This is a ready-to-use GCP audit report. It turns what an auditor observed into classified findings tied to evidence and a requirement, and it sets the CAPA response clock. Replace every <<FILL: ...>> placeholder, set your document numbers, and issue it within your SOP timeline. A worked filled specimen follows. Findings must be stated as objective fact tied to evidence, never as opinion.
Report control
| Field | Entry |
|---|---|
| Report ID | <<FILL: e.g. AUD-2026-014-R>> |
| Audit ID | <<FILL: e.g. AUD-2026-014>> |
| Entity audited | <<FILL: site or vendor>> |
| Trial(s) / scope area | <<FILL: protocol(s) or process>> |
| Audit dates | <<FILL: date(s)>> |
| Audit type | Routine / for-cause / qualification |
| Lead auditor / co-auditor | <<FILL>> |
| Report date | <<FILL: within SOP timeline>> |
| CAPA response due | <<FILL: date per SOP>> |
| Distribution | <<FILL: roles/functions>> |
1. Executive summary
A short, factual summary: what was audited, against what standard, the sample covered, the number of findings by classification, and the auditor’s overall assessment of GCP compliance and data reliability. State clearly whether any finding requires immediate action (subject safety or data reliability at risk).
2. Scope, standard, and sample
- Scope:
<<FILL: activities, period, systems in scope>> - Standard: ICH E6 (state version), the protocol and amendments, applicable regulations, and sponsor SOPs.
- Sample reviewed:
<<FILL: subjects or transactions, and the frame used>> - Areas reviewed:
<<FILL: list>>
3. Findings
Each finding is objective, evidenced, classified, and tied to a requirement. Use one row per finding.
| # | Finding (objective statement) | Classification | Requirement | Objective evidence | CAPA owner |
|---|---|---|---|---|---|
| 1 | <<FILL: what was observed, factually>> | Critical / Major / Minor | <<FILL: ICH E6 clause; CFR/CTR cite; protocol section>> | <<FILL: document, page, timestamp>> | <<FILL: role>> |
| 2 | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
Classification definitions (state your SOP’s exact wording):
- Critical: adversely affects subject rights, safety, or well-being, or data quality and integrity, or is a serious GCP or regulatory violation.
- Major: could adversely affect subject rights/safety or data integrity; a serious deficiency short of critical, or a pattern of minors.
- Minor: not expected to adversely affect subjects or data; often isolated.
4. Positive observations
Where relevant, note practices that were done well. This is not padding; it gives the report balance and helps the audited party keep what works.
5. CAPA requirement and response
State what response is required and by when: a written response for each finding with root cause, corrective and preventive action, owner, and target date, returned by the CAPA response due date. State the classification-driven escalation (for example, critical findings require immediate notification and may halt an activity).
6. Overall assessment
The auditor’s conclusion: is the entity in an acceptable state of GCP compliance, acceptable with the stated CAPA, or not acceptable pending remediation. Tie the conclusion to the findings, not to impression.
7. Auditor statement and approvals
The report is issued under the auditor’s name. The audit certificate (the record that an audit occurred, per ICH E6 R2 section 5.19.3) is retained separately and is generally protected from routine inspection demand while remaining producible on regulatory request.
| Role | Name | Signature | Date |
|---|---|---|---|
| Lead auditor | <<FILL>> | ||
| QA review | <<FILL>> |
8. References
ICH E6 Good Clinical Practice; the protocol; applicable regulations (21 CFR Parts 312/50/54/56; EU CTR 536/2014; local law); sponsor SOPs.
Confirm the current version and the ICH E6 version in force before issue.
Filled specimen
The following shows the findings and summary completed for an illustrative site audit. The site, subjects, and numbers are illustrative; replace them with your own.
Executive summary: Site 021 was audited for ONC-301 on 15-16 September 2026 against ICH E6, the protocol, and 21 CFR Parts 312/50/56. Twelve of 34 subjects were reviewed. Four findings were raised: one critical, two major, one minor. The critical consent-timing finding requires immediate action; it was already identified and is being corrected. The site is assessed as acceptable subject to completion of the CAPA.
| # | Finding | Classification | Requirement | Evidence | CAPA owner |
|---|---|---|---|---|---|
| 1 | Subject 014 underwent a screening blood draw on 12-Mar before the ICF was signed (signed 13-Mar) | Critical | ICH E6 4.8.8; 21 CFR 50.27 | ICF page 4 and lab requisition timestamps | PI |
| 2 | IP accountability log shows 3 unaccounted kits across two subjects; no destruction record | Major | ICH E6 4.6.3 | IP log vs pharmacy count 04-Apr | Site pharmacist |
| 3 | Two SAEs reported to sponsor 6 and 8 days after site awareness against a 24-hour requirement | Major | ICH E6 4.11.1; protocol 9.3 | SAE forms vs source notes | Study coordinator |
| 4 | Delegation log not updated when a sub-investigator began performing assessments | Minor | ICH E6 4.1.5 | Delegation log vs assessment signatures | PI |
The report states each finding as fact (“Subject 014 was screened on 12-Mar; ICF signed 13-Mar”), not opinion (“the site seemed disorganized”). That is the difference between a finding a site can act on and one it can argue with.
Common inspection findings this report prevents
- Findings written as opinion or impression rather than objective fact tied to evidence.
- Findings with no cited requirement, so they cannot be defended or acted on.
- Inconsistent classification that does not follow the SOP scheme, so escalation and timelines are arbitrary.
- No stated CAPA response date, so findings drift with no response clock.
- Reports issued late, outside the SOP timeline.
How to adapt this report
- Set your report and audit IDs, dates, and CAPA response due date.
- Use your SOP’s exact classification wording in section 3.
- For a vendor audit, replace the subject-based evidence with the traced transactions and system evidence.
- Confirm the ICH E6 version in force and the regulation citations for the region before issue.