Why Data Integrity Dominates Audit Findings

Data integrity is the extent to which data are complete, consistent, accurate, trustworthy, and reliable throughout the data lifecycle. It has become the single most common finding in GMP inspections worldwide. The reason is not that companies are deliberately falsifying data. The reason is that data integrity controls have not kept pace with the systems that generate data, and the gaps are often invisible until someone looks closely.

A data integrity finding can weaken an otherwise strong audit. It can also trigger a for cause inspection or escalate an inspection outcome. Understanding where the risks lie is the first step to addressing them.

The Regulatory Framework for Data Integrity

FDA 21 CFR 211.68, 211.180, 211.188, and 211.194

The FDA requires backup data to be true, complete, and secure under 21 CFR 211.68. Records must be original or true copies under 211.180. Complete batch production records are required under 211.188. Complete laboratory test data is required under 211.194. These are not new requirements, but enforcement has intensified.

MHRA Data Integrity Guidance

The MHRA guidance requires retained audit trails showing all changes to or deletion of data while preserving the original record. Audit trails should be enabled, protected from unauthorized alteration, and available for review as justified by a risk assessment. Shared or generic user accounts should not be used for systems generating, modifying, or storing GxP data. A specific footnote addresses legacy systems: GMP facilities with industrial automation and control equipment should be able to demonstrate working towards system upgrades with individual login and audit trails .

EU GMP Annex 11

Annex 11 covers computerized systems and requires risk management across the lifecycle, data integrity controls, incident management, and business continuity planning. It applies to all computerized systems used in GMP activities.

WHO Inspection Findings

WHO inspection findings for APIs in 2023 and 2024 include data integrity failures classified as major observations. Specific examples include no data integrity policy, no data integrity risk assessment for standalone equipment and systems, an SOP that did not address senior management oversight and adequate review of results, unlocked analytical balance timestamps, shared IT administrator passwords, analyst privileges for manual integration and file deletion, and audit trails not reviewed before batch release .

FDA Enforcement Examples

FDA 483 observations have cited analytical instrumentation with limited or no electronic audit trail capabilities, software that does not require unique usernames and passwords, communal usernames shared by all chemists, former employees retaining administrator access, GMP data in electronic recycle bins, and balances with password protection capabilities that were not being used .

Where the Risks Hide

Standalone Equipment and Instruments

Balances, pH meters, and standalone analytical instruments are often overlooked because they are not part of a larger networked system. They may have password protection that is not enabled, no audit trail, or shared logins. WHO findings specifically cite unlocked balance timestamps . FDA findings cite balances with password protection capabilities that were not used .

Legacy Automation and Control Systems

PLCs, HMIs, and SCADA platforms are often older than the quality systems that surround them. They may not support individual user accounts or audit trails. MHRA guidance acknowledges this and expects progress toward upgrades rather than immediate compliance. The key word is progress, and progress needs to be documented .

Shared and Generic Accounts

Shared accounts are a persistent problem. FDA findings describe communal Windows usernames used by all chemists and shared passwords for IT administrators . WHO findings describe IT administrators sharing passwords with QC and QA when on leave . Each of these breaks the link between data and the individual who created it.

Audit Trails That Are Not Reviewed

An audit trail that exists but is never reviewed provides little value. WHO findings note that audit trails were not reviewed before an API batch was released . Reviewing audit trails is part of the batch release decision, not an optional activity.

Manual Integration and Data Manipulation

Analysts with privileges to manually integrate chromatographic data and delete or edit files create risk. WHO findings cite this specifically . Privileges should be limited to what the role requires.

Data in Unexpected Places

FDA findings describe GMP related data records found in the electronic Recycle Bin on computer desktops . Data that can be deleted without a trace is data that cannot be trusted.

Addressing the Risks

Conduct a Data Integrity Risk Assessment

Identify all systems that generate, modify, or store GxP data. Assess each for data integrity risk based on its role and its controls. This includes standalone equipment, legacy automation, and paper records.

Enable and Review Audit Trails

Audit trails should be enabled, protected, and reviewed at a frequency justified by risk. For critical systems, review before batch release is appropriate. For others, periodic review may suffice.

Eliminate Shared Accounts

Individual accounts are required for systems that generate or modify GxP data. Where legacy systems cannot support this, document the interim controls and the plan for upgrade.

Limit Privileges

Analysts should have the privileges needed for their role, not more. Manual integration and file deletion should be restricted and controlled.

Train on Data Integrity in Context

Training that covers ALCOA plus principles abstractly is less effective than training that uses real examples from the site. People need to understand why the controls exist, not just that they exist.

Introducing GxP Cellators for Data Integrity Audits

GxP Cellators assesses data integrity controls across your systems and processes. We review whether audit trails are enabled and reviewed, whether user access rights are appropriate for roles, whether shared logins or generic accounts are in use, whether electronic signatures are compliant with 21 CFR Part 11, whether paper records are protected from alteration, and whether data transfers between systems are validated.

Our data integrity work is aligned with ALCOA plus principles and the expectations of the FDA and MHRA. We cover standalone equipment, legacy automation, and computerized systems including LIMS, CDS, and quality management systems. We also audit 21 CFR Part 11 compliance and EU GMP Annex 11 compliance.

Our auditors bring regulatory inspection and industry quality experience across FDA, EMA, Health Canada, MHRA, WHO, and PIC/S frameworks. We deliver clear, prioritized reports with practical remediation guidance.

Find and Fix Data Integrity Gaps

Visit https://www.gxpcellators.com/gmp-auditing/ for service details. Email or use https://www.gxpcellators.com/contact/ to discuss a data integrity audit.

Frequently Asked Questions About Data Integrity Risks

What is ALCOA plus?

ALCOA plus is a framework for data integrity. The original ALCOA principles are Attributable, Legible, Contemporaneous, Original, and Accurate. The plus adds Complete, Consistent, Enduring, and Available. It is used to assess whether data can be trusted.

Are standalone instruments really a risk?

Yes. Standalone instruments often lack audit trails or have password protection that is not enabled. WHO and FDA findings both cite standalone equipment as a source of data integrity issues.

What should we do about legacy systems that cannot support individual accounts?

Document the current controls, assess the risk, and create a plan for upgrade. MHRA guidance expects demonstrated progress toward individual login and audit trails for legacy automation.

How often should audit trails be reviewed?

It depends on the system and the risk. For critical systems that affect batch release, review before release is appropriate. For other systems, a periodic review at a defined frequency may suffice. The key is that the review happens and is documented.

Is paper data included in data integrity?

Yes. Paper records are part of the data lifecycle. They must be protected from alteration, and true copies must be retained where records are scanned or archived.

Can you audit our data integrity controls?

Yes. We assess data governance, gmp audit trails, access controls, shared accounts, electronic signatures, paper records, and data transfers across systems.

How do I request a data integrity audit?

Email or use https://www.gxpcellators.com/contact/. Service details are at https://www.gxpcellators.com/gmp-auditing/.