Auditor overreach or a real gap? How I tell in the room

The 9:14 a.m. request

Day two of an external surveillance audit. The lead auditor set her coffee on the table and asked for a complaint log going back two years. We have one. I knew what she was going to say when she saw it. Half the items she would call "complaints" were logged as "feedback" — written inquiries from clinicians about device operation that did not, by my procedure's read, constitute complaints.

This question comes up at three of our last five audits: how do you tell whether the auditor is pointing at a real gap, or asking for a record the standard does not require you to keep? The answer is in the room, not after. By the time the finding lands on paper, you have lost the chance to frame it.

Years ago I would have reached straight for whatever she asked for. The Tamil word that fits is கடமை (kadamai) — duty, the reflex to comply first and justify later. Years of audit prep have taught me to slow that reflex. Not to defy, not to fabricate, but to read the clause before reaching for the file.

The mental model I use

There are three shapes this kind of question can take.

• A real gap. The standard explicitly requires a record you do not have. ISO 13485:2016 §8.2.1 requires complaint handling records. §8.3 requires nonconforming product records. §7.6 requires calibration records. §7.5.5 requires traceability records for implantable devices. If your procedure says you keep them and you do not, the auditor is right. Acknowledge and CAPA.
• Auditor overreach. The standard says "maintain records that demonstrate the QMS is operating effectively" — a general obligation under §7.5.1 — but does not enumerate the specific record the auditor names. The auditor has invented a record type that exists nowhere in your QMS and is not demanded by the standard or your notified body's audit checklist.
• The grey zone. The standard requires "documented information" for a clause, the auditor names a specific format, and your procedure does not. Both readings can hold. EU MDR and ISO 13485 lean on outcome language precisely so they can be read in different ways. The auditor's interpretation is defensible; so is yours.

What I