Regulatory urgency and inspection timing

• What regulatory trigger prompted this evaluation (for example: FDA Form 483, ISO audit finding, internal audit, or routine improvement)? Options: FDA Form 483 or warning letter risk, ISO certification finding, Internal audit finding, Proactive improvement, Other
• When is your next regulatory inspection or audit that this solution would ideally be in place for? Options: Within 30 days, 31 to 90 days, 91 to 180 days, 181 to 365 days, More than 1 year, No scheduled inspection
• Is there a particular compliance gap driving urgency (CAPA timeliness, training records, document control, other)? Please name the primary issue.

Scope and existing systems

• Which quality processes must be included in the initial deployment? Options: Document control, CAPA management, Training management, Nonconformance tracking, Audit management, Supplier quality, All of the above, Other
• What enterprise systems will this need to integrate with? List system types or names (ERP, PLM, MES, LIMS, single sign on), or say None.

Budget and decision authority

• Is there an allocated budget range for implementing a validated QMS and related validation services? Options: Under $50,000, $50,000 to $150,000, $150,000 to $300,000, $300,000 to $600,000, Above $600,000, Not yet allocated
• Who will approve the purchase and who signs off on validation timelines? Please list roles or titles (for example: VP Quality, Director of Regulatory Affairs, Head of IT).

Readiness and compliance constraints

• Will any protected health information or similarly regulated personal data be processed or stored in scope? Options: Yes - PHI or equivalent will be processed or stored, No, Unsure - need to confirm
• Given your timeline and resource availability, can validation activities and IT work begin within the inspection timeline you indicated? Options: Yes - resources available, Partially - limited availability, No - significant constraints, Unsure
• Would you like to schedule a 60 minute discovery to confirm fit and review a tailored plan and timeline? Options: Yes - please schedule, Maybe - send availability options, Not at this time

Quick health check: your current audit timeline

• How soon is your next regulatory inspection or scheduled audit? Options: Within 2 weeks, Within 1 month, 1–3 months, 3–6 months, No fixed date
• When did your site receive its most recent Form 483 or equivalent audit finding? Options: Within 30 days, 30–90 days, 3–6 months, More than 6 months, No recent findings
• Tell me about the specific findings at your site and which functional areas they touch, for example CAPA, training, or document control
• How many open CAPAs at your site are currently past their target close dates? Options: None, 1–5, 6–20, 21–50, More than 50
• Who on your team owns escalation when an inspection finding risks a warning letter, shipment hold, or executive action? Options: VP Quality, Director of Regulatory Affairs, Quality Manager, Site Manager, Cross-functional committee, Not defined

Where the quality gaps actually live

• What single finding in your current quality system would cause leadership to pause shipments immediately? Options: Unresolved critical CAPA, Invalid training records, Broken document control, Traceability gap, Other
• Walk me through your current process that creates and approves a procedure change, from draft through controlled release
• Which document types at your site remain outside your electronic system and how are they tracked today? Options: Controlled SOPs only, Work instructions and forms, Batch records, Training matrices, All tracked in spreadsheets/binders
• In the last three inspections, approximately how many times were training records or document revision histories cited as concerns? Options: None, 1 time, 2–3 times, More than 3 times, Not applicable / no inspections
• List the locations your team uses for audit evidence today, for example shared drives, binders, or system audit trails Options: Network shares, Local binders, Email threads, Point tools/spreadsheets, Existing QMS system

What's breaking downstream and why it matters

• If a critical CAPA fails its effectiveness check, which downstream outcome concerns your team most—shipment delay, inspection escalation, product hold, or something else? Options: Shipment delay, Inspection escalation, Product hold, Customer complaint/escalation, Other
• Who typically discovers an effectiveness-check failure in your process and what steps follow in the next 48 hours?
• Tell me how CAPA close times at your site vary by severity over the past 12 months Options: Most close on time, Some high-severity delayed, Many medium/low delayed, High variance across sites
• Which operational metrics for your team would change if document revision histories were reliably auditable and accessible during inspection? Options: Time to respond to audits, CAPA cycle time, Training completion rate, Batch release time, Supplier corrective actions
• What single integration failure, for example lot traceability between your MES and ERP, would derail your inspection timeline?

