Workflow

Flow 17 — Quality audit programme and findings

Approve a risk-based audit programme and engagement plan, execute independent fieldwork, retain immutable report and response versions, verify findings and close only after linked NCR/CAPA completion.

Overview

Inventory meaning

Quality audit records are assurance evidence only. They never create, block, move, release or adjust inventory; they never change a supplier approval or product baseline, automatically close an NCR or send an external message.

Responsible roles

Quality Audit Manager → different QA Head → different Internal Auditor → different Quality Engineer process owner → QA Head → read-only stakeholders

Process

1
Programme
Author risk, period, scope and criteria; QA rejects or approves immutable versions.
Assurance schedule · Inventory unchanged
2
Audit plan
Assign a distinct auditor and process owner with bounded sampling and evidence.
Independent assignment · no operational authority
3
Fieldwork
Assigned Internal Auditor starts and samples controlled objective evidence.
Read/evidence activity · no stock action
4
Report
Submit immutable report/findings; QA accepts or requires a new version.
Finding facts · no automatic NCR closure
5
Response & verify
Process owner links NCR/CAPA; QA rejects or verifies effectiveness.
Corrective-action gate · custody unchanged
6
Independent closure
Close only after effective responses and closed linked NCR/CAPA records.
Audit closed · read-only history
READ ONLY

Role handoff

Quality Audit Manager → different QA Head → different Internal Auditor → different Quality Engineer process owner → QA Head → read-only stakeholders

Detailed reference chapters

Quality audit programmes, findings and closure Nonconformance and CAPA governance Controlled documents and evidence roles

Detailed steps

1
As Quality Audit Manager, open Quality → Audit programmes and create programme v1 with site, period, frequency, objectives, scope, criteria, risk basis, classification and CLEAN evidence. Submit it for independent QA decision.
2
As QA Head, reject programme v1 and confirm it remains immutable. Have the manager create/submit v2, then approve it. Under the active programme, create audit plan v1 with distinct Internal Auditor and Quality Engineer process-owner assignments.
3
Reject plan v1 as QA, retain it, then create/submit/approve plan v2. Confirm the author, lead auditor, process owner and QA approver are four different named users.
4
As the assigned Internal Auditor, record opening/fieldwork evidence and submit report v1. Reject it as QA, confirm it remains immutable, then submit and accept corrected report v2 with objective findings.
5
As the assigned Quality Engineer process owner, answer each major/minor finding with root cause, correction, systemic corrective action, completion evidence, effectiveness criteria and a same-site NCR/CAPA link. QA rejects response v1 and verifies immutable response v2 as effective.
6
Attempt closure while the linked NCR/CAPA remains open and confirm it is blocked. Complete that Flow 13 record separately, then close the audit as QA with CLEAN evidence and any follow-up date.
7
As Supplier Quality Engineer or read-only Auditor, reconcile every actor, version, evidence link, audit/outbox fact and confirm inventory, supplier approval and product baseline state did not change.

Field-by-field practice data

Use a disposable training tenant

Draft a risk-based internal audit programme for the training site. The page shows sample set A; the workbook includes independent A, B and C values.

Download all workflow samples (.xlsx)

Field names match the current application labels. Select existing approved records where shown, leave optional values blank unless they genuinely apply, and never copy fictitious TRAIN values into live work.

Quality Audit Manager

Create the audit programme

Open /quality/audits

Define the period, objectives, scope and criteria, then submit to an independent approver.

Exact field name	Requirement	Sample value A	How to use it
Site	Select existing	`COM-01`	Select the audited site.
Title	Required	`TRAIN-A Q4 receiving and traceability audit`	Use a clear controlled title.
Frequency	Required	`ANNUAL`	Select the approved cadence.
Period start	Required	`2026-10-01`	Start of the governed programme period.
Period end	Required	`2026-12-31`	End of the governed programme period.
Classification	Required	`RESTRICTED`	Match the audit evidence.
Objectives	Required	`Verify inbound authority, quarantine and batch-traceability control effectiveness.`	Define measurable audit objectives.
Scope	Required	`Receipt through putaway for TRAIN-A material at COM-01.`	Bound organisational and process coverage.
Criteria (one per line)	Required	`Company receiving procedure Batch traceability control Approved procurement clauses`	Enter one controlled criterion per line.
Risk basis	Required	`High-criticality material and new supplier route.`	Explain why the audit is prioritised.

Expected result: The approved programme authorises later audit planning but does not alter source Quality records.

End state

One closed Quality audit retains an approved risk programme, independently approved plan, immutable rejected/replaced reports and finding responses, effective verification and closed NCR/CAPA provenance while operational authority remains in its owning modules.