> For the complete documentation index, see [llms.txt](https://docs.medcrypt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.medcrypt.com/msi/check-estar-readiness/run-a-regulatory-audit.md).

# Run a regulatory audit

A regulatory audit is an automated mock regulatory review of your documentation. It grades your documents against the Medcrypt Security Requirements for your compliance goal, ranks findings by severity, and can draft the deficiency letter a reviewer would likely send, so you can fix the gaps before you submit.

## Before you begin

* Your organization's plan must include Regulatory Audit.
* The Regulatory Audit isn't available for every organization. If you don't see **Regulatory Audit** in the sidebar, contact Medcrypt.
* Select the device and device version you want to audit, and upload its documents.

## Start an audit

1. In the sidebar, select **Regulatory Audit**. If the selected version has no audit yet, you see the start form.
2. Under **Compliance Goal**, check the regulatory framework the audit grades against. It defaults to the goal set for the device version. Pick another, such as **FDA 510(k)**, **FDA PMA**, **EU MDR — CE Conformity**, or **Health Canada**, to run a one-off audit for a different market.
3. Select **Start Audit**.

While the audit runs, the page shows its progress through **Categorizing documents**, **Evaluating requirements**, **Verifying evidence**, **Analyzing patterns**, and **Generating report**. Findings appear in the **Live Findings Stream** as they're found.

To start another audit later, use the selector in the page header and select **+ New Audit**. You can use the same selector to switch between previous audits.

## Understand the results

A completed audit has two steps in the bar at the top: **Categorize Documents** and **Report**.

The report shows:

* **Severity summary**: the total number of findings split into **Critical**, **Major**, and **Minor**. Fix critical and major findings first.
* **By Type**: how many findings are **Compliance** findings and how many are **Evidence** findings.
* **Executive Summary**: a short narrative of the key gaps and strengths found across your documents.
* **Findings table**: every finding, organized by submission section, with **Cross-Cutting Issues** for findings that span sections. Each row shows the finding's **Category**, **Severity**, **Type**, **Gap**, and how fully the requirement is **Addressed**. Narrow the table with **Search findings...** and the category, severity, and type filters.

Select a finding to see the full **Assessment**, the **Deficiencies Identified**, **Recommendations**, the **Regulatory Reference**, the **Supporting Documents** it's based on, and the **MSR Requirement Chain** that links the finding back to the requirement it was graded against.

{% hint style="info" %}
Requirements the audit couldn't assess are listed as **Not assessed** and are left out of the compliance score and deficiency counts. Re-run the audit or review them yourself.
{% endhint %}

## Correct document categories and re-run

The audit starts by sorting your documents into categories. If it got one wrong, the findings that depend on it can be wrong too.

1. Select the **Categorize Documents** step. Under **Document Categorizations**, you see how the AI categorized each document, with its confidence.
2. On a document, select **Override**.
3. Choose the **Correct Category**, explain why in **Reason for Override**, and select **Save Override**.
4. Select **Create New Audit from this Step** to re-run the audit with your corrections.

## Draft the reviewer's deficiency letter

When the FDA finds problems during a premarket review, it sends an additional information letter (AI/N letter) listing what you need to provide. The audit can draft one from its findings so you can supply that information before you submit.

1. In the report header, select **AI/N Letter**.
2. If no letter exists yet, select **Generate letter**.
3. Review the draft, which lists **Major deficiencies** and **Minor deficiencies**, then select **Download PDF** or **Download Word**.

The letter is an AI-generated draft for your own preparation, not an FDA document.

## Compare audits

1. Select **Compare Audits** in the step bar. It's available once the audit is complete.
2. Choose the **Baseline (from)** and **Comparison (to)** audits.
3. Select **Compare** to see how your findings changed between the two audits.

## Export and check traceability

* Select **Export** and choose **PDF**, **Markdown**, or **JSON** to download the report.
* Select **Traceability** to see each excerpt from your documents the audit cited, and whether it was verified word for word against the document.

## Next steps

* [Find and close compliance gaps](/msi/check-estar-readiness/find-and-close-compliance-gaps.md): a completed audit updates the Gap Register, where you can work through each gap.
* [Check eSTAR readiness](/msi/check-estar-readiness.md): check your documentation against the eSTAR cybersecurity requirements.
* [Generate submission documents](/msi/check-estar-readiness/generate-submission-documents.md): produce the documents your findings call for.