CGMP Third-Party Audit: Supplier Audits, Scope and Evidence

A CGMP third-party audit is an independent external assessment of a supplier site's manufacturing practices and records against a defined set of current good manufacturing practice criteria. In supplier-audit practice, the term describes a scoped assessment, not a universal credential. The applicable CGMP criteria depend on the products, activities, and market being assessed.

The audited supplier provides access to its operations, personnel, and records. The independent auditor evaluates evidence and reports findings. The commissioning organisation arranges the assessment and agrees its purpose and scope. The organisation relying on the report decides whether it supports its own supplier decision; it may or may not be the commissioning organisation. Independence involves more than employing someone outside the supplier: financial interests, consulting relationships, and responsibility for the work being assessed can affect impartiality. These relationships are commonly considered when selecting an auditor for a quality assurance audit.

A third-party audit or certificate is never FDA approval. An audit report records an assessment within its stated scope, including the activities and evidence examined. It is not an agency decision, and its conclusions do not extend automatically to unexamined sites or processes.

Supplier qualification is the broader decision process into which an audit can feed. Common quality-system practice separates supplier acceptance, closure of audit findings, and material disposition. Accepting a supplier establishes an authorised sourcing relationship; closing a finding addresses an identified problem; material disposition determines what happens to particular material. Each decision has its own evidence and responsible owner.

These activities answer different questions. In common industry usage, a supplier audit describes the subject of an assessment; third-party describes the assessor’s relationship to the parties. A supplier audit may therefore be conducted by the customer or by an independent assessor.

Certification adds a scheme-specific decision; it is not simply another name for the audit report. Likewise, material testing characterises samples rather than assessing an operating system. A QA audit commonly examines how that system works.

Buyer acceptance commonly depends on the buyer’s criteria, the audited site and activities, access to the report, exclusions, and unresolved findings. A certificate alone may not answer those questions. For dual-source qualification, compare each supplier’s evidence against the intended purchase and use—not merely whether both hold certificates.

This mapping addresses the identified US human-food and dietary-supplement provisions. For pharmaceuticals, devices, chemicals, and other markets, check the applicable product and jurisdiction rules rather than extending these provisions by analogy. A supplier audit should be mapped to its actual purpose; not every supplier audit is a preventive-controls audit.

For broader context, see human-food controls under Part 117. For supplement receiving decisions, use component identity confirmation alongside the operational discussion of supplement supplier qualification audits. Keep the product-specific questions separate rather than combining them into a generic CGMP checklist.

Keep each assessment criterion in its own category

• Binding regulation: identify the applicable product, jurisdiction and provision beside each legal criterion. The table above is a narrow regulatory map, not a complete supplier-verification programme.
• Official guidance: label it separately from binding regulation. When using guidance, name the issuing authority and document, and distinguish its recommendations from any underlying legal duties.
• Industry practice: commonly useful methods include linking audit questions to hazards, tracing findings to records and documenting the basis for a supplier decision. Label these methods as practice rather than attributing them to an unrelated provision.
• Voluntary schemes and buyer policies: maintain a separate criteria set for certification expectations and purchasing conditions. Record whose criterion applies so that a scheme finding or buyer restriction is not mislabeled as a statutory breach.
• Optional software support: treat record organisation and workflow as implementation choices, not another source of regulatory authority. Keep human review, approval and supplier decisions explicit; using software is not proof that a site complies.

A useful audit scope identifies the supplier decision the assessment will inform, such as qualification for a particular ingredient and process. The following are suggested planning fields, not a statutory checklist:

• Legal entity and physical site, including the address and relevant production or storage areas.
• Supplied material and the manufacturing, processing, packing, or handling activity being assessed.
• Audit criteria, distinguishing applicable legal provisions from customer specifications and internal procedures.
• Relevant hazard or material specification, with the process step intended to control or meet it.
• Record period examined, identifying the operational history covered by the sampled records.
• Explicit exclusions: locations, activities, materials, and records outside the assessment.

Trace the physical supply chain through the manufacturer, contract processor, packer, warehouse, and distributor; identify which roles share a site and which belong to separate businesses. Follow the material rather than stopping at the invoicing supplier. An assessment of a distributor’s storage practices does not describe an unexamined manufacturer’s processing controls. Record coverage separately for each participant.

Use the material specifications and hazard analysis to select audit questions. Connect the resulting boundaries to supplier qualification, including qualification of alternate sources, and use change control to reconsider coverage when a site, process, specification, or subcontractor changes.

