This is a ready-to-use report that closes a CSV/CSA program self-audit cycle. It does not repeat the per-system worksheets; it rolls them up into scope, results, findings, and a program-level conclusion that feeds the quality management review. Replace every <<FILL: ...>> placeholder, attach the completed per-system worksheets and checklist, and route it through your normal document control, review, and approval. A worked filled specimen follows. Verify each cited regulation against the current source before you rely on it.
Document control header
| Field | Entry |
|---|---|
| Document title | CSV/CSA Program Self-Audit Report |
| Document number | <<FILL: report ID, e.g. CSA-AUDIT-2026-03>> |
| Version | <<FILL: version, e.g. 1.0>> |
| Effective date | <<FILL: effective date>> |
| Document owner | <<FILL: role, e.g. Head of Validation>> |
| Audit period | <<FILL: dates covered>> |
| Site(s) / program scope | <<FILL>> |
1. Purpose
This report summarizes the self-audit of the computer system validation and computer software assurance program at <<FILL: site / program>>, states the sampling scope and rationale, rolls up results against the acceptance criteria in the underlying checklist, lists every finding by priority, and concludes whether the program remains fit for purpose.
2. Scope and sampling
| Field | Entry |
|---|---|
| Total GxP systems in inventory | <<FILL>> |
| Systems sampled this cycle | <<FILL: count and tier breakdown>> |
| Sampling rationale | <<FILL: criticality tiering, recent-change bias, rotation basis>> |
| Systems deferred to next cycle | <<FILL: list or "None">>, with reason |
3. Results against acceptance criteria
| Section | Result | Notes |
|---|---|---|
| System inventory and classification | Pass / Pass with findings / Fail | <<FILL>> |
| Validation documentation | Pass / Pass with findings / Fail | <<FILL>> |
| Requirements traceability | Pass / Pass with findings / Fail | <<FILL>> |
| Supplier assessment and reliance | Pass / Pass with findings / Fail | <<FILL>> |
| Change control | Pass / Pass with findings / Fail | <<FILL>> |
| Periodic review | Pass / Pass with findings / Fail | <<FILL>> |
| Retirement and data migration | Pass / Pass with findings / Fail | <<FILL>> |
| Program governance | Pass / Pass with findings / Fail | <<FILL>> |
4. Findings register
List every finding raised across all sampled systems, triaged per the parent checklist’s logic (could this, found by an inspector today, support an objection).
| Finding ID | System / area | Description | Priority | Routed to | Owner | Due date | Status |
|---|---|---|---|---|---|---|---|
<<FILL>> | <<FILL>> | <<FILL>> | Critical / Major / Minor / Recommendation | Deviation / Tracked action / Recommendation | <<FILL>> | <<FILL>> | Open / Closed |
5. Red-flag pattern check
Assess whether findings cluster into a structural pattern rather than isolated misses.
| Pattern | Present this cycle? | Evidence |
|---|---|---|
| System inventory stale (12+ months) | Yes / No | <<FILL>> |
| Multiple systems with overdue periodic review | Yes / No | <<FILL>> |
| Change control records exist but testing evidence is consistently thin | Yes / No | <<FILL>> |
| Supplier assessments that never state a testing-reduction conclusion | Yes / No | <<FILL>> |
| Validation summary reports that never state a fit-for-intended-use conclusion | Yes / No | <<FILL>> |
Any “Yes” above is treated as a program-level finding in its own right, opened as a CAPA against the pattern, not just against the individual instances.
6. Trend since last cycle
| Metric | Last cycle | This cycle | Trend |
|---|---|---|---|
| Systems sampled | <<FILL>> | <<FILL>> | <<FILL>> |
| Findings raised | <<FILL>> | <<FILL>> | <<FILL>> |
| Findings by priority (Critical/Major/Minor) | <<FILL>> | <<FILL>> | <<FILL>> |
| Prior findings still open | <<FILL>> | <<FILL>> | <<FILL>> |
7. Acceptance criteria for this report
- Every system in scope this cycle has a completed worksheet attached, and the sampling rationale is documented.
