SearchDesign & Development

Design History File (DHF) Audit

A design history file audit that opens the test report behind each trace link and shows whether it proves the input as released, with the page cited and two people signing.

See the demo Book a demo

Follow DI-0312 from a green link to a blocked review ↓

Watch with transcript →

The problem

A green trace matrix over test reports nobody has opened

Before a phase gate, the design quality engineer exports the trace matrix, rebuilds it in a spreadsheet and filters for orphans. That part is easy. Opening the reports behind the links is where the hours go, so the reports get sampled.

The sample is where things slip. A report that tested an older revision of the part, a criterion copied from a superseded specification, a sample size with no rationale, a draft with one signature missing: each one shows as a linked requirement until an auditor opens the page.

Built forDesign quality engineersDesign assurance managersSystems engineersProgram managers

The Problem Today

A green trace link says a report is attached, and someone still has to open it and check it proves the requirement.

80 h: to audit one design file by hand, opening each report our estimate

Read by hand today

Reports
Drawings
Changes
Samples

Old revision, green linkA report on rev B still shows as proving rev D
Sums nobody redoesA sample size rationale is copied, never checked

The Solution

Each report openedAgents read each linked report, page by page, against its input
Tested against releasedThe part tested is compared with the one released, change orders read
The sums redonePass criteria and sample size sums recomputed and cited to the page
Two people signThe engineer confirms, the manager countersigns, the trail keeps both

Built-in controls

Nobody countersigns their own finding
Agents never sign, close or carry a gap
Safety and release questions go to a person

What You Get

Design quality walks into each design review knowing which links prove their input and which do not.

12,000 h: of report reading a year returned at a large maker our estimate

Gaps found before the gateEach with both pages, an owner and an answer clock
Passing links sampled tooTwo people draw separate samples of the links that prove
An inspector can follow itRequirement to page to signature, in one export

One knee update, one morning export

A design history file the trace matrix called green

A cemented knee system gets a new tibial insert lock, two new insert thicknesses and new trial instruments. The validation review is a few weeks out, and the audit report is due to its board first.

demoThe knee program, its parts, the people and the figures you see are sample data.

01Morning export
14 links changed overnight and sit pale on the V, unopened
Design quality engineer
The V draws all 1,214 trace links of the program: needs and inputs down the left arm, verification and validation up the right, drawings along the base. This morning's export added 9 validation links to three new reports and moved 5 design outputs to a new revision. Until someone opens those reports, the dots stay pale and count for nothing.
02Morning export
Ten of the fourteen prove their input, and four do not
Design quality engineer
She starts the run. The agents open 8 reports and 190 pages, compare each criterion with its input and redo each sample size plan. Three links tested rev B inserts while rev D is released. A usability validation tested 9 scrub nurses with no rationale. The legend now reads 1,135 that prove it and 71 that do not.
03Review
TR-0881 passed at 295 N against 250 N, on parts no longer released
Design quality engineer
Five checks run on the link record that a trace tool cannot run. Criterion and input match, the tolerance bound holds and all 8 pulls passed, the lowest at 327 N. Page 4 is the problem: its test-article table lists insert rev B, tray rev C and tab rev A, while the released revisions are D, D and B.
04Review
The change order says dimensional only, and it moved the locking slot
Design quality engineer
She opens the cited change order at page 3. ECO-26-0193 took the insert from rev C to rev D: slot depth 1.10 to 1.25 mm, entry angle 30° to 25°. Its verification impact reads none identified, and it does not name TR-0881. The slot is the interface this test loads, so the impact statement does not settle it.
05Confirm
She signs that the link does not prove its input as released
Design quality engineer
The confirm button stayed locked until she had opened the input page and the report page. She picks the reason, writes a note for the trail naming the three old parts, and signs with the meaning printed above the password box. The gap goes on the list for the validation review.
06Countersign
Confirmed by the engineer, and the manager's countersign stays gray
Design assurance manager
On the manager's screen the record reads Needs countersign, the two pages are blurred shut and the button is gray. Her confirmation is not enough. He has to open the input and the report on his own screen before the button wakes. No timer opens it, and the audit has no sign-all button.
07Send
Two signatures on the finding before the systems engineer sees it
Design quality engineer
He opens both pages, agrees and countersigns. Back on her screen, the record's history lists her confirmation and his countersign, each with its time. She sends it to the systems engineer who owns tibial locking, and the answer clock starts. Gaps on femoral, patella, instrument and packaging parts go to their own team leads.
08Answer
He plans TP-0881-R1 on the released revision instead of arguing
Systems engineer
The systems engineer opens both pages first, then picks a re-test over a written rationale. The plan names the protocol, the date it runs and the test articles: released revision, production-equivalent lot. Saving it closes nothing. The gap stays open until the new report is linked and the agents have read it.
09Validation review
Ready for design transfer reads No, and revision gaps have no carry button
Design assurance manager
The DR4 page lists seven things blocking his signature on the audit report, his own sample of 29 links among them. 93 gaps are open. The 23 revision gaps on released outputs cannot be carried past DR4 under a rule he signed. Other gaps carry only if the program manager proposes it and he signs.

