There is a moment in every audit I can set my watch by. I ask to see how a process actually works, and someone leans back, laces their fingers, and says, “Oh, we always do that.” They say it warmly. They believe it completely. And then I ask to see the last three times they did it, and the room gets very quiet.
That pause — that’s the whole job, really. Because an auditor doesn’t collect what you say you do. An auditor collects objective evidence: the records, the artifacts, the tangible proof that the thing happened the way your procedure says it should. Everything else is a nice conversation.
“Objective evidence” is a fancy phrase for “show me”
ISO 13485:2016 §8.2.4 — the internal audit clause — asks you to determine whether your quality system actually conforms to your planned arrangements, the standard, your own procedures, and the applicable regulatory requirements, and whether it’s effectively implemented and maintained. That last phrase is the whole ballgame. Not “documented.” Not “intended.” Implemented. And the only way to know something is implemented is to look at what it left behind.
ISO 19011 — the guidance every auditor secretly runs on — describes exactly three ways to gather that proof: you review records, you observe activities, and you interview people. Notice the order. Records first. A record is a fact with a date on it. An interview is a memory, and memories are generous to the people who hold them.
So a competent auditor is not being difficult when they say “show me.” They’re doing the only thing that counts. “We calibrate all our gauges” is a claim. The calibration certificate, in date, traceable to a standard, matching the gauge ID on the bench — that’s evidence. One of those survives an FDA inspection. The other one is a vibe.
The three sources, and where each one leaks
Each evidence type catches a different kind of problem, which is why good auditors triangulate.
Records tell you what happened on paper. A Device History Record, a training record, a CAPA file, an audit trail. But records can be beautifully complete and still describe a fantasy — the batch record signed off at 4:58 on a Friday by someone who wasn’t on shift.
Observation catches the gap between the procedure and the practice. I once watched an operator perform a step flawlessly — then reach past the work instruction to a laminated cheat sheet taped inside the cabinet, because the real way to do it had never made it into the controlled document. The record was perfect. The process was informal. Only walking the floor found it.
Interviews tell you whether people actually understand the system they’re living in. “What do you do if you find a nonconforming part?” is a wonderful question, and the fifteen seconds of silence that sometimes follows it is data too.
Nobody checks everything — that’s what sampling is for
Here is the thing that surprises people: an auditor does not read every record. There are twelve thousand DHRs and one auditor and a Tuesday. Auditing has always been, and will always be, a sampling exercise. You look at enough of the population, chosen well, to draw a defensible conclusion about the whole.
“Chosen well” is where the craft lives. A sample of one, hand-picked by the auditee, tells you nothing — that’s the tour, not the audit. A good sample is representative and a little unpredictable: a few records across different months, different operators, different product lines, and — crucially — at least one you selected, not one that was helpfully pre-pulled and stacked on the conference table. FDA’s own inspection approach (QSIT) even publishes staged sampling tables so investigators can size a sample and know the confidence it buys them. Your auditor is doing a quieter version of the same math.
And sampling cuts both ways, which is the part worth internalizing. If a reviewer pulls seven records and three have the same gap, that is almost never “three unlucky records.” A sample is a window. When the window shows a problem, the honest assumption is that the room behind it has more.
Do this today
You don’t have to wait to be audited to think like one. Before your next internal audit:
- Pick one procedure and try to prove it happened — from records alone. No asking around. If you can’t reconstruct it from evidence, neither can an auditor, and that’s a finding waiting to be written.
- Pull your own sample the mean way. Don’t grab the tidy recent ones. Grab a random month from eighteen months ago. That’s where the drift hides.
- Walk the floor and watch one task performed. Then read the controlled document for that task. If they don’t match, you’ve found the laminated cheat sheet before an inspector does.
This is exactly the kind of discipline a real system of record makes easier — when every audit, finding, and piece of evidence lives in one traceable place instead of a shared drive named Audits_FINAL_v3, “show me” stops being a scramble and becomes a click. That’s a lot of what we’re quietly doing for clients on the Candor platform: keeping the evidence honest so the audit can be, too. And if you’d rather have an independent set of eyes run the exercise for real, that’s exactly what our internal audit services are for.
Because in the end, an audit isn’t a memory test or a personality contest. It’s a very patient person asking “show me,” and a quality system either has an answer or it doesn’t. The good news is you get to ask yourself first. (If you want the bigger picture on why we do this at all, that’s the confession-booth conversation; and if your audit “program” is one entry on a December calendar, we talked about that too.)