Report: QMS Self-Audit Summary Report

This is a ready-to-use summary document for a completed QMS self-audit cycle, the kind run against all nine domains in QMS Self-Audit: Evaluating Your Pharmaceutical Quality Management System: document control, deviation management, CAPA, change control, training, supplier qualification, the internal audit program itself, quality metrics and management review, and product quality reviews. It sits at a different altitude from a single scheduled area audit write-up or an annual program-effectiveness review: it rolls up one full pass across the whole QMS into one artifact a management review can actually act on. Replace every <<FILL: ...>> placeholder with your own specifics, set your document numbers and dates, and route it through your normal document control, review, and approval. A worked filled specimen follows. Verify each cited regulation against the current source before you rely on it.

Document control header

1. Purpose

This document summarizes the results of one complete QMS self-audit cycle across all nine domains, states what was found by domain and by severity, applies the prioritization lenses the self-audit method calls for, and converts the result into a CAPA plan and a management-review input. It is the deliverable the self-audit method itself is designed to produce; running the checklist without producing this is running an exercise, not a program.

2. Scope as executed

3. Observations by domain

Full detail per observation (requirement, evidence, owner, due date, status) lives in Log: QMS Self-Audit Finding and Closure Tracking Register; this table is the rollup view, not a replacement for it.

4. Prioritization: the three lenses

Every Critical and Major observation is run through the same three questions before it is sequenced for action.

An item with any “Yes” in the first two columns is sequenced ahead of one with none, regardless of its position in the observations table; a systemic item is sequenced ahead of the isolated instances that revealed it.

5. Cross-domain themes

Group related observations across domains into themes; a document control gap, a training-currency gap, and a change control gap that all trace back to the same broken document-to-training handoff are one systemic issue, not three separate ones.

6. Maturity read

A qualitative read of where the QMS sits, domain by domain, on the reactive-to-proactive scale described in the self-audit checklist. This is a narrative judgment, not a computed score.

A formally scored maturity assessment against the ICH Q10 elements, where a numeric rating is needed for a broader benchmarking exercise, is at Checklist: PQS Annual Self-Assessment Against ICH Q10 Elements.

7. CAPA plan and effectiveness commitments

8. Bottom line

State plainly whether the QMS, based on this cycle, is in a state a regulator would find defensible today, what the highest-priority gaps are, and when the highest-severity items will be re-checked. Avoid a generic “quality acceptable” line; this should read as a direct consequence of sections 3 through 6, not a separate assertion.

<<FILL: 2-4 sentences, e.g. "The QMS is broadly compliant with two cross-domain issues requiring management attention: change control revalidation follow-through and training-currency synchronization with document control. Neither presents a confirmed patient impact, but both match recurring regulator citation patterns and are sequenced accordingly. Re-check of the two Critical items is planned for [date].">>

9. Re-check plan

10. References

EU GMP Chapter 9 (Self Inspection). ICH Q9, Quality Risk Management; ICH Q10, Pharmaceutical Quality System, sections 3.2 and 4. 21 CFR 211.22, 211.192.

Confirm the current version of each reference before issue.

11. Approvals

12. Revision history

Filled specimen

An excerpt from an example self-audit cycle at a mid-size biologics site. Values are illustrative.

Scope as executed: all nine domains covered; document control and CAPA sampled at 15 records each, other domains at 10; record window the prior 12 months; supplier qualification covered for high-tier suppliers only, medium and low tier deferred to the next cycle and stated as such.

Prioritization (excerpt): SA-2027-04 (Change Control, Critical, revalidation nine months outstanding): patient safety impact Yes, matches the “production and process control records” citation pattern, systemic (one other line found in the same equipment category on follow-up). Priority 1. SA-2027-01 (Document Control, Major, contemporaneous recording): patient safety impact indirect, matches a recognized citation pattern, isolated to one product family. Priority 2.

Cross-domain theme: “document-to-training synchronization” links SA-2027-01 and SA-2027-03 (training on a superseded SOP version), two items in different domains with the same root cause: document control does not automatically trigger a retraining assignment on revision. Systemic severity: Major.

Bottom line: the QMS is broadly compliant with one Critical, isolated-but-scope-expanded gap in change control revalidation follow-through, now reopened with a fleet-wide scope, and one cross-domain document-to-training synchronization gap spanning two domains. Neither reflects a confirmed patient impact, but the change control gap matches a recurring, heavily cited regulator pattern and is sequenced for closure within 30 days with a 60-day re-check.

Common gaps this template prevents

• A self-audit that produces nine separate area notes with no single rollup, so the whole-QMS pattern a reviewer would look for never gets assembled.
• Items sequenced purely by the order they were written down, rather than by patient impact, citation pattern, or systemic reach.
• A cross-domain theme buried inside three unrelated-looking observations because nobody grouped them.
• A bottom line that does not follow from the observations table, the exact “quality acceptable” pattern the self-audit checklist warns against.
• No re-check plan, so the highest-severity items are assumed fixed rather than confirmed fixed.

How to adapt this document

1. Set your document number and finding register reference in the header, and keep this document and the underlying register in sync; this is a rollup, not a duplicate ledger.
2. Adjust the nine-domain table if your organization’s self-audit scope differs (for example, splitting supplier qualification into materials and software vendor sub-rows if that distinction matters at your site).
3. Keep the prioritization table honest: an item with no patient-safety link and no citation-pattern match can still be Critical for other reasons, but say so explicitly rather than letting the table imply otherwise.
4. Route every Critical and Major item into your real CAPA system, and report the open list at management review until the re-check plan in section 9 is complete.
5. Confirm every reference in section 10 against the current published version before issue.