How Small Gaps in Documents and Records Widen Your Audit
In almost every audit, a record comes up with a small gap: a missing signature, a date that doesn't add up, or a reference to a version of a procedure that is no longer in effect.
Usually the quality manager knows what happened there and why it isn't a material problem, but the document itself does not give the auditor that information.
A gap in the documentation generates more questions, widens the scope of the audit, and weakens confidence in everything the record was supposed to prove. In small and medium-sized medical device companies, this is one of the things that most affects how long an audit takes and how much work is left after it, and it can usually be reduced without a major change to the system.
Why one gap doesn't stay one gap
When an auditor finds an incomplete record, they have to decide one question: is this an isolated case or a symptom of something broader?
If the documentation doesn't give them the answer, they have to keep looking.
This isn't out of malice or a wish to catch you out. It is simply that they have no other way to close the point.
An organization with good documentation can define the boundaries of the problem itself.
It can say who exactly was affected, in what time window, what was done with the output from that period, and when the gap was closed.
An organization with weak documentation cannot say this, so the auditor sets the boundaries for it, usually wider than would have been needed in the first place.
In an audit I performed at a company that manufactures a Class IIb device, it came up that one production employee had performed an operation according to an old version of a work instruction.
The company had an orderly training matrix with dates, read-and-understood acknowledgments for each version, and a distribution record showing when the new version reached the production floor.
Within half an hour it was clear that this was one employee, that his work had been checked by quality control, and that all the other employees had acknowledged the new version on time.
The finding was closed as an isolated event.
At another company, with the same type of finding, training was recorded in an Excel file that someone updated once a month, with no read-and-understood acknowledgments and no documented distribution date.
The auditor could not determine how many employees were in the same situation. He asked for all the training records of the department, then for the training records of two more departments, and in the end he opened a question on the effectiveness of the entire document control process.
The initial finding was identical in both cases, but the workload that landed on the company after the audit was completely different.
One gap, several questions
Quality records are connected to one another.
A training record is linked to an employee's qualification, which is linked to the approval of a step in the process, which is linked to batch release.
A gap in one link weakens the evidence across the whole chain.
Because of this connection, one gap brings several questions with it at the same time.
Take, for example, a training record that was not completed. It raises a question about that employee's competence, a question about the organization's ability to identify training gaps in time, and a question about the validity of the work the employee performed during the relevant period. That is three questions from one record, and each of them can lead to a request for more records.
At a medical device company I supported last year, a CAPA was opened following a complaint from the field.
The CAPA was closed, but the evidence of effectiveness was a single sentence: "No further complaints were received."
There was no defined follow-up period, no reference to the complaint data that had been reviewed, and no link to the PMS records.
The auditor could not verify the statement, so he asked for all complaint records from the past two years and the PMS report.
From there, questions rolled on about how complaints were classified and about the criteria for reporting to the authorities, when the original finding had only been about how one CAPA was closed.
Documentation is the organization's memory
Audits look back. Sometimes they look at an event that happened two years ago, when the employee who handled it is no longer with the company, the procedure has been updated twice since, and the system where the data was kept has been replaced.
The records are what remains.
They need to survive staff turnover, procedure changes, system migrations, and long investigations that go on for months.
If a record cannot explain itself without a person sitting next to it and interpreting it, it will not pass this test.
This is especially true for the startups I work with.
At an early stage, everything is in the heads of two or three people, and that works very well until the day one of them leaves, or until the day a notified body arrives and asks to understand a decision made in development three years ago.
A practical tip:
Take one record from two years ago, from the technical documentation or from a quality process, and give it to someone in the company who was not involved in the event. If they can't reconstruct from it what happened, who decided, on what basis, and what the results were, the record is not doing its job.
I do this exercise when preparing for an audit, and it uncovers more gaps than a ready-made questionnaire.
How an auditor builds a sample
An auditor cannot check everything, so they sample.
They take a small number of records and draw conclusions from them about the whole system.
The sample size is not rigidly fixed in advance. It responds to what the auditor finds.
When the records in the initial sample are complete and clear, the auditor gains confidence in the system and moves on.
When they run into repeated gaps or conflicting information between records, that confidence erodes and the sample grows.
Then the organization finds itself pulling more records, bringing more people into the room, and reconstructing old decisions in real time in front of the auditor.
The real cost here is the hours burned on reconstruction and responses, and afterward on writing replies and carrying out corrective actions that are broader than they needed to be.
What to do about it: a work plan
The idea is not to add more records.
A strong documentation system lets the organization define the boundaries of a problem itself, before the auditor does.
1. Follow one process from end to end
Choose one process that crosses systems, such as CAPA, a document change, training, or handling a nonconformance. Take a real case from the past few months and follow it from opening to closure, not according to what the procedure says, but according to what actually happened.
At every step, ask where the information is, who entered it, who it was passed to, and how you know it was passed on in full.
2. Mark the seams
The seams are the places where information is copied by hand, sent by email, retyped into another system, reconciled manually between two files, or kept outside the main record. That is where most gaps are created.
Give priority to the points that prevent you from doing two things: defining the affected population, and confirming that the action was effective.
These are the two questions an auditor will always ask, and they are also what defines the scope of the review.
At another company I supported, training acknowledgments were kept on a paper form that was scanned to a network folder, while the list of employees required to take the training was managed in a separate Excel file that the HR manager updated as people were hired. The two sources did not talk to each other. When a new employee joined mid-month, they were added to the list but not always to the training. This is a classic seam, and the solution was simple: one source of truth for the employee list, from which the training matrix is derived.
3. Documentation controls you must have
These are the controls I check in every gap assessment:
Clear ownership of every type of record: who is responsible for creating it, who approves it, and who keeps it.
Controlled templates, not a Word file copied from someone's computer.
A reliable version history, including what changed and why.
Links between related records, such as a CAPA that refers to the complaint, the risk analysis, the document change and the training that came out of it.
Access and editing permissions: who can change a record after it has been closed, and how you can see that this happened.
A defined retention policy that meets MDR requirements and FDA requirements, as applicable.
Evidence for the decision, not just the outcome: why this action was chosen and what was considered.
An audit trail in computerized systems, including systems nobody thinks of as quality systems.
Where to start
The difference between a short audit and one that keeps rolling and widening depends mainly on the organization's ability to show where the problem starts and where it ends, and less on the quality of the system itself.
If you have an audit coming up, the exercise of following one process from end to end is the most effective place to start.
It takes about a day of work, and in my experience it uncovers the same gaps the auditor would reach, only earlier, while there is still time to fix them.