By Brandy Irons, Sr. Training Manager and Technical Support, InstantGMP

Most software companies keep their compliance program somewhere their customers never see. A folder of policies on a shared drive. A spreadsheet of open items that one person updates. A consultant who appears a few weeks before the audit and disappears after it.

We decided not to do that. We are building our SOC 2 program inside InstantGMP, the same platform our customers use to run their quality systems. If the software is good enough to hold a pharmaceutical company’s batch records, it is good enough to hold our own change controls.

Why SOC 2, and why now

Our customers are regulated manufacturers. Pharmaceutical, biotech, nutraceutical companies working under FDA and international Good Manufacturing Practice requirements. Their quality and production data lives in our cloud. I am usually the one who answers when a customer sends us a security questionnaire, and the questions have gotten sharper over the past year. The fair one underneath all of them is this: how do you know the vendor holding all of this is actually doing what it says it does?

A SOC 2 Type II attestation answers that in a way a sales presentation cannot. Type I looks at whether controls are designed properly on a single day. Type II watches them operate over a sustained period, then reports whether they actually worked. That difference is the whole point. Anyone can be compliant on a Tuesday.

So our leadership chartered a cross functional Change Control Committee to govern the program, pulling in the technical, quality and customer facing people who would have to live with whatever we wrote.

We consolidated instead of accumulating

The first phase was the boring part, and the part most companies get wrong. Security policies. Risk assessment and fraud management procedures. An information technology asset register. A formal charter for the committee itself.

The temptation with a document library is to keep adding. A new concern arrives, so a new policy gets written, and three years later you have forty overlapping documents and no idea which one governs. We went the other way and consolidated related policies into a smaller, clearer set. That was deliberate. A lean library is easier to keep current, and an auditor does not grade you on how many policies you have. They grade you on whether the ones you have are being followed.

Every document went through a structured review and approval cycle with named reviewers accountable for specific sections, all of it managed in our own document management system. Then we put the resulting action plan into a single tracked register with a timeline, so status, ownership and target dates live in one place instead of scattered across email threads.

A policy is only intent

Here is where most programs quietly fail. A written policy demonstrates intent, and nothing else. A policy nobody follows is a fire extinguisher with the pin painted over. It looks like protection right up until the moment you need it.

Type II is earned in the quality actions the policies describe. Change controls opened and closed. Corrective and preventive actions, or CAPAs, tracked to completion. Deviations investigated and resolved. Audits logged with findings and follow up. That evidence has to be current, and it has to come from the system where the work actually happened, with the audit trail and electronic signature controls that 21 CFR Part 11 already requires of our customers.

The usual solution is a second system. A status tracker that shadows the real one, maintained by hand, always a little out of date. We did not want that. So we connected a Model Context Protocol server, an MCP server, directly to our own InstantGMP instance.

MCP is an open standard that lets an AI assistant query a system of record in plain language and get back structured, accurate answers. No report to run, no export to reformat.

In practice, a member of the Change Control Committee can ask what is open in the quality management module, or what a specific document’s review history looks like, or what stands between a policy draft and final approval. The answer comes from the live system. Not from a spreadsheet somebody updated last week.

We are already using it internally to surface batch production activity, quality event status and inventory snapshots on demand, and to keep the committee’s own review assignments current as documents move through approval.

Why this approach matters

Everything stays in one system of record. Quality actions are tracked inside the same quality management system where they are created and resolved, so the audit trail is current by design. There is no second log to reconcile.

The answers come faster. Natural language queries replace most of the manual pulling and formatting that normally sits between a question and a status update.

And the governance rhythm is one a committee can actually sustain. When document and action status is a question away instead of a spreadsheet to maintain, people show up, review, and close items without a heavy administrative tax. Programs do not usually die from bad policies. They die from administrative fatigue.

Our first formal Change Control Committee meeting under the new charter is scheduled for October 2026, with its proceedings logged directly in the platform’s document management system. The same audit log capability every InstantGMP customer already has.

What this means for our customers

The natural language access layer we are using to build our own compliance program is the same one available to customers running their quality systems on InstantGMP. You can read more about how we are applying it in AI Insights.

If you are a quality assurance team preparing for an internal audit, a customer inspection, or your own attestation, the benefit is the same. A current, queryable record of change controls, CAPAs, deviations and training status, without building and maintaining a reporting layer on top of your quality management system.

I spend most of my week training customers on this platform and answering their technical and quality questions, and the pattern I see over and over is this: the moment compliance tooling lives apart from the system that generates the records, you are maintaining two versions of the truth and defending the one that turns out to be wrong.

Building our own SOC 2 program on the platform we sell is the clearest evidence we can offer that the approach works.

What comes next

The document library is substantially complete and the committee’s governance rhythm is underway. Next we hold the first meeting, close out the handful of documents still in final review, and begin the sustained operating period a Type II attestation requires.

Part Two of this series will report on that first audit cycle, including what changed once the program moved from building the foundation into steady state operation. I expect a few surprises. I will write about those too.

To see how InstantGMP handles quality management, electronic batch records and inventory in one validated platform, schedule a demo or contact our team at 919-645-1074.