Before you cancel a legacy QMS subscription: export checklist

What should you export before canceling a QMS subscription?#

Before canceling a QMS subscription, export every record in a form you can read without the vendor: the structured data, every attachment, the audit trail, the links between records and evidence of each electronic signature. Then verify a sample against the live system before you give notice. The checklist below covers the full set.

• 1Structured records: NCRs, CAPAs, complaints, internal and supplier audits, supplier corrective actions, change controls and training records.
• 2Attachments: photos, inspection reports, 8D reports, supplier responses and emails attached to records.
• 3Audit trails: who changed what and when, for every record.
• 4Electronic signatures: the signer, the meaning of the signature, the date and the record version signed.
• 5Links: the IDs connecting NCRs to CAPAs, suppliers, parts, lots and documents.
• 6Controlled documents: every revision, not only the current one, with its approval history.
• 7Configuration: workflows, form fields, picklists and reason codes, so records can be interpreted later.
• 8Retention metadata: record dates, retention classes and any legal holds.

Read the exit terms before you give notice#

The exit terms in your QMS contract set your deadline and decide what a full export actually contains, so read them before anything else. Ask the vendor for a sample export early, because what one contract calls a complete export can be very different in practice.

Attachments: the easiest part of a quality record to lose#

Attachments are the easiest part of a quality record to lose in a QMS exit, because some export tools deliver the fields but not the files, or deliver the files without saying which record each belongs to. An NCR without its photos and measurement data is a summary, not evidence.

Insist on an attachment manifest: one row per file with the record ID, file name, upload date and uploader role. Check that file names survive, that versions are kept where the system versioned attachments and that emails attached to records come out with their own attachments.

Audit trails and electronic signatures#

Audit trails and electronic signatures prove who did what, and they are what auditors and customers ask for when they sample old records. Export the audit trail as structured data with record ID, field, old value, new value, user and timestamp, and render signed records with their signature details visible.

Manufacturers under FDA rules, such as medical device makers, may have obligations under FDA's electronic records rule, 21 CFR Part 11, that affect how exported records and signatures are retained. Aerospace and automotive suppliers often face customer and registrar expectations about record availability. Confirm the requirements with your regulatory or quality lead before choosing formats.

Keep both forms. A PDF rendering alone is hard to analyze later, and structured data alone may not satisfy an auditor who wants to see a signed record as it appeared.

Links between records#

Links between records turn a pile of quality files into a history: the NCR that triggered a CAPA, the supplier and part it concerned, the lots affected, the document revised as a result and the effectiveness check that closed it. Export the link tables, not just each record's own fields.

Test the links on a few closed CAPAs. If you cannot walk from a CAPA back to its NCRs and forward to the document change using only the export, the export is incomplete, and the time to fix it is while the subscription is still active.

Retention: who decides how long to keep the export#

Retention for an exported QMS archive is set by several parties at once: your own quality system, your customers' quality agreements, your registrar and, in regulated sectors, the regulators. The archive should be kept at least as long as the strictest of those requires.

Retention also has a value side. Closed quality history records how the company finds and fixes problems, and it can matter later in an acquisition, a customer dispute or a data license. Deleting it because a subscription ended is usually an accident rather than a decision.

Illustrative: a sensor maker exits a cloud QMS#

Illustrative: Brightwater Sensors is a fictional maker of industrial pressure and flow sensors certified to ISO 9001. It had used a cloud QMS for NCRs, CAPAs, supplier corrective actions and document control, and decided to move quality workflows into its ERP's quality module.

The VP of quality asked the vendor for a sample export before giving notice. Fields came out cleanly, but attachments arrived in one folder without record IDs, and the audit trail was missing. The company negotiated a second export with an attachment manifest and audit trail tables, rendered signed CAPAs to PDF and tested link integrity on a sample of closed CAPAs.

Only then did it give notice. The verified archive now sits in company storage with a short guide to reading it, and the closed NCR and CAPA history was listed in the company's data inventory for a later licensing review.

How SourceX approaches a retired QMS archive#

SourceX approaches a retired QMS archive as a preserve-first case: the export checklist comes before any licensing conversation. If the company later wants an assessment, the SourceX five-step transaction starts with a metadata-only fit check of record families, years of history and known restrictions, and no files are shared at that stage.

Customer complaint details, supplier confidential data and personal details are removed during Preparation, the SourceX Evidence Packet records the rights and privacy work, and nothing is delivered without the company's approval. The archive is licensed rather than sold, so ownership stays with the manufacturer.