---
title: "Compliance Tracking"
description: "Comprehensive guide to tracking regulatory compliance with TraceRTM"
---

# Compliance Tracking

Ensure regulatory compliance and pass audits with confidence using TraceRTM's comprehensive compliance tracking capabilities. This guide demonstrates how to manage compliance requirements, maintain audit trails, and generate evidence for regulatory frameworks.

## Overview

Compliance traceability is critical for organizations operating in regulated industries. TraceRTM provides the tools needed to:

- Map regulations to system requirements
- Maintain complete audit trails
- Track evidence and documentation
- Generate compliance reports
- Identify and address compliance gaps
- Prepare for certifications and audits

### Why Compliance Traceability Matters

In regulated industries such as healthcare, aerospace, automotive, and finance, demonstrating compliance is not optional. Regulatory bodies require:

- **Complete Traceability**: Every regulation must map to implementation and testing
- **Audit Evidence**: Documentation proving compliance at every stage
- **Change Control**: Tracked and approved modifications
- **Version History**: Complete historical record of all changes
- **Gap Analysis**: Identification of incomplete or missing requirements

### Supported Regulatory Frameworks

TraceRTM supports compliance tracking for major regulatory frameworks including:

- **ISO Standards** (ISO 9001, ISO 13485, ISO 26262)
- **FDA Regulations** (21 CFR Part 11, 21 CFR Part 820)
- **SOC 2 Type II** compliance
- **IEC Standards** (IEC 62304, IEC 61508)
- **DO-178C** (aerospace software)
- **GDPR** and privacy regulations
- **HIPAA** for healthcare
- **Automotive SPICE** and **ASPICE**

## Setting Up Compliance Requirements

### Project Structure for Compliance

Create a structured hierarchy that mirrors your regulatory framework:

```bash
# Create compliance project
tracertm project create "Medical Device Compliance - Class II" \
  --type compliance \
  --standard "FDA 21 CFR Part 820, ISO 13485"

# Set up regulation hierarchy
tracertm item create REG "FDA 21 CFR Part 820" \
  --project "Medical Device Compliance - Class II" \
  --type regulation

tracertm item create REG-820.30 "Design Controls" \
  --parent REG \
  --type regulation \
  --compliance-level mandatory
```

### Defining Compliance Requirements

Each regulatory requirement should be captured as a traceable item:

```bash
# Create design control requirements
tracertm item create REQ-DC-001 "Design and Development Planning" \
  --parent REG-820.30 \
  --type requirement \
  --compliance-standard "21 CFR 820.30(a)" \
  --attributes '{
    "regulation_clause": "820.30(a)",
    "compliance_level": "mandatory",
    "verification_method": "document_review",
    "risk_level": "high"
  }'

tracertm item create REQ-DC-002 "Design Input Requirements" \
  --parent REG-820.30 \
  --type requirement \
  --compliance-standard "21 CFR 820.30(c)" \
  --attributes '{
    "regulation_clause": "820.30(c)",
    "compliance_level": "mandatory",
    "verification_method": "inspection",
    "risk_level": "high"
  }'

tracertm item create REQ-DC-003 "Design Output Documentation" \
  --parent REG-820.30 \
  --type requirement \
  --compliance-standard "21 CFR 820.30(d)" \
  --attributes '{
    "regulation_clause": "820.30(d)",
    "compliance_level": "mandatory",
    "verification_method": "document_review",
    "risk_level": "high"
  }'
```

### Compliance Attributes and Metadata

Define custom attributes for compliance tracking:

```python
from tracertm.api import TraceAPI

api = TraceAPI()

# Define compliance item with rich metadata
compliance_req = {
    "id": "REQ-ISO13485-7.3.2",
    "title": "Design and Development Planning",
    "type": "requirement",
    "attributes": {
        "standard": "ISO 13485:2016",
        "clause": "7.3.2",
        "compliance_level": "mandatory",
        "risk_classification": "Class II",
        "verification_method": "document_review",
        "responsible_party": "Quality Assurance",
        "review_frequency": "annual",
        "last_audit": "2024-06-15",
        "audit_status": "compliant",
        "evidence_required": ["Design Plan", "Risk Management Plan"],
        "certification": "ISO 13485:2016"
    }
}

api.items.create(**compliance_req)
```

