Know exactly what your audit evidence contains.

A binder copies the evidence. Seal opens the record.

A traditional eQMS is a system of record. Its audit module schedules the audit, files the report and tracks each finding as a task, while the evidence is exported from the batch, training and equipment systems into a binder or a shared folder and checked by hand for version and completeness.

A copy cannot say which version of a record it came from, or that the record has changed since. So each audit starts again from a blank checklist or last year’s agenda, and a finding closes when its tasks do, whether or not the question behind it was answered.

In Seal the evidence is the record itself. The audited batches, deviations, changes and training share one record, so a package references each source at the version selected for it, with its history, rather than a copy made for the audit. A gap is an open request with an owner. A finding links its assessment, the change it leads to and the verification, and the corrective action can change the workflow that produced the gap instead of adding a note to a procedure.

Figure 1 follows internal audit AUD-⁠014, which samples batch reviews B-⁠041, B-⁠044 and B-⁠047. Package PKG-⁠014 keeps B-⁠041 and B-⁠044 at the version selected, v1, although B-⁠041 has since been revised to v3. B-⁠047’s review evidence has not been supplied, so the gap becomes owned work, and the audit’s follow-up runs as four records: obtain the source, assess the gap, prepare a workflow change and verify retrieval. The sections below follow AUD-⁠014 from the programme to the effectiveness review.

Acclinate spends 40% less time preparing for audits: the evidence that the right documents were in place and that people were trained on them is produced as part of normal work, so there is less to assemble. When customers audit its quality system, approval histories, training records and access controls are shown directly from Seal. Bioventix, regularly audited by the diagnostic companies that depend on its antibodies, runs its document control, training, audits and CAPAs in Seal.

You can start with one audit, alongside the eQMS you already run: Seal connects to the documents, CAPAs and change controls in systems such as Veeva Vault QMS, MasterControl, Qualio and ETQ Reliance. The advantage grows as quality, manufacturing and laboratory work run on the same connected records: the evidence an auditor asks for is then the record of the work, not a copy assembled for the audit.

Plan each audit from risk and history.

The programme decides what is audited, when and by whom. Base it on risk, earlier findings and what has changed, and keep the reason for each choice, and for any deferral, with the scope.

EU GMP asks for personnel, premises, equipment, documentation, production, quality control, distribution, complaints and recalls, and self-inspection itself to be examined at intervals under a pre-arranged programme, in an independent and detailed way, by designated competent people.¹ FDA’s quality systems guidance expects the audit schedule to take account of the relative risk of each activity, the results of previous audits and corrective actions, and the need to audit the complete system.² ICH Q7 asks for regular internal audits to an approved schedule.³

A batch-review audit, a supplier visit and a laboratory audit ask different questions, so they need different scope, evidence and people. Each engagement in Seal records its focus, window, lead and preparation state, and opens into its own scope, agenda and evidence requests. In Figure 2, AUD-⁠014 examines evidence retrieval for batch review, AUD-⁠015 the qualification of a supplier site and AUD-⁠016 access to laboratory methods.

Record the assigned auditor’s competence and independence as evidence in their own right; a name on the schedule establishes neither. The assignment keeps the auditor’s role, qualification and independence, any conflicts or restrictions, and its approval. The FDA guidance also asks that auditors be trained in gathering objective evidence.²

Supplier audits run from the same programme. EU GMP requires audits of the manufacturers and distributors of active substances, with a report that fully reflects what was done and seen and identifies any deficiencies, and further audits at intervals set by quality risk management.⁴ Bring the supplier’s approved scope, changes and unresolved qualification work into preparation, and follow the evidence into the review without treating a supplier’s name as blanket approval. Supplier quality covers the qualification itself.

Client and regulatory audits of your own site run as engagements too. Each request keeps the auditor’s wording, its clarification, owner, priority and due time, the evidence that answers it, and its review and delivery.

Know exactly what the evidence contains.

