Audit Readiness
Audit Map
When an auditor arrives, the question is predictable: “How do you control this, and where is the record?” The table below maps the requirements they ask about most often to the ISOZAI process behind them, the record it produces, who is responsible, and the evidence you can show. Every behavior on this page is live in the product today and has been tested end to end.
ISOZAI is not a compliance product certified by any certification body or public authority; it supports the recordkeeping, control, traceability and audit-readiness that standards require. Certification itself is a matter between your business and its certification body.
Requirement → process → record → evidence
| Requirement | ISOZAI process | Resulting record | Responsible role | Evidence to show the auditor |
|---|---|---|---|---|
| Lot-level forward/backward traceability | Traceability screen — automatic genealogy from a finished-good lot back to raw materials (and forward again); the link is created automatically as production output is recorded | Lot genealogy records | Quality Manager | Screen view + exportable Excel/PDF traceability report |
| Recall exercise (e.g. BRCGS 8.3) | Recall screen — from a single raw-material lot to the affected products, shipments and customer list within minutes; once a case is activated, the affected lots are automatically blocked and a blocked lot cannot ship | Recall case (simulation → active → closed) + affected lot/customer list | Quality Manager | Recall report + customer-list export; exercise duration is recorded on the case |
| Quarantine and release discipline | A quarantine location is mandatory at goods receipt (receipt without one is rejected); a lot cannot move to released status without a quality decision; only released lots can be reserved or shipped | Lot status history (quarantine → released/rejected) | Warehouse + Quality | Lot inventory + status transitions in the audit trail |
| Incoming quality control and specification conformance | A quality plan is tied to each material; a decision cannot be made until EVERY parameter in the plan has a result (the system rejects it otherwise) | QC check + parameter results | Quality | QC record + Certificate of Analysis (CoA) |
| Out-of-specification (OOS) result management | An out-of-limit result plus a reject decision: the system automatically opens an OOS investigation and blocks the lot | OOS investigation record + rejected lot | Quality | OOS record + audit trail |
| Electronic signature and second-person approval (maker-checker) | A quality decision cannot be recorded without an e-signature; the person who performed the check cannot approve their own check; two different people must sign — all enforced server-side | Electronic signatures tied to the record and the user | Quality (2 separate users) | E-signature records + audit trail |
| Non-conformance and corrective action (NC/CAPA) | QC & Non-conformance screen — open an NC, link a CAPA, track root cause, due date and closure; attachments (photos, reports) can be uploaded | NC + CAPA records | Quality | CAPA record + trend analysis + attachments |
| HACCP / CCP monitoring | CCP monitoring points and readings; a limit excursion triggers a non-conformance | CCP readings + triggered non-conformance | Production Operator | CCP reading records + alarm/NC link |
| Allergen management | Material-to-allergen mapping and a recipe allergen matrix; allergen sequencing is respected in production scheduling | Allergen matrix | Quality + Production | Recipe allergen matrix view |
| FEFO and expiry-date control | Consumption suggestions follow expiry order (FEFO); an expired lot is never suggested; the expiry-monitoring screen lists upcoming risk | Lot-level stock movements | Warehouse | Expiry-monitoring report + consumption records |
| Calibration of measuring equipment | Equipment inventory, calibration schedule and result records; the certificate file is attached to the record | Calibration records + attached certificates | Quality | Calibration record + uploaded certificate |
| Stability studies | Study definition, pull points and result entries; reports are attached to the record | Stability study + pull-point results | Quality | Stability record + attachments |
| Change control | Change request → impact assessment → approval workflow; related documents are attached to the record | Change request + assessment | Quality | Change record + attachments |
| Internal audit and management review | Internal audit and management-review records, with findings, decisions and attachments | Internal audit + management-review records | Quality + Senior Management | Records + attachments |
| Training and competency | Training courses, personnel training records and assessments | Training records | Quality / HR | Per-employee training history |
| Append-only audit trail | Every critical change is recorded automatically with who/what/when/before-after values (see the technical note below) | Audit log | Owner (view only) | Audit Log screen + export |
- Requirement
- Lot-level forward/backward traceability
- ISOZAI process
- Traceability screen — automatic genealogy from a finished-good lot back to raw materials (and forward again); the link is created automatically as production output is recorded
- Resulting record
- Lot genealogy records
- Responsible role
- Quality Manager
- Evidence to show the auditor
- Screen view + exportable Excel/PDF traceability report
- Requirement
- Recall exercise (e.g. BRCGS 8.3)
- ISOZAI process
- Recall screen — from a single raw-material lot to the affected products, shipments and customer list within minutes; once a case is activated, the affected lots are automatically blocked and a blocked lot cannot ship
- Resulting record
- Recall case (simulation → active → closed) + affected lot/customer list
- Responsible role
- Quality Manager
- Evidence to show the auditor
- Recall report + customer-list export; exercise duration is recorded on the case
- Requirement
- Quarantine and release discipline
- ISOZAI process