Connectivity and data readiness: the practical gates

• If your ERP or MES teams cannot provide an API endpoint within four weeks, what happens to your inspection readiness and deployment plans? Options: Delay deployment, Proceed with manual workarounds, Scope integration later, Stop the project
• Please identify the third-party systems your team must integrate to preserve audit trails, for example ERP, MES, or PLM Options: ERP, MES, PLM, LIMS, Document repository, No integrations required
• Estimate the headcount and roles your IT and validation teams can dedicate during a six-week implementation Options: 0–1 FTE, 2–3 FTE, 4–6 FTE, More than 6 FTE
• Do you have a named data owner who can approve document migration extracts and grant access to source repositories? Options: Yes, named and available, Named but limited availability, No, not assigned
• Can your security or legal team sign the vendor access and data-processing agreements within your inspection window? Options: Yes, within 2 weeks, Yes, within 4 weeks, No, longer review required, Unknown
• Identify the single readiness gate that would immediately stop go-live in your inspection window Options: Missing validation sign-off, Critical integration not available, Data migration failure, Training incomplete, Other

The alternatives you are weighing

• Assuming you could keep your current systems, what one improvement would remove the urgency to change?
• Please select the types of alternatives your team is currently evaluating Options: Incumbent QMS, In-house build, Generic document-management with bolt-ons, Another vendor QMS, No formal alternative yet
• Name the stakeholders who have proposed an internal solution rather than engaging an outside vendor
• Estimate how long your organization could continue with the incumbent or manual process before inspection risk becomes unacceptable Options: Less than 1 month, 1–3 months, 3–6 months, More than 6 months
• From the alternatives you selected, indicate which path would accelerate a buying decision most Options: Better pricing, Faster validation evidence, Single-vendor integration, Executive sponsorship, Proof from a pilot

Acceptance criteria: how your leadership will judge success

• Assuming we deliver the platform, what measurable change in your audit findings or CAPA timelines would prove success to your leadership?
• List the regulatory standards the solution must map to out of the box, for example 21 CFR Part 11, ISO 13485, AS9100 Options: 21 CFR Part 11, ISO 13485, AS9100, GxP / Annex compliance, Other
• Describe how your organization will measure reduction in audit findings or time-to-close for CAPAs
• Identify the roles required to sign off on validation evidence for go-live and the formats they require, for example IQ/OQ packet or extracted logs
• Name the single approval that would allow you to sign a contract within this quarter Options: Budget owner sign-off, Quality VP sign-off, Legal approval, IT/Infrastructure approval, Other

Deployment constraints and timing

• On a realistic schedule, can your validation team complete the required testing and sign-off within six weeks? Options: Yes, Yes with extra resources, No, needs more time, Unsure
• Provide the environments that must be provisioned before configuration work starts, for example test, UAT, and production
• Do you already have migration scripts or will content need to be extracted manually for documents and records? Options: Scripts available, Partial scripts, Manual extraction required, Unknown
• Assign the day-to-day owner for data migration and validation activities during the project, name or role
• Provide any blackout dates or production freezes in the next 90 days that would prevent configuration or cutover
• Select the single timing constraint that would delay go-live the most Options: Validation availability, Integration readiness, Data migration quality, Training completion, Regulatory window

User adoption and training readiness

• Imagine an inspector selects an operator and finds the changed-procedure training incomplete, what consequence would follow at your site? Options: Minor observation, Formal finding, Release hold, Executive escalation, Unknown
• Outline the user groups that need role-based training before the system becomes the authoritative record Options: Operators, Supervisors, Quality engineers, Regulatory team, IT/Validation
• Give an approximate count of active users who will need initial training versus occasional access Options: <50, 50–200, 201–500, 501–1000, 1000+
• Assign the person or role who will manage change communications and track training completion during parallel operation
• Select the single action that would stop cutover if training completion slips by more than 20 percent Options: Delay cutover, Extend parallel period, Increase on-site training, Proceed with exceptions, Other

Final next steps and decision calendar

• Between your audit timeline and budget cycle, what single date must we hit to stay on schedule?
• Choose your target go-live month Options: This month, Next month, Within 2 months, Within 3–6 months, No target yet
• Share the final decision-makers and the approvals each must provide
• Describe the remaining blockers that would prevent immediate signature after a successful pilot
• Specify the single commitment from us that would make you comfortable executing a statement of work within two weeks

• desired_state
• current_state
• stakeholders
• gaps
• success_criteria
• decision_readiness
• desired_state
• decision_readiness
• current_state
• success_criteria
• gaps
• stakeholders
• desired_state
• success_criteria
• stakeholders
• gaps
• current_state
• decision_readiness
• decision_readiness
• decision_readiness
• decision_readiness
• decision_readiness

