logs and from our own receipt data. No record examined was pre-selected by the supplier." If any record was supplier-offered, say so.>>

Access or evidence limitations: <<FILL: none, or state each one, e.g. photography prohibited so entries were transcribed; a record was not produced within the audit; a system could only be viewed over the shoulder of an administrator.>>

6. Summary of findings

Grades follow the three-tier GMP scheme described in <<FILL: your classification SOP-ID>>: critical where product could put a patient at risk or where data appear falsified or manipulated; major where product could fall short of specification, or a serious GMP departure stands alone, or several related minors show a system out of control; minor for other departures from GMP.

No new findings appear in this report that were not raised at the closing meeting. <<FILL: confirm, or if a finding was added after the visit, state why and confirm it was communicated to the supplier before issue.>>

7. Detailed findings

Finding entry sub-template

Copy this block once per finding. Keep the objective observation and the grade separate, so the supplier can dispute your judgment without disputing the fact. The report states the gap; the fix belongs to the supplier.

Finding <<FILL: number>> - <<FILL: Critical / Major / Minor>>

Area: <<FILL: system area, e.g. QC laboratory, data integrity>>

Observation: <<FILL: what was observed, in the past tense, with the record identifiers, versions, dates, lot or instrument IDs, and the count affected out of the number examined. No adjectives, no inference. A reader who was not present must be able to locate the same evidence.>>

Requirement: <<FILL: the external requirement, cited to part and section, AND the supplier's own procedure by number, revision and step. Both.>>

Risk and impact: <<FILL: what could reach the patient or the product because of this gap, in plain language a non-specialist can follow. Say whether product already supplied to us is potentially affected.>>

Grade rationale: <<FILL: why this grade and not the one above or below, in terms of patient impact, specification impact, and systemic reach.>>

Spread: <<FILL: isolated / repeated / systemic, with the numbers that support it, e.g. "3 of 3 excursions reviewed">>

Supplier response at closing: <<FILL: accepted / disputed, with their stated position recorded factually>>

Rules that keep detailed findings defensible:

1. Every finding names at least one specific record, with its identifier and date.
2. Every finding cites an external requirement and the supplier’s own procedure.
3. Risk is written for a reader who is not a specialist in that area.
4. The count examined appears alongside the count affected. “Three deviations lacked an impact assessment” means something different when three of three were examined than when three of forty were.
5. The finding contains no proposed solution. Root cause and corrective action are the supplier’s work, and pre-writing their answer weakens both the finding and their ownership of the fix.

Findings

<<FILL: repeat the block above for each finding, numbered sequentially, ordered worst grade first>>

8. Positive observations

Genuine strengths only, briefly. Two or three. Invented praise to soften a report destroys the credibility of everything else in it, and a report with nothing positive in it is usually a report from an auditor who was not paying attention.

9. Overall conclusion and recommendation

Recommendation: <<FILL: Approve / Approve with conditions / Not approved>>

Rationale: <<FILL: tie the recommendation to the specific findings by number. State how the worst finding drove the outcome. If the recommendation is approve with conditions, the reader must be able to see exactly which finding each condition answers.>>

Conditions of approval (if applicable)

Interim risk controls applied on our side: <<FILL: e.g. increased incoming testing, lot quarantine pending supplier response, hold on new orders, or none>>

Impact on supplier qualification status and audit interval

The recommendation must be consistent with the worst finding in section 7. A critical finding and an “approved” recommendation in the same document is the sort of contradiction an inspector will find in ten seconds.

10. CAPA request and timeline

The supplier is requested to respond to each finding with an immediate correction, a root cause, a corrective action, and where warranted a preventive action and an effectiveness check, each with a named owner and a due date.

Responses are to be sent to <<FILL: name and contact>> and will be tracked to closure in <<FILL: CAPA tracking log reference>>. Majors and criticals close on verified effectiveness, not on completion of the action. Responses consisting only of retraining and re-issue of a procedure will be returned for a systemic root cause.

Follow-up planned: <<FILL: e.g. desk review of evidence for minors; focused remote verification for finding 02; on-site verification of finding 01 at the next audit or a dedicated visit by ...>>

11. Attachments

12. Auditor signature and approval

By signing, the lead auditor confirms that the findings in this report are based on objective evidence recorded during the audit, that no finding appears here which was not raised at the closing meeting, and that the recommendation follows from the findings.

