Audit Ready vs. Audit Passing: Why Lab Data Integrity Depends on System Architecture

The scramble everyone knows

Ask anyone who has run a regulated lab about the weeks before an assessment and you will hear the same story. Someone is reconstructing who touched a sample and when. Someone else is stitching together records from a spreadsheet, an instrument export, and a paper logbook that live in three different places. A third person is quietly hoping the version everyone is working from is the current one. The lab passes. Everyone exhales. Then the whole exercise repeats at the next assessment.

It is tempting to read that scramble as a people problem, a matter of tighter discipline or better checklists. It is not. The scramble is a symptom of how the lab's records are put together. When integrity depends on assembling the truth after the fact, every audit becomes a project. When integrity is built into how work is recorded in the first place, an audit becomes a query.

Passing is a moment, ready is a state

Passing an audit proves that on one particular week, with enough preparation, a lab could produce defensible records. Being audit ready means the lab can produce those records on any ordinary Tuesday, without a project, because the trustworthy version is the only version that exists. Regulators have been pointing at this distinction for years, even when they do not use those words.

The United States Food and Drug Administration published its data integrity guidance in 2018 in response to what it described as an increasing number of data integrity violations in current good manufacturing practice inspections. The guidance is less about catching bad actors than about a simple expectation: that a record reflects what actually happened, that it is attributable to a person, and that it can be reviewed. 21 CFR Part 11 sets the same expectation for records in electronic form, covering the access controls, authority checks, and FDA compliant electronic signatures that make an electronic record trustworthy. In the accreditation world, ISO/IEC 17025:2017 holds testing and calibration labs to a documented, defensible standard of competence that an assessor can inspect at any time.

Read together, these standards are not asking a lab to prepare harder. They are asking it to operate in a state where the record is trustworthy by default. That is a design goal, not a preparation task.

Why the difference is architectural

A lab that operates audit ready has removed the gaps where integrity usually leaks. The most common leak is manual transcription, the moment a number is copied from an instrument to a sheet and then to a report, because every copy is a place a value can drift from its source. The second leak is disconnection, the manual handoff between systems that no one owns and no one logs. The third is the missing electronic chain of custody, the inability to show who did what to a sample and when, in one continuous record.

Close those gaps and the audit changes character. Traceability stops being something the lab reconstructs and becomes something the lab reads. Every result points back to its source. Every action is attributable to a person. Every record is the current one because there is no shadow copy competing with it. This is what it means to say the difference is architectural: the lab is not working harder before an audit, it has built a system where the trustworthy answer is the easy answer.

What audit ready looks like on an ordinary day

In a lab that operates this way, a quality manager who is asked to show the history of a batch does not open a project. They run a query and see the full sample tracking chain, from receipt to released result, with every step attributed and time stamped. An analyst who needs the current specification does not ask a colleague which version is right, because the system holds one approved version. When an assessor arrives unannounced, the lab does not change how it works, because the way it works on an ordinary day is already the way it would want to look under inspection.

The gains show up in more than audit weeks. Industry analysis of digitized quality control labs points in a consistent direction. McKinsey, in its 2019 study of the future of pharmaceutical quality control, estimated that digitization use cases in QC labs demonstrated more than a 65 percent reduction in deviations and gave early Industry 4.0 lab use cases productivity increases in the range of 30 to 40 percent. Those are estimates for pharmaceutical QC labs, not universal guarantees, but they describe the same mechanism this article does: when integrity is built in rather than reconstructed, both risk and manual effort fall at the same time.

The gap worth naming

There is a reason this remains hard for many labs. According to the American Society for Quality, citing the 2025 ASQE Insights on Excellence Cost of Quality report, only 31 percent of respondents felt they fully understood the impact of their quality costs. If a lab cannot see what its quality gaps cost, it will keep treating audit readiness as an event to survive rather than a state to design for. Naming the distinction is the first step. A lab that decides to be audit ready every day, rather than audit passing on demand, has already changed the question it is asking of its systems.

Where this lands for Confience

This is the argument behind how myLIMS, the Confience laboratory information management system (LIMS), is built. The point of connecting systems, removing manual transcription, and holding one continuous chain of custody is not to pass the next audit. It is to make the trustworthy record the only record, so the lab is ready for whatever comes next, whether that is an assessment, a decision, or an expansion into a new site or market.

Audit ready is not audit passing. It is a way of operating that a lab can design for, and it is the clearest expression of what complete traceability and trustworthy data are actually for.

‍