Guide
The Audit Pack: what a sponsor or an inspector can verify without taking your word for it
Published October 25, 2026
At the close of the study, the sponsor writes: "Prove it." They are not talking about your results. They are talking about the path. Was the protocol approved before the start? Who signed what, and when? Which deviations were declared? Has the audit trail been changed since?
If the answer is a file you assembled yourself, you are asking your reader to believe you.
This page covers one object: the end-of-study deliverable, and what a third party can verify from it alone. It does not replace your quality assurance or your validation.
The file of the last week
The end of a study concentrates the requests. The sponsor wants to be sure the report matches what happened. QA prepares its review. An inspector may pick a step performed months earlier.
When the file is rebuilt at that moment (exports from several tools, spreadsheets, pages signed by hand), each piece is probably accurate. But you are the one who gathered them. The reader cannot see what is missing.
A file that can be checked on its own changes the conversation. You stop discussing trust and start discussing documents.
What the site states
The Audit Pack is the sealed deliverable of a study. It holds the approved protocol, the signatures, the deviations and the hash-chained audit trail. It exports in one click. Your sponsor and your inspector can verify it.
The trail is append-only, timestamped and SHA-256 hash-chained. Any alteration shows. Sealing starts when the sample is received and stops when the result is handed over.
The limit fits in one sentence: this page does not describe the file format, its fields or the verification procedure, because the site does not publish them. Those are questions to ask, not promises.
Verifying is not believing
In a hash chain, each entry depends on the previous one. Changing an old entry breaks everything after it. A third party who reruns the computation sees it without needing your word.
That is the general principle. How the Audit Pack applies it, what the verifier needs in hand, and whether they can do it without your tool: that is what to ask, us included.
Two dated points from the release notes, to place the state of the product. On 19 October 2026 they state that the reception time of steps is set by the server, and that a signed review of the audit trail exists on the server side, with its screen in the application coming later. Do not assume either one appears in the deliverable.
What the chain does not prove
A hash chain reveals alteration. It does not stop a wrong value from being entered in the first place. A false value, correctly recorded, stays false and stays chained.
It covers only what was recorded. What happened outside the record, on a loose sheet or in another tool, is not in it.
It does not say the action was done well. That is the job of the operator's signature, the declared deviation and QA review. On per-step signatures, see the page on electronic signature and Part 11.
A deliverable that can be verified proves it has not changed. It does not prove it was right.
What the Audit Pack does not replace
It does not replace the final report signed by the study director, nor the quality assurance statement that goes with it. GLP also sets the content of the report and the archiving rules (21 CFR 58.35(b)(7), 58.185 and 58.190; OECD Principles of GLP, sections 9.1, 9.2 and 10).
It does not replace validation of the computerized system. That remains each organization's responsibility. Biotraxion provides the technical traceability building blocks and the material to carry it out.
It does not settle the question of copies. Part 11 asks that you can produce accurate and complete copies of records, in human-readable and electronic form, for inspection, review and copying by the agency, and that records are protected so they can be retrieved accurately and promptly throughout the retention period. What your organization keeps, where, and for how long is still up to you.
Six questions for any end-of-study deliverable
- What is sealed, from which moment to which moment, and what happens before and after?
- Is the approved protocol in it, with its amendments and approval date?
- Does each signature show the name, the time and the meaning of the act?
- Are the deviations in it, with their category and the step concerned? The release notes of 18 October 2026 state that a declared deviation carries a category, visible in the run file and the report. What about the deliverable?
- What happens to a correction made after sealing? Does the old value stay readable?
- Who verifies, with what, and can they do it without your tool or your help?
The sixth is the one that separates a file from a proof.
See an example, then judge
We show a sample Audit Pack and go through what your sponsor or inspector could verify from it alone: contact@biotraxion.com, or request a pilot from the home page. Product changes are dated in the release notes.