You Cannot Show Who Changed What, and an Audit Is Coming

To pass an audit you need a system that records, automatically and permanently, who created or changed each record, when, and what the value was before. Spreadsheets cannot do this reliably, because anyone with the file can change anything and leave no trace. A database application gives each user their own sign-in, limits what each role may do, and writes every change to a log that users cannot edit.

Signs this is your problem

• An auditor or customer has asked for a record’s history and you could not produce it.
• Controlled records are kept in spreadsheets on a shared drive.
• Several people sign in to a system with the same account.
• Approvals are recorded by typing someone’s initials into a cell.
• Preparing for an audit takes weeks of gathering files.
• You have had a finding or a corrective action about record control.

Why spreadsheets fail an audit

• No reliable record of changes. A cell can be overwritten and the old value is gone.
• No real identity. A shared file does not know which person made an entry.
• No control over who can do what. If you can open it, you can usually change all of it.
• Copies everywhere. An auditor asks which file is the official record, and nobody is sure.
• Nothing enforces the procedure. A required review or sign-off can simply be skipped.

Password-protecting the workbook and keeping a manual change log help a little. Both depend on people remembering to do the right thing, which is exactly what an audit is there to test.

What auditors and customers actually ask for

The details vary by industry, whether it is a customer’s quality audit, a financial audit, patient privacy rules such as HIPAA, or a quality standard such as ISO 9001. The questions are much the same:

• Who has access to this information, and how is that decided?
• Can you show the history of this record from creation to today?
• Who approved this, and when?
• How do you know nobody altered it afterwards?
• Can you produce these records quickly, for any date range?

What the application does

• Individual sign-ins. Every action is tied to a named person.
• Role-based permissions. People can see and change only what their job requires.
• An automatic change log. Who, when, old value, new value. Written by the system and not editable by users.
• Enforced steps. A record cannot move forward until the required review, approval or signature is recorded.
• Locked records. Once approved or closed, a record cannot be quietly changed. Corrections are made as new, visible entries.
• Reports on demand. The history of any record, or all changes in a period, in a few clicks.

We built a system for the Bariatric Surgery Program at Dartmouth-Hitchcock that had to be secure and comply with HIPAA. Read the Dartmouth-Hitchcock case study.

How Keene Systems handles it

1. We learn what you are audited against. And which records and steps it covers.
2. We map the process and its control points. Who may create, review, approve and change each record.
3. We build the application with the controls inside it. So following the procedure is the only way to do the work.
4. We bring in the existing records. And give you the reports an auditor will ask for.

The next step is a short, no-pressure conversation. Book a call with Lance Keene or use the form on this page.