Example: assume a food ingredient manufacturer outsources a microbial-reduction step. The scope names the manufacturer’s legal entity and site, ingredient, preparation activity, agreed specifications, relevant microbial hazard, and production-record period. It identifies the contract processor and states whether its processing activity is included. If excluded, the audit can describe the manufacturer’s assessed activities and outsourcing oversight, but cannot establish how the processor actually operates. That boundary defines a coverage gap for subsequent assessment, not a company-wide conclusion.

A third-party supplier audit typically follows a planned assessment, evidence evaluation, supplier response, and receiving-organisation decision. This is an operational model, not a universal legal sequence. The workflow below shows the main handoffs; unresolved evidence can send the assessment back for further work.

Commission and agree scope → review auditor suitability → develop agenda and select records → observe processes and interview personnel → reconcile evidence and report findings → obtain supplier response → receiving organisation reviews and decides.

At commissioning, the receiving organisation typically identifies the supplier decision the audit will inform, agrees access and scope with the supplier, and reviews the auditor’s relevant technical experience and potential conflicts. Agenda development connects the agreed scope to processes, personnel, and records. A practical QA audit plan leaves room to follow unexpected evidence rather than treating the agenda as a fixed script. Record selection commonly combines representative operations with targeted review of changes or recurring problems.

Evidence triangulation tests whether different accounts agree. For example, compare a written cleaning procedure with a relevant production batch record, then observe the activity or ask an operator to explain it. If the procedure describes a check that the record does not show, investigate whether another record captures it, whether the procedure changed, or whether the check was missed. The discrepancy is a question to investigate, not proof of misconduct. Reconcile conflicting evidence before drawing a conclusion, and identify any uncertainty that remains.

A useful finding records the criterion, observed condition, supporting evidence, affected scope, and requested response. The supplier response can distinguish immediate correction of the observed issue from investigation of its cause and corrective action intended to prevent recurrence. Finding categories can follow the agreed audit programme without implying a universal grading system.

The receiving organisation’s designated human reviewer evaluates the report and response, records the supplier decision, and states limitations, outstanding questions, and follow-up ownership. Closing a finding is not itself a material-release instruction; material disposition remains a separate decision for the responsible personnel.

Organise audit evidence around the decision it supports: whether a process is controlled, monitoring is implemented, a deviation is investigated, corrective action is completed, or a limitation is accepted. This is practical quality-system organisation, not a prescribed regulatory schema. A collection of procedures and certificates without links to conclusions leaves reviewers to reconstruct the reasoning.

For each conclusion, identify the supporting record and explain its relevance. A procedure describes intended practice; a completed monitoring record helps demonstrate execution. An investigation supports the assessment of a departure. An accepted limitation records what remains unresolved, why the reviewer accepted that uncertainty, and how it constrains the supplier decision.

Suggested audit data model

Supplier site → audit and scope → evidence reference → finding → review decision

This diagram is a suggested implementation. The site identifies the location assessed; the audit records the process and hazard boundaries. Evidence references connect observations to identifiable records. Findings explain how that evidence supports or challenges the audit criteria. The review decision records the human assessment, disposition, and any conditions. Allow several evidence references per finding and several findings per decision rather than forcing unrelated conclusions into one attachment.

Useful provenance fields include document identifier, revision status, record date, relevant process or lot reference, evidence location, access restrictions, and reviewer identity. Following attributable recording principles helps distinguish who created a record from who assessed it. A document-control link can point to the authoritative record without copying it into every audit file; retain the reviewed revision reference so later changes do not obscure the basis of the conclusion.

Separate response, implementation, and effectiveness

A supplier response may promise a change; it does not demonstrate completion. Link the finding to deviation management and corrective and preventive action records, then identify evidence of the implemented change. Keep the later CAPA effectiveness check distinct: it evaluates whether the change addresses the issue in operation. Record these assessments separately so administrative closure does not conceal an outstanding effectiveness review.

These illustrative cases use stated assumptions, not real supplier outcomes. Each separates the evidence available from the decision it can support. The unresolved question identifies what the reviewer still needs to establish, rather than assigning an invented audit score.

