This is a ready-to-use register for tracking self-audit findings from the moment they are written to verified, effective closure. It is built around the four-part finding method (requirement, observation, impact and severity, reference) and the nine self-audit domains used throughout a full QMS self-audit, so one register can hold every finding a cycle produces, not just the ones from a single area. Replace every <<FILL: ...>> placeholder with your own specifics, set your document number, and route it through your normal document control and records retention. A worked filled specimen follows. Verify each cited regulation against the current source before you rely on it.
A finding with no due date is not a finding, it is a comment. This register exists to make that impossible: every row carries an owner, a due date set by severity, and a status that an aging rule actively watches, so a slipping critical finding surfaces itself instead of waiting to be noticed.
Register control
| Field | Entry |
|---|---|
| Register reference | <<FILL: e.g. LOG-QA-021>> |
| Version | <<FILL>> |
| Owner | <<FILL: role, e.g. Head of Quality Assurance>> |
| Governing procedure | <<FILL: SOP-ID for the self-audit / internal audit program>> |
| Self-audit cycle covered | <<FILL: e.g. 2027 annual self-audit>> |
| Review frequency | <<FILL: e.g. monthly at the quality council, and immediately on any critical finding>> |
| Retention | <<FILL: period, aligned to the audit report it supports>> |
Severity-based due dates and escalation
| Severity | Default due date | Aging escalation trigger |
|---|---|---|
| Critical | <<FILL: e.g. 7 calendar days>> | Not visibly on track at the midpoint of the due window: auto-escalates to the Head of Quality |
| Major | <<FILL: e.g. 30 calendar days>> | Not visibly on track at the midpoint: escalates to area management, then the quality unit if still stalled |
| Minor | <<FILL: e.g. 90 calendar days>> | Individually tracked but not individually escalated; a growing minor backlog is itself reported as a finding |
Field table
| Field | Format | Required | Notes |
|---|---|---|---|
| Finding ID | Unique ID, e.g. SA-<<FILL: year>>-### | Yes | Sequential per self-audit cycle |
| Self-audit domain | One of: Document Control, Deviation Management, CAPA Management, Change Control, Training, Supplier/Vendor Qualification, Internal Audit Program, Quality Metrics/Management Review, Product Quality Reviews | Yes | Matches the nine sections of the self-audit checklist |
| Requirement | The regulation, standard, or internal procedure the observed practice does not meet | Yes | Cited specifically, e.g. “EU GMP Chapter 4” or “SOP-QA-014 §5.3” |
| Observation | The specific, evidenced fact, with record identifiers and dates | Yes | Not an impression; something someone else could relocate and verify |
| Impact / severity | Why it matters and the grade (Critical / Major / Minor) | Yes | Grade against your own severity definitions |
| Owner | Single named individual | Yes | Not a department |
| Date opened | Date | Yes | The date the finding was written, not the date of the underlying event |
| Due date | Date, set from the severity table above | Yes | Recalculated only through a documented extension, never silently |
| Status | Open / In Progress / Escalated / Closed - Pending Effectiveness / Closed - Verified | Yes | Updated continuously, not just at the end |
| Aging escalation fired? | Yes/No, with date | Conditional | Set automatically at the midpoint rule if status is not visibly on track |
| CAPA reference | CAPA ID, or “correction only, see rationale” | Conditional | Required for Major and Critical findings |
| Effectiveness check plan | Measurable, dated, falsifiable pass/fail criterion | Required for Major and Critical | A “no recurrence” statement alone does not satisfy this field |
| Effectiveness check result | Pass / Fail / Not yet due | Conditional | A Fail reopens the finding with a broader scope, it does not quietly reclose |
| Verified closed by / date | Name, date | Required at closure | Someone other than the finding’s own owner |
Instructions
- Log every finding the day it is written, from the self-audit report, not in a batch weeks later.
- Set the due date from the severity table, not from a negotiated date with the area being audited. If the area needs more time, that is an extension request logged against the original due date, not a quiet reset.
