Audit trail and approval software for when you must prove it
Controlled access, defined approval chains, and audit trails designed to be read by an inspector years after the event.
append-only · no row is ever edited
- Controlled access systems
- Approval workflows
- Audit trails
- Best when
- Approvals run over email or paper, and an inspector will ask for the trail.
- Not a fit when
- Nobody outside the team will ever ask who approved what.
- First thing you get
- One approval chain live, with an append-only record.
What is an audit-ready workflow system?
An audit-ready workflow system is software that controls who may request, approve and access something, and records every step in an append-only audit trail an inspector can read years later. It is the normal requirement in pharmaceutical and regulated manufacturing. We build these with configurable approval chains, controlled access and records designed to prove compliance.
Some software carries a requirement most business software does not: it has to produce evidence. It is not enough for the right person to have approved something — you must be able to demonstrate, long afterwards, who approved it, when, under which version of which procedure.
That reframes the design. Audit trails are not a logging feature added near the end; they are the primary output the system exists to produce, and the workflow is built around generating them correctly. This is the normal condition in pharmaceutical and regulated manufacturing, and it appears anywhere authority has to be provable rather than assumed.
We have built exactly this — a controlled-access IT request portal covering software, instrument, and equipment access with configurable approval chains and an append-only audit trail.
What this includes
- 01
Controlled access systems
Role-based access to software, instruments, and equipment with recorded authorisation.
- 02
Approval workflows
Configurable multi-stage approvals that reflect how quality and IT actually divide authority.
- 03
Audit trails
Append-only records of actor, action, target, and timestamp, retained and queryable.
- 04
Document and record management
Controlled documents with versioning and access history.
- 05
Instrument and equipment registers
Master data for instruments and equipment IDs, managed centrally.
- 06
Validation support
Technical documentation and traceability to support your own qualification activities.
Situations we see most often
Access requests handled over email
No reliable record of who approved what, and an audit request that cannot be answered from a mail thread.
Paper-based approval chains
Signatures on forms in a filing cabinet, with no way to report on volume, ageing, or outcomes.
Instrument access is untracked
No central register of who is authorised to operate which equipment.
Audit preparation takes weeks
Evidence assembled by hand each cycle instead of being produced continuously by the system.
What to know before you start
What makes an audit trail trustworthy to an inspector?
It has to be complete, attributable and unchangeable. Every action records who did it, under their own unique identity, when, what changed from what, and why where a reason is required. Records are append-only: corrections add a new entry referencing the old one rather than overwriting it.
And it has to be readable. An inspector asking who approved a change three years ago should get a clear answer in minutes, not a database export someone has to interpret.
How do configurable approval chains work?
Each request type, such as software access, instrument use or a document change, has an approval chain defined by role, not by named people, so it keeps working as staff change. Chains can branch on conditions like site, risk level or amount, and include sequential and parallel approvals.
Quality teams change the chains through configuration, with the change itself recorded, rather than raising a development request each time a procedure is revised.
Why replace email and paper approvals?
Email approvals are scattered across inboxes, easy to forward out of context, and hard to prove complete. Paper chains are slow, get lost, and turn audit preparation into weeks of searching. Neither can show reliably that the approver saw the right version of the right document.
A system of record makes the trail a by-product of doing the work, so audit preparation becomes a report rather than a project.
How are instruments and equipment registers handled?
Each instrument or piece of equipment has a record: who is authorised to use it, its calibration and maintenance status, and the history of access requests and approvals. Access can be blocked automatically when calibration lapses, so the register enforces the procedure instead of just documenting it.
How does the system support validation?
We provide the technical documentation and traceability a validation team needs: requirement specifications, design records, a traceability matrix linking requirements to tests, and test evidence from each release. Changes after go-live follow a controlled change process with the same documentation.
Executing IQ, OQ and PQ remains your quality function's responsibility; our job is to make that work straightforward.
What drives the cost of an audit-ready workflow system?
Cost follows the number of controlled processes and how strictly they must be evidenced. These factors move it most.
| Factor | Effect | Why it matters |
|---|---|---|
| Number of workflows | High | Each controlled process needs its own forms, approval chain, records and tests. |
| Regulatory requirements | High | Electronic signatures, validation evidence and retention rules add design, testing and documentation. |
| Integrations | Medium | Directory services for identity, and systems that grant the access being approved, add integration work. |
| Document management | Medium | Versioned documents with review cycles and controlled distribution add a substantial module. |
| Deployment environment | Medium | Deploying inside your validated infrastructure needs more coordination than a managed cloud. |
| Reporting | Low | Audit reports are built on the trail itself, so they are modest to add. |
What a typical engagement looks like
- 011–3 weeks
Discover
Process map
- 022–4 weeks
Design
Interactive prototype
- 03two-week cycles
Build
Working software each cycle
- 04ongoing
Ship & support
Automated pipeline
What we build it with
- Controls
- Unique identityRole-based accessElectronic signatures
- Records
- Append-only logVersioned documentsRetention
- Deployment
- Your infrastructurePrivate cloudValidation documentation
Where we have done this
Questions we get asked
01Can you build 21 CFR Part 11 compliant systems?
We build to the technical controls the regulation requires — unique user identity, role-based authorisation, defined approval workflows, and append-only audit trails with actor and timestamp. Compliance itself also depends on your validation activities, SOPs, and qualification documentation, which we support but do not certify.
02Do you provide validation documentation?
We provide the technical documentation and traceability your validation team needs — specifications, design records, and test evidence. Executing IQ, OQ, and PQ remains your quality function's responsibility.
03Can systems be deployed on our own infrastructure?
Yes. Where data residency or validation scope requires it, we deploy inside your own environment rather than a shared cloud.
04Can approvers sign electronically?
Yes. Electronic signatures are tied to each user's unique identity, re-authenticated at the moment of signing, and recorded with the meaning of the signature, such as reviewed or approved, as the regulation expects.
05Can existing paper records be brought in?
Yes. Historical records can be scanned and indexed against the relevant instrument, document or process, so the system holds the complete history from day one.
Adjacent capabilities
Further reading
Tell us what you are building.
Share the problem and we will come back with an approach, a rough shape of the work, and what it would take to deliver it.