In this guide 6 sections
Make the vendor prove five things on your own sample records instead of slides, starting with an audit trail that names who changed which field and when. Then test roles set per screen, certificates stored against lots, tracing from a serial number to its parts, and a full export of every table.
Ask to see the audit trail, not read about it
Every vendor claims an audit trail. Ask them to edit a nonconformance record in front of you, then open the history and look for the user, the time and the old and new values.
You want the user name, date and time, old value, new value and a reason for the change on every edit to a deviation. Can a reviewer edit an approved record? Does a deleted row vanish or stay visible?
An auditor will ask the quality head, so test it the way an auditor would, from the first entry of one device history record to its release. Some tools log only the final save. Auditors want every intermediate edit to a deviation, a calibration entry or a release decision, because the final save alone hides who changed the value first.
- Old value and new value shown side by side
- Reason for change captured at the moment of edit
- Approved records locked, with a controlled reopen step
- Deleted entries kept in the log
- History printable for an auditor
Roles should follow screens, not job titles
A stores clerk should not close a corrective action and an operator should not approve a deviation, so ask whether access is set per screen and per button.
Many tools offer only three fixed roles, admin, editor and viewer, which is too coarse for a plant with incoming inspection, assembly, sterilisation and final release. Request a printable role matrix. Have the vendor show a stores clerk logging in and trying to open the supplier approval screen, so you see the refusal for yourself.
Then ask about the person who leaves. How fast can one account be switched off, and does the log still show every entry that person made before leaving the plant?
Where do supplier certificates and test reports live?
Raw material, sterilisation and calibration certificates arrive as PDFs and scans, so ask whether each file attaches to a lot, a supplier or an instrument. Biocompatibility reports go missing in audit week.
A folder of loose scans is not traceability. A certificate should open from the lot it belongs to and show its expiry, so the system warns before a gauge calibration certificate lapses.
Ask about file size limits and about scanned images versus text PDFs, then test search by asking for every certificate from one supplier in a single step.
- Certificate linked to lot, supplier or instrument
- Expiry date captured and flagged ahead of time
- Large scans accepted without a workaround
- Search by supplier, lot or certificate number
Can it trace a serial number up and down?
Pick one finished unit from your last batch and ask which component lots, which operator, which gauge and which inspection records belong to it. That is the downward trace. Use a real serial number from a recent batch, because a vendor who picks the example will always choose a flattering one.
Then run the reverse. Take one component lot and ask which finished serial numbers used it and which customers hold them, because that upward trace is the one a recall needs.
If the vendor answers with a slide, ask for a live demo on dummy data shaped like yours and time each trace. Two clicks is good. A day of exports is not.
Settle the exit before you sign
Request a complete copy of every table, every attachment and the audit log, then check the formats, since CSV for records and original files for attachments are normal. A locked proprietary format is a warning.
Find out who owns the records, which provider hosts them and how restores are tested, and ask what happens to your data if the contract ends. Get those answers into the contract.
Finish by scoring each vendor on the same five demos, using your own sample records, and take the score sheet to the shortlist meeting. Decide on evidence.
Vendor demo scorecard
Five rows cover audit trail, roles by screen, certificate storage, serial trace and data export, with columns for the test run, what you saw and a verdict. A closing block lists the exit terms the vendor agreed in writing, plus the demo date and the vendor contact who ran it.
Open a blank worksheet to printQuestions owners ask
How many vendors should we demo?
Three is enough for most plants, and each should get the same sample records and the same five tests so the results compare cleanly.
Should production staff join the demo?
Yes. An inspector and a line supervisor will spot clumsy screens that a quality head misses, and their clicks show how the shop floor will cope.
Is a cloud system acceptable for quality records?
It can be. Ask which provider hosts it, how access is logged and how you get a full copy out, because your auditor will ask the same things.
What if the vendor has no device industry experience?
Weigh that honestly. A general tool can work if it passes your five demos, but you will configure more yourself and should budget time for it.