- A quarantine location is mandatory at goods receipt (receipt without one is rejected); a lot cannot move to released status without a quality decision; only released lots can be reserved or shipped
- Resulting record
- Lot status history (quarantine → released/rejected)
- Responsible role
- Warehouse + Quality
- Evidence to show the auditor
- Lot inventory + status transitions in the audit trail
- Requirement
- Incoming quality control and specification conformance
- ISOZAI process
- A quality plan is tied to each material; a decision cannot be made until EVERY parameter in the plan has a result (the system rejects it otherwise)
- Resulting record
- QC check + parameter results
- Responsible role
- Quality
- Evidence to show the auditor
- QC record + Certificate of Analysis (CoA)
- Requirement
- Out-of-specification (OOS) result management
- ISOZAI process
- An out-of-limit result plus a reject decision: the system automatically opens an OOS investigation and blocks the lot
- Resulting record
- OOS investigation record + rejected lot
- Responsible role
- Quality
- Evidence to show the auditor
- OOS record + audit trail
- Requirement
- Electronic signature and second-person approval (maker-checker)
- ISOZAI process
- A quality decision cannot be recorded without an e-signature; the person who performed the check cannot approve their own check; two different people must sign — all enforced server-side
- Resulting record
- Electronic signatures tied to the record and the user
- Responsible role
- Quality (2 separate users)
- Evidence to show the auditor
- E-signature records + audit trail
- Requirement
- Non-conformance and corrective action (NC/CAPA)
- ISOZAI process
- QC & Non-conformance screen — open an NC, link a CAPA, track root cause, due date and closure; attachments (photos, reports) can be uploaded
- Resulting record
- NC + CAPA records
- Responsible role
- Quality
- Evidence to show the auditor
- CAPA record + trend analysis + attachments
- Requirement
- HACCP / CCP monitoring
- ISOZAI process
- CCP monitoring points and readings; a limit excursion triggers a non-conformance
- Resulting record
- CCP readings + triggered non-conformance
- Responsible role
- Production Operator
- Evidence to show the auditor
- CCP reading records + alarm/NC link
- Requirement
- Allergen management
- ISOZAI process
- Material-to-allergen mapping and a recipe allergen matrix; allergen sequencing is respected in production scheduling
- Resulting record
- Allergen matrix
- Responsible role
- Quality + Production
- Evidence to show the auditor
- Recipe allergen matrix view
- Requirement
- FEFO and expiry-date control
- ISOZAI process
- Consumption suggestions follow expiry order (FEFO); an expired lot is never suggested; the expiry-monitoring screen lists upcoming risk
- Resulting record
- Lot-level stock movements
- Responsible role
- Warehouse
- Evidence to show the auditor
- Expiry-monitoring report + consumption records
- Requirement
- Calibration of measuring equipment
- ISOZAI process
- Equipment inventory, calibration schedule and result records; the certificate file is attached to the record
- Resulting record
- Calibration records + attached certificates
- Responsible role
- Quality
- Evidence to show the auditor
- Calibration record + uploaded certificate
- Requirement
- Stability studies
- ISOZAI process
- Study definition, pull points and result entries; reports are attached to the record
- Resulting record
- Stability study + pull-point results
- Responsible role
- Quality
- Evidence to show the auditor
- Stability record + attachments
- Requirement
- Change control
- ISOZAI process
- Change request → impact assessment → approval workflow; related documents are attached to the record
- Resulting record
- Change request + assessment
- Responsible role
- Quality
- Evidence to show the auditor
- Change record + attachments
- Requirement
- Internal audit and management review
- ISOZAI process
- Internal audit and management-review records, with findings, decisions and attachments
- Resulting record
- Internal audit + management-review records
- Responsible role
- Quality + Senior Management
- Evidence to show the auditor
- Records + attachments
- Requirement
- Training and competency
- ISOZAI process
- Training courses, personnel training records and assessments
- Resulting record
- Training records
- Responsible role
- Quality / HR
- Evidence to show the auditor
- Per-employee training history
- Requirement
- Append-only audit trail
- ISOZAI process
- Every critical change is recorded automatically with who/what/when/before-after values (see the technical note below)
- Resulting record
- Audit log
- Responsible role
- Owner (view only)
- Evidence to show the auditor
- Audit Log screen + export
Audit trail — technical note
Saying "we have an audit trail" is easy; an auditor asks how it actually works. Here is what is verifiably true of the audit trail in ISOZAI:
- Every record includes: the user who performed the action, the action type, the affected record (type + identifier), a timestamp, before/after values, IP address and browser information.
- Failed login attempts are also written to the audit trail (with the reason); successful logins, approvals/rejections and permission changes are tracked as separate action types.
- The application has no endpoint that can edit or delete an audit record — the API only allows insert and read; no role, including admin/owner, can edit a record.
- The audit trail can only be viewed by the "Owner" role; records are isolated per organization by row-level security (RLS).
- Records can be filtered by entity type, action type, user and date range, and downloaded as a report from the Export Center — the export action itself is also written to the audit trail.
- Commercial documents are never physically deleted: invoices are voided with a reversing journal entry or applied to a credit note, and payment reversals net out the offsets with a reversing entry — all subject to the accounting-period lock.
You can try every one of these flows yourself in the live demo.