I watched this short walkthrough (linked below) and built a practical, time-boxed plan from it that I’ve used in audit prep for Class II products. If you’re staring at an incoming audit or a notified-body timeline and can’t afford a year-long IT project, this is the lean path that actually gets you to inspection readiness without the scope creep.
Video: https://www.youtube.com/watch?v=3F6zkaS5XPk
Why this matters to me
I’m a Senior Quality Engineer at a ~200-person Class II shop; we’ve faced the classic trap: wanting a “perfect” QMS upgrade that never ships. Audits don’t wait for perfect tooling. What does work is a focused, evidence-first approach that maps to ISO 13485 and FDA inspection readiness (21 CFR 820.22) and shows the auditor the controls you actually execute.
Below is a condensed, pragmatic plan you can run as a series of 2–4 week sprints.
Core principles (what keeps it lean)
- Prioritize evidence over elegance. Auditors want proof you control processes; they don’t care whether your SOPs live in a bespoke database or a network share.
- Work top-down from risk and regulation: identify the minimum set of artifacts auditors will call for (Design History File, device master record, CAPA records, internal audits, supplier controls, training evidence).
- Minimize simultaneous scope: pick one document class or process to normalize each sprint (e.g., Design Controls first, then CAPA).
- Use “good enough” tools today; automate later. Manual evidence that’s consistent and traceable beats incomplete automation.
8-week sprint plan (high level)
Week 0: kickoff & scoping (half week)
- Identify the audit date and the auditor’s expected evidence list.
- Assemble a small cross-functional core team: QA lead, one engineer, one document owner, and one sysadmin.
- Pick your sprints: Document control, Design History, CAPA, Training/Internal Audit.
Sprints 1–2 (weeks 1–4): Document control + Design Controls
- Export or centralize the top 20 controlled documents that auditors will request (SOPs for design control, complaint handling, CAPA, supplier controls, validation plans).
- Ensure each doc has: revision history, approval signatures, controlled distribution list, and applicable training records.
- For Design Controls: gather Design Inputs, Outputs, Verification/Validation records, and your trace matrix. If your traceability is incomplete, create a concise trace matrix for the current product version — auditors prefer a clear map over a sprawling, half-complete system.
Sprint 3 (weeks 5–6): CAPA and Supplier Evidence
- Triage open CAPAs: close what can be closed with objective evidence. For those remaining, ensure there’s a documented investigation, containment, root cause, and planned corrective action with timelines.
- Compile supplier contracts, incoming inspection records, and supplier evaluation evidence. If supplier files are messy, extract the critical evidence packet: supplier evaluation, certificate of compliance, incoming quality inspection for the last 3 shipments.
Sprint 4 (weeks 7–8): Internal audit, training, and pack the evidence folder
- Run a scoped internal audit aligned with clause 8.2.2 (ISO 13485) and 21 CFR 820.22 expectations. Use a short checklist focused on high-risk areas: design controls, CAPA, complaint handling, document control.
- Ensure training records show competency for key SOPs. If training is incomplete, run targeted sessions and log the records now.
- Build the “auditor packet”: a single folder (digital and a small physical binder if needed) that contains a table of contents and hyperlinked evidence. Include a short process map for each major system (Design Control, CAPA, Complaints) that shows the flow and where evidence is stored.
Tactical tips that saved me time
- One-page process maps: auditors appreciate a one-page diagram that points to where evidence lives (folder X, ticket system Y). It reduces their friction and your time answering navigation questions.
- Use timestamps and hashes for exported docs: when documents are exported from a QMS, record the export date and a checksum. It’s cheap assurance that the exported packet matches the system state.
- Bulk exports first: if your QMS supports CSV/zip exports, pull everything and then curate. If not, export the critical artifacts one-by-one but keep a manifest.
- Short-lived change freezes: impose a 2-week freeze on non-critical document changes before the audit to avoid last-minute confusion.
- Evidence index: each evidence item should have a 1-line caption: what it is, why it’s relevant, and the controlling requirement (ISO clause or 21 CFR section).
When to automate (and when not to)
Automate the repetitive parts that will free time for investigation and remediation:
- Automated training completion reminders
- Export scripts that create the evidence manifest and packaging
- Webhooks that link a Jira issue to a CAPA record (if you have the API path already)
Don’t automate if it risks delaying the audit. If building the integration will take >2 sprints, defer it and focus on manual, auditable processes first.
What to expect in the room
Auditors will probe:
- Do you follow your procedures (not just have them)?
- Can you show objective evidence for recent activities?
- Do you have a risk-based rationale for decisions?
A well-curated evidence pack and a crisp process map answer most of these quickly.
Final note — practical mindset
An audit is a snapshot. Your goal is to present a coherent, traceable story for how you manage quality. The lean approach trades polish for clarity and completeness. It’s not about cutting corners; it’s about delivering the right evidence in the right order so the auditor can see that controls work.
I’d be curious: which single artifact would you prioritize if you had only two weeks before an auditor walks in — a complete DHF trace matrix, closed CAPAs, or documented internal audits? Why?
