Audit Management Software: Internal Audit to CAPA Loop That Stays Inspection-Ready

Internal audit that dies in a PDF is a calendar event. Inspection-ready audit management is a loop: plan, execute, record findings, grade them, feed CAPA or corrections, verify, and show the trail the next time an investigator asks how you know your QMS works.

This article is for Quality Managers and audit program owners under ISO 13485:2016 clause 8.2.4 (internal audit) and FDA QMSR. The software requirements below keep the loop closed. FDA's QMSR FAQ: Quality Management System Regulation – Frequently Asked Questions.

Cloudtheapp runs audits as a connected process with CAPA and documents. Use the checklist if you evaluate any validated eQMS.

Why the PDF binder fails

The schedule lives in a spreadsheet. Checklists live on laptops. Findings are emailed. CAPA is opened weeks later with a different number and no link. Effectiveness is a memory. When FDA or a notified body asks for last year's internal audits, you assemble a zip file and hope the dates match.

Software has to make the schedule, the finding, and the CAPA the same story.

Program and plan

• Annual (or defined period) audit program covering QMS processes, not only the warehouse
• Risk-based frequency: previous findings, process changes, new products, supplier risk, regulatory signals
• Auditor qualification on file, including independence from the process being audited
• Site and process as controlled fields
• Lead auditor and team assigned before the audit starts
• Notification and agenda stored on the record

ISO 13485 expects audits at planned intervals. "We audit when we can" is not a program.

Execution

• Checklist or process questions tied to the procedure or clause
• Objective evidence field: record IDs, lot numbers, interview notes
• Finding classification: major, minor, observation, opportunity, per your SOP
• Immediate correction captured without pretending it is CAPA
• Opening and closing meeting notes
• Remote or on-site flag (useful after 2020, still useful for CMOs)

If the checklist is a disconnected Excel file, you will not trend "document control" findings across three years.

Finding to CAPA loop

This is the requirement most modules fake.

• Each finding is a child record with owner, due date, and status
• Link to CAPA when the procedure says the finding is systemic or major
• Link to a simple correction/containment when the procedure allows it
• Cannot close the audit while required findings are open, or a documented exception with QA approval
• Verification of completion and, where required, effectiveness, with a second date
• Repeat finding flag when the same clause or process failed before

An investigator will pick one major finding and ask for the CAPA number, the actions, and whether it came back. If those are three systems, you will spend the inspection reconstructing.

Independence and competence

• Auditor cannot be the process owner for that audit
• Training and qualification records linked (see the training article in this series)
• Guest auditors (consultants) get time-boxed access
• Conflict of interest noted when a small company has no choice but to use adjacent staff, with QA mitigation documented

Reporting and management review

• Audit report generated from the record, not rewritten in Word as the official copy (Word can be an output; the record stays in the system)
• Metrics: plan versus complete, findings by process, aging, repeat findings, CAPAs from audits
• Inputs ready for management review

Suppliers and external audits

• Supplier audit type distinct from internal
• Link to supplier record and to incoming quality issues
• Remote evidence requests tracked
• Certificate and questionnaire dates if you still use them as part of control, not as a substitute for audits you already decided you need

Part 11, access, validation

• Unique users, signatures with meaning on report approval
• Audit trail on status changes and finding grades
• Site-based access so Plant A does not browse Plant B's dirty laundry without a role that allows it
• Validation: intended use of the audit workflow, risk, vendor package, tests of finding-to-CAPA

Demo script

Ask the vendor to schedule an audit, log a major finding, open CAPA, close the CAPA with a failed effectiveness, reopen, and show the audit still knows. Then export last year's program versus actual.

Cloudtheapp Fast Track can include audits in a later wave if document control, training, and CAPA go first. Do not buy an audit calendar with no finding object.

Refuse to buy

Refuse a tool that is only a scheduler, or that stores findings as comments. Internal audit is how you prove the QMS is alive. The software either holds that proof or you will rebuild it under time pressure.