Each audit trail entry must
be attributable to the individual responsible for the direct data input so
all changes or creation of data with the persons making those changes.
When using a user’s unique ID, this must identify an individual pers
on.
Each audit trail must be
linked to the relevant record throughout the data life cycle.
Legible
The system should be able
to print or provide an electronic copy of the audit trail.
The audit trail must be
available in a meaningful format when. viewed in the system or as
hardcopy.
Contemporaneous
Each audit trail entry must
be date- and time-stamped according to a controlled clock which cannot
be altered. The time should either be based on central server time or a
local time, so long as it is clear in which time zone the entry was
performed.
Original
The audit trail should
retain the dynamic functionalities found in the computerized system,
included search functionality to facilitate audit trail review
activities.
Accurate
Audit trail functionality
must be verified to ensure the data written to the audit trail equals
the data entered or system generated.
Audit trail data must be
stored in a secure manner and users cannot have the ability to amend,
delete, or switch off the audit trail. Where a system administrator
amends, or switches off the audit trail, a record of that action must be
retained.
Complete
The audit trail entries
must be automatically captured by the computerized system whenever an
electronic record is created, modified, or deleted.
Audit trails, at minimum,
must record all end user initiated processes
related to critical data. The following parameters must be included:
The identity of the person
performing the action.
In the case of a change or
deletion, the detail of the change or deletion, and a record of the
original entry.
The reason for any GxP change or deletion.
The time and date when the
action was performed.
Consistent
Audit trails are used to
review, detect, report, and address data integrity issues.
Audit trail reviewers must
have appropriate training, system knowledge and knowledge of the process
to perform the audit trail review. The review of the relevant audit
trails must be documented.
Audit trail discrepancies
must be addressed, investigated, and escalated to JEB management and
national authorities, as necessary.
Enduring
The audit trail must be
retained for the same duration as the associated electronic record.
Available
The audit trail must be
available for review at any time by inspectors and auditors during the
required retention period.
The audit trail must be
accessible in a human readable format.
21CFR Part 11 Requirements
Definition: An audit trail is a secure, computer-generated, time-stamped electronic record that allows for the reconstruction of events related to the creation, modification, and deletion of an electronic record.
Requirements:
Availability: Audit trails must be easily accessible for review and copying by the FDA during inspections.
Automation: Entries must be automatically captured by the system without manual intervention.
Components: Each entry must include a timestamp, user ID, original and new values, and reasons for changes where applicable.
Security: Audit trail data must be securely stored and not accessible for editing by users
EMA Annex 11 (Eudralex Volume 4) Requirements
Definition: Audit trails are records of all GMP-relevant changes and deletions, created by the system to ensure traceability and accountability.
Requirements:
Risk-Based Approach: Building audit trails into the system for all GMP-relevant changes and deletions should be considered based on a risk assessment.
Documentation: The reasons for changes or deletions must be documented.
Review: Audit trails must be available, convertible into a generally readable form, and regularly reviewed.
Validation: The audit trail functionality must be validated to ensure it captures all necessary data accurately and securely.
Requirements from PIC/S GMP Data Integrity Guidance
Definition: Audit trails are metadata recorded about critical information such as changes or deletions of GMP/GDP relevant data to enable the reconstruction of activities.
Requirements:
Review: Critical audit trails related to each operation should be independently reviewed with all other records related to the operation, especially before batch release.
Documentation: Significant deviations found during the audit trail review must be fully investigated and documented.
Investigations of a Dog 
2 thoughts on “The Audit Trail and Data Integrity”