The audit found seven observations. The process failed once.

Here is an uncomfortable observation from two decades on both sides of audit tables, automotive and aerospace: the findings list is the cheapest quality data a plant receives all year, and most of it gets spent on a two-week response letter.

Alkem's Daman facility has just picked up seven observations on an FDA Form 483, and I can reconstruct the closing meeting without having attended it. Relief in the room — only seven. Someone assigned to compile the responses. A deadline set for the letter. Nobody asking the only question that matters: if an investigator sampled a fraction of your records over a handful of days and found seven, what is the generating process actually producing? Nothing corrupts corrective action faster than relief.

A finding is a sample, not a census

An FDA investigator, like an IATF 16949 or AS9100 auditor, sees a slice of the plant. A fraction of the records. Two shifts out of three, one line out of four. Seven observations in a few days is an estimate of a failure rate, not the failure itself. Seven findings from a sample means the population is worse than seven — the only open question is the multiplier, and you do not want the regulator estimating it for you.

Put the same logic on the shop floor. If a quality engineer pulled a sample from a batch and found seven nonconforming parts, the batch would be quarantined before lunch. Hand the same engineer seven audit observations and they get answered one by one, then filed as correspondence.

The fix starts with clustering. Pareto the findings the way you would Pareto defect data — by process, not by clause. Seven observations routinely collapse into two or three generating processes: outdated work instructions, training records never closed, deviations handled after the fact. Dig beneath those and you keep hitting the same root. The process owner does not own their documentation, so the quality department owns it for them — badly, and at a distance.

The response is a change, not a letter

Seven separate answers produce seven Band-Aids. Each gets an owner, a deadline, an effectiveness check. None touches the common cause, which is the only cause that repeats. The alternative is one systemic 8D across the set: define the problem in D2 as "our management system produced these seven conditions", verify causes against the actual control points, then treat the corrective action like any process change — APQP and PFMEA logic, control plan updates, retraining, requalification of the affected steps, effectiveness evidence a stranger could audit.

I have run this both ways. At SNOP I inherited a queue of repeat findings from customer audits, each with its own little response history. We stopped answering the queue. We clustered the recurrence into one systemic 8D and fixed the underlying control points — and that discipline carried a real share of the 70% defect-cost reduction we delivered. The cheapest defect is the one you stop manufacturing on schedule.

There is a € trade-off, and it belongs in the boardroom, stated honestly. The systemic fix costs money now: engineering hours, line trials, requalification — realistically tens of thousands of euros for a mid-sized plant. The alternative costs more and arrives later. Repeat inspections, escalated customer audits, the slow tax on confidence. In pharma the ladder runs 483, warning letter, consent decree. In automotive it runs escalated supplier surveillance into new-business hold. Same ladder, different letterhead.

An audit finding is an invoice for a decision the plant already made.

Rehearse the audit you intend to pass

Audit readiness has one simple test: the operator can produce the evidence without the quality manager standing next to them. If evidence needs an escort, it is not a system — it is a performance staged twice a year. And rehearsal is not theatre prep. If readiness work creates a separate set of audit documentation alongside the live one, you have built two systems: one that runs the plant, one that decorates it. Auditors find the seam.

When I built the QA/QC department for a 900-plus-employee greenfield plant, readiness was designed in from day one — records owned at the point of use, layered process audits, internal VDA 6.3-style audits run harder than the external ones. The external auditors found little because the internal ones had already found the rest.

I have always audited the way I probe systems I am certified to break: find the path of least resistance, then assume the operator walks it every day. Fix the path, not the operator.

And the closing meeting sets the ceiling on response quality. Argue findings and you get defensive correspondence; ask what the sample implies and you get change. My de-escalation record — zero critical customer escalations within a quarter — came from treating every finding as system data, not a negotiation to be won. The response letter inherits the temperature of that room.

Inspectors do not manufacture findings. They collect what the system already produced, weeks or months before they walked in. Seven observations, one process failure. Answer the system, not the list — the next investigator reads your last response before booking the flight, and the next audit is a re-test of it. With ISO 9001:2026 transitions underway and leadership accountability moving to the centre of the standard, response discipline is becoming a boardroom-visible line between plants that improve and plants that repaint. Seven findings were never the problem. Seven answers will be.