KENX AI in GxP East 2026

2026-09-15-1516-gxp-audit-war-room-mock-audits

13 min read

Eric Ma and an audit practitioner on war rooms, scribes, and mock audits

Recorded 2026-09-15 at 1516 via Plaud. 06:42.

Summary

Recorded right after the final talk at the GxP and AI conference, this is a conversation between Eric and a regulatory-audit practitioner, with a brief dinner-coordinating exchange up front involving William, an AD of Quality Systems, and Samuel. Eric, new to Moderna’s clinical development (Clindav) space after taking over his second team, asks how FDA and EMA inspections actually run. The practitioner lays out the protocol: audits usually arrive as a notification with an intended inspection date plus an agenda, so teams have time to study up (surprise notifications are the scary ones); the core mandate is verifying that systems actually support the SOPs, with auditors reading the SOPs in silence and then demanding “show me this process” executed live in the system; seniority has nothing to do with who is in the room, because the SOP calls out who executes a process and that operator is brought in to demonstrate it, with a quality lead like William present to facilitate and answer high-level questions; and auditors ask for proofs, logs, and audit trails, for example a report on how many users ran process X and whether they all ran it the same way. The unpredictable part is that once auditors find a thread they keep pulling at it, and you cannot reliably guess where they will go.

The counterweight is organizational. Larger organizations run a war room during audits: SMEs in a back room watch a live transcription beamed from a scribe in the front room, predict the investigator’s next path (“I think that investigator is going to go for this path”), and prepare the relevant documentation before it is requested. Etiquette makes the loop work: never make anything up; if you do not know, say so or say “let me double check that for you”, which is itself the trigger for the war room to find and confirm the documentation, after which the scribe can lean over with the evidence ready. The practitioner’s reassurance is that audits are long days but fun, not scary, as long as you know your process. On preparedness, mock audits are run by outside firms typically staffed by former FDA or EMA auditors who are audit certified; the quality team owns the schedule and usually runs at least one mock audit per functional area per year. Eric is not sure whether Moderna does them (“either Moderna is like cowboy, or something else”) and leaves with a concrete next step: check with the Clindav digital lead about the mock audit schedule. The practitioner contrasts his own background at Google, a med device company with no audits and “a lot more flexibility.”

Plaud AI notes

App-generated, verbatim from Plaud’s Summary tab.

Core Synopsis

The reality of a regulatory audit is not about surprise, but about rigorous, evidence-based process verification. Auditors from agencies like the FDA and EMA do not hunt blindly; they follow a pre-announced agenda, scrutinizing whether a company’s documented Standard Operating Procedures (SOPs) are reflected in actual system execution. The core of the audit is a demand for proof: “Show me this process,” “Show me the logs,” “Show me that every user ran it identically.” This creates a high-stakes, theatrical environment where the organization’s preparedness is tested in real-time. Success hinges on a disciplined “War Room” model that anticipates the auditor’s line of inquiry, retrieves documentation instantly, and coaches subject-matter experts to respond with facts, not speculation. The most effective defense against this scrutiny is not seniority, but deep operational knowledge, reinforced by routine, high-fidelity mock audits.

Anatomy of a Regulatory Audit

The Inspection Protocol

  • The Announcement: Audits are typically pre-scheduled, with regulators sending a notification and an agenda. This allows the organization time to prepare. Unannounced inspections are rare but create significant pressure.
  • The Core Mandate: The primary goal for an auditor is to verify that a company’s SOPs are not just theoretical documents but are actively and accurately supported by its systems (e.g., GXP systems). They will read the SOPs and then demand a live demonstration of the corresponding process within the system.
  • The Chain of Inquiry: An auditor will pull on any thread of inconsistency. If they find one deviation or anomaly, they will continue to investigate that specific path, making the audit’s trajectory unpredictable. They will request audit logs, audit trails, and reports to verify uniform execution across all users and instances.