## Mapping Regulations to Requirements

### Creating Compliance Links

Establish traceability between regulations and implementation:

```bash
# Link regulation to system requirement
tracertm link create REG-820.30 SYS-REQ-001 \
  --type "derives_from" \
  --attributes '{
    "compliance_mapping": true,
    "mapping_rationale": "System requirement implements FDA design control regulation"
  }'

# Link to design specification
tracertm link create SYS-REQ-001 DESIGN-SPEC-001 \
  --type "implements" \
  --attributes '{
    "implementation_status": "complete",
    "reviewed_by": "Jane Smith, QA Lead",
    "review_date": "2024-11-15"
  }'

# Link to verification activity
tracertm link create DESIGN-SPEC-001 TEST-PROTOCOL-001 \
  --type "verified_by" \
  --attributes '{
    "verification_method": "inspection",
    "test_status": "passed",
    "evidence_location": "docs/verification/TP-001-results.pdf"
  }'
```

### Multi-Level Compliance Mapping

Create comprehensive traceability chains:

```python
from tracertm.api import TraceAPI

api = TraceAPI()

# Complete compliance chain
compliance_chain = [
    # Regulation
    {"id": "REG-FDA-820.30", "type": "regulation", "title": "Design Controls"},

    # System requirement
    {"id": "SYS-001", "type": "requirement", "title": "User Authentication"},

    # Design specification
    {"id": "DESIGN-001", "type": "design", "title": "OAuth2 Authentication"},

    # Implementation
    {"id": "CODE-001", "type": "implementation", "title": "auth_service.py"},

    # Test case
    {"id": "TEST-001", "type": "test", "title": "Authentication Test Suite"},

    # Evidence
    {"id": "EVIDENCE-001", "type": "evidence", "title": "Test Results Report"}
]

# Create items
for item in compliance_chain:
    api.items.create(**item)

# Create links
links = [
    ("REG-FDA-820.30", "SYS-001", "derives_from"),
    ("SYS-001", "DESIGN-001", "implements"),
    ("DESIGN-001", "CODE-001", "implemented_by"),
    ("CODE-001", "TEST-001", "verified_by"),
    ("TEST-001", "EVIDENCE-001", "documented_by")
]

for source, target, link_type in links:
    api.links.create(source_id=source, target_id=target, type=link_type)
```

## Evidence Collection and Linking

### Types of Compliance Evidence

Track multiple evidence types for comprehensive compliance:

```bash
# Test evidence
tracertm item create EVIDENCE-TEST-001 "Unit Test Results" \
  --type evidence \
  --attributes '{
    "evidence_type": "test_results",
    "test_date": "2024-11-20",
    "test_engineer": "John Doe",
    "pass_rate": "100%",
    "file_location": "evidence/tests/unit_test_results_2024-11-20.pdf",
    "hash": "sha256:abc123..."
  }'

# Design review evidence
tracertm item create EVIDENCE-REVIEW-001 "Design Review Meeting Minutes" \
  --type evidence \
  --attributes '{
    "evidence_type": "design_review",
    "review_date": "2024-11-18",
    "attendees": ["Jane Smith", "Bob Johnson", "Alice Williams"],
    "outcome": "approved",
    "action_items": "None",
    "file_location": "evidence/reviews/design_review_2024-11-18.pdf"
  }'

# Inspection evidence
tracertm item create EVIDENCE-INSPECT-001 "Code Inspection Report" \
  --type evidence \
  --attributes '{
    "evidence_type": "inspection",
    "inspection_date": "2024-11-19",
    "inspector": "Quality Assurance Team",
    "findings": "0 critical, 2 minor",
    "resolution_status": "resolved",
    "file_location": "evidence/inspections/code_inspection_2024-11-19.pdf"
  }'

# Link evidence to requirements
tracertm link create SYS-001 EVIDENCE-TEST-001 --type "verified_by"
tracertm link create DESIGN-001 EVIDENCE-REVIEW-001 --type "approved_by"
tracertm link create CODE-001 EVIDENCE-INSPECT-001 --type "inspected_by"
```

