An audit file should connect a device and its processes to current, usable evidence. A list of procedures or a supplier’s certificate is not the complete quality-management record.

01

Trace a selected device through the records

Start with device identity and relevant specifications. Connect design changes where applicable, purchasing and acceptance, production, release, distribution and service records. Show that versions and identifiers match. A hypothetical complaint about a batch should lead to the affected units and investigation, rather than a folder of unrelated forms.

02

Show why validation remains applicable

For a process requiring validation, retain the planned criteria, method, outcome and response to changes. Distinguish verification of an individual result from evidence that the process consistently achieves its intended result. A new machine, software version or outsourced step may need review; changing a document date does not establish continued validity.

03

Use complaint and corrective-action evidence

Connect complaints to investigation, risk review and any applicable reporting obligations. Track correction, cause, corrective action and effectiveness. Do not assume that closing a customer ticket ends every regulatory duty. Management review and internal assessment should reflect actual device/process results and unresolved issues.

04

Budget and verify the right outcome

Separate design work, validation, technical documentation, testing and regulatory-market fees from initial audit, surveillance and recertification. Read assumptions for sites, device groups, travel and additional assessments. Match a certificate’s issuer, entity, scope, edition and current status; check claimed accreditation separately. It is not product clearance, CE authorization or an exemption from FDA inspection.

05

Preparation and independent decision

ISO does not issue certificates. Verify the proposed issuer, standard and activity against any claimed accreditation scope. Consultancy cannot guarantee approval; the competent body evaluates evidence and makes the independent decision. The applicant implements the system and prepares procedures specific to its own operations and operating records. A certification enquiry to Kayra concerns actual activities, sites, application information, authority and impartiality risks; this role does not include designing or implementing the client’s system. A management-system certification body, other parts of the same legal entity and controlled entities cannot offer or provide management-system consultancy; separate contracts do not remove this restriction.

Sources and application limits

Examples are hypothetical record checks. Actual preparation time depends on process maturity and evidence gaps; neither a quoted date nor consultancy guarantees an approval.