Report issued within <<FILL: number>> calendar days of the closing meeting, per <<FILL: SOP-ID>>. Working papers retained for <<FILL: retention period>>.

Filled specimen

An extract of a completed report for an illustrative contract sterile fill-finish supplier, showing one finding worked in full. Company, site, numbers and dates are invented for teaching purposes.

Header extract: Report SUP-AUD-2026-018-R, final, issued 26 May 2026. Northvale Sterile Services Ltd, Cork, Ireland. Aseptic fill-finish of our drug product into 2 mL vials, visual inspection, secondary packaging, QC release testing. Audit dates 19 to 20 May 2026. Type: for-cause combined with periodic re-qualification, announced three weeks. Lead auditor K. Ferreira. Quality agreement QAG-2024-031. Prior audit September 2024, two majors, four minors, all closed at the time of this audit.

Objective: Determine whether Northvale’s aseptic fill and container closure control on line FL-02 is capable of consistently delivering integral sealed vials, and whether the quality system detected and acted on four container closure integrity failures found at our incoming inspection between November 2025 and March 2026.

Areas covered, extract: 16 on-site hours. Observed a live fill on FL-02 for 70 minutes including capping and crimp force verification. Reviewed executed batch records for lots NS-25-1142, NS-25-1198 and NS-26-0031, all selected by the audit team. Reviewed all six deviations raised on FL-02 in the period. Backward trace completed from the CoA for lot NS-26-0031 to the container closure integrity instrument raw data and its audit trail. Change control CC-25-088 reviewed end to end. Photography prohibited by site policy; evidence was transcribed with full identifiers and the supplier provided copies of eleven named records.

Summary of findings: 0 critical, 2 major, 3 minor.

Finding 01 worked in full:

Finding 01 - Major

Area: Change control and supplier notification

Observation: Change control record CC-25-088, approved 14 October 2025 and implemented 27 October 2025, changed the supplier of the aluminium crimp caps used on line FL-02 from Vendor A to Vendor B. The change record classified the change as “like for like, no qualification required” and no requalification of the capping station crimp force settings was performed; the capping station settings record CAP-SET-FL02 rev 8 remains dated 11 March 2024. The change record contains no entry in the customer notification section, and no notification was issued to us. Lots NS-25-1142, NS-25-1156, NS-25-1188 and NS-26-0009, all filled after 27 October 2025 and all supplied to us, subsequently failed container closure integrity testing at our incoming inspection. Four of four failures at our receipt in the period fall after the implementation date; no failure was recorded on our receipts in the twelve months before it.

Requirement: EudraLex Volume 4, Chapter 5 (Production), clause 5.25, requires that changes with the potential to affect product quality be evaluated and, where relevant, validated, and Chapter 1 paragraph 1.4(xiii) carries the expectation that significant changes are approved before implementation. Quality agreement QAG-2024-031 clause 5.2 requires Northvale to notify us in writing at least 30 days before implementing any change to materials, components, equipment or process affecting our product, and to obtain our written agreement for changes to primary container closure components. Northvale’s own SOP-QA-018 rev 5 section 6.4 requires a component change to be assessed for impact on validated process parameters and states that a change to a primary packaging component is not eligible for the like-for-like route.

Risk and impact: A crimp cap from a different supplier can differ in dimension, hardness or coating, so the crimp force validated for the previous component may no longer produce an integral seal. A vial that is not sealed integrally can lose sterility. Product already supplied to us is potentially affected: four lots failed on receipt and were rejected, and three further lots filled in the same period remain in our quarantine pending this assessment. The failure to notify meant we continued to receive and process material without knowing a container closure component had changed.

Grade rationale: Major, not critical. No product reached a patient: all affected lots were detected at our incoming testing and none were released. It is not a minor because a primary container closure component was changed without impact assessment or requalification, in direct conflict with the supplier’s own procedure and with a contractual notification obligation, and because the change is temporally associated with a real product failure. It is not critical because there is no evidence of falsification and no affected product entered the market.

