Audit readiness self-assessment — Part 11, Annex 11, ISO 13485, FSMA 204

1 / 10 · Records

How are batch / production records captured today?

Paper forms transcribed laterMix of paper + spreadsheetsElectronic, but in a tool not designed for GxPValidated electronic system with audit trail

2 / 10 · 21 CFR Part 11

Are e-signatures linked to a unique authenticated user, with reason for signing?

We use paper signaturesShared logins / kiosk accountsPer-user login but no reason capturedPer-user login + reason + audit trail

3 / 10 · 21 CFR Part 11

Can you produce a tamper-evident audit trail for any record on demand?

NoFor some systems, not allYes, but it takes hours to exportYes, instant export with full history

4 / 10 · Training & competency

Are operators blocked from work they aren't trained / qualified for?

No — relies on supervisor judgementPaper training matrix, reviewed quarterlySystem enforces it for some stepsEvery regulated step gates on live training records

5 / 10 · Document control

How do you guarantee operators are working from the current SOP version?

Printed binder at the lineShared drive, operators check before startingDMS with controlled distributionKiosk renders the current effective version automatically

6 / 10 · Quality events

When a deviation happens on the floor, how is it captured?

Verbal → email → form days laterPaper deviation form, scanned laterLogged in a system, manually linked to CAPASource capture, auto-linked to CAPA + genealogy

7 / 10 · Traceability

How fast can you complete a forward + reverse lot trace?

Days, with spreadsheet workHours, by querying multiple systemsUnder an hourSeconds, on demand, in either direction

8 / 10 · Equipment

Is in-tolerance status enforced before an instrument is used in a regulated step?

We trust the sticker on the deviceCalibration spreadsheet, no kiosk enforcementSystem tracks calibration, partial enforcementOut-of-cal instruments are blocked at point of use

9 / 10 · Change control

How are SOP / spec / recipe changes approved and rolled out?

Email approval, manual rolloutForm-based, but rollout is manualDMS with approval workflowVersioned, e-signed, auto-effective at the kiosk

10 / 10 · CSV / GAMP 5

Do you have a vendor-supplied validation pack (IQ / OQ / PQ) for your QMS?

No — we built everything in-housePartial, very out of dateYes, but we re-do most of it ourselvesYes, current, executed each release

Answer all 10 questions to see your score (0/10 done).

Would you pass an audit tomorrow morning?