SOP: For-Cause and Unannounced Supplier Audit Trigger

This is a ready-to-use SOP for deciding when a quality event or trend becomes a for-cause supplier audit, as distinct from the routine qualification or periodic audit covered by your general supplier audit procedure. Replace every <<FILL: ...>> placeholder with your own specifics, set your document numbers and dates, and route it through your normal document control, review, and approval. A worked filled specimen follows the template. Verify each cited regulation against the current published source before you rely on it. This template is an educational reference for you to adapt to your own quality system, products, and regulatory context; it is not legal, regulatory, or professional advice.

A for-cause audit is not a periodic audit run early. It exists because a signal already told you where to look, and the value of the visit depends on reaching that specific area before it can be corrected, relabeled, or explained away. This procedure governs the decision to trigger one, the authorization, the notice approach, and the handling that makes the resulting evidence hold up.

Speed is the entire value proposition. Lose it, and what you have is a periodic audit with worse paperwork and a longer backstory.

Document control header

1. Purpose

This procedure defines how <<FILL: COMPANY NAME>> decides that a quality event or trend warrants a for-cause supplier audit rather than, or in addition to, the next scheduled periodic audit; how that decision is authorized; how the notice approach (unannounced, short-notice, or for-cause with normal notice) is chosen and documented; and how evidence handling and reporting differ from a routine audit. The objective is a consistent, defensible trigger decision that reaches the right suppliers quickly without turning every quality event into an audit or every audit into a general system review.

2. Scope

This procedure applies to any signal concerning an approved or candidate supplier of GxP materials, components, or services that raises the question of whether an audit outside the normal schedule is warranted. It covers the trigger evaluation, authorization, notice decision, and scope lock. It does not replace the fieldwork, classification, reporting, or CAPA procedures that govern the audit itself once triggered; those are the same procedures used for any other audit type, applied to a narrower scope.

3. Responsibilities

4. Definitions

• For-cause audit: an audit triggered by a specific, nameable signal (not a general concern) that points to a defined failure mode, run outside the normal periodic schedule and scoped to that failure mode.
• Unannounced audit: conducted with no advance notice to the supplier beyond what is needed to gain physical access and meet basic safety requirements.
• Short-notice audit: conducted with enough notice for the supplier to make records and people available (commonly a few days) but not enough to materially alter the condition of the area in scope.
• Scope lock: the written, dated statement of exactly what the for-cause audit will examine, approved before departure and not expanded on site without a documented reason.
• Trigger signal: a complaint trend, recall, regulatory action at the supplier, a deviation or out-of-specification result tied to received material, a sudden shift in Certificate of Analysis pattern, or an equivalent specific indicator.

5. Procedure

5.1 Log and route the signal

1. Log every candidate trigger signal in the for-cause evaluation log (section 8) within <<FILL: number>> business days of becoming aware of it, whatever its eventual disposition.
2. Route the signal to the Supplier Quality / audit program owner for evaluation. Do not wait for a periodic review meeting; a for-cause signal ages badly.

5.2 Evaluate whether the signal is a for-cause trigger

1. State the suspected failure mode in one sentence. If the signal cannot be stated as a specific, nameable failure mode, it is not yet a for-cause trigger; route it to the next periodic audit or a targeted document request instead (section 5.2.3).
2. Confirm the signal is linked to this supplier specifically (not a category-wide concern better handled as a risk reassessment across multiple suppliers).
3. Where the signal does not meet the bar for a for-cause audit, document the rationale and the alternative action taken (periodic audit brought forward, document request, increased incoming testing, or no action with reasoning).

5.3 Decide the notice approach

1. Ask: would advance notice allow the supplier to correct, relabel, or conceal the specific area in scope before the audit team arrives? Document the answer and the reasoning.
2. If yes, recommend unannounced or short-notice. If no, a for-cause audit with normal notice is acceptable; the scope stays narrow either way.
3. The Quality Head authorizes the notice approach in writing before the supplier is contacted or the team travels. An unannounced audit additionally requires confirmation that the quality agreement or contract preserves the right of unannounced access; where it does not, address the gap before committing to the approach.

5.4 Lock the scope

1. Write the scope in one or two sentences naming the specific failure mode, the process area, and the records the team intends to trace. Have the Quality Head approve it before departure.
2. On site, the lead auditor may expand scope only where the evidence directly found during the visit justifies it, with the reason documented in the working papers; a scope expansion driven by the supplier’s agenda or convenience is not acceptable.

5.5 Conduct the audit

1. Conduct fieldwork, sampling, interviews, and evidence capture per the governing audit procedure referenced in the header, applied to the locked scope.
2. Confirm the originally suspected failure mode first, before pursuing any other thread, so the visit’s primary purpose is answered even if time runs short.

