Data Integrity Audit Guide for Pharmaceutical Documents

A data integrity audit examines whether a record and its supporting evidence can reliably reconstruct the activity and decision it represents. For pharmaceutical documents, follow the chain from source data through transcription or calculation, document revisions, review, approval, use and retention. A polished PDF or an “approved” badge does not establish that the chain is intact.

This guide helps quality, document-control and system owners audit that chain. It retains the wider governance, laboratory, access, supplier and CAPA context because document defects often originate outside the EDMS. The worksheet and fictional worked case below are practical audit aids, not evidence of a performed commercial-system audit.

The primary US context is drug CGMP, including biologics, addressed in FDA's December 2018 final data-integrity guidance. Clinical investigation, GLP, device and EU GMP assessments need their own applicable authorities. ALCOA+ is useful terminology for examining trustworthy records; it is not a universal standalone law that replaces those requirements. Primary sources were checked on October 6, 2026. FDA guidance page and scope.

Start with the decision the evidence supports

Choose a consequential workflow, such as a batch-related laboratory report, a controlled manufacturing instruction or a GMP investigation. State the audit period, sites, record families, systems and interfaces. Identify the authorized decision maker and the requirements governing the record.

Map the evidence chain before opening random files:

Original observation → source record and metadata → processing or transfer → exact document revision → review and approval → authorized use → retained, retrievable record.

At each arrow ask what establishes the relationship. A filename that resembles a report number may be a useful clue, but it does not prove that the report used that source version. A signature may belong to an earlier revision. An exported table may have lost the unit that makes its values meaningful.

Audit in both directions. Start with an approved report and trace its claims back to source records. Then select a source event, including an adverse or invalidated result where relevant, and follow it forward into the report or documented disposition. The first direction finds unsupported conclusions; the second helps identify omitted evidence.

Keep the boundary explicit. An EDMS may retain a controlled report while a laboratory system retains dynamic source data. That can be an intentional design. The audit question is whether the complete required record remains linked, controlled and available through the accepted arrangement, not whether every object lives in one application.

Translate ALCOA+ into questions about evidence

FDA's 2018 guidance explains ALCOA in its drug-CGMP context. MHRA's March 2018 guidance explains the additional terms complete, consistent, enduring and available, while noting that the acronym does not change the underlying expectations. Its guidance must be read with the applicable GxP rules. FDA, question 1, MHRA revision 1, section 3.10.

Use the following questions as audit prompts rather than a score that certifies compliance.

Do not classify all drafts, environmental-monitoring records or training records as inherently low risk. Their role in a GMP decision determines what matters. Likewise, a missing optional keyword is different from a missing sample identity or unit used to interpret a result.

The FDA data-integrity guide provides additional context for that US drug-CGMP assessment. Keep the applicable authority in the worksheet instead of treating an acronym as the record's legal basis.

Prepare an audit that can find omissions

Assign a lead auditor, process owner, technical contact and quality decision maker. A small organization can combine duties where appropriate, but the plan should identify conflicts and how they are managed. Give the auditors authorized access to the evidence they need, including supplier-held information.

Build a record inventory from an authoritative population, not solely the final folder offered by the auditee. Record the query or export criteria, date range, extraction time and exclusions. Compare expected logical records, versions and attachments separately; a matching total cannot detect one duplicate replacing one missing record.

Select samples based on their decision impact and opportunities for undetected change or loss. Include routine successful records and relevant adverse conditions: rejected work, superseded versions, manual transfers, corrections, failed interfaces and prior findings. Document why the sample covers the stated risks and when a finding will expand the scope. Avoid presenting an arbitrary percentage as a regulatory sampling minimum.

Prepare three evidence groups:

1. Governance: applicable procedures, responsibilities, audit scope, prior findings and unresolved CAPAs.
2. System context: intended use, configuration, validation status, interfaces, permissions and supplier responsibilities.
3. Record chains: source data, metadata, processing history, document versions, approvals, review evidence and retention/retrieval locations.

Ask operators to demonstrate their actual workflow: finding the effective instruction, recording an error, locating an earlier result and escalating missing evidence. Compare the demonstration with the procedure. Interviews explain behavior, but a recollection that “QA approved it” does not replace the approval record.

Use approved synthetic fixtures in a suitable test environment for disruptive permission or deletion tests. Do not create, modify or delete live GMP records merely to make an audit demonstration convenient. Record which conclusions came from existing production evidence and which came from a controlled test.

Follow the document evidence chain

Identify the source and its meaning

For each material statement or value, capture the source system, stable record ID, version or acquisition identifier, relevant location within the source and necessary metadata. Check sample/batch identity, units, method, actor and time where those attributes affect interpretation.

Under 21 CFR 211.194, applicable laboratory records include complete test data and specified contextual information, calculations and reviewer attribution. A final document cannot stand in for omitted required laboratory evidence. 21 CFR 211.194.

