Are R2v3 audits really unannounced?

Scheduled audits — annual surveillance and the three-year recertification — are the norm, but the R2 program also provides for unannounced audits of certified facilities. The operational consequence is the same either way: the standard is written so that evidence should exist continuously, not be produced for a date on the calendar.

What should a facility be able to produce on any given day?

The complete story of any device or lot currently in or recently through the facility: serial-level custody from receipt onward, sanitization records with verification sampling, photos and checklist evidence at the stages that require them, and downstream shipment records tied to vendors whose certifications were current on the ship date.

What's the difference between audit prep and audit readiness?

Audit prep is a project: assemble, reconcile, and fix before a known date. Audit readiness is a property of the process: records are created at the moment of work, gates prevent skipped steps, and the evidence for any unit is complete the moment its processing is complete. Prep gets a facility through a scheduled audit; readiness survives an unscheduled one.

Where do facilities most often discover they weren't ready?

In the reconciliation gaps: devices received but never dispositioned, sanitization records that don't match erasure-tool certificates, photos that exist on someone's phone instead of the item record, verification sampling that was done by the same person who performed the sanitization, and shipments to a vendor whose certification had lapsed between annual file reviews.

You Can't Cram for an Unannounced Audit

By W. Miller, TetraCore

Most compliance regimes are exams with a published date, and facilities treat them accordingly: a quiet quarter, then a sprint. R2v3 removes that comfort in one quiet clause — the program provides for audits that arrive unannounced. You cannot cram for a test you can't see coming. You can only be the kind of facility that doesn't need to.

The clause that changes the operating model

Whether or not an unannounced auditor ever walks through your door, the possibility is doing design work on your process. An evidence system built around a known audit date can tolerate months of drift — loose records, unfiled certificates, photos on phones — because there's always a reconciliation project before anyone looks. An evidence system built for an unknown date can't tolerate drift at all. The drift is the finding.

This is the same discipline distinction other high-stakes fields discovered long ago: restaurants run differently under surprise health inspections than scheduled ones, and financial firms under continuous supervision keep different books than ones audited annually. The unannounced model doesn't raise the bar on paper — the requirements are identical — it raises the bar on when the requirements are true. The answer has to be: always.

What "always ready" means, concretely

On any ordinary Tuesday, mid-shift, a ready facility can do these things without warning:

Tell the story of any unit on the floor. Where it came from, where it is, who has touched it, what stage it's in, and what evidence exists for each step so far — from the system, not from memory.
Show sanitization records that match the tooling. Every sanitized device or lot has a record; the records agree with the erasure tool's certificates; the failures are recorded alongside the passes, because an evidence trail with no failures in it reads as curated.
Produce the sampling evidence. The verification sample was selected randomly, covers the required share of sanitized media, and was verified by someone other than the operator who did the work — with all three facts demonstrable, not asserted.
Open the vendor files. Every downstream vendor's certification status is current in the register, and — the part that fails silently in annual-review systems — no shipment has gone out to a vendor whose status had lapsed.

Why willpower doesn't get you there

Every facility believes it will keep records current this year. The belief fails for a structural reason, not a moral one: on a busy floor, the record is always the step that can be deferred. The device physically moves on whether or not the spreadsheet was updated; the truck leaves whether or not the vendor file was checked. When the record is optional in the moment, drift isn't a risk — it's a certainty, accumulating one deferred entry at a time until the next reconciliation project.

The fix is to make the record non-optional in the moment: gates instead of reminders. When a unit cannot advance past sanitization until a passing record exists, when a stage cannot complete without its required photo, when a shipment cannot be created for an expired-cert vendor, the floor's own momentum keeps the evidence current. Readiness stops being a virtue and becomes a property of the system — this is precisely what ItemStage's compliance mode enforces.

A 30-day path from prep-mode to ready-mode

Week 1 — run the single-device drill. Pick three ordinary recently shipped devices and assemble each one's complete story, timed. This is your baseline, and it will tell you exactly where your gaps live.
Week 2 — find the deferrable steps. Walk the floor and list every point where the record can lag the work: hand-logged transitions, photos on phones, end-of-day batch entry. Each one is a drift generator.
Week 3 — convert the worst two to gates. Whatever mechanism you use, make the two highest-risk records blocking instead of optional — sanitization evidence and outbound vendor checks are usually the right first two.
Week 4 — re-run the drill. Same exercise, new devices. The time should collapse for units processed under the gates. That difference, annualized, is what prep-mode was costing you.

The uncomfortable summary

An unannounced audit doesn't test whether your facility can produce evidence. It tests whether your facility already has. Those are different capabilities, and only one of them can be built in the week before an audit — which is exactly why the standard is written the way it is. For the wider industry picture — including how many facilities are new to this discipline — see our State of R2v3 data.