The technical documentation is complete. SOPs are approved, risk management is documented, evidence is filed. Then the review question arrives: how exactly is this security requirement implemented?

The room goes quiet. Not because nobody knows the answer, but because nobody can substantiate it in reasonable time. The quality manager wrote the chapter but has no access to the repository. The engineer knows the implementation but has never read the document. Between them sits a translation gap – and in an audit, that gap is exactly what's under discussion.