An evidence package in Seal references each source at the version selected for it. If the source is revised later, the package keeps the version it contained, and replacing it is a separate, reviewed decision.

When an auditor asks for a batch review, the package should show which version of that record was selected and why. PKG-⁠014 answers request REQ-⁠014 with a targeted sample of three batch reviews. It links B-⁠041 and B-⁠044 at v1. Seal’s version warning on B-⁠041 shows that a newer revision exists, and the package still points to v1. B-⁠047 is listed as missing, with REQ-⁠015 as the open work to obtain it, so the package’s state is incomplete.

New evidence belongs to a new source version. Seal’s version comparison sets B-⁠041’s original finding beside the added reconciliation, a reported and reconciled yield of 97.2%, and its technical review is still open. Inspecting that revision does not replace the packaged source. If the team decides v3 belongs in the package, the replacement is reviewed and recorded with its reason.

Keep the request’s exact wording, the selection rule and the specific source versions together. The sample records its population, selection method, strata and any replacements or exceptions, so a reviewer can see why these three batches, and not others, were chosen. In these captures, Published marks a saved version of a record. Technical review, disclosure approval, delivery and audit acceptance are separate decisions.

During a regulatory inspection the same records answer live requests. Inspection readiness covers the request log, the package as delivered and evidence for the date of the work.

Neil prepares the evidence. Your team decides.

Neil is Seal’s AI agent. Bring it the request, the procedure and the records you can access; it locates candidate sources, compares the selected versions with later revisions and prepares linked requests for whatever is still missing. The result is work in Seal, with owners and states the audit team can check, rather than a summary to paste into a response.

To prepare the evidence response, ask Neil to find the batch reviews selected for the request and show their versions and anything still missing. It assembles the candidate sources, compares the selected revisions with later changes and prepares linked requests for the missing evidence, keeping the selection rationale available for disclosure review.

To investigate a recurring finding, ask it to compare the finding with earlier audits: what recurred, and what would distinguish the possible causes? It traces the findings into their responses and effectiveness records, and prepares an assessment with the evidence for and against each explanation, the gaps to resolve and proposed follow-up work. It does not return a root-cause verdict the evidence cannot support.

To configure the request workflow, ask it to turn your inspection procedure into a reusable evidence-request and review workflow. It authors the templates, capture fields, source references and review states in Seal, and prepares verification cases for a missing source, a changed revision and an unauthorised completion attempt. Your team tests and approves the configuration.

Neil uses supplied documents and permitted records. Proposed records and configuration need review; people authorise disclosure, test changes and approve publication. In line with the EU’s draft GMP Annex 22 on AI, Neil is not used in GMP execution. It helps set up configuration, which your team verifies and releases under change control. Customer data is not used to train AI models, and the requester’s permissions govern what Neil can read. See how Neil fits Annex 22 and more about Neil.

Treat a finding as a question to answer.

A finding is answered when the evidence shows why the gap arose and that it has been fixed, not when its tasks are complete. Keep the source request, the assessment, the change and the verification as separate records, each with its own owner and state.

In the example, B-⁠047 is in the audit sample, but its review evidence has not been supplied. The first step is to obtain the source and establish why it was missing. REQ-⁠015 assigns that to the batch record owner, links back to the package and stays open until the source and its revision are linked, or the reason it is unavailable is recorded and the gap escalated. A request is not evidence. A retrieval problem and a missing technical review are different problems with different fixes, and neither should be recorded as the cause until the evidence supports it.

Establish the condition and its supporting evidence before classifying a finding. An observation records the condition, where it was seen, the evidence and the criterion it is judged against. The finding states the requirement, the scope, its severity and whether it recurs. An observation alone does not establish a root cause.

Seal keeps the source request, the assessment, the proposed change and the verification as separate records linked to the package, each with its own owner, due date and state. Here the batch record owner obtains the source, the audit lead assesses the gap, quality systems prepares the workflow change and an independent reviewer verifies retrieval. The assessment, the change and the verification are still open, and a completed task cannot stand in for an unanswered question.

