Process For Vendor Audit

Audit Process:

The process of managing the Vendor Audit Program is conducted in the following phases:

  • Initiation
  • Pre-audit & Audit Planning
  • Preparation of Audit
  • Audit Execution
  • Generation of Audit Report and CAPA Plan
  • Audit Response  
  • Audit Closing
  • Metrics and Tracking
  1. Initiation:

-The Quality Audit Function shall determine which potential or current vendor audits are to be scheduled for the upcoming year, based on the Annual Audit plan.

-For all potential critical items, a vendor audit shall be performed. 

2. Pre-audit and Audit Planning:

-The Lead Auditor assigned to the identified Vendor shall request pre-audit information.

3. Preparation for Audit:

Preparation for the audit may include following , but is not limited to,

  • Site layout and organogram
  • Site Master File
  • Validation Master Plan
  • List of Equipment
  • List  of products
  • Production Planning
  • History of customer complaints
  • Product recall history
  • Status of regulatory audits , its observations & restrictions (if any)
  • Applicable regulatory standards

Request and review information for the specific issue, such as copies of pertinent investigations, OOS result investigations, and subsequent CAPA implemented.  

Review of relevant documents, regulatory filings, GMP certifications and regulatory status, quality agreement with the vendor/service provider, and vendor quality review.

Vendor Audits shall be communicated and agreed upon with the Vendor. The announcement shall include, but not limited to:

-Proposed scope and purpose


-Date and duration of audit

4. Audit Execution:

  • A Third Party Consultant can perform audits at vendors/vendors on behalf of company. The audit report can be purchased from the Third Party after evaluating the adequacy and trained & qualified staff having knowledge of cGMP regulations for conducting audit.
  • In all cases, the Audit Team will request an appropriately targeted selection of documentation for review as indicated in the Audit Plan.
  • The following components shall be incorporated into the audit as per the Audit Agenda:

-Opening Meeting and Introductions

-Facility Tour

-Documentation Review

  • Close out meeting shall be scheduled to share observation(s) and to provide an opportunity to clarify any incorrect information, misunderstandings, and/or expectations relating to observations (as applicable).
  • Lead auditor shall ensure that the audit observations are clearly understood by the Vendor in order to facilitate CAPA plan.
  • In case of critical observation based on the type of observations and its impact assessment on quality of product and business decision of discontinuation of service shall be prioritized.
  • Upon assessment of observation by Corporate Head, Quality Audit, escalation procedure should be initiated within 7 calendar days of notification.

 Generation of Audit Report and CAPA Plan

  • Audit plans, reports and associated corrective and preventive actions (CAPAs) records are maintained by the Quality Audit Functions.
  • Audit reports are confidential and customarily will not be shared with Regulatory Agency inspectors.
  • The Audit report must be prepared by the Lead Auditor.  The audit report shall include but not limited to  following:

-Name and address of Vendor Audit Site

-Report Number

-Title, Name of Lead Auditor and other team members

-Distribution list


-Scope of the Audit

-Executive Summary

-Observations with Category


-Signature of Lead Auditor and Approver with name and date

-Signature for Authorize for distribution.

  • A copy of the approved audit report shall be submitted to the vendor within 30 business days after the audit completion date.
  • Audit report shall be circulated to vendor through commercial department or audit coordinator.

Audit Response

  • The audit response shall include:

-A description of the correction(s) or CAPA(s) implemented or planned for each observation

-Proposed time frames for completion

-Responsible functions/persons for each correction or CAPA

  • The final CAPA plan shall be reviewed by the Lead Auditor.
  • Commercial to ensure that Response and CAPA Plan shall be received within 30 business days from sharing the report with Vendor.
  • In case of delay the escalation shall be done to the Head Corporate Quality Audit.

7. Audit Closing

The Audit closure shall be issued on receipt of response for Critical and Major Observation and successful verification.

8. Metrics and Tracking

Metrics shall be in place to track, at a minimum bi-annually frequency, the performance of the Vendors with respect to Audit Response and Closure.

For any feedback or suggestions write to

Write a comment