Your Calibration Report Template Is Uncontrolled

Elena is the quality engineer at an AS9100 aerospace machine shop, and she keeps every calibration certificate her lab has ever issued. During an internal review she pulled two of them side by side — a certificate printed in 2023 and one printed last month, both for the same air gauge, both produced by the same Access database. They did not look the same. The newer one had a measurement-uncertainty field the older one lacked, the tolerance column had moved, and the signature block sat in a different place. Someone had improved the report layout at some point. That is not the problem. The problem arrived as a single question she could not answer: which version of the template produced the 2023 certificate, and can you prove it?

She could not. The Access report object had been edited in place, over years, by more than one person. There was no revision history, no approval record, no way to reconstruct what the form looked like on the day it printed that certificate. The evidence she hands an auditor to prove her instruments are fit for purpose was itself produced by a document nobody controls.

The record is controlled. The thing that prints it is not.

Most quality teams think carefully about the calibration record — the as-found and as-left readings, the pass/fail, the certificate number. What slips past everyone is that the Access form and report that render those records into the document you present at audit are themselves documented information under ISO 9001 clause 7.5. Clause 7.5.2 says that when you create documented information you must ensure appropriate identification, format, and — critically — review and approval for suitability and adequacy. Clause 7.5.3 says documented information must be controlled: version-managed, distributed to the right people, protected from unintended alteration, and retained. AS9100 and IATF 16949 inherit all of this and add teeth, because the certificate is objective evidence in the product-conformity chain.

A report object living inside an .accdb file meets none of those requirements. It has no version number. It was never formally reviewed or approved as a controlled form — it just evolved. Anyone with the database open in design view can change it, and the change takes effect immediately with no record that it happened. You cannot state which revision is current because there is no concept of a revision. That is, by the plain definition in the standard, an uncontrolled document sitting at the exact point where you generate your audit evidence.

Why it was built this way, and why that was reasonable

None of this is a story about a lazy team. When the database was built, putting the report inside Access was the obvious, correct choice. The data was already there; Access could bind a report straight to a query and print a tidy certificate without a second tool. It was free, it was fast, and it kept the whole thing under the quality team’s control instead of waiting on an IT project that was never going to be funded. Building the certificate template where the data already lived was good engineering for the constraints of the day.

The liability is not that the choice was wrong. It is that a form built to print a certificate quietly became a piece of documented information that the standard expects you to control — and Access gives you no mechanism to control it.

What actually goes wrong

Walk through the failure concretely, because "uncontrolled document" is a phrase auditors use and quality engineers under-weigh until it costs them a finding.

You cannot prove provenance. When two certificates for the same instrument look different across years, you must be able to show the change was deliberate, reviewed, and dated — that revision B superseded revision A on a known day for a known reason. With an edited-in-place Access report, there is no revision A to point to. The layout simply is what it is today, and history is gone.

Reprints rewrite the past. Here is the part that turns a tidiness issue into a traceability defect. Ask Access to reprint a 2022 certificate today and it renders the 2022 data through today’s report template. The document that comes out never existed in 2022. If the template gained or lost a field in the meantime, your reprint silently disagrees with the original you filed — two "identical" certificates for the same event, differing because the uncontrolled form moved underneath them. An auditor who spots that pair has a legitimate question about the integrity of your entire certificate output.

A well-meant fix corrupts everything at once. Someone corrects a mislabeled column or nudges the uncertainty statement to satisfy one customer. Because the report is a single shared object, that edit now applies to every certificate the system will ever print or reprint, backward and forward, with no approval step and no notice to anyone. One unreviewed change to one form object has altered the appearance of your whole calibration history.

Distribution is uncontrolled too. Clause 7.5.3 also covers who can access and change documented information. When the report lives in a shared .accdb, controlling access to the record and controlling edit rights to the template are the same permission — open the file and you can do both. There is no way to let a technician print a certificate while preventing them from redesigning the certificate.

"But my certificates are saved as fixed PDFs"

This is the honest objection, and it is worth answering squarely rather than waving away. Yes, if you export each certificate to PDF and file it, that individual output is frozen. But it does not close the finding, for three reasons. First, the frozen PDF still cannot tell an auditor which template revision produced it — provenance is missing at the moment of creation, not recoverable afterward. Second, the moment anyone reprints from the database instead of retrieving the saved PDF, the divergence above reappears. Third, and most fundamentally, clause 7.5.2 governs the template itself as documented information you create; a shelf of fixed outputs does not make the form that generates them a controlled document. Saving PDFs is good practice, but it is downstream housekeeping bolted onto an uncontrolled source.

What a controlled system changes on day one

The fix is not a stricter Access habit or a folder of dated backups of the .accdb. It is to generate the certificate from a system where the template is a controlled, versioned object and the output is a defensible artifact. In a platform like PrüfDesk, calibration certificates are produced as audit-ready PDF reports rendered by the system, so the document you hand an auditor is generated from the controlled record rather than assembled by a form anyone can quietly redesign. Reusable calibration procedure templates apply consistently across equipment of the same type, with per-unit overrides, so the method behind the certificate is itself standardized and traceable rather than improvised per instrument. And because the record and the rendering are separate from the ability to edit them, print rights and design rights are no longer the same permission — a technician can produce a certificate without being able to alter the certificate’s design.

The result maps directly back to what Elena could not do. The as-found/as-left readings, the pass/fail, and the certificate all belong to the instrument’s own history in one place, so provenance travels with the evidence instead of depending on a form object’s undocumented past.

You migrate to this in stages, not a leap

The reasonable fear is that moving certificate generation off Access means losing the historical documents you have already filed. It does not, if you move in stages and preserve the originals. Export the Access tables and keep every existing certificate PDF exactly as filed — those remain your record for the periods they cover; you are not rewriting history, you are stopping the uncontrolled generation of new history. Clean the obvious integrity faults in the data, map each field to the target system, then validate by reconciliation so every instrument and its calibration history arrives intact. Run both in parallel for one calibration cycle, printing certificates from the new controlled template alongside the old form, and confirm they carry the same facts before you retire the Access report. History and traceability are preserved because you carried the records forward and checked them.

A short pre-migration checklist

Before you move anything, spend an afternoon here:

• Find the template. Locate the Access report object that prints your certificates and confirm it has no version number, no approval record, and no change history. Write that gap down — it is the finding you are closing.
• Compare across years. Pull one certificate from two or three years apart for the same instrument. Note every layout or field difference; each one is a change you currently cannot account for.
• Test a reprint. Reprint an old certificate and lay it next to the original PDF. If they differ, you have documented proof of the reprint-rewrites-the-past risk.
• Separate the permissions. List who can open the database. Every one of them can currently redesign your certificate; decide who actually should.
• Preserve the originals. Confirm every historical certificate is saved as a fixed PDF before cutover, so the record for past periods is intact independent of any template.

Where this leaves you

The uncontrolled document was never a formatting nuisance. It sits at the precise point where your calibration program turns records into evidence, and clause 7.5 expects that point to be controlled, reviewed, and traceable. Moving certificate generation from an editable Access form to a versioned system that renders audit-ready PDFs is not a dramatic leap — it is the staged, reconcilable change that lets you answer the one question Elena could not: which version produced this, and can you prove it?

If you would like to see what a controlled certificate looks like when its template can’t be quietly redesigned, take a short look at how PrüfDesk generates audit-ready reports from a versioned, controlled record.