A PDF may be an appropriate record or copy for one purpose and insufficient for another. Determine whether the source has dynamic features needed to reconstruct the activity. FDA's questions 9–10 distinguish true copies from static outputs that lose the content or meaning of a dynamic original. A hash comparison alone cannot establish semantic completeness. FDA guidance, questions 9–10.

Reconstruct transformations and versions

Trace manual transcription, spreadsheet calculations, unit conversions, import mappings and generated summaries. For a consequential calculation, identify both the input versions and the rule applied. Reperform a selected calculation independently; agreement with another copied spreadsheet cell is not independent confirmation.

For example, converting 0.25 g to 250 mg preserves magnitude when the factor is 1,000 mg/g. Copying “0.25” into a field labeled mg changes the meaning even though the numeric characters match. If the unit is absent and cannot be established from an authoritative source, record an unresolved input rather than guessing from surrounding values.

Check the revision actually used at the time of the activity. The newest available document today may not have been effective then. Conversely, citing a historically valid version does not justify using it after a superseding change became applicable. Preserve the date, state and intended-use relationship that determines the answer.

Connect review and approval to the exact record

Confirm what the reviewer could see, which version was reviewed, the reviewer identity and the resulting decision. Inspect any changes between that review and the version later used. A disconnected approval email or a signature attached to a similarly named file leaves the version relationship unresolved.

Do not equate uploading an approved report with approving all underlying data. For applicable drug production/control records, 21 CFR 211.192 addresses quality-unit review before batch release and investigation of unexplained discrepancies. Define the quality decision and supporting evidence separately from the EDMS transport step. 21 CFR 211.192.

Verify history, access and retrieval

Inspect the events around the selected record: creation, consequential edits, processing changes, approvals and relevant deletion or access events. Reconcile actor identifiers and time zones across systems. A later file-copy timestamp is not automatically evidence that the underlying activity occurred late; investigate which event each timestamp represents.

Record the required review timing. FDA's audit-trail guidance ties specified review frequencies to the associated CGMP data; where not specified, it describes risk-based determination. It does not establish one monthly, quarterly or annual schedule for every trail or internal audit. FDA guidance, questions 7–8.

Test authorized retrieval of the retained source, version and context, not just the latest PDF. Applicable Part 211 records must remain available for inspection through their retention period; the exact period depends on the record and rule. 21 CFR 211.180.

Use this scoped document-audit worksheet

Create one worksheet per selected document chain. Header fields are audit ID, intended decision, applicable requirement, system/configuration, document ID/version, audit period, auditor and population/sample reference. For each row retain the evidence location, observation, result, owner and follow-up reference.

Use supported, adverse finding, unknown or justified not applicable for each criterion. Supported means evidence matches the stated requirement. An adverse finding records an observed contradiction or missing required element established by the audit. Unknown means evidence is unavailable or insufficient to decide. Not applicable requires a documented reason accepted by the designated reviewer.

An inaccessible source is unknown; a verified source showing a different value is adverse. Both prevent treating the affected claim as supported. These worksheet results do not assign regulatory severity automatically. The quality system should determine impact, escalation and disposition using the actual process and evidence.

Worked case: a correct-looking report with broken links

The following fictional exercise concerns a GMP investigation summary, INV-27 revision 4, containing a measured mass and a conclusion attributed to laboratory report LAB-88. The local acceptance rule requires each material claim to match the applicable source, preserve its unit and have approval tied to the document revision.

Ordinary case. LAB-88 revision 2 records 0.25 g. The summary records 250 mg with the conversion factor. Its source reference identifies revision 2, and approval AP-19 names INV-27 revision 4. The reviewer can retrieve the source, required context and approval. W2, W3, W4 and W7 are supported for those checks. This does not pass unrelated checks that were not performed.

Now change one condition at a time:

If AI was not used, W11 may be not applicable with the documented workflow basis. It cannot be marked not applicable merely because the generated answer is difficult to explain.

A model's confidence or repeated answer does not replace evidence. Review each material assertion against its source, version, context and derivation. Where AI generates a number, distinguish a copied measurement from a calculation or proposed assumption. Keep unverified output out of the approved evidence chain until resolved under the controlled process.

These are suggested audit controls for generated content, not a claim that FDA's 2018 guidance prescribed a particular AI architecture or prompt log. Preserve the information your assessment requires without treating sensitive source data as unrestricted debugging material. For the qualification decision, use the AI regulatory-writing validation guide.

Extend the assessment beyond the report

Laboratory and paper records

Reconcile the report with relevant runs, processing history, investigations and original records. An invalidated result needs its disposition; excluding it from a conclusion does not mean deleting the evidence. In a paper workflow, inspect issued forms, corrected entries and replacement records as part of the same chain. An electronic scan does not repair missing original context.

