Audit management software for GxP teams: six quality systems read against the audit file

A GxP quality team runs three kinds of audit, and each leaves a different file. The rule that asks for the file differs for a device maker, a drug maker and a GLP lab; the Part 11 controls on it do not. Switch between them.

The file only works if it stays joined up. A finding that opens a CAPA has to show that CAPA's status, and the CAPA has to point back at the finding; the CAPA software comparison reads the same quality systems from the CAPA side, and the deviation management comparison from the record that most often opens one. Where CAPAs are still opened on paper, the CAPA form template names the audit finding as the source record, so the link back survives there too. A supplier audit has a second link to keep: its outcome should move the supplier's approved status, the side the supplier quality management comparison reads.

Under the old QS regulation a device maker could keep its internal audit reports out of an FDA inspection. The regulation said its record-access section did not apply to management review, quality audit or supplier audit reports; an investigator could ask only for a signed certification that the audits had happened. The QMSR, effective February 2, 2026, dropped that exception.

Commenters asked FDA to keep the exception, and one pointed out that FDA's own inspection technique guide treated these reports as exempt. FDA said no, for three reasons: the exception is “not available to manufacturers being inspected by other regulators or being audited by other entities” such as MDSAP auditing organizations; the reports already exist and “should be readily available”; and its investigators already had access to the data behind management reviews, such as nonconformances and complaints, and to corrective actions resulting from internal and supplier audits 89 FR 7514.

For the software, the report has become a record you will hand over. That puts four controls ahead of the rest: the copy you give the investigator § 11.10(b), the trail on the report's edits and how long it is kept § 11.10(e), who could read the draft § 11.10(d), and the signatures on the final § 11.50. Drug makers have no exception of this kind to lose: Part 211 never uses the word “audit”. The QMSR guide for small device makers walks through the rest of the change.

The rows run in the order an investigator's request meets an audit file: the copy, the trail, its retention and who could see the draft, then the signatures, validation and EU Annex 11. The open-system row comes last; it matters only if suppliers or outside auditors work inside your system rather than sending their answers in.

TrackWise Digital's statuses come from the vendor's Part 11 and Annex 11 assessment, read on 2026-10-22; the document itself is dated March 2019, so ask for the one that matches the release you would buy.

The table reads by vendor; an audit program reads by control. This ledger turns it on its side: for each row, the vendors whose own pages describe the control, and how many only claim it or say nothing.

On the three rows an investigator's request leans on first (copies, the trail and its retention), TrackWise Digital and Veeva QMS describe all three on their own pages. The verdict goes to TrackWise Digital, which documents 9 of 10 rows, and to Veeva QMS, which documents 8 from the Vault platform's current help pages and runs external audits next to supplier quality, the pairing a device maker with contract manufacturers needs. Scilife takes the third row for its executed validation package rather than its rows. The medical device QMS comparison reads the device-specific suites.

Ideagen Quality Management describes running audits offline with checklists, which suits supplier sites with poor connectivity, but none of its rows are described on the pages we read, so take its Part 11 rows into the demo below.

The controls that make audit software different from a document system are not in our register: we read no vendor's pages on them, so we give no status. Pick the audits you run, copy the script into each demo, write the asks you keep into your user requirement specification, and test them again in validation. The signature manifestation check tests one signed report against § 11.50.

Each card shows the six rows an audit report leans on. Some quality vendors' pages could not be read on the read date, so they are not in this lineup; a missing vendor is not a verdict on it. For the same vendors read as whole suites, see the Part 11 eQMS comparison.

1. 21 CFR Part 11, Electronic Records; Electronic Signatures, eCFRread 2026-10-22
2. Part 11, Electronic Records; Electronic Signatures: Scope and Application (guidance, 2003), FDAread 2026-10-22
3. Medical Devices; Quality System Regulation Amendments, final rule, 89 FR 7496 (2024); Comment 55 at 89 FR 7514, Federal Registerread 2026-10-22
4. 21 CFR Part 820, Quality Management System Regulation (§§ 820.7, 820.10, 820.35), eCFRread 2026-10-22
5. 21 CFR 820.180, General requirements (text in force before February 2, 2026), eCFRread 2026-10-22
6. 21 CFR 820.22, Quality audit (text in force before February 2, 2026), eCFRread 2026-10-22
7. 21 CFR Part 58, Good Laboratory Practice for Nonclinical Laboratory Studies (§ 58.35), eCFRread 2026-10-22
8. 21 CFR Part 211, CGMP for Finished Pharmaceuticals (§ 211.192), eCFRread 2026-10-22
9. EudraLex Volume 4, Annex 11: Computerised Systems (2011), European Commissionread 2026-10-22