• Configure Document Control Processes
• Migrate Document Records with Audit Trail Preservation
• Configure CAPA Lifecycle Workflow
• Migrate CAPA, NCR, and Training Records
• Configure Nonconformance (NCR) Tracking Workflow
• Configure Training Management and Assignments
• Provision Users, Roles, and Access Controls
• Deliver Prebuilt IQ/OQ Validation Package
• Integrate ERP and PLM Systems for Part/BOM Sync
• Configure Audit and Audit-Finding Workflows
• Setup Supplier Quality and Supplier Records
• Configure Management Review Dashboards and Reports
• Parallel-Run Support and Go-Live Assistance

Configure Document Control Processes

• Which controlled document types require lifecycle states in the platform (examples: standard operating procedure, work instruction, master batch record)? Options: SOP (standard operating procedure), Work Instruction, Master Batch Record, Quality Manual, Other
• How many active document repositories or libraries must be mapped into the platform (examples: site SOP library, device-family dossier folder)? Options: 1, 2-3, 4-10, More than 10
• What naming and numbering convention must be enforced for controlled documents (for example device-class-part-number + revision)?
• Who are the approver roles that must be mapped for document release (examples: RA Director, QA Manager, Document Control Clerk)?
• Are there specific 21 CFR Part 11 or ISO 13485 controls required for e-signature, versioning, or record retention on these document types? Options: Yes, No, Requires discussion

Migrate Document Records with Audit Trail Preservation

• Estimate the count of document records (including historical revisions and attachments) that require migration. Options: Less than 5,000, 5,000-20,000, 20,000-100,000, More than 100,000
• Indicate the source locations for those documents (examples: network shares, legacy QMS export, ECM system, local drives). Options: Network share, Legacy QMS export, Enterprise Content Management (ECM), Other
• List the metadata fields that must be preserved (examples: original author, creation timestamp, revision history, approval signature timestamps).
• Provide the evidence that will validate successful migration and audit-trail preservation (examples: reconciliation reports, hash checksums, sample audit-trail exports).
• Do any regulatory retention policies or Device History Record tie-ins require special handling of migrated documents? Options: Yes, No, Unsure—need guidance

Configure CAPA Lifecycle Workflow

• List the CAPA initiation triggers you must map (examples: FDA Form 483 observation, production nonconformance, customer complaint, audit finding).
• Who will serve in the CAPA owner and effectiveness-check roles (examples: QA Manager, Site Manager, Process Engineer)?
• Identify the mandatory CAPA fields and attachments you require (examples: root-cause analysis, 5 Whys, fishbone diagram, corrective action plan, verification evidence).
• Specify escalation thresholds for CAPA (for example overdue duration before executive alert, severity levels that require immediate containment). Options: Overdue 7 days, Overdue 30 days, Immediate for critical safety issues, Custom
• Describe how CAPA effectiveness criteria map to measurable production or quality metrics (examples: reduce scrap rate by X%, close repeat NCRs to zero for Y quarters).

Migrate CAPA, NCR, and Training Records

• Estimate the number of CAPA, NCR (nonconformance), and training records to migrate, by type. Options: CAPAs <1,000 / NCRs <1,000 / Trainings <10,000, CAPAs 1k-5k / NCRs 1k-5k / Trainings 10k-50k, Larger—discuss
• List legacy identifiers that must remain traceable after migration (examples: CAPA ID, NCR number, employee ID, lot/lot number, inspection record ID).
• State the minimum data completeness threshold you require for migrated records (examples: 95% of key fields populated, 99% of records reconciled). Options: 95%, 98%, 99%, 100%
• Identify who will perform post-migration validation sampling and the preferred sample size (examples: 5% sample, all critical CAPAs). Options: Internal QA team, Third-party validation, Joint QA with vendor
• Confirm whether training completion evidence must include time-stamped signatures or witnessed competency artifacts to satisfy your training matrix. Options: Yes, time-stamped signatures required, No, completion status sufficient, Depends on training type

Configure Nonconformance (NCR) Tracking Workflow

• Enumerate the NCR categories you use and that should drive separate workflow branches (examples: incoming inspection, in-process, final, customer-return).
• Define the NCR severity levels and the actions each level must trigger (examples: minor→log, major→investigation, critical→quarantine+stop production).
• Point to the integration sources that should automatically create NCRs (examples: MES test failures, ERP receiving nonconformances, inspection equipment outputs).
• Specify containment evidence types that must be attachable to NCRs (examples: quarantine tags, photographs, inspection reports, lab test results). Options: Photos, Quarantine tag scanned copy, Inspection report PDF, Lab result file
• How should supplier-related NCRs route to suppliers and what response time is expected for supplier replies? Options: 24 hours, 3 business days, 7 business days, Custom SLA

