This is a ready-to-use risk assessment for deciding how much to rely on an audit report your company did not commission directly: a report from a third-party audit firm the supplier engaged, or a joint or consortium audit shared across multiple customer companies. Replace every <<FILL: ...>> placeholder with your own specifics, set your document numbers and dates, and route it through your normal document control, review, and approval. A worked filled specimen follows the template. Verify each cited regulation against the current published source before you rely on it. This template is an educational reference for you to adapt to your own quality system, products, and regulatory context; it is not legal, regulatory, or professional advice.
Shared and third-party audit programs exist because the same supplier sites get audited by dozens of customers a year at real cost to everyone. Using the output responsibly is not automatic: the decision to rely on someone else’s audit instead of running your own is a decision you make, and it is yours to defend at your next inspection, not the third party’s.
Document control header
| Field | Entry |
|---|---|
| Document title | Third-Party or Shared Audit Report Reliance Assessment |
| Document number | <<FILL: e.g. RA-QA-058>> |
| Version | <<FILL: e.g. 1.0>> |
| Supplier name and site | <<FILL: supplier, site address>> |
| Material or service covered | <<FILL>> |
| Source of the report being assessed | <<FILL: e.g. supplier-commissioned third-party auditor; joint/consortium audit program named>> |
| Assessed by | <<FILL: name, role>> |
| Assessment date | <<FILL: date>> |
| Next scheduled reassessment | <<FILL: date, or "at next report renewal">> |
1. Purpose
This assessment decides, on a documented and repeatable basis, whether an audit report your company did not itself commission, whether from a third-party audit firm the supplier engaged or from a joint or consortium audit program such as an industry shared-audit scheme, can substitute for your own on-site audit, supplement it, or neither. The goal is a defensible basis for the reliance decision rather than an assumption that a competent-sounding third party’s conclusion transfers automatically.
2. Scope
This assessment applies to a single supplier, a single site, and a single report. A new report, a materially changed site, or a change in the auditing organization requires a new assessment; reliance decided once does not carry forward indefinitely. It does not replace your own supplier risk-tier classification, which decides how much scrutiny the supplier needs overall; this assessment decides whether a specific third-party report can satisfy some or all of that scrutiny.
3. Methodology
Score six factors on a 1 to 3 scale, low risk to high risk (that is, a 3 indicates a factor that weakens reliance, not strengthens it). Sum the six scores for a total between 6 and 18 and map it to a reliance tier using the band table below, unless the assessor documents a deviation with rationale in section 6.
3.1 Scoring scale
| Score | Meaning |
|---|---|
| 1 | Supports full reliance: equivalent to, or stronger than, what your own audit would establish |
| 2 | Partial support: usable but leaves a specific gap you must address separately |
| 3 | Does not support reliance on this factor: treat as if the information does not exist |
3.2 Factors
| # | Factor | Score (1-3) | Basis for the score |
|---|---|---|---|
| 1 | Auditor / organization qualification, measured against a bar comparable to your own lead-auditor qualification | <<FILL>> | <<FILL: training, technical background, independence of the auditing organization from the supplier>> |
| 2 | Scope coverage of the activities, systems, and processes your material or service actually depends on | <<FILL>> | <<FILL: does the report reach the specific line, system, or method you use>> |
| 3 | Recency, and what has changed at the site since the report date | <<FILL>> | <<FILL: report date; known changes in equipment, process, key personnel since>> |
| 4 | Access level the auditor had (full records and floor access versus a curated tour or document-only review) | <<FILL>> | <<FILL>> |
| 5 | Depth of what is available to you: full finding and CAPA detail versus a pass/fail summary rating only | <<FILL>> | <<FILL>> |
| 6 | Whether your own audit rights (supplemental, for-cause, or full periodic) survive this reliance in the quality agreement | <<FILL>> | <<FILL>> |
3.3 Reliance tier banding
| Total score | Reliance tier | Meaning |
|---|---|---|
| 6-9 | Full reliance | The report can stand in place of your own audit for this cycle, with ongoing monitoring unchanged |
| 10-14 | Supplemented reliance | The report counts toward qualification, paired with a defined mitigation (section 5) that closes the specific gaps identified |
| 15-18 | Reliance not supported | Conduct your own audit; the third-party report is retained as a data point in the pre-read only |
4. Assessment table
| Field | Entry |
|---|---|
| Report reference and date | <<FILL>> |
| Auditing organization or program | <<FILL>> |
| Sum of factor scores | <<FILL>> |
| Reliance tier | <<FILL: Full / Supplemented / Not supported>> |
| Areas excluded from reliance regardless of overall tier | <<FILL: e.g. data integrity of the QC LIMS was not in the third-party scope>> |
5. Mitigations
Where the tier is Supplemented, name the specific action that closes each factor scored 2 or 3, with an owner and a date. Typical mitigations: a short-duration verification visit scoped only to the excluded or outdated area; your own trace of a received lot against receipt and incoming-test data as a check on the parts of the system the third party did not examine; a request for the full underlying finding detail where only a summary rating was shared; or a quality agreement amendment to restore an audit right that reliance would otherwise erode.
