I have been in the conference room for the three-week panic. You know the one. Somebody gets a phone call, and suddenly the entire quality department stops doing quality and starts doing theater. Binders come off the shelf. Somebody discovers that four SOPs went effective without training records. Somebody else volunteers to “clean up” the CAPA log, which is a sentence that should make your neck prickle.
For about twenty years, that scramble mostly worked — not because it was good, but because the evidence of the scramble was invisible. FDA didn’t look at your internal audit reports or your management review minutes. Those sat behind a little velvet rope at §820.180(c), and everybody knew it.
That rope is gone. And the thing about a fire drill is that it leaves ash.
What actually changed, briefly
Two things happened on 2 February 2026, and the second gets less attention than it deserves.
The first: the QMSR did not carry forward the §820.180(c) exemptions. Internal audit reports, management review records, and supplier audit reports are ordinary QMS records now. I wrote about that in Your Internal Audit Isn’t a Test — It’s a Confession, and I stand by the framing: your audit file is no longer a private diary.
The second: FDA retired QSIT. The four-subsystem model a generation of quality managers learned to game gave way to Compliance Program 7382.850, which reorganizes inspections into six QMS Areas — Change Control; Design and Development; Management Oversight; Measurement, Analysis and Improvement; Outsourcing and Purchasing; Production and Service Provision — plus four Other Applicable FDA Requirements (MDR, corrections and removals, tracking, UDI). Investigators are directed to follow risk to the patient, and to follow it across processes rather than staying inside one tidy box.
Read those two changes together and here’s where you land: your internal audit program lives inside “Measurement, Analysis and Improvement,” which means it is not just the thing that prepares you for the inspection. It is one of the things being inspected.
Why the cram doesn’t survive contact
Here is the part that people underestimate. A last-minute readiness push doesn’t just fail to help — it can actively make the record worse, because everything it produces is date-stamped.
I watched a company run a genuinely excellent mock audit six weeks before an inspection. Fourteen findings, all real, all well-written. They closed every one of them in nine days. Impressive, honestly. Then the investigator asked a completely reasonable question: show me the effectiveness verification.
There wasn’t any. There couldn’t have been — nine days isn’t long enough for most fixes to prove anything. So the record now showed fourteen fresh nonconformities, fourteen fast closures, and no evidence that any of it worked. They had accidentally documented that their CAPA system closes things without confirming them. That finding was worse than any of the original fourteen.
The other classic: an audit schedule showing the entire QMS audited in a two-week burst, every year, always the same fortnight. That tells an investigator something about your program before they read a single finding — the subject of “We Audit Everything Once a Year” Is a Red Flag, Not a Program, and truer now that someone else gets to read the schedule.
You cannot retroactively have been paying attention. The dates give you away.
What “audit-ready” actually means
Audit-ready is not a state you enter three weeks out. It’s a property your system either has on an ordinary Tuesday or doesn’t. Four tests, in rough order of how often people fail them:
1. Can you produce it? Pick a record type at random — a supplier requalification, a process validation, the training file for whoever signed last Thursday’s DHR. If the honest answer is “give me a couple of days,” you’re not ready, and prep week doesn’t fix a retrieval problem. Investigators notice how long things take.
2. Does the chain hold end to end? Finding → correction → root cause → corrective action → effectiveness verification → closure, with dates that make sense in sequence. Under a risk-following inspection model, that’s exactly the thread someone pulls, and it’s where tidy-looking systems come apart. (If your root causes still tend to land on a person, we’ve had that conversation.)
3. Is anything conspicuously stale? A risk-based schedule means you can answer “when did we last audit sterilization, and why then?” without opening a spreadsheet and wincing.
4. Does management actually review? §5.6 inputs arriving continuously, decisions recorded with owners and dates, and evidence a decision changed something. An annual meeting that generates a slide deck and no actions is now a legible artifact, not a private one.
Do this today
Not a transformation program. Three small things.
Run a ten-minute retrieval drill: name four records out loud, start a timer, see what happens. You’ll learn more in ten minutes than in a week of binder-tidying.
Count how many of your last twelve months of closures have real effectiveness evidence attached. Not “SOP revised.” Evidence.
Then look at your audit schedule and ask whether it describes a risk-based program or a December habit.
The honest sales bit
This is where a system of record stops being an administrative preference and starts being the actual argument. Not because software makes you compliant — it doesn’t, and anyone who says otherwise is selling harder than I am — but because a system that captures the date when the thing happened produces a timeline you can hand over without flinching. You cannot backfill a record that was written as events occurred. That’s the whole value.
Red Hen Admin runs internal audit programs for manufacturers who don’t have the headcount to run one properly, with Candor as the place the trail lives. It doesn’t guarantee a clean inspection. Nothing does. It does mean that when someone shows up on a Tuesday, the answer to “show me” is a link rather than a scavenger hunt.
And the fire drill stays cancelled — which, speaking as someone who has sat through a great many of them, is worth something all by itself.