Configure Training Management and Assignments

• Describe the training elements to capture (examples: SOP acknowledgements, competency assessments, refresher intervals, certification attachments).
• Estimate the number of distinct training roles and curricula in your current training matrix. Options: 1-10, 11-50, 51-200, 200+
• Provide the events that should automatically assign training (examples: new SOP revision, role change, CAPA assignment).
• Select the types of completion evidence you require for compliance (examples: timed e-learning completion, proctored test score, witnessed on-the-job competency). Options: E-learning timestamp, Test score, Witnessed competency record, Certificate upload
• Name the owner of training remediation and specify the timeframe after a failed assessment for assigning remediation. Options: Immediate, Within 3 business days, Within 2 weeks, Custom

Provision Users, Roles, and Access Controls

• State the expected count of user accounts and distinct roles to provision at go-live. Options: Less than 50, 50-250, 250-1,000, More than 1,000
• Outline the role-based permissions required for controlled documents, CAPA edits, and electronic signature execution.
• Do you require Single Sign-On (SSO) with your identity provider and which protocol is preferred (examples: Security Assertion Markup Language (SAML) 2.0, OAuth2)? Options: SAML 2.0, OAuth2 / OpenID Connect, LDAP, No SSO
• Explain any segregation of duties rules or privileged-user restrictions that must be enforced (example: approver cannot be document creator for given doc class).
• Name the role or person who will maintain the user-role matrix after go-live and indicate the expected change cadence. Options: Quarterly, As needed, Weekly, Monthly

Deliver Prebuilt IQ/OQ Validation Package

• State the regulatory standards the IQ/OQ must support (examples: 21 CFR Part 11, ISO 13485 clause references). Options: 21 CFR Part 11, ISO 13485, Other regulatory frameworks, Multiple—list in details
• Select the configuration baseline the IQ and OQ should assume (examples: out-of-the-box configuration, minor configuration within supported parameters, custom code changes). Options: Out-of-the-box, Supported configuration changes, Major customization (out of scope without change order)
• Indicate the environment types that require validation artifacts (examples: production, staging, test) and provide environment names if available.
• Confirm the evidence required to validate the IQ/OQ deliverable for your auditors (examples: executed test scripts with signatures, traceability matrix to ISO clauses).
• Indicate any laboratory or manufacturing-specific configurations the IQ/OQ must cover (examples: controlled capture of lot numbers, integration with inspection equipment). Options: Lot number control, Inspection equipment integration, Calibration traceability, None

Integrate ERP and PLM Systems for Part/BOM Sync

• Indicate the systems that hold your Bill of Materials (BOM) and part master data (examples: ERP system, PLM system).
• How often must part/BOM synchronization occur to meet your change control needs (options: real-time, hourly, daily, nightly)? Options: Real-time, Near real-time (hourly), Daily, Nightly batch
• Detail the key fields that must sync between systems (examples: part number, part revision, approved supplier list, regulatory classification).
• Select the integration method you prefer for BOM sync (examples: API-based sync, flat-file export/import, middleware broker). Options: API-based sync, Flat-file export/import, Middleware / ESB, Other
• Designate the reconciliation owner when BOM mismatches occur and state the tolerance for mismatched items before blocking a release. Options: No tolerance—block immediately, 1-5 mismatches allowed, Custom tolerance—specify

Configure Audit and Audit-Finding Workflows

• Detail the types of audits you track and whether each requires its own workflow (examples: internal, supplier, regulatory inspection).
• Explain how audit findings are assigned to owners today and specify the SLA for initial response to findings (examples: 3 business days, 5 business days). Options: 3 business days, 5 business days, 10 business days, Custom
• Detail audit evidence types that must be attachable to findings (examples: photos, corrected documents, meeting minutes, lab results).
• Do you require automatic mapping from audit findings to CAPAs and automatic CAPA creation for certain finding severities? Options: Yes—auto-create CAPA for critical findings, Yes—but require manual approval, No
• Document the regulatory clauses or CFR/ISO clause references you need findings mapped to for auditor traceability.