ICH Q10 expects the CAPA system to take in corrective and preventive actions resulting from audits, regulatory inspections and their findings, with an investigation whose effort is proportionate to the risk.⁵ EU GMP asks for each self-inspection report to contain all its observations and, where applicable, proposals for corrective measures, and for the actions subsequently taken to be recorded too.¹ ICH Q7 asks that findings and corrective actions be brought to the attention of responsible management, and that agreed actions be completed in a timely and effective manner.³

Because findings, responses and source records share one platform, the audit team can follow a finding into the batch record, procedure version or training record it concerns, and into the CAPA it opens. The corrective action can then change the workflow that produced the gap, through change control, instead of adding a note to a procedure.

Close on evidence of effectiveness.

Decide how effectiveness will be shown before an action is called complete, then close on that result. Task completion and effectiveness are separate decisions.

Define the population, selection rule, review period and acceptance criteria for the specific action, then retain the source versions, exceptions and the reviewer’s decision. For the missing batch review, the verification tests retrieval after the approved change against a defined batch population, keeping each source, its version, the retrieval time and any exception, and the results are assessed before the work closes. That might mean sampling later batch reviews and confirming that each can be retrieved at the version the package cites.

ICH Q10 asks for the effectiveness of corrective actions to be evaluated in commercial manufacturing.⁵ FDA’s quality systems guidance expects the managers responsible for the audited areas to resolve findings in good time and to make sure follow-up actions are completed, verified and recorded.²

The follow-up record matters beyond the audit itself. In a routine inspection, FDA’s policy is not to review or copy the reports of a quality assurance programme’s audits; it may instead seek written certification that the audits were implemented, performed and documented and that any required corrective action was taken.⁶ The evidence that your audit system works is the programme, the findings and their verified follow-up, kept where they can be shown.

If a commitment continues beyond audit closure, such as a response promised to an authority or a client, keep its owner, due date, evidence and follow-up visible after the audit record closes. Configure the review and disclosure steps that closure itself requires. In this fictional example, the assessment, change and effectiveness review are still open.

Report the programme to management review.

Management review should see the results of audits and inspections, the commitments made to regulators and whether corrective actions worked. In Seal those are records, so the review reads them from the programme rather than from a summary assembled for the meeting.

ICH Q10 asks for the management review of process performance and product quality to include the results of regulatory inspections and findings, audits and other assessments, the commitments made to regulatory authorities, the effectiveness of changes arising from corrective and preventive actions, and follow-up from earlier reviews. Its review of the pharmaceutical quality system adds self-assessments, including audits, and external assessments such as regulatory inspections and customer audits.⁵ EU GMP expects a process for self-inspection or quality audit that regularly appraises the effectiveness and applicability of the quality system, and a periodic management review with senior management involved.⁷

Repeat findings show where the programme should look next. A finding linked to an earlier audit’s finding and effectiveness review shows whether the earlier action worked. In the connected records of Appendix A, FIND-⁠022 is a major repeat finding for an ineffective periodic access review, and its second effectiveness verification is scheduled after the problem recurred in one department. When the programme itself changes, as AUDIT-⁠PROGRAM v04 did after a supplier-quality signal, the earlier version and the reason for the revision are kept.

Start with one audit.

Bring one real audit request and a small, defined evidence population: its scope, the relevant procedures and the records you can already access.

Neil prepares the candidate evidence, the requests for what is missing and the request workflow from that material, and your team inspects them against how the audit should run. Start with sample material or arrange an NDA before sharing confidential records.

Prove selected versions, a missing source and a reviewed replacement, with the required access and approval steps, before extending the workflow to the rest of the audit schedule. Then follow one finding through its assessment, change and effectiveness review.

Seal can run beside the eQMS you already use. Agree which system owns the audit record, which records Seal reads and how status crosses the boundary. To scope the first audit with us, book a demo.