The Organizational Response

  • The Front Room: The primary interaction with the auditor occurs here. The key personnel are not necessarily senior leaders, but the actual operators who execute the processes defined in the SOPs. A quality lead (like William, the AD of Quality Systems) facilitates, but the Subject-Matter Expert (SME) demonstrates. Critically, scribes are present to transcribe the entire conversation for the back room.
  • The War Room: In a separate location, a team of SMEs monitors the live transcription from the front room. Their function is anticipatory: they follow the auditor’s questions, predict the next line of inquiry (“I think they’re going for this path”), and proactively gather the relevant documentation and proof points.
  • The Communication Loop: When a presenter in the front room is asked a question they cannot answer, the correct response is never to invent an answer. Instead, they state, “Let me double-check that for you.” This is the trigger for the War Room to find the definitive documentation. The scribe can then quickly provide the evidence to the presenter, demonstrating rapid, organized command of the company’s own processes.

The Preparedness Doctrine: Mock Audits

The fundamental strategy for de-risking a real inspection is to conduct mock audits. These are simulated inspections run by external organizations, often staffed by former FDA or EMA auditors. The mock audit plays out the exact scenarios of a real one, allowing teams to practice, identify process gaps, and build the muscle memory required to perform under pressure. It is recommended that each functional area undergo at least one mock audit per year, typically scheduled by the internal Quality team. For teams new to regulated spaces (like the Clindav space), inquiring about the mock audit schedule is a critical first step.

Next Move

@Speaker 3

  • Check with the Clindav digital lead about the current mock audit schedule and whether the team participates - [TBD]
  • If no mock audits are scheduled, propose initiating one to the Quality team - [TBD]

@Speaker 1

  • Connect with Speaker 2 and Samuel via text stream to finalize dinner plans for 6:15 PM - [Today]

Transcript

[00:00] Speaker 1: That’s really depends on what system they’re looking at. The system they’re understanding

[00:07] Speaker 2: This is my coworker William. Oh, this is Eric. Nice to meet you. Real quick, did you? We’re gonna try to get dinner around six fifteen. Did you want to join us? Yeah. Where you guys gonna go? I know. I just gave Samuel your your number. Yeah. And then we’ll he’s just gonna set up a text stream. All right. Yeah. So we’ll figure it out. Yeah, that works. Yeah. So I just kind of look around.

[00:26] Speaker 1: I might be a little late. I have some. I know I have some emails to do after this. Okay. Yeah, I’ll be around that time. If I can only join you guys for a cocktail, is that cool?

[00:34] Speaker 2: Yeah, yeah. So we’ll let you know. All right, we’ll just set up a text. All right,

[00:37] Speaker 1: Cool. All right, I’ll see you later, William. He’s actually good to talk to if you have the chance to. He is our AD of Quality Systems. Oh, cool. Cool. So, what an auditor will ask for it depends on the context of what they’re looking for. Okay. So, and it depends on if it’s the FDA and if it’s the EMA. They have different things that they like to focus on. Ah. Generally speaking, though. The prior to an audit, they’ll send you a notification saying, “Hey, this is our intended date of coming to inspect.” If you get a surprise notification, those are always scary. But they’ll generally have an agenda of what they want to look at, so everybody has time to study up and prepare, so you’re not completely caught off guard. Okay. So if they’re inspecting your GXP system, okay, inspection of GXP systems. Primarily, what they want to do is they want to verify that your processes are actually supporting of your SOPs. So they will read through your SOPs, and you just sit there in silence sometimes. And then they’ll say, ” Show me this process. Show me how it’s executed in the system. And does the system support your SOPs?” Okay.

[01:45] Speaker 3: And so, under those circumstances, is it true then that like folks would? Bring in the operators who know the SOPs, and then walk the regulators through.

[01:56] Speaker 1: Correct. So seniority has nothing to do with who’s in the room. Yeah. Like a quality lead will be in there. Like a William will be in there. Yeah. But he’s in there just to kind of like facilitate the conversations and answer high - level questions. Yeah. There’s a specific question they have about a process within the SOP. It’s why it’s important. The SOP calls out who executes it. Yeah. Then they call that person in to say, “All right, show me how you execute this.” Okay. And then they’ll even ask for examples. Okay, give me. Can you give me a report on how many users have actually ran process X? Okay. And I want to see that they all ran the same process. They’ll ask you for proofs. They’ll ask you for logs.