- Watch the midpoint of every open finding’s due window. If it is not visibly on track, the aging escalation fires per the table above, and the “Aging escalation fired?” field is set the same day, not after the due date has already passed.
- Do not close a Major or Critical finding on the strength of the corrective action being implemented alone. Closure requires the effectiveness check result, and a Fail reopens the finding rather than starting a new one, so the history of what didn’t work stays attached to the original observation.
- Report open, aging, and overdue counts by domain at every management review; a domain with a persistently high count is itself the kind of systemic signal this checklist asks you to escalate above the individual finding.
- Retain the register per the records retention schedule, for not less than
<<FILL: retention period>>.
Filled specimen
The following shows five rows completed for an example self-audit cycle, consistent with the sample finding log in QMS Self-Audit: Evaluating Your Pharmaceutical Quality Management System, extended here with the full tracking fields. The company, records, and dates are illustrative.
| Finding ID | Domain | Requirement | Observation | Severity | Owner | Due date | Status | CAPA ref | Effectiveness result |
|---|---|---|---|---|---|---|---|---|---|
| SA-2027-01 | Document Control | EU GMP Ch.4, contemporaneous recording | 6 of 10 batch records sampled (BR-2291, BR-2294, …) signed end-of-shift in one session, not at recorded times | Major | Mfg lead | 2027-02-12 | Closed - Verified | CAPA-2027-117 | Pass, 30-day sample of 25 records all contemporaneous |
| SA-2027-02 | CAPA Management | ICH Q10 §3.2.2 | CAPA-2026-102 has no effectiveness check defined | Major | QA | 2027-01-27 | Closed - Verified | CAPA-2027-118 (rework of CAPA-102’s plan) | Pass |
| SA-2027-03 | Training | 21 CFR 211.25 | 3 of 5 sampled staff trained on a superseded SOP version | Major | Training lead | 2027-02-05 | In Progress | CAPA-2027-119 | Not yet due |
| SA-2027-04 | Change Control | 21 CFR 211.100(a) | CC-2204 open 9 months, revalidation not performed | Critical | Engineering | 2027-01-20 | Escalated | CAPA-2027-120 | Fail (see note), reopened with broader scope |
| SA-2027-05 | Document Control | EU GMP Ch.4 | Obsolete form found taped at one workstation | Minor | Area lead | 2027-02-19 | Closed - Verified | n/a, correction only | n/a |
Note on SA-2027-04: the aging escalation fired at day 4 of the 7-day due window when the revalidation protocol had not been drafted. Escalated to the Head of Quality per the critical-severity rule. The first corrective action (expedited protocol drafting) closed the immediate gap but the effectiveness check at 30 days found the same equipment category had two more instances of unrevalidated post-change use elsewhere in the site; the finding reopened with the scope expanded to all equipment of that category, exactly the “where else” discipline the self-audit checklist asks for.
Common inspection findings this log prevents
- A finding with a due date recorded once and never revisited, so “open” and “overdue” are indistinguishable in the record.
- A finding closed because the action was implemented, with no evidence the action actually worked.
- A critical finding that slipped past its due date with no trace of anyone noticing before an inspector did.
- Findings scattered across separate area-specific trackers with no single view of the whole self-audit cycle, so a systemic pattern across domains stays invisible.
- A reopened finding treated as a brand new one, losing the history of what was already tried and failed.
How to adapt this log
- Set your own severity-to-due-date mapping in the header table; the values here are illustrative starting points, not a regulatory requirement.
- If your electronic quality system already tracks CAPA to closure, use this register as the self-audit-specific index into that system rather than duplicating every CAPA field, and keep the domain and requirement fields here since the CAPA system rarely organizes by self-audit domain.
- Wire the aging escalation rule into your electronic system’s notification logic if you have one; a manual register works but depends on someone reliably checking it.
- Review the domain-level open and aging counts, not just the individual findings, at management review; see Log: Management Review Action Tracker for the parallel pattern applied to management review commitments themselves.
- Roll this register up into a cycle summary using Report: QMS Self-Audit Summary Report.