### Document Management Integration

Link external compliance documents:

```python
from tracertm.api import TraceAPI

api = TraceAPI()

# Create document references
documents = [
    {
        "id": "DOC-DHF-001",
        "title": "Design History File - Volume 1",
        "type": "document",
        "attributes": {
            "document_type": "DHF",
            "version": "2.1",
            "approval_date": "2024-11-15",
            "approved_by": "QA Manager",
            "location": "vault://dhf/volume_1_v2.1.pdf",
            "checksum": "sha256:def456...",
            "regulatory_requirement": "21 CFR 820.30(j)"
        }
    },
    {
        "id": "DOC-DMR-001",
        "title": "Device Master Record",
        "type": "document",
        "attributes": {
            "document_type": "DMR",
            "version": "1.5",
            "approval_date": "2024-11-10",
            "approved_by": "Engineering Manager",
            "location": "vault://dmr/dmr_v1.5.pdf",
            "regulatory_requirement": "21 CFR 820.181"
        }
    }
]

for doc in documents:
    api.items.create(**doc)

# Link to requirements
api.links.create("REG-820.30", "DOC-DHF-001", type="documented_by")
```

## Audit Trail Configuration

### Enabling Comprehensive Audit Logging

TraceRTM automatically tracks all changes for compliance:

```python
from tracertm.api import TraceAPI
from tracertm.services import AuditService

api = TraceAPI()
audit_service = AuditService()

# Enable detailed audit logging
audit_config = {
    "track_all_changes": True,
    "track_user_actions": True,
    "track_system_actions": True,
    "retention_period_years": 10,  # FDA requires 10 years for Class II devices
    "immutable_logs": True,
    "cryptographic_signing": True,
    "timestamp_source": "ntp_server"
}

audit_service.configure(audit_config)

# Query audit trail for specific requirement
audit_trail = audit_service.get_history(
    item_id="SYS-001",
    include_linked_items=True,
    date_range=("2024-01-01", "2024-12-31")
)

for entry in audit_trail:
    print(f"{entry.timestamp} - {entry.user} - {entry.action} - {entry.details}")
```

### Change Control and Approval Workflows

Implement regulatory change control:

```bash
# Create change request
tracertm item create CR-001 "Update Authentication Algorithm" \
  --type change_request \
  --attributes '{
    "affected_items": ["SYS-001", "DESIGN-001", "CODE-001"],
    "change_reason": "Security enhancement",
    "impact_analysis": "Medium - requires reverification",
    "regulatory_impact": "Yes - affects 21 CFR Part 11 compliance",
    "requested_by": "Security Team",
    "request_date": "2024-11-25",
    "status": "pending_approval"
  }'

# Link to approval workflow
tracertm link create CR-001 APPROVAL-001 --type "requires_approval"
```

## Compliance Reports Generation

### Traceability Matrix Report

Generate comprehensive compliance matrices:

```python
from tracertm.api import TraceAPI
from tracertm.services import ReportService

api = TraceAPI()
report_service = ReportService()

# Generate FDA compliance matrix
fda_matrix = report_service.generate_traceability_matrix(
    project="Medical Device Compliance - Class II",
    source_type="regulation",
    target_types=["requirement", "design", "test", "evidence"],
    filters={
        "standard": "21 CFR Part 820",
        "compliance_level": "mandatory"
    },
    format="pdf",
    include_evidence=True,
    include_audit_trail=True
)

fda_matrix.save("reports/FDA_Compliance_Matrix_2024.pdf")
```

### Gap Analysis Report

Identify compliance gaps:

```python
# Generate gap analysis
gap_report = report_service.generate_gap_analysis(
    project="Medical Device Compliance - Class II",
    regulatory_framework="21 CFR Part 820",
    check_criteria={
        "requirements_linked": True,
        "design_linked": True,
        "tests_linked": True,
        "evidence_attached": True,
        "approval_status": "approved"
    }
)

# Analyze results
print(f"Total Requirements: {gap_report.total_requirements}")
print(f"Fully Compliant: {gap_report.compliant_count}")
print(f"Gaps Identified: {gap_report.gap_count}")

for gap in gap_report.gaps:
    print(f"\nGap: {gap.requirement_id} - {gap.title}")
    print(f"Missing: {', '.join(gap.missing_elements)}")
    print(f"Risk Level: {gap.risk_level}")
```

### Certification Report Package

Generate complete certification documentation:

```bash
# Generate certification package
tracertm report generate certification \
  --project "Medical Device Compliance - Class II" \
  --standard "ISO 13485:2016" \
  --include-sections "
    executive_summary,
    compliance_matrix,
    requirements_traceability,
    design_verification,
    validation_results,
    risk_management,
    change_history,
    audit_trail
  " \
  --output "certification_package_iso13485_2024.pdf"
```

