How Is a Digital Record System Set Up for a TÜRKAK Audit?

What is the essence of an audit-ready record discipline?

Every record must be findable with which requirement it meets, its valid version, its owner, approval history and linked evidence. A missing, expired or unauthorized record must not be considered complete.

Audit preparation is not collecting files before the audit. It is the daily workflow producing personnel, device, method, report, nonconformity and document records in the same identity chain. Thus the team can show not only the existence of the document, but also as a result of which operation and by whom the record was formed.

How is the digital record backbone established?

Short answer: first a requirement inventory is drawn up; then each requirement is matched with process, record type, responsible role, retention rule and verification method.

1. Fix the scope: Manage the accreditation scope, branches, activities and applicable TÜRKAK/standard documents in a single requirement record.
2. Create a record glossary: Define record families such as personnel competency, device, environmental condition, method, work order, raw data, technical review, report, complaint and nonconformity.
3. Establish the identity link: Give every work order, personnel member, device and report an unchanging system identity. The file name alone must not be the identity.
4. Separate version and approval: Keep the draft, under review, approved and withdrawn statuses clear; do not overwrite the previous version with the new file.
5. Add fail-closed gates: If there is an expired device, out-of-scope personnel, missing raw evidence or an incomplete technical review, the report must not be closed.
6. Preserve the audit trail: Record creation, viewing, change, approval, export and authorization changes with time, user and justification.
7. Prepare the audit view: Give the auditor only read-only, time-limited access related to the scope; make it possible to go back to the source of every piece of evidence.

Which fields should an evidence package carry?

The fields of each record type may differ; the common core is identity, context, version, responsibility, time and integrity information.

How should standard and document version be managed?

Uploading a PDF to the archive does not complete the control. Its source, document code, edition, publication/effective date, owner, affected processes and periodic review date must also be recorded.

ISO's official catalogue shows the March 2026 3rd edition of ISO/IEC 17020 as published. Such a change in the system should produce not only a file change, but tasks for impact analysis, checklist update, training needs and implementation evidence. The organization must additionally verify the transition conditions through its own accreditation scope and TÜRKAK's current announcements/documents.

TÜRKAK's application page also offers different document lists according to conformity assessment fields. For this reason, instead of copying another organization's folder structure, link the document list valid for your own scope to the controlled external document inventory.

How is the personnel, device and report link shown?

On a single screen or with traceable links, the auditor must be able to follow this chain: work order → method/scope → assigned personnel → competency on the operation date → instruments used → calibration/intermediate check status on the operation date → raw evidence → technical review → published report.

The personnel's competency that appears valid today does not by itself prove a past assignment. The system must preserve the scope and validity status at the moment of assignment. Likewise, the device's current certificate does not replace its status on the measurement day. EN ISO 9712 personnel assignment check and guide to blocking an expired device elaborates on these two gates.

How are access, backup and integrity verified?

Records being accessible does not mean they are open to everyone. Role- and scope-based authorization, multi-factor authentication, time-limited auditor access and logging of sensitive exports must be applied together.

ISO/IEC 27001 addresses information security within risk management with confidentiality, integrity and availability objectives. The KVKK's Personal Data Security Guide also emphasizes access authorization, logging, backup and administrative/technical measures. The technical counterpart is not merely taking backups, but proving the restore test with a dated result; not merely keeping logs, but protecting log integrity and access boundaries.

• Link record class, recovery objective, responsible person and test frequency to the backup plan.
• In the restore test, verify that the selected samples are readable and their relationships are preserved.
• Automatically close the account opened for the audit on the end date.
• Do not copy annexes containing personal data unnecessarily; restrict access by scope.

How is an audit rehearsal done?

ISO 19011 provides guidance for audit principles, program management and auditor competence. The internal rehearsal, too, must be run on a scope- and evidence-based approach rather than randomly browsing folders.

1. Randomly select a recent report and trace it back to its source.
2. Reproduce the past status of personnel and devices.
3. Try that a withdrawn procedure cannot be selected in a new job.
4. See the system stop in scenarios of a missing annex, unauthorized approval and a failed restore test.
5. Trace a nonconformity's root cause, action, verification and closure evidence.
6. Test that the read-only auditor role cannot access out-of-scope records.

The output of the rehearsal is not a pile of screenshots; it is a tracking record consisting of the gaps found, risk, responsible person, target date, correction evidence and effectiveness verification.

In what scope should a pilot with VizyonTech be established?

Vizyon Periyodik or when evaluating the VizyonTech solution suitable for your organization, select a single real report family. Establish personnel assignment, device suitability, field form, technical approval, report and revision chain from beginning to end.

Try five negative scenarios in the pilot: expired device, out-of-scope personnel, old procedure, missing raw evidence and unauthorized approval. If the system only warns and continues in these situations, the record order is not ready for the audit. The successful criterion is that it prevents the error, makes the reason understandable and preserves the new audit trail formed after the correction.