Setup Supplier Quality and Supplier Records

• Enumerate the supplier attributes that must be captured (examples: supplier ID, approved part numbers, certificate of conformance, site address).
• Give the approximate count of active suppliers and supplier site records to import. Options: Less than 50, 50-250, 250-1,000, More than 1,000
• Do you require supplier performance metrics and which metrics/formulas must be tracked (examples: on-time delivery %, defect per million opportunities)? Options: Yes—OTD and defect rate, Yes—custom metrics, No
• Give examples of trigger points that should create supplier nonconformance cases (examples: incoming lot rejection, COA mismatch, supplier audit failure).
• Designate the roles authorized to update supplier approvals and indicate the evidence required for requalification (examples: supplier audit report, C of C, test data).

Configure Management Review Dashboards and Reports

• Document the KPIs that must appear on the management review dashboard (examples: open CAPA count, audit findings trend, training completion rate).
• Clarify the date ranges and filters required for trend analysis (examples: rolling 12 months, by device family, by site).
• Assign recipients for scheduled management review packets and select the preferred packet format (examples: PDF export, live dashboard link). Options: PDF export, Live dashboard link, Both
• Select whether you require traceability from dashboard metrics to the underlying source records for auditor follow-up. Options: Yes—full drilldown required, Partial traceability, No
• Select the frequency for formal management reviews and indicate whether the platform should capture meeting minutes and action items. Options: Monthly, Quarterly, Annually, Custom

• Master Services Agreement (MSA)
• Statement of Work (SOW)
• Subscription Order Form
• Validation and Acceptance Addendum
• Service Level Agreement (SLA)
• Order Confirmation & Payment Schedule
• Change Order Agreement
• Data Processing Agreement (DPA) — conditional
• Regulatory Compliance Addendum — conditional

• Go-Live Health Check
• First Outcome Measurement
• Acceptance Gate and Formal Acceptance Decision
• Quarterly Success Review

• Schedule the next quarterly success review and circulate the requested pre-read data set at least two weeks in advance.
• Buyer to run targeted training sessions for regulated roles and report updated completion rates before the acceptance gate.
• Seller to provide any missing validation documents or migration reconciliation files needed for acceptance evidence.
• Restate acceptance criteria and numeric targets
• Produce a documented acceptance record showing pass/fail per criterion recorded in Solution Scope.
• If any criteria failed, agree remediation tasks with owners and firm completion dates sufficient to declare acceptance when closed.
• Confirm the incumbent system decommission or read-only retention plan and the archive status of legacy data.
• Circulate the formal acceptance record with the buyer's named signatory or buyer owner decision within 24 hours.
• List and assign remediation items for any failed criteria with evidence requirements and completion dates.
• Seller to provide final migration reconciliation and archive confirmation for incumbent system wind-down.
• Review outcome trends
• Confirm whether CAPA closure timeliness and audit-finding counts are moving toward the targets recorded in Solution Scope or require additional remediation.
• Ensure all open remediation items have owners, target dates, and evidence requirements documented.
• Agree a short list of operational follow-ups and owners to be completed before the next quarterly review.
• Update the shared issue and enhancement channel with assigned owners and target dates for all reviewed items.
• Owner to deliver evidence of remediation completions for any items due before the next quarterly review.
• Re-confirm success criteria and owners
• Confirm there are no unresolved migration or validation defects that prevent the platform from acting as the authoritative record.
• Named owners and target dates assigned for each open high-priority issue.
• Agree immediate remediation actions to be completed before the first measurement meeting.
• Distribute the migration and validation integrity report for async review within 48 hours.
• Buyer to confirm access and ownership for named data owners and validation evidence locations.
• Seller to schedule remediation work sessions for any blocking configuration or migration defects.
• Present first outcome data
• Determine whether CAPA closure timeliness and training completion rate are on track to meet targets recorded in Solution Scope.
• Document root causes for any metric shortfalls and assign corrective actions with target dates.
• Confirm the list of outstanding evidentiary items required for the acceptance gate.
• Owner to deliver corrected workflow configuration or SOP changes addressing CAPA lifecycle delays.
• Present outcome data against each criterion
• Open remediation items burn-down
• Deployment and migration validation
• Root-cause diagnosis for gaps
• Document pass/fail per criterion and capture acceptance decision
• Early adoption signals
• Enhancement and issue log review
• Validate migrated audit-trail and data completeness
• Operational housekeeping and risk items
• Agree remediation plan for any failed criteria
• Blockers and open issues
• Assign corrective actions and owners
• Confirm timeline to acceptance gate
• Incumbent system wind-down confirmation
• Agree next quarter's focus and checkpoints
• Agree immediate remediation actions