## Gap Analysis for Compliance

### Automated Gap Detection

Configure automated compliance checking:

```python
from tracertm.services import ComplianceService

compliance_service = ComplianceService()

# Define compliance rules
compliance_rules = [
    {
        "rule_id": "RULE-001",
        "name": "All regulations must have implementing requirements",
        "check": "regulation_has_child_requirements",
        "severity": "critical"
    },
    {
        "rule_id": "RULE-002",
        "name": "All requirements must have test coverage",
        "check": "requirement_has_test",
        "severity": "critical"
    },
    {
        "rule_id": "RULE-003",
        "name": "All tests must have evidence",
        "check": "test_has_evidence",
        "severity": "high"
    },
    {
        "rule_id": "RULE-004",
        "name": "All design items must have review evidence",
        "check": "design_has_review",
        "severity": "high"
    }
]

# Run compliance check
results = compliance_service.run_compliance_check(
    project="Medical Device Compliance - Class II",
    rules=compliance_rules
)

# Generate gap report
for violation in results.violations:
    print(f"{violation.severity}: {violation.rule_name}")
    print(f"  Item: {violation.item_id} - {violation.item_title}")
    print(f"  Issue: {violation.description}")
    print(f"  Recommendation: {violation.recommendation}\n")
```

### Coverage Analysis

Measure compliance coverage:

```python
# Calculate compliance coverage
coverage = compliance_service.calculate_coverage(
    project="Medical Device Compliance - Class II",
    metrics=[
        "regulation_to_requirement",
        "requirement_to_design",
        "design_to_implementation",
        "implementation_to_test",
        "test_to_evidence"
    ]
)

print(f"Regulation Coverage: {coverage.regulation_coverage}%")
print(f"Test Coverage: {coverage.test_coverage}%")
print(f"Evidence Coverage: {coverage.evidence_coverage}%")
print(f"Overall Compliance: {coverage.overall_compliance}%")
```

## Certification Preparation

### Pre-Audit Checklist

Prepare for regulatory audits:

```bash
# Generate pre-audit checklist
tracertm compliance checklist \
  --standard "FDA 21 CFR Part 820" \
  --project "Medical Device Compliance - Class II" \
  --output "pre_audit_checklist.pdf"

# Verify all requirements
tracertm compliance verify \
  --project "Medical Device Compliance - Class II" \
  --check-completeness \
  --check-traceability \
  --check-evidence \
  --check-approvals \
  --check-audit-trail
```

### Audit Package Generation

Create comprehensive audit packages:

```python
from tracertm.services import AuditPackageService

audit_package_service = AuditPackageService()

# Generate complete audit package
audit_package = audit_package_service.generate_package(
    project="Medical Device Compliance - Class II",
    regulatory_framework="21 CFR Part 820",
    sections=[
        "quality_management_system",
        "design_controls",
        "document_controls",
        "purchasing_controls",
        "process_validation",
        "corrective_preventive_action",
        "labeling_packaging",
        "complaint_handling",
        "records_maintenance"
    ],
    include_artifacts=True,
    include_signatures=True,
    format="pdf"
)

audit_package.save("FDA_Audit_Package_2024.pdf")
```

## Regulatory Frameworks Examples

### ISO 13485 Medical Device Quality Management

```python
# ISO 13485:2016 compliance structure
iso_13485_structure = {
    "ISO-4": "Quality Management System",
    "ISO-5": "Management Responsibility",
    "ISO-6": "Resource Management",
    "ISO-7": "Product Realization",
    "ISO-7.3": "Design and Development",
    "ISO-7.3.2": "Design and Development Planning",
    "ISO-7.3.3": "Design and Development Inputs",
    "ISO-7.3.4": "Design and Development Outputs",
    "ISO-7.3.5": "Design and Development Review",
    "ISO-7.3.6": "Design and Development Verification",
    "ISO-7.3.7": "Design and Development Validation",
    "ISO-8": "Measurement, Analysis and Improvement"
}

# Create hierarchy
for clause_id, title in iso_13485_structure.items():
    api.items.create(
        id=f"REG-{clause_id}",
        title=title,
        type="regulation",
        attributes={
            "standard": "ISO 13485:2016",
            "clause": clause_id,
            "compliance_level": "mandatory"
        }
    )
```

