DEV Community

James Whitfield
James Whitfield

Posted on

Bake audit‑readiness into daily work: map SOPs, verify links, and automate approvals

#qms #medtech #regulatory #compliance

I stopped treating "audit prep" as a quarterly fire drill two years ago. We're a 200‑person Class II shop using an eQMS, and the single biggest improvement came when I stopped hoping audits would be surprised by our readiness and started designing my day‑to‑day work so auditors would find evidence, not excuses.

This is a practical walkthrough you can apply today: map your SOPs, verify links automatically, and automate the dull parts of approvals while keeping humans in the loop. I’ll show the low‑lift wins I used, and the CI/webhook ideas I wish I'd had sooner.

1) Map your SOP landscape (30–90 minutes to start, then maintain)

If your QMS is a filing cabinet with a search bar, you’ll fail an audit on traceability.

What to build first:

  • A single spreadsheet or lightweight DB with one row per controlled doc:
    • doc id / title
    • owner
    • process(es) it governs
    • linked artifacts (work instructions, forms, test reports)
    • linked requirements / regs (ISO 13485 clause, 21 CFR 820 section)
    • last review date and next review
    • training status for impacted roles
  • Export this as CSV so tooling can read it

Why this helps:

  • Auditors ask "where does X live?" — your map answers in one line.
  • It shows gaps: an SOP with no owner, or a procedure that references a product spec that doesn't exist.

Practical tip: start with the 20% of SOPs that cover 80% of product/review activity (change control, CAPA, risk mgmt, device history file). Expand from there.

2) Verify links and references — automate checks

Broken or stale references in controlled docs are an easy citation.

Quick wins:

  • Export your controlled docs to HTML or plain text (most eQMSs can export PDF/HTML — if yours can't, export PDF and use a text extractor).
  • Run a weekly job that:
    • parses the HTML for hrefs and internal anchors
    • checks each URL with a HEAD/GET and flags non‑2xx responses
    • verifies internal anchors (do #section anchors actually exist?)
    • looks for references to other controlled-doc IDs and verifies they exist in your master map

Minimal Python snippet pattern (conceptual):

# pip install requests beautifulsoup4
from bs4 import BeautifulSoup
import requests

html = open('export.html').read()
soup = BeautifulSoup(html, 'html.parser')
links = {a.get('href') for a in soup.find_all('a', href=True)}

for url in links:
    if url.startswith('#'): continue
    try:
        r = requests.head(url, timeout=5)
        if r.status_code >= 400:
            print('Bad link:', url, r.status_code)
    except Exception as e:
        print('Error checking', url, e)
Enter fullscreen mode Exit fullscreen mode

Run this in a scheduled CI job (GitHub Actions, GitLab CI) or a simple cron on an internal server. Save the report as an artifact and email the owner.

Special cases: intranet links or files behind auth need a mapping table — mark them as "internal" and verify existence by a simple pattern match rather than HTTP status if you can't authenticate.

3) Automate approvals — but keep humans as the gate

Automating approvals doesn't mean auto‑signing. The rule I use: "AI or scripts propose, humans approve and sign." That keeps you aligned with safe assistance and with e‑signature requirements (think 21 CFR Part 11 and your regional equivalents).

Automation ideas:

  • When someone uploads a new controlled doc or revision:
    • trigger a webhook that creates a review task in your ticket system (or QMS task list) assigned to the SOP owner + one SME
    • prefill the task with the SOP map row (owner, linked artifacts) and the link‑check report
  • Send reminders (3, 7, 14 days) for outstanding approvals; escalate after 21 days
  • Allow "approvals guide work" — reviewers can start using the doc while review continues, but the approval workflow remains visible and requires sign‑off before the doc becomes the canonical version in the DHF
  • Store audit trail metadata with each approval: user id, timestamp, comment, and the diff/attachment that was approved

Implementation note: most eQMSs have webhooks or APIs; if yours doesn't, use a middleman (Zapier/Make or an internal lambda) to watch an email inbox or folder and kick off the workflow.

4) Gate production changes with CI checks (small but powerful)

When engineering changes touch documents or require SOP steps, enforce traceability at merge time.

Simple pattern:

  • In PR template require a "Traceability" section linking to SOP IDs and CAPA/change request IDs.
  • Add a CI job that:
    • scans PR text for controlled‑doc IDs and verifies they exist in the SOP map CSV
    • fails the check with a clear message if links are missing This shifts missing traceability from "audit finding" to "PR feedback" — a much less painful time to fix.

5) Build a continuous audit snapshot

Nightly or weekly, export:

  • current controlled doc PDFs
  • the approval history CSV for the period
  • the SOP map snapshot

Zip and store with a timestamped index. When an auditor asks for "evidence for Q1," you can hand them a delimited bundle that is already cross‑referenced.

Low lift next steps you can do today

  • Export a list of controlled docs to CSV and add owner/process columns
  • Run a link checker on one exported SOP HTML and fix the top 3 broken links
  • Add a PR template field for SOP IDs and put a simple CI check to scan for them

Audit readiness stops being a dread when it's a byproduct of how people work. Small automation + a clear map + human approvals = fewer surprises.

What's one automated audit check you've put in place that surprised auditors (or your QA lead) in a good way?

Top comments (0)