In particular, industry citations have increased as they relate to areas of Part 11 and data integrity. At the heart of these, is the ability to ensure that no original record is obscured, or is destroyed before the retention period has ended. The best way to preserve database records, those that are uniformly structured, is to place an audit trail on the file. The audit trail will create a new record every time a record is updated, including the old value, new value, date, time, person who authentically performed the modification to the record, and the reason for the change.

Companies are not aligning well with the Part 11 and data integrity requirements, and while many use audit trails, these are not always managed appropriately. In some cases, FDA has found that the audit trail was deactivated for a period of time, but this was not documented, or it was modified or deleted. Without this protection, it’s virtually impossible to follow the life cycle for any record from creation to disposition at the end of the retention period.

In some cases, audit trails exist, but do not require th user to enter a reason for a change to a record. This is a challenge when trying to reconstruct what happened, and not having the reason brings into question the validity of the record.

Some legacy stand-alone systems that include software loaded onto a local device, instrument, or piece of equipment do not have audit trail capability. This is not a valid reason for ignoring Part 11 and data integrity requirements. If no technical control is available, such as an audit trail, then a procedural control must be in place. In the case of a stand-alone system, the user would have to maintain a log of all changes made, and this could be done using a bound laboratory notebook or log book, or using Excel or some other means of tracking this information.

Not only do these companies risk being out of compliance, but they are not able to perform analysis and trending on the records to identify the reason behind changes. If it’s a consistent reason, it may be due to a training deficiency or have some other cause that should receive action.

We will explore the best practices and strategic approach for evaluating computer systems used in the conduct FDA-regulated activities and determining the level of potential risk, should they fail, on data integrity, process and product quality, and consumer/patient safety. We will walk through the System Development Life Cycle (SDLC) approach to validation, based on risk assessment, and will also discuss 21 CFR Part 11 and data integrity, and the importance of managing electronic records and signatures appropriately.

We will also walk through the entire set of essential policies and procedures, as well as other supporting documentation and activities that must be developed and followed to ensure compliance. We will provide an overview of practices to prepare for an FDA inspection, and will also touch on the importance of auditing vendors of computer system hardware, software, tools and utilities, and services.

Finally, we will provide an overview of industry best practices, with a focus on data integrity and risk assessment, that can be leveraged to assist in all your GxP work.

You should attend if you are responsible for leading or participating in a computer system validation project for a system regulated by FDA. The system will require testing to ensure it meets FDA requirements for 21 CFR Part 11, the guidance for electronic records and electronic signatures, and data integrity. Audit trails play a key role in ensuring compliance and understanding how to defend data chronologically through its retention period. Learn how a work-around when a legacy system has no audit trail, but contains electronic records. Also, understand what a vendor may be able to provide to demonstrate complete traceability of data.

You’ll also learn an approach to both 21 CFR Part 11 and data integrity compliance understanding what FDA expects stakeholders in industry to do. There a few simple suggestions that can streamline validation activities related to all of these key areas.

Preparing for an FDA inspection is a challenge, but an internal inspection by Quality can help you identify gaps where data integrity may be in question and how to remediate them before the agency arrives.