Questions to ask when contemplating data integrity

Here are a set of questions that should be evaluated in any data integrity risk assessment/evaluation.

1. Do you have a list of all GxP activities performed in your organization?
2. Do you know which GxP activities involve intensive data handling tasks?
3. Do you know the automation status of each GxP activity?
4. Have you identified a list of GxP records that will be created by each GxP activity?
5. Have you determined the format in which the official GxP records will be maintained?
6. Have you determined if a signature is required for each GxP record?
7. Do you have controls to ensure that observed, measured or processed GxP data is accurate?
8. Do you have controls to ensure that GxP data is maintained in full without being omitted, discarded or deleted?
9. Do you have controls to ensure that naming, measurement units, and value limits are defined and applied consistently during GxP data handling?
10. Do you have controls to ensure that GxP data is recorded at the same time as the observation/measurement is made or shortly thereafter?
11. Do you have controls to ensure that GxP data is recorded in a clear and human readable form?
12. Do you have controls to ensure that data values represent the first recording of the GxP data or an exact copy of an original data?
13. Do you have SOP(s) addressing management of GxP documents and records and good documentation practices?
14. Do you have SOP(s) addressing the escalation of quality events that also cover data integrity breaches?
15. Do you have SOP(s) addressing self-inspections/audits with provisions for data integrity?
16. Do you have SOP(s) addressing management of third parties with provisions for the protection of data integrity?
17. Do you have SOP(s) for Computerized Systems Compliance?
18. Do you have SOP(s) for training and does it include training on data integrity for employees handling GxP data?
19. For GxP activities that generate data essential for product quality, product supply or patient safety, do you have controls to prevent or minimize:
    • Process execution errors due to human inability, negligence or inadequate procedures?
    •  Non-compliance due to unethical practices such as falsification?
20. Do you have controls to ensure that only authorized employees are granted access to GxP data based on the requirements of their job role?
21. Do you have controls to ensure that only the GxP activity owner or delegate can grant access to the GxP data?
22. Do you have controls to eliminate or reduce audiovisual distractions for GxP activities with intensive data handling tasks?
23. Do you assess the design and configuration of your computerized GxP activity to minimize manual interventions where possible?
24. Do you have controls for review of audit trail data at relevant points in the process to support important GxP actions or decisions?
25. Do you have controls, supervision or decision support aids to help employees who perform error-prone data handling activities?
26. Do you have controls to ensure business continuity if a GxP record essential for product quality, product supply, or patient safety is not available? Both for when there is a temporary interruption to GxP activity or during a disaster scenario?
27. Do you have a process for ensuring that data integrity requirements are included in the design and configuration of GxP facilities where data handling activities take place?
28. Have you assessed the compliance status of computerized systems used to automate GxP activities?
29. Do you have controls to prevent data capture and data handling errors during GxP data creation?
30. Do you have controls to ensure the accuracy of date and time applied to GxP data, records and documents?
31. Do you have controls to ensure that changes to GxP data are traceable to who did what, when and if relevant why during the lifecycle of the GxP data?
32. Do you have controls to ensure that – when required – legally binding signatures can be applied to GxP records and its integrity are ensured during the retention period of the GxP record?
33. Do you have controls to ensure that GxP computerized systems managing GxP data can:
    • Allow access only to employees with proper authorization?
    • Identify each authorized employee uniquely?
34. Do you have controls to ensure that GxP data can be protected against accidental or willful harm?
35. Do you have controls to keep GxP data in a human readable form for the duration of the retention period?
36. Do you have controls to ensure that the process for offline retention and retrievals is fit for its intended purpose?