Exporting evidence for an auditor

Reports and data exports: run a report; choose the right export; request an evidence archive; preserve a usable evidence package. This is chapter 34 of the NormaQMS User Guide.

Run a report

Open: Reports. Select Last 30 days, Last 90 days, Last 365 days, or Custom range and choose Apply. For a custom range, choose and apply Custom first, then enter From and To and apply again. Confirm the Showing dates. Missing or invalid custom dates fall back to the default period until corrected.

Report	What to use it for
Overdue work by owner	Locate overdue CAPA, NC, and action follow-up
Nonconformance aging by stage	Review Open and Dispositioned NCs and older work
CAPA aging and effectiveness	Review implementation, verification, overdue checks, and closures
Repeat nonconformance	Look for repeated detection points or supplier-related issues
Training current by department	See where required reading remains incomplete
Supplier performance	Review evaluation timing and related NCs
Equipment due	Find overdue, never-calibrated, and upcoming instruments
Document review load	Plan due and upcoming periodic reviews
Audit finding closure	Review audits and unresolved findings
Audit program coverage	Count the audits planned in the period by outcome: completed, overdue, cancelled, deferred, or not applicable
Qualifications expiring or expired by department	Find people whose certificates or qualifications lapse within 30 days or already have

Read the definition and denominator printed with each report. Some lines describe current state; others use the selected period. Do not assume every number is limited to records created within that range.

Tip: For a management review, run Last 90 days and download the management review pack the same day. The pack's CSVs are the evidence that the numbers in the minutes came from the registers as they stood, which is the question a registrar asks about a review.

Select a figure to drill into its register. The drill-down opens exactly the rows the figure counts, with the filters that select them shown on the register; a percentage opens the rows it was computed over. Figures count the records you can open, so a department-scoped user and a quality manager can see different numbers for the same report, and each one's drill-down reproduces their own figure. The reports page is not an automatic scheduled-email reporting service. The work digest is a separate system.

Choose the right export

Output	Contains	Does not automatically include
Filtered register CSV	Displayed collection-table rows in the displayed order	Every row in the organization
Register CSV	The permitted register data for that export	All attachments and full chains
Organization ZIP	Every register as CSV, every stored file under files/, every record chain under chains/, manifest.json with checksums, README.html	Products the organization does not own, such as Traveler (declared in the manifest's omissions); archives above 400 MB, which are refused: use an evidence archive instead
Evidence archive	The same archive as the organization ZIP, built in the background, at any size	Files after 30 days; the manifest, digest and chain entry are kept
Management review ZIP	Available management-review, metric, NC, CAPA, audit, and complaint CSVs plus report definitions	Approved meeting minutes generated from your meeting
Termination ZIP	termination.html with every register table and chain-head hashes, plus every file and chain and a verifiable manifest	A restore-ready database backup; a deletion certificate
Record-chain JSON	The selected record's chain evidence	Every record in the organization

Export controls can be visible differently from write controls, but each route still checks access. A module you have switched off does not hold its records back: the registers, files and chains written while you had it are exported like any others, and its register CSV still downloads. A module never bought that holds no records is left out.

The organization ZIP, evidence archives and the termination pack hold the whole company's records, so they are for administrators only. Their links on Settings and Reports show only to administrators, and each download first asks for the second sign-in step (chapter 2). With an authenticator app, enter its code and the download goes ahead. Without one, Norma emails a code, but only when you choose Email me a code on that page; opening the link sends nothing. After the emailed code, the termination pack downloads straight away; for the organization ZIP and evidence archives, Norma sends you to Settings to set up an authenticator app first, and you then open the download again. The register CSV stays with quality managers and administrators. A consultant key cannot download the whole-company exports, and an Advise key cannot export registers.

Request an evidence archive

Open: Settings > Evidence archives, or Evidence archives (large exports) on Reports. Only an administrator can request or download one, after the second sign-in step. Use it when the organization ZIP is too large for one download, or whenever you would rather not wait on a single download.

1. Choose Request a full archive. Its contents are fixed at that moment; records written afterwards belong to the next archive.
2. The archive shows as Queued, then Building, then Ready, with its size, entry count, and SHA-256. Nothing needs to stay open while it builds. Up to two archives can be building at once.
3. Select the download and verify it as any other archive: sha256sum -c manifest.sha256 in the unzipped folder.

A ready archive stays downloadable for 30 days; then its files are deleted and it reads No longer available, while its manifest, digest and chain entry are kept. Request a new archive whenever you need the files again. Every request and download is on the organization chain with the person's name. None of this depends on which modules are switched on.

Preserve a usable evidence package

Download the needed register pack, read its README, and obtain the specific documents, calibration certificates, supplier files, and chain exports needed for the review. Save the package in your approved retention location with organization and date. Open a sample CSV, HTML file, and attachment before treating the package as complete.

When leaving the system, an administrator downloads the organization export or an evidence archive and the termination pack from Settings. Switching modules off first does not remove their records from either. The termination pack is intended to remain readable without the app, but it is not a replacement for retaining the original evidence files your shop needs.

In the user guide

This article is chapter 34, "Reports and data exports", of the NormaQMS User Guide (NORMA-UG-001), which is under Help > User guide. Chapter numbers in the text refer to that guide.