Most organisations assess audit readiness by asking people whether they feel ready. This reliably produces an optimistic answer, because the person answering is rarely the person who would have to retrieve the records.
There is a better test, it takes fifteen minutes, and it tells you the truth. The only requirement is that you run it on a system nobody has prepared.
The drill
Pick a validated system at random. Not a flagship, not one that was recently audited — something ordinary. Then, with a timer running, ask for five things.
- Its current validation package, including the summary report and its approval signatures.
- An audit trail extract for a specific record over a specific date range, readable, without developer involvement.
- Its complete change history since go-live, each change with its impact assessment and approval.
- Training records for two named users of that system, current as of today.
- A current statement of whether the system is in a validated state, and what proves it.
Fifteen minutes is the budget. An inspector asking for a validation package expects it in minutes, and a delay is read as evidence that documentation is not controlled — which tends to broaden what gets asked for next.
What the result actually tells you
If everything arrives inside the budget, your estate is under control and you can stop worrying about this. That is a real and uncommon outcome.
If the audit trail extract needs a developer, you have a retrieval problem that will surface in every inspection you ever have. If the change history is incomplete, you have lifecycle debt. If nobody can state the current validated status without a meeting, that is the finding, and you found it before anyone else did.
The most common failure is not that evidence is missing. It is that evidence exists in four places and the person who knows where is on holiday.
Run it unannounced, or do not bother
A rehearsed drill on a prepared system measures how well you prepare, which is not the question. The point is to find out what normal looks like.
This makes the drill mildly unpopular, and it is worth saying out loud beforehand that the purpose is to find gaps rather than to catch people. A drill that becomes a performance review stops producing honest results immediately.
Turn the gaps into tracked work
Everything the drill could not answer becomes an action with an owner and a date. Then re-run the drill after remediation — a gap is closed when the drill passes, not when the action is marked complete. Those are different things more often than anyone expects.
Keep the records. An organisation that can show it audits itself, finds problems and closes them is in a materially stronger position than one presenting an unblemished history, because the unblemished history invites the question of how hard anybody looked.
The items that fail most often
In our audit readiness work, the same four come up repeatedly: periodic reviews overdue, audit trails that exist but are never reviewed, deviations closed without a documented resolution, and a traceability matrix that stopped matching the system some time ago.
None of them are failures of the original validation. All of them are failures of the lifecycle afterwards, which is exactly the part that has no project attached to it.
Where to go next
Explore GxP Copilot for AI-native validation, TraceDraft for source-traceable clinical documentation, or book a demo to see either on your own data.