UDI Evidence Pack: What audit evidence RA/QA needs for submissions

An audit rarely fails because “nothing was submitted.” It fails because you cannot consistently demonstrate: who approved and submitted what, when, based on which data set—and how rejections/returns were handled.

1) Evidence Pack – minimum contents (checklist)

• Scope description: Which product families/UDI-DIs are included in this run?
• Data baseline (“freeze”): Version/date of the data basis (Excel/SAP export) + hash/file name.
• Review & approval: Who reviewed? Who approved? (sign-off, ticket, workflow log)
• Validation outcome: Validation report (errors/warnings) and corrective actions.
• Submission proof: Status, timestamps, unique run reference.
• Authority responses: Receipts/ACKs/responses (if available) + interpretation.
• Result reports: Success/failed lists, detailed reports per record.
• Audit-trail extract: User actions, changes, approvals (time-aligned).
• Archiving: Storage location, retention, access control (authorized roles only).

2) Evidence from the Global Submission Portal (practical)

If you run submissions via a portal, the key RA/QA advantage is that status phases, validation errors, and result files are available per run in one place, including a downloadable package.

What you should archive per run

• ZIP download package (or individual reports) as the primary evidence container.
• Authority responses (e.g., ACKs) as proof of processing.
• Status screenshot/export (Uploaded/Processing/Success/Failed) as management evidence.
• Error report for failed runs as CAPA input (symptom/root cause/fix).

Important: operational retention

Define an SOP to export/archive evidence per run in a timely manner (e.g., monthly or per submission). This is especially important if result files are only available in the system for a limited time.

3) Evidence from the Global UDI Add-on (governance-strong)

When UDI data management and approvals are mapped in SAP, RA/QA benefits primarily from process-based evidence: roles/rights, approval events, history, and traceability.

What you should archive per run

• Approval log (who/when/which record/optionally business unit)
• Audit-trail extract covering approvals and changes
• Export/submission artifacts (depending on authority/plugin)
• Change history (diff: before/after) for updates

4) Evidence from Excel (entry-level—but audit-ready is possible)

Excel can be audit-ready if you enforce disciplined versioning and review. However, Excel is not a submission engine—it is the structured data baseline.

Minimum standard (recommended)

• File naming convention: SRN_UDI_SCOPE_YYYY-MM-DD_vX.xlsx
• Review log: Reviewer, date, findings, approval
• Change log: Field changes + rationale (change request)
• Backup rule: Store in a controlled area (DMS/SharePoint) + authorization concept

5) Standard SOP: Evidence Pack in 6 steps

1. Freeze: Define the data baseline (Excel/SAP export) + document scope.
2. Review: RA/QA checks completeness and plausibility; findings are documented.
3. Approval: Sign-off (workflow/ticket) – no submission without approval.
4. Submission: Execute the run; capture status and results.
5. Bundle evidence: ZIP/reports/ACKs/logs + review/approval in one folder.
6. Archive: Define retention & access; audit-ready storage.

6) Common audit questions (and how to answer)

“Where does the data come from—and who is the owner?”

An owner matrix per field (ERP/labeling/R&D/QM). In case of deviations, a defined priority applies (“system of record”).

“How do you ensure data integrity?”

Versioning, controlled storage, approval process, audit trail, and reproducible submission runs with result artifacts.

“How do you show that rejections/returns were handled correctly?”

CAPA-ready error handling: rejection/return → mapping to error library → correction → re-submission → evidence.

Next step

For structured data capture: Excel Template
For submission/status/evidence without an SAP project: Global Submission Portal
For SAP governance with approvals/audit trail: Global UDI SAP Add-on