TR-0881: a sum that holds on parts that changed

The sample size checker redoes the report's own tolerance bound from page 3 and page 6, then reads the test-article table on page 4.

From the report	Value
Input DI-0312, axial disassembly force	at least 250 N
Eight pulls, lowest to highest	327 to 395 N
Mean and standard deviation	362 N and 21 N
Tolerance factor, 95% confidence of 95% reliability	k = 3.188
Lower bound, 362 − 3.188 × 21	295 N
Insert, tray and tab tested, against released	B, C, A against D, D, B

demoSample data, from the working solution. The criterion, the sum and the result all pass. The link still fails, because the parts on page 4 are not the parts released.

Around the audit report

Gaps, samples and scans across the design history file

What the engineer, the manager and the systems engineer open between the morning export and the validation review.

Gap list for a design review: requirement, report, reason, what the report says, owner team, state and clock for each gap — **The gap list**93 gaps for design review 4: 71 links that do not prove their input and 22 requirements with no link, each with its owner, state and clock.

Sampled sign-off of trace links the agents say prove their input, two separate random samples and the confidence each gives — **Sampled sign-off**The 1,135 links that prove it are accepted on two random samples, 59 for the engineer and 29 for the manager, that never overlap.

Verification report review by search: 23 report pages that tested rev B parts, each passage with its page number — **Search the file**A search for rev B returns 23 report pages that tested an older revision, each with the change order that moved the part on.

Reports read list with two scanned reports held for a person, their pages and the links that wait on them — **Scans held for a person**Two reports carry handwritten data sheets. Their 8 links show could not be read, and the engineer reads them herself instead of trusting a guess.

Read-only exports from three systems feeding the trace matrix audit, and the 14 changed links with their result — **Exports**Read-only feeds from the lifecycle system, the requirements tool and document control, with today's 14 changes and what each one now proves.

Audit trail of a design history file audit: agent steps, confirmations and countersignatures, each with what the signer meant — **Audit trail**Each agent step and each person's action with its time, its reason and what the signature meant. The evidence exports for an inspector.

demoSample data, from the working solution.

71 links that fail to prove their input, and 22 with no link at all

The reasons on the gap list after the run, as the V counts them.

Tested revision differs from the released output	23
Sample size without rationale	19
Criterion missing or not equal to the input	17
Result failed or partial	6
Report not approved	6
Linked, but does not prove it	71
Requirements with no link at all	22
Gaps on the list for design review 48 more links wait for a person to read two scans	93

demoSample data, from the working solution.

Five roles, and the one who confirms never countersigns

Each opens a different part of the file first.

