The Decision Authorization Model
Compliance systems document events.
Inspectors evaluate decisions.
Most quality systems produce records that document what happened. Inspectors rarely challenge those records. They challenge the decision behind them — and that authorization trail is what most organizations cannot produce.
The Documentation Gap
Your quality system documents everything except the one thing inspectors ask about.
Most organizations can produce the batch record, the investigation report, the deviation closure, the CAPA, the validation protocol. These systems work. They document operational events:
- SOPs and procedure records
- Training and qualification records
- Batch records and release documentation
- CAPA investigations and closure records
- Change control records
But inspections rarely challenge these records. Investigators challenge the decision logic behind them.
Who made the decision? What evidence did they review? What standard governed the conclusion? Who authorized the outcome?
A complete record of the operational event — the batch, the deviation, the investigation, the CAPA, the conclusion.
The record answers: What happened?
The authorization behind the record — who evaluated the evidence, what standard they applied, who approved the outcome, and when.
The question is: Who authorized this decision, and on what basis?
The Inspection Moment
One question reveals the gap.
An FDA investigator reviewing a CAPA file asked one question:
“Who authorized the decision that this CAPA was effective, and what evidence did they review before making that determination?”
- EXISTSThe CAPA investigation report
- EXISTSThe corrective action documentation
- EXISTSThe effectiveness check record
- MISSINGThe authorization record documenting who evaluated that evidence, what standard they applied, and who approved the closure decision
The Authorization Model
Where most companies stop. Where inspectors look.
The documentation chain most organizations build ends one step before where inspectors apply scrutiny. The missing element is not the record — it is the authorization decision that follows it.
Steps 3 and 4 are where the observation is written. Most organizations stop at Step 2 and discover the gap when the investigator asks.
All four steps exist. When the investigator asks who authorized the decision, the record answers immediately.
Common Authorization Gaps
These are authorization failures — not documentation failures.
In each case below, the record exists. The authorization evidence behind it does not.
Batch Release Authorization
The batch record is complete. The release signature exists. No record documents who evaluated the evidence before that signature.
"Who authorized the release decision and what evidence did they review?"
Deviation Disposition
The deviation was investigated. Root cause was identified. The disposition decision was never formally authorized.
"Who made the disposition determination and what methodology did they apply?"
CAPA Closure Decision
Effectiveness was verified. The CAPA was closed. No record identifies who made the closure determination or the standard applied.
"Who determined this CAPA was effective and what evidence supported that conclusion?"
Change Control Impact
The change was documented and implemented. The regulatory impact determination exists as a conclusion — not as an authorization record.
"Who made the regulatory impact determination and what was the basis for that assessment?"
Validation Approval
The protocol was executed. Results were documented. Approval was signed — but the decision logic behind the signature was never recorded.
"Who authorized validation acceptance and what acceptance criteria governed the decision?"
Supplier Qualification
The audit was conducted. The supplier was approved. The authorization decision documenting that evaluation was never created.
"Who authorized supplier qualification and what risk evaluation preceded that decision?"
These gaps are not visible until an investigator asks the question. By then, the record cannot be created retroactively.
The ComplianceWorxs System
ComplianceWorxs creates the authorization record most quality systems never produce.
A Decision Defense Record (DDR) is a structured authorization artifact created at the moment of the compliance decision. It documents the decision logic, the evidence reviewed, the regulatory standard applied, and the identity of the decision authority — in a form that is immediately inspection-ready.
The DDR is created before the inspection. It answers the investigator's question before it is asked.
Every DDR produces
- Authorization Record — the core decision documentation
- Audit Defense Brief — inspection-ready narrative summary
- Decision Summary — regulator-ready evidence binding
- Compliance Certificate — timestamped defensibility attestation
How the System Works
From inspection question to defensible authorization record.
Inspection Scenario
Each scenario documents the moment an FDA investigator asks the question the record cannot answer. The question reveals the authorization gap — the decision was made, but the authorization evidence was never created.
Browse all 20 inspection scenarios →Authorization Gap Identified
The gap is the space between the compliance record and the authorization decision behind it. Identifying that gap is the first step toward closing it before an inspection.
Authorization Assessment
The Decision Ownership Assessment maps which decisions in your organization are missing authorization records — and which create the most inspection exposure. Free, 3 minutes, no login required.
Start the Authorization Assessment →Decision Defense Record Issued
ComplianceWorxs issues a DDR for each critical decision — a structured, immutable authorization record that answers the investigator's question before it is asked. The record is frozen at the moment of authorization and cannot be altered retroactively.
See Inspection Case Files →Authorization Capability Levels
Where does your organization operate today?
Organizations implement authorization infrastructure at different levels of maturity. The gap between where most organizations operate and where inspectors apply scrutiny is the authorization gap this system closes.
Level 1
Reconstruction
Decision logic exists in emails, notes, and memory. The organization can rebuild what happened — given time. Inspectors do not give time.
Level 2
Documented Authorization
Decisions are documented at the time they are made. The authorization event is captured with a named owner, evidence reviewed, and regulatory standard applied.
Level 3
Inspection Defense Infrastructure
Authorization records are issued systematically, permanently frozen, and immediately producible under inspection. Decision trails exist as a matter of operating procedure.
ComplianceWorxs
Free · 3 Minutes · No Login
Find Your Authorization Gaps
Start the Authorization Assessment to determine whether your compliance decisions can be reconstructed during an inspection.
Start the Authorization Assessment