Data integrity and documentation compliance

Data integrity findings are among the most damaging an inspection can produce, because they call into question every other record you hold. We assess your systems, paper and electronic, and give you a remediation plan that is proportionate to the risk.

The principles are simple to state and difficult to hold. A record should be attributable, so you can tell who made it. Legible, so it can still be read years later. Contemporaneous, so it was made at the time and not reconstructed afterwards. Original, meaning the first capture rather than a transcription. And accurate. The additions are that data should also be complete, consistent, enduring and available.

Almost every finding we see maps onto one of these. Shared logins fail attributable. Results written on a scrap of paper and entered later fail contemporaneous. A printed chromatogram kept while the underlying electronic file is deleted fails original and complete.

Shared or generic accounts. Still common on standalone instruments and older equipment. It removes attributability entirely, and an inspector who finds one will assume the problem is broader.

Audit trails that are never reviewed. Enabling an audit trail is the easy part. Defining who reviews it, how often, what they look for and what they do when they find something is the part that gets skipped. An unreviewed audit trail provides no assurance.

Uncontrolled spreadsheets. Spreadsheets performing GMP calculations, with unlocked formulas, no version control and no verification of the calculation. This is the single most widespread gap we find, and it is usually invisible to the site because the spreadsheet has been in use for years.

Data held only on local drives. Instrument results on a workstation that is not backed up, or that is backed up but has never had a restore tested.

No documented periodic review. User access lists that were never re-checked, so leavers still have accounts and privileges have crept upwards.

Not every system needs the same treatment. A system that generates data supporting batch release requires far more control than one that logs room temperature in an office. The purpose of the risk assessment is to make that distinction explicitly, so that effort concentrates where an error would reach the patient or the release decision.

Companies that skip the risk assessment tend to spend heavily on validating things that do not matter, run out of budget, and leave the critical chromatography system untouched. That is the outcome we work to avoid.

Most data integrity failures are not fraud. They come from people trying to do their job under pressure, in a system that makes doing it correctly inconvenient. Someone signs a colleague in because the queue at the terminal is long and the batch is waiting.

A remediation programme that only tightens technical controls, without asking why the workaround existed, tends to produce a new workaround. We look at both, and we say so in the report when the cause is workload or system design rather than carelessness.

Do we have to validate our spreadsheets?

If a spreadsheet performs a calculation that supports a GMP decision, you need assurance that the calculation is correct and cannot be altered undetected. For simple sheets that can be a locked template with a verified calculation and controlled distribution. Full validation is not always required, but doing nothing is not an option.

Does this apply to a company of our size?

The principles apply to everyone holding GMP data. The scale of the response does not. A small site with three instruments needs a proportionate assessment, not the programme a multinational runs.

How do inspectors actually test this?

Commonly by following one result from the raw capture through to the certificate, checking that every transformation is traceable. Then by asking to see the audit trail and the record of who reviewed it. Then by asking what happens when a result is out of specification. It is worth walking that path yourself before someone else does.

We found a data integrity problem. What now?

Contain it, assess the scope honestly, and decide whether it affects released product. Do not narrow the investigation to make the answer more comfortable. If it is serious, the reporting obligations need considering early. This is a case where an independent view is worth having quickly.

Can you train our staff?

Yes. Training that uses examples from your own systems works considerably better than generic awareness slides, and we build it that way.