### FDA 21 CFR Part 11 Electronic Records

```python
# 21 CFR Part 11 compliance tracking
part_11_requirements = [
    {
        "clause": "11.10(a)",
        "requirement": "Validation of systems",
        "implementation": "System validation documentation"
    },
    {
        "clause": "11.10(b)",
        "requirement": "Ability to generate accurate copies",
        "implementation": "Report generation with audit trail"
    },
    {
        "clause": "11.10(c)",
        "requirement": "Protection of records",
        "implementation": "Backup and recovery procedures"
    },
    {
        "clause": "11.10(e)",
        "requirement": "Use of secure, computer-generated time-stamped audit trails",
        "implementation": "Immutable audit logging system"
    }
]

for req in part_11_requirements:
    api.items.create(
        id=f"REG-CFR-{req['clause'].replace('.', '-')}",
        title=req['requirement'],
        type="regulation",
        attributes={
            "standard": "21 CFR Part 11",
            "clause": req['clause'],
            "implementation_note": req['implementation']
        }
    )
```

### SOC 2 Type II Controls

```python
# SOC 2 Trust Service Criteria
soc2_criteria = {
    "CC1": "Control Environment",
    "CC2": "Communication and Information",
    "CC3": "Risk Assessment",
    "CC4": "Monitoring Activities",
    "CC5": "Control Activities",
    "CC6": "Logical and Physical Access Controls",
    "CC7": "System Operations",
    "CC8": "Change Management",
    "CC9": "Risk Mitigation"
}

for criterion_id, title in soc2_criteria.items():
    api.items.create(
        id=f"SOC2-{criterion_id}",
        title=title,
        type="regulation",
        attributes={
            "framework": "SOC 2 Type II",
            "criterion": criterion_id,
            "audit_period": "12 months",
            "evidence_required": "continuous_monitoring"
        }
    )
```

## Best Practices for Compliance Tracking

### 1. Establish Clear Governance

```python
# Define compliance governance structure
governance_config = {
    "roles": {
        "compliance_owner": "Quality Assurance Manager",
        "regulatory_affairs": "Regulatory Affairs Team",
        "design_authority": "Engineering Lead",
        "approvers": ["QA Manager", "Engineering Manager", "Regulatory Affairs"]
    },
    "review_schedule": {
        "design_reviews": "at_phase_gates",
        "compliance_audits": "quarterly",
        "gap_analysis": "monthly",
        "management_review": "annually"
    },
    "approval_requirements": {
        "regulation_changes": ["compliance_owner", "regulatory_affairs"],
        "requirement_changes": ["design_authority", "compliance_owner"],
        "design_changes": ["design_authority", "approvers"]
    }
}
```

### 2. Maintain Complete Traceability

Always ensure bidirectional traceability:

- Regulation → Requirement → Design → Implementation → Test → Evidence
- Evidence → Test → Implementation → Design → Requirement → Regulation

### 3. Automate Compliance Checks

Set up continuous compliance monitoring:

```python
# Automated compliance monitoring
from tracertm.services import MonitoringService

monitoring = MonitoringService()

monitoring.schedule_check(
    name="daily_compliance_check",
    frequency="daily",
    checks=[
        "verify_traceability_completeness",
        "check_orphaned_requirements",
        "validate_evidence_currency",
        "audit_trail_integrity"
    ],
    notification_recipients=["qa-team@company.com"],
    auto_generate_report=True
)
```

### 4. Version Control for Regulations

Track regulatory changes over time:

```bash
# Version regulatory requirements
tracertm item update REG-820.30 \
  --version "2.0" \
  --change-description "Updated per FDA guidance document 2024" \
  --approval-required \
  --impact-analysis "requires review of 15 linked requirements"
```

### 5. Regular Gap Analysis

Schedule periodic compliance reviews:

```bash
# Monthly compliance review
tracertm compliance review \
  --project "Medical Device Compliance - Class II" \
  --standards "21 CFR Part 820,ISO 13485:2016" \
  --output-format "executive_summary" \
  --email-to "compliance-team@company.com"
```

## Next Steps

- [Learn about Risk Management Integration](../../advanced/risk-management)
- [Explore Audit Trail Configuration](../../guides/audit-trails)
- [Review Validation and Verification](../05-validation-verification)
- [Check Traceability Matrix Best Practices](../04-traceability-matrix)
