The controls your auditors actually check

Document control, audit trail, electronic signatures, access control, and training records — as first-class capabilities, not a checkbox bolted on afterward.