The audit trail and electronic signatures
Tamper-evident audit trail
Every change records who, what, when, before and after. Each entry is cryptographically chained to the one before it, and the chain can be checked at any time.
The audit trail cannot be edited
The database account the software uses has no permission to change or delete an entry. The database enforces this, not the software.
Electronic signatures
The signer types their password again, and that second login is the second factor. The name, the meaning they accepted and the license they held are all recorded at that moment.
One signature, one action
A signature is created for one action on one record and used up by it. It cannot be reused, and a second attempt is refused.
The compliance export
One click produces the full regulatory copy of a record: the record, its complete audit trail, its signatures with their meanings, and a list of every attached file.
Printed records
Any record prints as a formal document: identified, attributed, and stating the time zone it was printed in, because 14:32 on its own does not identify a moment.
Nothing is ever deleted
No license level can delete a record, not even the system administrator, and the software contains no code that could.
Signing an approval
The signer chooses the meaning, then types their password again. The meaning they accepted, their name and the license they held are recorded at that moment and cannot be changed afterwards.
The audit trail
Each entry names the person, the action, the status before and after, and the approval it belongs to. Entries are chained to one another and cannot be edited.
Workflow and approvals
Segregation of duties
The person who creates a record is not shown the button that approves it. One person cannot complete a quality event alone.
Who may perform each action
Each action names the person who may perform it: the assignee, the QA approver, the record owner. Everyone else does not see the button, and the server refuses them if they try.
Fields lock by status
A record under review is frozen: its wording, its dates, its severity. Which fields lock in which status is a setting, not something built into the software.
One person keeps one field
On a frozen record, the one person the workflow is waiting for keeps exactly the field they are asked for, and nobody else does. A record that nobody can change could never move forward.
Parallel approvals
A change plan can name as many approvers as it needs, each one required or optional, and they sign in parallel. Quality is shown nothing until the group has finished, and signs last.
The workflow shown on the record
Every record shows its own steps and where it currently stands, next to the actions available to the person looking at it.
Linked records are controlled
Which linked records may be created, and in which status, is checked on the server. A record cannot be closed while a linked record it depends on is still open.
Due dates move only by request
Once a due date is locked it can move in one way only: a request that is justified, approved and signed by somebody else. Nobody edits a date directly.
Every rejection states a reason
A rejection or a cancellation requires a signature and a written reason, and the record returns to a status where the mistake can actually be corrected.
Approvals in order
Two people are asked at the same time, one required and one optional. Quality is the second step and is shown nothing until the first one finishes.
Where the record stands
Every record shows its own steps and the point it has reached. The action beside it is the one this person may perform; somebody else sees a different set, or none.
