How to prepare for an AED program audit

An audit asks one question in several forms: can you show that each unit was maintained, inspected and recorded? This article lists the evidence to gather and the order to gather it in.

This article is general information, not legal advice. legal-approved disclaimer text this passage needs legal sign-off

Audits differ by state, by regulator and by insurer. Most requests fit five groups:

• Inspection records: the date, the inspector, the checklist answers and the result.
• Device history: status changes, location changes and service events, in order.
• Documents: the user manual, the AED registration record and the service reports.
• Maintenance and testing records: the dates and the person who signed them.
• Training records for anticipated responders, and the program's medical-direction arrangement.

The audit does not ask for a story. It asks for the record behind each unit and each responder.

An audit can arrive with short notice, and it can arrive with a long list. The preparation does not change with the notice, because the record work is the same. Start with the unit count, then work through the groups below.

State law adds the requirements that a national checklist misses. The CDC fact sheet found that 42 states required or encouraged the maintenance and testing of AEDs as of 30 June 2017. Thirty-three states had an AED registry or a notification rule. Twenty states required or encouraged medical oversight, and 19 states required clinical use reporting.

Make sure that you read the current rule for each state where a unit sits. The numbers above describe one snapshot, not today's law.

Source: CDC Public Access Defibrillation (PAD) State Law Fact Sheet, with the law as of 30 June 2017. Last verified 24 September 2026.

Compliance depends on your state and your program. legal-approved disclaimer text this passage needs legal sign-off

ReadyAED keeps the facts, the inspection history, the event history and the documents on the device record. The record also names the site custodian and the last inspector, so each unit carries a person.

Three exports leave the platform: a report, a CSV file and a device history. The audit trail records user and system events, device history and inspection history. Export the pack before the auditor asks, and keep the export date.

• Compliance automation: inspection records, device history and an audit trail in one place.
• Mobile inspections: the five-line phone flow behind each inspection record.

Each record group answers a question an auditor can ask.

• Inspection record: when was the unit last inspected, by whom, and what did the inspection find?
• Device history: where has the unit been, and what changed?
• Documents: does the unit have its manual, its registration record and its service reports?
• Maintenance and testing: did the parts with dates get replaced on time?
• Training record: is a trained person present during operating hours?
• Medical-direction agreement: who provides oversight, and which sites does the agreement cover?

One record can answer more than one question. The device record holds the first four groups, and the audit trail holds the events behind them.

The device list is the spine of the pack. Add each unit when it arrives, and record each move or replacement. A list that lags by one site produces an audit pack with a hole in it.

The register filters by status, brand and site, so the pack can start from a current view. The device record holds the history, and the state of the list is visible before the audit begins.

One person owns the evidence pack, and the cover page names that person. The owner does not gather every document by hand. The owner makes sure that each site custodian knows the file, makes sure that the export date is current, and keeps the version that goes to the auditor. The owner also keeps a one-page status note with the export date and the open gaps.

A second person learns the pack. A single owner is a key-person risk, and an audit does not move because the owner is on leave.

1. In week one, list every unit, its site and its custodian.
2. In week one, list every document the file must hold.
3. In week two, inspect every unit that is due or overdue.
4. In week two, upload the missing documents to each device record.
5. In week three, make sure that the training list matches the people expected to respond.
6. In week three, make sure that the state comparison is current for each site.
7. In week four, export the pack and brief the site team.
8. In week four, write down every gap that stays open, with an owner for each.

A gap with an owner is a work item. A gap without one is a finding.

Two weeks before the real audit, run the whole pack against one unit and one site.

1. Pick one unit at random, and ask the site custodian to produce its record.
2. Ask the trainer to produce one certificate.
3. Ask the file to produce the maintenance date for the same unit.
4. Write down the time each answer takes. A slow answer points at a gap.
5. Fix the gap, then run the same test on a second unit.

The test finds missing documents and stale training lists while there is still time to act.

1. Freeze the export and keep the date.
2. Send the cover page and the file list to the site custodian.
3. Confirm the room and the person who answers the questions.
4. Wait for the auditor to ask for a paper copy before you print one.
5. Keep the open gaps on one page, with an owner and a date for each.

The final week is not the time to rebuild the file. It is the time to make sure that the file is current and that someone can answer for it. A rehearsal question usually finds a document that moved.

An auditor needs the evidence, not every file in the system. Keep the pack to the five record groups. Give each group a cover page with the export date, the site and the unit count. Link each cover page to the export file it describes.

A short pack is easier to defend than a binder with no order. The export date on the cover page also shows how current the pack is. Name each file with the site and the export date, so the next pack does not overwrite the last one.

See the audit trail and the device record. Book a demo, and bring the record groups your auditor asks for.

The FDA asks owners to report problems with AEDs and accessories through MedWatch. The FDA also publishes corrections and removals in the Medical Device Recall database. A reported problem is an audit fact, and it belongs in the device history next to the service record.

The FDA asks owners to keep an AED available for use while they replace a device or an accessory that is not approved. A unit in service still needs its record.

A device problem is a fact with a date. When the fix arrives, the service report joins the same record, and the two documents tell one story.

• AED laws by state: what changes at the state line: the program areas state law touches, from placement to immunity.
• How often should you inspect an AED?: the interval behind the inspection records.
• The AED management blog: all five articles.