| Gap (factor #) | Mitigation | Owner | Due date | Status |
|---|---|---|---|---|
<<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
6. Residual risk and approval
| Field | Entry |
|---|---|
| Residual risk after mitigations | <<FILL: statement in plain terms>> |
| Deviation from the tier banding, if any, with rationale | <<FILL: "none" or describe>> |
| Next audit or reassessment trigger | <<FILL: date, report expiry, or a defined site-change trigger>> |
| Role | Name | Signature | Date |
|---|---|---|---|
| Assessor | <<FILL>> | ||
| QA reviewer | <<FILL>> | ||
| Approver (Quality Head or delegate with no commercial stake in the supplier) | <<FILL>> |
7. Records generated
Retain this assessment, the underlying third-party report, and any mitigation evidence per <<FILL: records retention schedule>> for <<FILL: period>>, available on request during an inspection of the supplier oversight programme.
8. References
21 CFR Parts 210 and 211 (cGMP; the manufacturer’s accountability for materials and services does not transfer to a third-party auditor or a consortium program). ICH Q10 (2008), Pharmaceutical Quality System (management of outsourced activities and purchased materials). EudraLex Volume 4, Chapter 7, Outsourced Activities (the written agreement and retained audit rights).
Confirm the current version and clause numbers of each reference before issue.
9. Revision history
| Version | Date | Author | Summary of change |
|---|---|---|---|
<<FILL: 1.0>> | <<FILL: date>> | <<FILL: author>> | Initial issue. |
Filled specimen
A worked example for an illustrative excipient supplier.
Document control: RA-QA-058 rev 1. Supplier: <<FILL: excipient manufacturer>>, site in <<FILL: country>>. Material: microcrystalline cellulose, pharmaceutical grade. Source: a joint audit report obtained through an industry shared-audit consortium, performed by a qualified third-party auditor on behalf of several member companies. Assessed by the Supplier Quality Specialist, 02 September 2026.
Scoring:
| # | Factor | Score | Basis |
|---|---|---|---|
| 1 | Auditor qualification | 1 | Auditor credentials and the program’s own qualification standard reviewed; comparable to internal lead-auditor bar |
| 2 | Scope coverage | 2 | Covered the manufacturing and QC release process; did not cover the site’s computerized LIMS audit trail configuration, which this company’s own method depends on |
| 3 | Recency | 1 | Report dated five months prior; no known site changes since |
| 4 | Access level | 1 | Full records and floor access per the report’s stated methodology |
| 5 | Finding detail available | 1 | Full finding list and CAPA status obtained, not only a summary rating |
| 6 | Retained audit rights | 2 | Quality agreement allows a supplemental audit but does not explicitly preserve an unannounced-access right |
Sum: 8. Reliance tier: Full reliance, with one mitigation.
Mitigation: Because the shared audit did not examine the LIMS audit trail configuration this company’s incoming-test method depends on, a two-hour remote verification session was scheduled with the supplier’s QC IT lead to confirm audit trail configuration and review practices directly. Owner: Supplier Quality Specialist. Due: within 60 days of this assessment.
Residual risk: Low, pending the scheduled LIMS verification. No deviation from the standard tier banding. Next reassessment at the consortium’s next scheduled audit cycle or on any site change notification, whichever comes first.
Common inspection findings this risk assessment prevents
- A supplier qualification file that cites a third-party or consortium audit report with no record of who evaluated whether it was adequate to rely on.
- Reliance on a report whose scope never actually reached the process, system, or method the company depends on, discovered only after a quality event.
- A stale shared-audit report carried forward year after year with no check on what changed at the site since it was issued.
- No evidence that the company retained, or even considered, its own right to a supplemental or for-cause visit despite the shared report.
- A reliance decision made informally by whoever read the report, with no documented tier, mitigation, or approval.
How to adapt this risk assessment
- Set your document number, owner, and effective date, and route it through your existing supplier qualification document control.
- If your organization participates in a specific joint-audit or third-party audit program, name it and record its own published auditor qualification standard as your comparison baseline in factor 1.
- Adjust the reliance tier bands in section 3.3 if your quality system already defines qualification tiers elsewhere; align the vocabulary rather than running two parallel tiering schemes.
- Where a supplier offers a report from a program you have not evaluated before, treat the first such report as an opportunity to also assess the program itself (its auditor qualification standard, report format, and renewal cycle) so later assessments can reference that evaluation instead of repeating it.
- Confirm every regulation in section 8 against the current published version before issue.