Design quality engineer

Sees: Amber links with the input and report pages side by side
Signs: Confirms or dismisses each finding and reads the scans

Design assurance manager

Sees: The same record, opened on his own screen, and a separate sample
Signs: Countersigns findings and signs the audit report for each review

Systems engineer

Sees: Gaps on the parts he owns, oldest clock first
Signs: Answers with a re-test plan, a new report, a rationale or a dispute

Program manager

Sees: What blocks the review and the gaps that could be carried
Signs: Proposes a carry, which only counts with the manager's signature

Guest auditor

Sees: Any requirement, its report page and who signed
Signs: Nothing; reads and exports on a mock inspection

Who opens the reports

Six agents read the design file, and none of them closes a gap

They open, compare, redo sums and draft. People confirm, countersign and answer.

Index builder

Builds needs, inputs, outputs and links with revisions from the exports, and finds what changed.

Never edits a link in the source tools
Never guesses a missing link

Report reader

Reads each linked report for protocol, criterion, test article, sample size, results, deviations and signatures.

Never treats a handwritten scan as read
Never reads complaint or vigilance records

Criterion checker

Compares the report's criterion with the input: value, units, direction and method.

Never decides a looser criterion is acceptable

Revision checker

Compares the tested revision with the released one and reads each change order in between.

Never decides whether a change needs a re-test

Sample size checker

Finds the stated rationale and recomputes zero-failure plans and one-sided tolerance bounds.

Never invents a rationale

Gap writer

Writes each finding with both pages cited, proposes the owner and drafts the audit report.

Never confirms, dismisses or signs a finding
Never relaxes a rule

Where the audit stops and an engineer decides

These calls belong to named people, and the screens say so.

Whether a change needs a re-testThe revision checker shows the change order. The systems engineer decides if the moved part touches what was tested.

A typed rationale is never scoredThe agents leave its words alone. It is flagged for a human reader and goes to the engineer and the manager exactly as typed.

Looser decisions wait for the second personConfirming a gap takes effect at once. Dismissing one or accepting a rationale waits until the manager has opened the record.

Patient safety and lot releaseWhether the knee is safe for a patient, use on a child or off-label use goes to the medical affairs director. Releasing, shipping or the sterility of a lot goes to the quality release lead. Neither gets an answer or data here.

What design quality engineers ask before a DHF audit

What is a design history file audit?

A design history file audit checks that the design file proves what it claims before a design review. Here agents open the report behind each trace link and check the criterion, the tested revision, the sample size rationale, the result and the approval, citing the page for each.

How is this different from design controls traceability in our requirements tool?

The requirements tool shows that a link exists. This opens the report at the end of the link and reads whether it proves the input as released, then joins it to the lifecycle system's revisions and change orders.

Does it write to our lifecycle, requirements or document control systems?

No. It reads their exports through read-only connections. A link is never created, edited or deleted in the source tools.

What happens to a scanned report with handwritten data sheets?

Its links are marked could not be read instead of guessed. The design quality engineer reads the pages and records whether they prove the input, and the manager countersigns.

Can a gap be carried past a design review?

Only when the program manager proposes it and the design assurance manager signs. A revision gap on a released output cannot be carried past the validation review at all; it closes with a re-test on the released revision.

Does it read complaint or post-market files?

No. Where a design input came from post-market experience, the source appears as one signed input from the complaint handling team, referenced and not opened. The agents read requirements, design outputs, change orders and test reports.

Design & Development

Bring the trace export for one program
and the reports it links to.

We will open each linked report and show you the links that do not prove their input as released.

Book a demo Browse solutions

Design History File (DHF) Audit

A green trace matrix over test reports nobody has opened

The Problem Today

The Solution

What You Get

A design history file the trace matrix called green

14 links changed overnight and sit pale on the V, unopened

Ten of the fourteen prove their input, and four do not

TR-0881 passed at 295 N against 250 N, on parts no longer released

The change order says dimensional only, and it moved the locking slot

She signs that the link does not prove its input as released

Confirmed by the engineer, and the manager's countersign stays gray

Two signatures on the finding before the systems engineer sees it

He plans TP-0881-R1 on the released revision instead of arguing

Ready for design transfer reads No, and revision gaps have no carry button