[02:41] Speaker 3: So to that degree. That’s why there’s audit logs and audit trails. They’ll pull for all of that.

[02:49] Speaker 1: They’ll pull all of that information. And if they find one, and this is the part where the unpredictability comes in, which is if they find a string, they’ll just keep pulling at it, and you don’t, and you don’t know where they’re really going to go. We’re trying to guess where they’re going to go. Okay. Okay. But it’s not. Always have like a war room. Ideally, if your organization is large enough, you’ll have a war room set up for those audits. Yeah, yeah. And in that war room, you’ll usually have a bunch of SMEs in there. Ideally, you have somebody in the front room who’s transcribing. Yeah. And then that transcription is showing up on a screen in the back room. So the team in the war room is actively following the conversation and saying, “I think that investigator is going to go for this path.” Whoa. Start preparing for for that. Oh wow! Okay, it’s it can be intense. They’re long days, but they’re fun. Okay, it’s it’s not as scary as people think it is. Okay, it’s not scary. Get in there as long as you know your process, you’re good. Okay, okay, got that. And if you don’t know the answer, never say, never make up anything. Right, right. If you say we don’t know, we’ll yeah find the right person. Or let me double check that for you. Yeah, yeah. And as soon as you say, ” Let me double check that for you,” should trigger the war room to say, ” Find that documentation, confirm the process.” And then the scribe who is in the room. Sometimes there’s more than one scribe in the room with the with the auditor. They could just lean over and say, ” Look at this. Here’s the documentation. It’s ready.” Ah.

[04:22] Speaker 3: Wow.

[04:26] Speaker 1: Someone’s not that scared.

[04:27] Speaker 3: All right. Okay. Because I’ve I’ve heard of it. Like the inspectors come, and then it’s a big deal. And I’ve never had to take part in any of them. So then, the stories I’ve heard are, shoots. We have to drop everything we were going to do today, and make time. Um, if it was an unexpected, if it was an unexpected, or unannounced visit. That is. Yeah.

[04:51] Speaker 1: Are you guys doing mock audits?

[04:54] Speaker 3: I don’t know actually. I’m I’m new to the. Clinet Clindav space, so I gotta double check with the Clindav digital lead. Yeah, he’s here too, but I’ll I’ll have to check mock audits.

[05:06] Speaker 1: What what what are they like? So it’s it’s hiring an outside organization to come in and do and play that inspection role for you. So typically there are people who used to work at the FDA or the EMA. Yeah, they also are typically audit certified. So yes, go get your degree and get your certificate of being an auditor. Yeah, and they’ll. Come through, and they will do mock audits for you, so you’re prepared to practice. Oh, okay, okay. And you make improvements, improve your processes, and but that will help you get more comfortable. Okay, okay. If you haven’t had one, ask Mike. Can can we get a mock audit going? Usually, your quality team is responsible for scheduling those out. Okay, okay, gotcha, gotcha. They shut up. They should have a mock audit schedule set up. Every functional area. Yeah. So if you reach out to them, they’ll tell you what their schedule is. They usually, at least from my experience, they usually do at least one for each of the functional areas per year.

[06:05] Speaker 3: Yeah. Oh. Okay. Okay. Huh. All right. Either Moderna is like cowboy, or or something else. I was working at Goldman. Heard of it, but maybe I’m. I think they might. I think we might. We might.

[06:20] Speaker 1: I was working at Google. We never got any audience.

[06:23] Speaker 3: Yeah. Okay.

[06:24] Speaker 1: But we were a med device, so it was a little more cowboyish. A lot more flexibility. I kind of miss that.

[06:33] Speaker 3: I’m gonna go. See you around.

← Abhishek on acceptance criteria | Home | Abhishek follow-up →

Graph View

Backlinks