The method · site audit, v1
Nine stages.
Sixty-four steps.
Nine gates.
This is the whole site-audit blueprint, not a summary of it. Each stage declares the documents it takes in and puts out, the skills it may invoke, and the one human checkpoint that closes it. The gate questions below are the questions the auditor is actually asked — reproduced as written, not paraphrased.
- 9
- stages
- 64
- steps
- 9
- human gates
- 11
- folders in the audit file
The blueprint ships as versioned data and is validated when it loads. Vendor and internal audits are new blueprints against the same engine, which is the test of whether the abstraction holds.
How to read a stage
The assistant's half
Every step names its inputs, its outputs, and the skill it is allowed to call. Nothing is improvised: a step that has no skill assigned does not get one at runtime.
The auditor's half
Each stage ends at a checkpoint with an explicit go, no-go, or go-with-conditions. The assistant assembles the evidence for that decision. It does not make it.
Verbatim vs derived
Seven of the nine gate questions are marked verbatim — lifted word for word from the source SOPs. Two are marked derived, written to fill a gap the SOPs left implicit.
The pipeline
Stage by stage.
Folder numbers refer to the eleven-folder controlled audit file each engagement is scaffolded into at ST0.
-
ST0Folder 01
Initiation
Confirm the mandate is auditable: that the audit can proceed independently, safely and with adequate competence, and that a controlled workspace exists before any document is opened.
CP0 Engagement approved verbatim
Can the audit proceed independently, safely and with adequate competence?
-
ST1Folder 02
Scoping and risk
Fix the purpose, scope and criteria of the audit — including which requirement version applied on each event date — and form the preliminary risk picture.
CP1 Scope and criteria approved verbatim
Is the preliminary risk picture sufficient to design the document request and audit agenda?
-
ST2Folder 03
Announcement and requests
Announce the audit under control, agree the agenda at least fourteen calendar days ahead, and issue a blinded document request whose every item is tracked to closure.
CP2 Agenda approved and sent at least fourteen days ahead verbatim
Are the agenda, documents and system access adequate for meaningful pre-audit review?
-
ST3Folder 05
Pre-audit review
Run eight independent evidence workstreams whose results converge into a consolidated risk register, the sampling strategy and the audit plan.
CP3 Audit plan and sampling approved verbatim
Does the plan provide sufficient coverage of critical processes and identified risks?
-
ST4Folder 07
Fieldwork
Work the live checklist across eight parallel streams, triangulate evidence as it is gathered, and expand sampling where the evidence demands it.
CP4 Exit meeting completed derived
Have preliminary observations been presented factually, has the site had the chance to correct facts, and is the outstanding-document list with its deadline agreed?
-
ST5Folder 08
Evidence and findings
Finalize the evidence, decide what post-audit documents actually prove, separate ownership, quantify extent, and draft and classify each finding.
CP5 Findings approved verbatim
Is there sufficient objective evidence to draft each finding and defend its classification?
-
ST6Folder 09
Report and QC
Assemble the report in the tenant template, run consistency and reference QC, resolve review comments, and render, sign and issue it.
CP6 Report approved and issued verbatim
Is the report complete, internally consistent, approved and ready for formal distribution?
-
ST7Folder 10
Response and CAPA
Issue per-addressee response forms as views over the one findings register with citations stripped, take in and parse the responses, and assess each CAPA.
CP7 Responses accepted verbatim
Is the CAPA complete, risk-proportionate, measurable and capable of preventing recurrence?
-
ST8Folder 11
Follow-up and closure
Verify implementation, assess effectiveness, resolve every finding's status, close the audit, issue the certificate and archive the file.
CP8 Audit closed derived
Are all closure prerequisites met, in particular are all critical and major CAPAs confirmed implemented with filed evidence?
The clocks
Thirteen timers,
each with its own day-type.
Deadlines in this domain are not interchangeable. Some count business days, some calendar days, some hours from the moment a finding is spotted on site — and one source SOP contradicts itself on which. The engine models the day-type, not just the number, because getting it wrong is itself a finding.
| Timer | Value | Source |
|---|---|---|
| Agenda and confirmation before audit | ≥ 14 calendar days | SOP-0030 7.3.5 |
| Critical finding or serious breach escalation | ≤ 24 hours, from site | SOP-0030 7.4.9 |
| Post-audit summary email | ≤ 3 business days | SOP-0030 7.5.1 |
| Thank-you letter | ≤ 5 calendar days | SOP-0030 7.5.3 |
| Critical executive summary, issue and approval | ≤ 5 bd / ≤ 10 bd | SOP-0030 7.6 |
| Critical finding auditee response | ≤ 5 business days | SOP-0030 7.7.4 |
| Draft report | ≤ 15 calendar days | SOP-0030 7.6.1 |
| Final report | ≤ 30 business days | both SOPs |
| Response document issue | ≤ 10 bd after approval | SOP-0030 7.7.1 |
| Auditee response | 30 days day-type differs by SOP | both SOPs |
| Finding resolution, unsatisfactory outcome | Critical ≤ 1 mo · Major ≤ 3 mo · Minor ≤ 6 mo | MP-SOP-025 |
| Follow-up audit after significant findings | 6–12 months | MP-SOP-025 |
| Routine cadence | Class I: 2 years · Class II: 3 years | MP-SOP-025 |
Your SOPs supply these values. They are tenant configuration — numbering schemes, definition texts, day-type rules and templates all are — not code.
What leaves the file
Routing is enforced,
not remembered.
Never
The audit report to the site. The site receives the agenda, its own response form and the certificate. The report itself goes to the sponsor.
Never
The audit report to the TMF. Filing a findings-bearing report into the trial master file is a routing error the platform refuses to make.
Only this
The certificate to the TMF. It records that the audit happened and that it closed. It discloses no findings, which is why it is the one artifact that belongs there.
Cover letters are split per addressee: the site sees the findings it owns, the CRO sees its own, and citations are stripped from the views that must not carry them.
Twelve rules travel with every blueprint.
Evidence precedes conclusion. Extent is quantified. Correction does not erase the condition. The assistant is bound by all twelve; the auditor is served by them.
Read the twelve rulesSee it run against
your own SOPs.
Design-partner pilots for sponsor QA, QA consultancies, and CRO quality — starting 2026.