During a recent customer audit, a reviewer asked me to produce three records for one rejected component lot:
- The incoming inspection report
- The nonconformance record
- The corrective and preventive action record
We had all three. What we did not have was a defensible chain between them.
The material had been quarantined before use. The supplier had responded. The CAPA existed. But the evidence sat in an incoming-inspection application, a shared drive and a CAPA spreadsheet.
The reviewer was not primarily interested in why the component failed. They wanted to know:
- Was the record approved and current?
- Did it identify the affected lot?
- Was the supplier evidence attached?
- Did the disposition reference the investigation?
- Did the effectiveness check close the same issue that was opened?
We spent the morning reconstructing the history. The underlying quality work was sound; the proof was fragmented.
Why auditors end up in the document room
I do not have credible stopwatch data proving that ISO 13485 auditors spend exactly 80% of their time on formatting and 20% on quality. I would not manufacture that statistic from a handful of audits.
But I can defend a related practitioner observation: a large portion of audit preparation at our contract manufacturing site is spent making evidence understandable, retrievable and connected.
This is partly what ISO 13485:2016 asks for. Auditors can sample documented information related to:
- Document control under clause 4.2.4
- Record control under clause 4.2.5
- Monitoring and measurement under clause 8.2.6
- Control of nonconforming product under clause 8.3
- Corrective action under clause 8.5.2
Quality-system conformity is demonstrated through evidence. When that evidence is incomplete, outdated or disconnected, the reviewer must reconstruct it.
That does not mean auditors are obsessed with neat binders. A procedure without execution evidence is merely a claim. A training record without evidence that the trained activity occurred is another claim. A CAPA without a documented effectiveness review is an unfinished claim.
Formatting becomes the visible burden because traceability is the underlying requirement.
Where CMO reality makes the multiplier worse
We work with more than 40 suppliers and process close to a thousand certificates of analysis in a typical quarter. Each certificate may need to be connected to:
- The supplier and manufacturing site
- The material and lot
- The applicable specification revision
- The incoming inspection result
- Any nonconformance or deviation
- The final material disposition
In a device-maker’s QMS, much of this evidence is internal. In a CMO, it crosses organisational boundaries.
An OEM may own the design and control the specification. We own incoming inspection, supplier performance, production controls and manufacturing records. The quality event may begin in a supplier’s process, continue in our goods-in area and end in a disposition recorded by our team.
When each handoff has its own format and storage location, formatting effort multiplies.
A supplier may provide a valid certificate with a clear result, but if it cannot be joined to the lot we inspected, our team spends time transcribing and reconciling it. The incoming inspection may be correct, but if its reference to the certificate is buried in a note field, the reviewer will still have to reconstruct the connection.
Nobody in that chain necessarily failed to do the right technical work. The system failed to preserve the proof.
The distinction I wish audit reports made
There is a difference between cosmetic formatting and traceability work.
Formatting waste looks like:
- Converting the same record into several file formats
- Renaming files to satisfy a checklist
- Copying information into a template after it was captured elsewhere
- Maintaining parallel spreadsheet and QMS versions
Traceability work looks like:
- Linking the supplier certificate to the inspected lot
- Connecting a nonconformance to its containment decision
- Preserving CAPA ownership, evidence and effectiveness checks
- Showing how a risk assessment changed after corrective action
Auditors require the second category. Process automation should remove the first.
The problem is that many QMS tools are good at generating compliant-looking records without solving the joins between operational evidence. The output becomes polished, but the history is still fragmented.
Automation should preserve the decision, not decorate it
For a small medtech manufacturer, useful automation should do at least four things.
- Capture information once, close to the work where it happens.
- Preserve links between records, lots, suppliers, risks and actions.
- Keep human review and approval visible.
- Make missing evidence or unresolved actions obvious.
Controlled assistance can help here. AI-assisted CAPA drafting may summarise inspection history, supplier responses and recurring nonconformances. But the generated explanation must remain reviewable and traceable to its sources. A polished root-cause paragraph without evidence behind it is merely formatting at a higher level.
This is where I remain sceptical of broad “AI in QMS” claims, including those around our own products.
qmsWrapper publicly positions itself around quality workflows for device makers and SaMD teams, including a bridge between development work in Jira and quality oversight for FDA and ISO 13485 workflows. That connected-workflow model is relevant to many SMEs.
But at a CMO, “connected” has to include supplier evidence, lot genealogy, incoming dispositions and CAPA effectiveness across external boundaries. I would not assume a device-maker-oriented workflow automatically solves the supplier-side traceability problem we face.
Disclosure: I work on qmsWrapper and am giving my honest read of where it does not fit.
We should measure readiness differently
Page count is a poor measure of audit readiness. I would rather track:
- Time required to reconstruct a material-disposition decision
- Number of duplicate evidence records
- Broken links between nonconformances, CAPAs and effectiveness checks
- Overdue supplier corrective actions
- Time from nonconformance detection to documented containment
- Whether recurring supplier issues update the associated risk assessment
These measures tell us whether the QMS supports operational quality. They also expose whether process automation is removing work or simply producing more records.
The unpopular opinion I would defend is not that auditors are unfair or that formatting is quality. It is that a mature QMS should make operational quality easy to demonstrate. If most audit time goes into reconstructing documentation, the QMS has become a document repository with workflow attached.
For QA and RA leaders reading this: which part of your next notified-body audit consumes more time—finding the record, proving that it is current, or reconstructing the decision behind it?
Top comments (0)