- Every finding is triaged and routed per the checklist’s logic, with an owner and a due date for anything beyond a recommendation.
- The red-flag pattern check was performed, not skipped, and any “Yes” was opened as its own CAPA.
- The trend comparison against the last cycle is complete, or the absence of a prior cycle is stated.
- QA has reviewed and challenged the conclusions, not simply countersigned them.
8. Conclusion
State, in one or two sentences, whether the CSV/CSA program remains fit for purpose, citing the pattern check and the open critical or major findings that qualify the statement.
9. References
GAMP 5 Second Edition, ISPE, 2022. FDA Guidance, Computer Software Assurance for Production and Quality Management System Software, current version. EU GMP Annex 11 (Computerised Systems). ICH Q9(R1), Quality Risk Management.
Confirm current versions before issue.
10. Attachments
| No. | Attachment |
|---|---|
| 1 | Completed CSV/CSA program self-audit checklist |
| 2 | Per-system audit worksheets for every sampled system |
| 3 | Deviation and tracked-action records opened this cycle |
11. Revision history
| Version | Date | Author | Summary of change |
|---|---|---|---|
<<FILL: 1.0>> | <<FILL: date>> | <<FILL: author>> | Initial issue. |
12. Approvals
| Role | Name | Signature | Date |
|---|---|---|---|
| Author (Lead auditor) | <<FILL>> | ||
| Reviewer (QA) | <<FILL>> | ||
| Approver (Quality Head) | <<FILL>> |
Filled specimen
The following shows an abbreviated rollup for an example annual cycle. The company, numbers, and findings are illustrative; replace them with your own.
| Field | Entry |
|---|---|
| Audit period | Q3 2026 |
| Systems sampled | 17 of 40 (6 high, 6 medium, 5 low) |
| Sampling rationale | All high-tier systems every cycle; medium/low weighted toward a recent major version upgrade, one overdue periodic review, and two randomly selected |
| Section 3 rollup | Inventory: Pass. Validation documentation: Pass with findings. Traceability: Pass with findings (one orphan-test finding). Supplier reliance: Pass. Change control: Pass. Periodic review: Pass with findings (one overdue). Retirement: N/A this cycle. Governance: Pass |
| Findings register | AUD-2026-Q3-01, CDS RTM orphan tests, Major, Tracked action, owner Validation Lead, due 30 Sep 2026. AUD-2026-Q3-02, Stability workbook periodic review 3 months overdue, Minor, Tracked action, owner Stability Lead, due 15 Sep 2026 |
| Red-flag pattern check | All “No” except: validation summary reports never state a fit-for-intended-use conclusion, “Yes”, found on 2 of 17 sampled systems; opened as CAPA-2026-0140 against report-template practice, not just the two instances |
| Trend since last cycle | Systems sampled 17 vs 14 last cycle; findings 2 major/minor vs 3 last cycle; no prior findings remain open |
| Conclusion | The CSV/CSA program remains fit for purpose. Two findings were raised, both tracked with an owner and a due date, and a report-template pattern was caught and opened as a CAPA before it recurred across a wider sample. No critical or unresolved major finding remains open |
The pattern check is what separates this report from a simple tally: two individually minor validation-summary-report gaps, on their own, would not be alarming, but recognizing the shared root cause (a report template that omits an explicit conclusion line) and opening one CAPA against the template, rather than two isolated fixes, is the difference between managing findings and managing the program.
Common inspection findings this report prevents
- A self-audit that produces a list of findings with no owner, no due date, and no trace to closure.
- Findings treated as isolated when they share a common root cause that keeps generating new instances.
- A report that never compares against the prior cycle, so a worsening trend goes unnoticed.
- A conclusion that recites activity without stating whether the program is fit for purpose.
How to adapt this report
- Set your document number, owner, and audit period in the header.
- Populate section 3 from your completed per-system worksheets and checklist.
- Tie finding IDs in section 4 to your real deviation and CAPA numbering.
- Build section 6 from your prior cycle’s report so the trend is a genuine year-over-year comparison, not a first-time estimate.
- Confirm every regulation in section 9 against the current published version before issue.