Data Integrity in FDA Inspections: A Critical Focus Area for GMP Compliance

In recent years, data integrity has emerged as one of the most scrutinized areas during US FDA inspections. With the increasing reliance on electronic systems, the agency has intensified its efforts to ensure that all data—whether paper-based or digital—is complete, consistent, and accurate throughout the data lifecycle. This article explores how data integrity has become a focal point in FDA inspections, including common inspection findings, regulatory expectations, and best practices for maintaining compliance with 21 CFR Part 11 and ALCOA+ principles.

Why Data Integrity Matters to the FDA:

• Ensures safety, efficacy, and quality of pharmaceutical products
• Prevents fraud, manipulation, and noncompliant practices
• Supports sound decision-making in manufacturing and quality control
• Builds trust in regulatory submissions, such as NDAs, ANDAs, and DMFs

Regulatory Foundations: 21 CFR Part 11 and ALCOA+ Principles

21 CFR Part 11:

• Applies to electronic records and signatures
• Requires audit trails, access controls, record retention, and validation of computerized systems
• Demands documentation of changes and user accountability

ALCOA+ Principles:

• Attributable – Who did it and when?
• Legible – Can the data be read and understood?
• Contemporaneous – Recorded at the time of the activity
• Original – Source data or a certified copy
• Accurate – No errors or alterations
• +Complete, Consistent, Enduring, and Available

Common Data Integrity Findings During FDA Inspections:

• Missing or incomplete audit trails for electronic instruments
• Backdating or re-entering results without justification
• Use of shared login credentials or password practices
• Inadequate control of raw data (e.g., overwritten chromatograms)
• Unauthorized access to critical systems and records
• Lack of procedures for data review and electronic record retention

Case Studies: Enforcement Trends

In multiple FDA warning letters, firms have been cited for:

• Deleting failed test results to present only passing outcomes
• Running unapproved trial batches to ‘test’ product quality before recording final data
• Failure to document failed analytical runs in HPLC systems
• Inadequate oversight from the Quality Unit in reviewing electronic audit trails

Data Integrity in Analytical and Stability Testing:

• Ensure all raw data, chromatograms, and test calculations are archived
• Audit trails must be active for all analytical instruments (e.g., HPLC, UV-Vis)
• Stability testing records should be secure, version-controlled, and properly justified
• Analytical method validation data must match what is used during routine testing

Expectations for Computer System Validation (CSV):

• Maintain a validated state for all GMP-relevant computerized systems
• Document user requirements, system design, testing protocols, and change controls
• Maintain electronic audit logs that are reviewed periodically
• Restrict administrator access and track system-level changes

Key Inspection Questions Related to Data Integrity:

• Can you show the audit trail for this test?
• How do you restrict user access to this system?
• Who reviewed and approved this electronic record?
• Where are your raw data files stored and backed up?
• When was the last audit trail review conducted?

Best Practices for Data Integrity Compliance:

1. Develop and implement robust data integrity SOPs
2. Train all employees—especially QC and QA—on data integrity principles
3. Conduct periodic internal audits focused on data lifecycle management
4. Implement secure electronic systems with proper role-based access
5. Monitor data trends and flag anomalies for deeper review

Role of the Quality Unit in Ensuring Data Integrity:

• Perform regular audit trail reviews across all electronic systems
• Ensure raw data is protected and reviewed before reporting
• Lead investigations into suspected data integrity breaches
• Establish a culture of transparency and ethical data recording

FDA Guidance and International Alignment:

• Follow FDA’s guidance document “Data Integrity and Compliance With Drug CGMP”
• Harmonize with MHRA and WHO data integrity expectations
• Incorporate PIC/S PI 041 principles into internal audit checklists

Remediation Strategies After a Data Integrity Finding:

• Perform full risk assessment of impacted data
• Evaluate product quality implications and batch disposition
• Revise systems, retrain staff, and requalify affected equipment
• Submit CAPA with documented evidence to FDA within response timelines

Conclusion:

Data integrity is not just a technical compliance issue—it reflects the ethical backbone of a pharmaceutical organization. As the FDA continues to prioritize this area, manufacturers must ensure their systems, practices, and culture uphold the highest standards of data reliability. From audit trails and ALCOA+ principles to validated systems and QA oversight, every step in the data lifecycle must be transparent, defendable, and inspection-ready.