Evidence Chain Readiness Checklist | Transvolve Consultancy

1. Requirements ↔ Risk Traceability

Every requirement has acceptance criteria Unambiguous criteria that can be verified
Risk controls link to specific requirements ISO 14971 controls mapped to design inputs
Design decisions are recorded and rationale documented ADRs or equivalent decision records exist
Traceability can be exported without manual effort Links are in a tool, not in people's heads

2. Verification Evidence

Each requirement has a defined verification method Test, inspection, analysis, or demonstration
Test evidence links back to requirements Bidirectional traceability in place
Risk control effectiveness can be demonstrated Evidence exists for each control measure
Test failures are tracked to resolution Clear audit trail from failure → fix → retest

3. Release Readiness

Release criteria are defined and measurable Not subject to interpretation or debate
Release evidence can be assembled in hours, not days No "audit scramble" required
DHF/Technical File is current and complete Not reconstructed under pressure
Residual risk is documented and accepted Benefit-risk documented per ISO 14971

4. Pipeline & Automation

Build provenance is repeatable and auditable Same inputs → same outputs
Automated tests produce evidence artefacts Logs and reports suitable for review
Quality gates enforce release criteria Human override is rare and documented
Security checks are integrated and risk-informed SAST/DAST/dependency scanning in place

Quick Assessment

Requirements ↔ Risk Traceability ___ / 4

Verification Evidence ___ / 4

Release Readiness ___ / 4

Pipeline & Automation ___ / 4

Total Score ___ / 16

12-16: Strong posture — focus on optimisation
8-11: Gaps present — targeted remediation recommended
0-7: Evidence chain recovery likely needed

1. Requirements ↔ Risk Traceability

2. Verification Evidence

3. Release Readiness

4. Pipeline & Automation

Quick Assessment

Need help closing gaps?