Who Changed That Due Date? Data Integrity and the Audit Trail Your Spreadsheet Can’t Prove

Mara has run the calibration program for a Tier 1 automotive plant for six years. She is calm in a surveillance audit, because her spreadsheet is tidy and every cell is filled. Then the auditor stops on one row. A bore micrometer shows a calibration due date of March next year. The certificate stapled behind it, issued by the external lab, sets the interval that would put the due date in October — five months earlier. The dates don’t agree. The auditor asks the only question that matters: "Who changed this, and on what basis?"

Mara doesn’t know. The cell could have been edited by anyone with the file open, on any day, for any reason — or for no reason at all. There is no history behind the number. And that, not the five-month gap, is the finding.

The record is the evidence, not the instrument

Auditors rarely doubt that your technicians can turn a micrometer. What they test is whether your records can be trusted as evidence. ISO 9001:2015 clause 7.5.3 requires documented information to be protected against unintended alterations. ISO/IEC 17025:2017 goes further and more specifically: clause 7.11.3 requires that when data or records are amended, the change is tracked, earlier versions are retained, and the person who made the amendment is identifiable. Clause 8.4 requires records to remain legible, retrievable, and protected from unauthorised change.

Read those clauses together and a plain expectation emerges. A calibration record is not just a value; it is a value plus its provenance — who created it, who touched it since, when, and why. The pharmaceutical world names these attributes ALCOA: attributable, legible, contemporaneous, original, accurate. You do not need to work under GMP to be judged by the same logic. An auditor asking "who changed that due date?" is asking whether your data is attributable and original. A spreadsheet cannot answer, because it was never designed to.

This is why "incomplete or missing calibration records for monitoring and measuring equipment" remains the most common finding cited against ISO 9001 clause 7.1.5, and why performance-monitoring and records gaps were the single largest laboratory nonconformity category logged by ANAB in 2025, with 548 nonconformities recorded. The instruments were usually fine. The evidence about them was not.

Where the spreadsheet quietly fails

A shared workbook has four structural weaknesses, and every one of them is an audit exposure.

• No attribution. A cell records a value, never an author. Change the due date and the old value is simply gone, along with any trace of who replaced it.
• No timestamp of the change itself. The file’s "modified" date tells you the file changed, not which of 400 rows, or when that specific reading was entered versus back-filled a week later. That breaks the contemporaneous test.
• Silent overwrite. Type over an as-found reading and the original is destroyed. You have lost the one number an out-of-tolerance investigation depends on.
• No enforced link to the certificate. The due date and the certificate that justifies it live in separate places, free to drift apart — exactly the gap that caught Mara.

None of this requires bad intent. A well-meaning edit to "fix" a date, made under deadline pressure, produces the same unprovable record as a deliberate one. The auditor cannot tell the difference, so they must treat both as suspect.

What a defensible record actually looks like

PrüfDesk treats the record, not the cell, as the unit of truth, and it does so by removing the manual steps where integrity leaks away.

Calibration due dates are auto-calculated from the calibration event and the interval, not hand-typed. When a pass/fail result is logged against an instrument, the next due date follows from the record itself, so the date and its justification cannot silently disagree. If someone needs to change an interval, that is a deliberate action on the record — captured, not a quiet overwrite of a cell.

Every pass/fail record carries its as-found and as-left values and the certificate as an attached, retained object rather than a staple that can wander off. The original reading is preserved when a later one is added, which is precisely what an out-of-tolerance investigation and clause 7.11.3 both demand.

Configurable overdue blocking means an instrument past its due date is not merely coloured red in a column that a busy operator scrolls past. Per tenant, you choose a hard block that removes it from service or a soft warning that flags it — a control the standard expects you to enforce, not merely display.

The check-out and permanent-allocation trail answers the possession question auditors increasingly ask: who held this gauge, where, and between which dates. Bookings, allocations, and location history are recorded as events, giving you the chain of custody a spreadsheet never had.

Finally, the audit-ready PDF report assembles this into evidence on demand: the instrument, its history, its certificates, its status, and the record of changes behind them — the document you hand an auditor instead of scrolling a workbook and hoping.

A short integrity check for your own program

Before your next surveillance audit, run this against whatever system you use today:

• Can you show who last changed any calibration due date, and when?
• If a due date and its certificate disagree, does the system stop you, or just show two numbers?
• When a new as-found reading is entered, is the previous value retained or overwritten?
• Can you produce a single instrument’s full history — calibrations, certificates, custody — without reassembling it from three files?
• Is an overdue instrument enforced out of service, or only coloured red?

If any answer is "no," that is not a paperwork nuisance. It is the gap the auditor will find first.

The point of a data layer you can defend

ISO 9001’s sixth edition, publishing this September, adds an explicit expectation to validate the software used for monitoring and measurement — a signal that regulators now see the system of record itself as part of the measurement chain. The direction of travel is clear: your calibration data has to be as trustworthy as the instruments it describes.

Mara’s micrometer was almost certainly still in tolerance. She lost the point on the record, not the reading. A calibration program earns a clean audit when every number can say where it came from and who last touched it.

If you’d like to see how PrüfDesk keeps that history intact — auto-calculated due dates, retained as-found/as-left values, a full possession trail, and audit-ready reports — it’s a short walk through your own equipment list. No calibration, and no due date, should ever be a mystery.