How Are Personnel, Device and Report Records Linked During an Audit?

Short answer: how are the three records related?

Link every job under a unique job/report identifier; to the personnel's authorization version at the moment of assignment, the equipment's suitability version at the moment of use, and the published report revision.

Audit evidence is not merely current personnel and equipment lists. The auditor must be able to reconstruct backwards who produced a given result, under which scope of authorization, with which equipment, with which method and form version; who reviewed it; and in which report version it was published.

Which identifiers should the common record backbone contain?

Short answer: immutable identifiers are needed for person, authorization, equipment, equipment suitability, job, method/form, and report. A name or file name must not be the relationship key.

ISO/IEC 17020:2026 defines the framework of competence, impartiality, and consistent operation for inspection bodies; the new edition also strengthens control of data and information. Software does not make the conformity decision for these requirements. Its task is to convert the organization's approved procedures into provable relationships and fail-closed gates.

How should personnel competence be linked to the report?

Link not the person's current profile but the authorization record in force at the time the job was assigned and performed. The ISO 9001 Auditing Practices Group competence guidance addresses determining the required competence, the activities undertaken to acquire it, evaluating effectiveness, and retaining documented information that constitutes evidence, together.

The authorization record should contain at least the role, method or activity, technical scope, level if required, assessment outcome, assessor/approver, start-end dates, and the underlying evidence identifier. Adding a certificate file to the profile is not sufficient on its own; the document's scope must match the scope the job requires.

The assignment gate can operate in this order: the role and scope required by the job are determined, the authorization version effective on the event date is looked up, restrictions or suspensions are checked, and a successful match is written into the job record as a snapshot. Even if the person's authorization is later renewed, the version on which an old report was based does not change.

Is the equipment record only a calibration date?

No. The ISO/IAF monitoring and measurement resources guidance recommends that the level of control depends on the intended use and that evidence be sought of the selected equipment's suitability for the specific activity. Therefore, a "valid calibration" alone does not make the equipment suitable for every job.

• The equipment's unique identifier, type, serial number, and responsible unit;
• measurement range, resolution, and other technical specifications required for the job;
• calibration or verification record, its scope, result, and validity status;
• maintenance, intermediate checks, faults, damage, quarantine, and return-to-service events;
• the time it was actually used on the job and, if required, its probe, sensor, or accessory relationship should be kept together.

The report must not look dynamically at the equipment card's current status; it must retain the suitability version accepted at the time of use. If the equipment is later found unsuitable, the system should be able to open an impact review by listing jobs linked to the same equipment-version-time interval. This does not mean automatically invalidating the result, but giving the correct scope to the authorized technical assessment.

How does a report revision preserve the evidence link?

A published report must not be overwritten in place. When a correction is required, the new revision is linked to the previous report identifier, the reason for the change, the changed fields, the re-reviewing/approving person, and the new publication time.

1. Field records and raw evidence are locked in the job identifier or completed with a controlled attachment record.
2. The report draft references the personnel authorization and equipment suitability versions used.
3. The technical review halts the approval if there is a missing or invalid link.
4. The publication event records the report revision, input versions, and authorized approval as an immutable package.
5. A later correction opens a new revision; the previous version, distribution, and verification trail remain accessible.

e-signed report revision and audit trail the guide details how the version chain should be preserved after signing.

Which events should be kept in the activity trail?

NIST SP 800-171 Rev. 3 requires that the audit record include the event type, time, location, source, outcome, and related person/object identifiers; and that audit information be protected against unauthorized access, modification, and deletion. This security framework does not replace an accreditation requirement, but it provides an applicable basis for the technical design of the digital evidence trail.

Record personnel assignment/rejection, authorization grant-suspension, placing equipment into service-quarantining it, creating field records, attaching evidence, technical review, report approval, revision, and publication events. Each event should include the user or service identifier, a timestamp containing the time zone, the relevant object identifiers, the result, and the rationale.

The log is not a copy of the job table. The current state speeds up operations; the event record shows by which steps that state was reached. Audit privileges should be separated from daily operational privileges, and the transactions of the few roles that can alter history should also be monitored separately.

Which queries should the auditor be able to run from a single report?

Short answer: all critical backward links from the report should be verifiable in a single view, but personal and commercial data should not be exposed beyond what the task requires.

• From which job, object, method, and form version was this report produced?
• Under what scope were the persons who performed and reviewed the job authorized on the event date?
• Which equipment, probe, or accessory was used, and which suitability record was valid at that time?
• Which review and approval steps existed between the raw field evidence and the published result?
• If the report was revised, why, by whom, and with which new inputs did it change?
• If an authorization or equipment nonconformity was later identified, which jobs were taken into the impact review?

The exported audit package must not be an uncontrolled copy of the live database. It should contain records selected by scope, version identifiers, and integrity verification; retention and access rules should be determined by the organization's procedures.

How are fail-closed gates tested in the VizyonTech workflow?

Vizyon Kalite or a related inspection flow is being evaluated, choose an anonymized sample job. First establish the correct personnel, equipment, and report link; then test not only the positive scenario but that the system halts errors.

1. Try an assignment with an insufficient scope or an authorization that expired on the event date.
2. Select equipment with valid calibration but not suited to the job's measurement range.
3. Send the report draft for approval with quarantined equipment.
4. Change raw evidence and verify that the previous report revision has not changed.
5. Run the publication or signature step before the technical review is completed.
6. On a subsequently discovered equipment nonconformity, check that the affected jobs are listed completely.

The success criterion is not producing a large number of records. The system should block a wrong link with an explainable reason, record authorized exceptions separately, and allow the auditor to reconstruct the historical event independently of current profiles.

Which source should be taken as the basis in the 2026 version transition?

According to ISO's official inventory, ISO/IEC 17020:2026 is the third edition, published in March 2026 and corrected in June 2026; the 2012 version has been withdrawn. ILAC P15:05/2020 on ILAC's current policy page, as its name suggests, is based on the application of ISO/IEC 17020:2012.

Therefore, do not automatically label the checklist "2026 compliant". The organization's accreditation scope, the national accreditation body's current transition decisions, and approved procedures should be verified together. The old and new requirement sets should be versioned separately; the transition decision, its owner, and the workflows it affects should be recorded.