5.6 Handle evidence with the added discipline a for-cause visit requires

1. For every record examined, capture the identifier, version, and timestamp at the moment it is seen, and note the interval between the triggering event and when the team gained access to the record.
2. Ask directly, and record the answer, whether the record or the physical area in scope has been altered since the triggering event; corroborate the answer against the supplier’s own system change log or audit trail where one exists.
3. Where evidence of alteration, concealment, or fabrication is found, treat it as a critical finding per the audit’s classification procedure regardless of the original trigger’s severity, and notify Legal / Regulatory Affairs per section 3.

5.7 Report on a compressed timeline

1. Issue the for-cause audit report within <<FILL: number, typically shorter than the standard periodic-audit timeline>> calendar days of the closing meeting, given the time-sensitivity of the underlying signal.
2. State explicitly in the report that this was a for-cause audit, the triggering signal, the notice approach used and why, and whether the scope was expanded on site and on what basis.

6. Acceptance criteria

A for-cause audit trigger decision is acceptable when all of the following are true:

• The suspected failure mode is stated as a specific, nameable condition, not a general concern.
• The notice approach and the scope were authorized in writing by the Quality Head before travel.
• Evidence capture documents the interval between the trigger event and the team’s access to each key record.
• The report states the trigger, the notice approach and rationale, and any scope change with its basis.
• Signals assessed and not escalated to a for-cause audit have a documented rationale and an alternative action.

7. Records generated

8. For-cause evaluation log (fields)

9. References

21 CFR Parts 210 and 211 (cGMP; manufacturer accountability for materials regardless of source). ICH Q10 (2008), Pharmaceutical Quality System (management of outsourced activities and ongoing supplier monitoring). ICH Q9, Quality Risk Management (risk-based basis for when a signal warrants an unscheduled audit). EudraLex Volume 4, Chapter 7, Outsourced Activities (audit rights and the written agreement that preserves them).

Confirm the current version and clause numbers of each reference before issue.

10. Revision history

11. Approvals

Filled specimen

A worked example. The company, supplier, and records are illustrative.

Signal: 14 February 2026, three customer complaints in five weeks citing visible particulate in vials of sterile drug product, all traced to lots filled by contract manufacturer <<FILL: CMO name>> between November and December 2025. Incoming QC had not flagged any related deviation.

Trigger evaluation: Suspected failure mode stated as “environmental monitoring excursions or a filling-line integrity issue in the Grade A zone during the November to December 2025 campaign were not detected or were detected and not escalated.” Signal met the for-cause bar: specific, nameable, and tied to this supplier. Logged same day by the Complaints Quality Specialist, evaluated by Supplier Quality within two business days.

Notice decision: Advance notice could allow review or reconstruction of EM excursion records for the affected period. Quality Head authorized a short-notice visit (72 hours), citing the quality agreement’s unannounced-access clause and judging that full surprise was not necessary since the records in question were historical and not alterable without leaving a system trail, but routine notice risked a prepared narrative. Scope locked to: EM excursion records and batch-impact assessments for the November to December 2025 campaign, media fill records for the same period, and the deviation log for any related but unescalated events.

Outcome: On site, EM excursion records EM-EX-2025-211, -219, and -224 showed excursions closed with no batch-impact assessment, consistent with the suspected failure mode; scope was not expanded. Report issued eight calendar days after the closing meeting (governing procedure allows 30 days for a standard periodic audit; this SOP set 10 days for a for-cause report given the active complaint investigation). Findings fed directly into the open complaint investigation and a recall risk assessment handled under separate procedures.

Common inspection findings this SOP prevents

• A clear quality-event pattern at a supplier with no record that anyone evaluated whether an audit was warranted.
• A for-cause audit run with no documented scope, drifting into a general system review that dilutes the original signal.
• An unannounced or short-notice visit conducted with no written authorization, leaving it open to challenge as procedurally improper.
• No evidence that the audit team considered or checked whether records had been altered between the triggering event and the visit.
• A for-cause report issued on the same slow timeline as a routine periodic audit, long after the urgency that justified the visit has passed.

How to adapt this SOP

1. Set your document number, owner, and effective date in the header, and point to your actual governing periodic/qualification audit SOP.
2. Calibrate the response and reporting timelines in sections 5.7 and 6 to what your quality system can realistically commit to and still meet.
3. Confirm your standard confidentiality agreement and quality agreement templates actually preserve an unannounced or short-notice access right; if they do not, this procedure cannot be executed as written for suppliers under the old template.
4. Name the specific trigger categories your own complaint, deviation, and regulatory-intelligence processes are most likely to surface, and add them as examples in section 4 so staff recognize a trigger without having to reason from first principles under time pressure.
5. Confirm every regulation in section 9 against the current published version before issue.