Dietary ingredient: an audit-only proposal

• Assumptions: A US supplement manufacturer receives a botanical dietary ingredient and an independent supplier audit report. No FDA identity-testing exemption applies. The proposed acceptance decision relies on the audit alone.
• Unit of assessment: The received component before use, within the manufacturer's dietary-supplement controls.
• Evidence: The report assesses supplier systems. An identity test result addresses the identity of the component tested. Those are different questions, even when the report describes strong identification procedures.
• Unresolved question: What analytical or examination evidence establishes the received dietary ingredient's identity?
• Decision: Reject audit-only reliance for identity verification. For this US dietary-supplement manufacturer, 21 CFR 111.75(a)(1)(i) requires at least one appropriate identity test or examination, applying the rule covered above. Retain the audit as supplier-system evidence, not as the missing identity result.

Human food: the wrong site was assessed

• Assumptions: A supplier's hazard-control process occurs at an outsourced processing site, but the available audit covers only the distributor's warehouse.
• Unit of assessment: The ingredient, the controlled hazard, and the processing site applying the control.
• Evidence: The warehouse report describes activities at that location. Its scope does not include the outsourced process.
• Unresolved question: What evidence demonstrates implementation of the relevant control at the processing site?
• Decision: Record the coverage gap and request evidence addressing that process, hazard, and location. Keep the warehouse report for the activities it actually assesses; do not treat it as proof of the outsourced control.

Human food: a supplier-control failure

• Assumptions: A US human-food receiving facility determines that its supplier is not controlling an identified hazard requiring a supply-chain-applied control.
• Unit of assessment: The supplier–ingredient relationship and potentially affected material records.
• Evidence: The review establishes failure of the identified control, rather than merely a missing report.
• Unresolved question: Which materials may be affected, and what response addresses the hazard?
• Decision: Under 21 CFR 117.410(e), this US human-food receiving facility must take and document prompt action in accordance with § 117.150. Illustrative operational responses include escalating to the responsible reviewer, assessing affected materials, determining interim purchasing or inbound receiving controls, and documenting the supplier decision. These options are not a mandatory sequence or a universal material disposition.

As an optional information architecture, connect supplier master data, document control, laboratory records, deviation management, corrective actions, purchasing, and receiving through controlled references or integrations. Use supplier and site identifiers to establish identity, an audit identifier to locate the assessment, and document, sample, or lot identifiers to locate supporting records. Assign an owner to each handoff: supplier quality maintains audit associations; laboratory personnel own test records; purchasing and receiving use the reviewed supplier status. This supports data integrity by design without assuming a particular software connection exists.

Suppose a supplier response arrives but is attached to the wrong site or audit. The recovery owner compares its site details and audit reference against the authoritative supplier master and audit record, asking the sender to clarify ambiguity. Correct the association with a recorded reason while preserving the original submission and its receipt history. The responsible reviewer then confirms that the response belongs to the intended audit and finding. An audit trail review workflow can support this check.

Keep technical status separate from business status: a successful upload does not establish evidence acceptance. A visible exception queue with an assigned recovery owner can expose failed transfers or unresolved associations. Design incomplete handoffs to leave the supplier decision unchanged pending review, rather than silently advancing it. Human review and approval remain as described in the lifecycle above.

The weaknesses below concern audit reasoning and follow-up, not regulatory finding classifications. Use these practical review controls alongside the scope, approval boundaries, and system handoff controls covered above.

For disputed record histories, use audit trail review to examine changes and data integrity principles to assess reliability. Keep uncertainty visible rather than forcing every observation into a universal grade.

Use this practical checklist alongside the scope, evidence model, and regulatory distinctions covered above. Record answers and owners rather than marking general readiness.

Staged review checklist

• Before commissioning: Does the commissioning brief identify the supplier decision, manufacturing site, process, supplied material, applicable criteria, and exclusions? Name the commissioning owner and document the basis for auditor suitability.
• Before the audit: Has the audit coordinator recorded access arrangements, supplier contacts, relevant records, confidentiality arrangements, and inaccessible activities? Keep these commitments with the audit management plan.
• During report review: Can the technical reviewer trace each finding to evidence and criteria? Record supplier responses, disputed facts, exclusions, and unresolved limitations in a review log.
• Before the supplier decision: Has the named decision owner assessed whether the evidence supports the intended use? Record the disposition and any restrictions, rather than treating report receipt as acceptance.
• During follow-up: Does each open action identify a supplier contact, internal owner, agreed completion point, and closure evidence? Name the reviewer responsible for assessing effectiveness before closing the action.

Practical review triggers include changes to the manufacturing site, process, supplied material, outsourced activity, or a significant new finding. Assign the supplier-quality owner to reassess relevance and document the response; these are not statutory re-audit deadlines.

Close with a decision record stating what was assessed, what evidence supported the conclusion, what remains unresolved, who decided, and what follow-up is assigned.