Spread: Systemic within change control. Of eight change records reviewed for the period, three used the “like for like, no qualification required” route, and two of those three involved a product-contact or container closure component that SOP-QA-018 excludes from that route.

Supplier response at closing: Accepted. The QA head stated that the like-for-like route had been applied because the caps carried the same drawing number, and acknowledged that the drawing number does not control the supplier’s manufacturing process. No dispute was raised on the observation or the grade.

Positive observations: P1, environmental monitoring data for FL-02 were trended monthly with alert and action levels derived from the site’s own data and reviewed at management review; the reviewer’s signature and any action taken were present for all twelve months examined. P2, the capping operators observed on the line were able to describe the crimp force check and the action to take on a failure without reference to the procedure, matching what SOP-PRD-044 rev 3 actually requires.

Conclusion: Approve with conditions. Two major findings, both connected to control of the container closure seal, and both in areas that directly caused product we rejected. No critical finding: no affected product reached a patient, the failures were detected by our own incoming testing, and there is no evidence of data manipulation. Approval is continued on a conditional basis because the underlying capability, aseptic fill and environmental control, was demonstrated, but the change control system did not reliably classify a change that mattered.

Status moved from conditionally approved to conditionally approved with conditions C1 to C4. Next audit interval shortened from 24 months to 12 months, on-site, focused on change control and container closure integrity. Referred to the Supplier Quality Review Board, decision record SQRB-2026-014.

CAPA request: Written response to both majors due 16 June 2026 (15 working days). Effectiveness checks required for findings 01 and 02 and verified before closure.

Notice what makes finding 01 hold up. It names the change record, the date, the settings record and its revision, the four affected lots and the base rate before the change. It cites an EU GMP chapter, a contractual clause, and the supplier’s own SOP with revision and section, so the supplier cannot argue the bar was unfair. The risk is written so a supply chain manager understands it. The grade is explained in both directions, why not critical and why not minor. And the spread number, two of three like-for-like changes wrongly routed, is what turns a single event into a systemic finding.

Common inspection findings this report prevents

• Audit findings written as opinions, with no record identifier, so the supplier’s corrective action cannot address anything specific.
• Findings that cite no requirement, leaving the supplier free to argue that no standard was breached.
• A report whose conclusion contradicts its findings, most often a critical or unresolved major alongside an approval recommendation.
• Reports issued weeks or months after the audit, by which time the supplier has lost the context and the momentum for corrective action.
• Findings appearing for the first time in the report, never raised at the closing meeting, which the supplier rightly disputes.
• No record of which documents were requested and not provided, so an evidence gap becomes invisible.
• Audit reports on file with no evidence that the outcome ever changed the supplier’s approved status or audit interval.
• Grade inflation or deflation with no stated rationale, so classification cannot be shown to be consistent across the audit programme.
• A report that gives broad assurance about a supplier when the audit examined a single line or a single product, because scope exclusions were never written down.
• No statement of how records were selected, so an inspector cannot tell whether the auditor sampled or accepted a curated set.

How to adapt this report

1. Set the report number, governing procedure and issue timeline in section 1 and section 12, and match the confidentiality marking to your CDA.
2. Trim the criteria table in section 3 to what genuinely applied. Delete the rows for regulations that do not govern what this site does.
3. Keep section 5 detailed. If your template pushes auditors to write “QC laboratory reviewed”, replace it with the row structure here, which forces the specific records and the time spent.
4. Adjust the recommendation categories in section 9 to the exact status names used in your supplier qualification procedure, so the report output maps directly onto your approved-vendor list.
5. Set the CAPA response timelines in section 10 to the commitments in your own procedure and quality agreements, and keep the rule that majors and criticals close on verified effectiveness.
6. If your organisation reports remote or documentary audits on the same form, add a mandatory statement in section 2 that no floor observation took place, so the limitation travels with the report.
7. Confirm every citation in section 3 against the current published version before issue.
8. Track the findings from this report to closure in Log: Supplier Audit CAPA Tracking, grade them using SOP: GxP Audit Finding Classification and Grading, and record each one on Form: Audit Finding Record if your process uses a separate per-finding record. The underlying fieldwork method is described in how to conduct a supplier or GMP audit.