QMS migration: preserving NCR, CAPA and audit history

What has to survive a QMS migration?#

Three things have to survive a QMS migration: the quality records themselves, the links between them, and the approval trail showing who decided what and when. Records without links cannot show that a nonconformance was investigated and corrected, and records without approval trails cannot show that the right people signed off.

Some of these records may live outside the QMS, in the ERP, a calibration tool, a spreadsheet or a shared drive. Inventory where each family actually lives before scoping the migration, because the vendor's import templates will only cover what you hand them.

• 1Nonconformance reports (NCRs) with dispositions and material review board decisions.
• 2Corrective and preventive actions (CAPAs), root cause analyses and 8D reports.
• 3Supplier corrective action requests and supplier scorecards.
• 4Customer complaints and returns investigations.
• 5Internal, customer and registrar audit reports, findings and responses.
• 6Controlled documents with every revision and its approvals.
• 7Training, calibration and management review records.

Keep the link chain from NCR to CAPA to supplier#

The link chain from NCR to CAPA to supplier is what turns a pile of quality records into evidence, so map every link before deciding what to migrate.

Many migrations carry the records but turn these links into free-text fields. Where the new QMS cannot hold a link natively, keep the old record IDs on both sides and archive a link table that preserves the chain.

Approval trails and electronic signatures#

Approval trails and electronic signatures rarely migrate as they were, because the new QMS records the migration user and date rather than the original approver and timestamp. An imported CAPA can end up looking as if the person who ran the import approved it on go-live day.

Keep the original audit trail alongside every migrated record, either as an attached export or in a linked archive, and document the migration itself as a controlled change with its own plan, test results and sign-off. Certification audits under ISO 9001 and sector standards such as AS9100 rely on retained records as evidence, and auditors may sample records created before the migration.

Manufacturers in regulated sectors may face additional electronic-records rules. Confirm with your quality and regulatory leads which requirements apply before deciding how signatures and audit trails are carried.

Migrate or archive: decide by record status#

Record status is the cleanest basis for a migrate-or-archive decision, because open work needs the new system's workflow while closed history needs to stay readable and intact.

Agree the split with whoever audits you. A registrar or major customer who expects to sample closed CAPAs in the new system is easier to satisfy if that expectation is known before the cutover plan is fixed.

QMS migration checklist#

A QMS migration checklist should be owned by the quality lead, with IT running extraction and operations confirming that links to ERP and MES records still resolve after cutover.

The most common mistake is letting the vendor's import templates set the scope. Templates cover the fields the new system needs, so links, attachments and audit trails that do not fit a template are quietly left out unless someone on the quality team insists they are carried or archived.

• 1Inventory every quality record family and where it lives today.
• 2Map links between NCRs, CAPAs, suppliers, parts, documents and audits.
• 3Decide migrate or archive by record status, and write down the reason.
• 4Export original audit trails, approvals and signatures with each record.
• 5Export attachments: photos, inspection data, 8D files and supplier responses.
• 6Keep old record IDs on migrated records and archive a link table.
• 7Reconcile counts by record type, status and year.
• 8Sample records end to end in the archive with someone who knows the history.
• 9Document the migration as a controlled change and file the evidence.
• 10Update your records control procedure so its retention rules cover the archive.

Illustrative: a precision machining company retires a homegrown quality database#

Illustrative: a fictional precision machining company serving industrial equipment makers has tracked NCRs and CAPAs for years in a homegrown database, with 8D reports and inspection photos on a shared drive. The COO approves a move to a cloud QMS.

The quality lead migrates open NCRs and CAPAs with full history and archives everything closed in open files, keeping original IDs, approval trails and a link table that ties each NCR to its CAPA, supplier, part number and drawing revision. Customer-owned drawings stay in the controlled document system, flagged as customer property.

At the next surveillance audit, the auditor samples a CAPA closed before the migration. The team pulls it from the archive with the linked NCRs, the root cause analysis, the revised work instruction and the original approvals, and the sample passes without a finding.

Why closed quality records matter beyond the audit#

Closed quality records matter beyond the audit because NCR dispositions and CAPA investigations capture expert judgment about real defects, suppliers and processes. That pairing of domain expertise and outcome is what AI developers working on manufacturing quality look for, and it is rare in generic data.

SourceX assesses such archives with the SourceX Enterprise Data Value Framework, which weighs drivers such as uniqueness, domain expertise, human-generated signal, recency and rights against preparation cost and privacy burden. Customer-owned designs and export-controlled work are excluded from the start. In the SourceX five-step transaction, preparation removes personal and confidential details such as employee names and supplier pricing, and the manufacturer approves each step before anything is delivered.