Avoid a blanket assumption that every laboratory instrument must retain the same type of electronic file. Determine the actual original record and method requirements. A balance printout and a reprocessable chromatographic file present different retention questions. The assessment should follow the record's nature rather than the instrument's network connection.

Access, configuration and validation

Compare authorized users with actual privileges, including administrators and service accounts. Test a permitted action and a corresponding denied action using the approved test arrangement. A shared editing identity weakens attribution; do not conclude that a person's training record alone establishes who made an entry.

21 CFR 211.68(b) addresses authorized changes and accuracy checks for computer-system inputs and outputs. Evaluate actual configuration and interfaces, including manual workarounds. A supplier's platform qualification does not demonstrate every customer workflow. 21 CFR 211.68.

Inspect change records for settings that affect document state, processing, permissions or history. Trace affected requirements and tests rather than assuming every update requires the same work. The computerized-system validation guide covers that broader lifecycle.

Link consequential configuration repairs to the pharmaceutical change-control process, including the affected records, release decision and verification owner.

Hosted systems and external laboratories

Establish who retains the authoritative source, supplies metadata/history, investigates discrepancies and delivers records when needed. Ask for evidence from the actual service boundary. A security certification or backup-job report answers only part of the data-integrity question.

If the laboratory or hosting provider changes, repeat the chain assessment across export, transformation and retrieval. Confirm that the customer can obtain the necessary evidence after contract termination under the agreed retention arrangement. An inaccessible supplier portal cannot be treated as a successful archive merely because a summary PDF was downloaded earlier.

Distinguish disaster recovery from long-term record preservation. Define the required record population and verify recovery of its dependencies, not just whether the EDMS launches after restoration. If the supplier performs the test, inspect applicable results and their scope instead of claiming that your team executed it.

Write findings that support investigation and correction

A useful finding contains the condition, exact evidence, applicable criterion, affected scope, immediate decision and unresolved questions. Separate observed fact from suspected cause. A missing audit event does not by itself establish intent to falsify records.

For the worked approval problem, write: “Approval AP-19 identifies INV-27 revision 3. Revision 4 is labeled approved, but no approval linked to revision 4 was available in the assessed workflow. The revision relationship conflicts with requirement DC-07.” Then state which use is held and who investigates. Do not invent a regulatory quotation or assign “critical” merely from the document label.

Preserve relevant evidence and assess potentially affected decisions before changing the records. Route significant concerns through the quality system; determine any notification or product action through the applicable process. For drug production/control discrepancies within its scope, section 211.192 includes investigation beyond the initially observed batch when associated products may be affected. 21 CFR 211.192.

Investigate why the relationship failed using actual configuration, logs, procedures and interviews. A plausible explanation is a hypothesis until supported. If evidence shows an import mapped the document ID but omitted the revision ID, test that mechanism and inspect other imports using the same mapping. Do not default to “retrain the author” when the failure occurred in an automated boundary.

Separate four actions: contain the unreliable use, correct the affected record under control, repair the demonstrated cause, and verify effectiveness on later or representative cases. For the hypothetical import defect, effectiveness should include both a matching-version acceptance and a mismatched-version rejection. Correcting one displayed badge without repairing the mapping does not establish prevention.

Make the corrective test concrete. Supply two fictional input pairs: INV-27 revision 3 / AP-19 approving revision 3, and INV-27 revision 4 / AP-19 approving revision 3. The corrected import should preserve the valid relationship in the first pair and prevent the second pair from becoming an approved revision-4 record. Add a third pair whose approval has no recoverable revision identity: that relationship remains unresolved rather than borrowing the current document version. Preserve all three inputs and outputs with the mapping version and reviewer decision. This checks the demonstrated cause and its adjacent ambiguity boundary, not only the one record first noticed.

Maintain oversight without mistaking activity for assurance

Keep the useful governance functions visible: accountable owners, role-appropriate training, a route for raising concerns, resources for investigation and management review of unresolved risk. The auditor should be able to follow a reported concern to its assessment rather than relying on a policy that nobody uses.

Automation can help collect history or flag unusual events, but assess the alert rules and source coverage. An off-hours action may be legitimate; a harmful change may occur during normal hours. Test known adverse events, ordinary events and a missing-feed case. A dashboard with zero alerts is inconclusive if the source stopped delivering data.

Track measures with clear denominators and definitions. For example, 18 reviews completed on time out of 20 due is 90%; it measures timeliness, not review quality. If none were due, report “not applicable for this period” rather than 100%. Pair timeliness with unresolved findings, recurring causes and evidence of CAPA effectiveness.

Do not use a rising count of reported concerns as proof that integrity is worsening without considering detection and reporting changes. Likewise, backup success rate does not replace successful retrieval of the complete record chain. Choose a small set of measures that prompts a defined owner to act.

Where an investigation uses process trends, the statistical process-control guide can help frame the separate monitoring question. A stable trend cannot validate missing source records, incorrect units or a broken approval relationship; reconcile those foundations before interpreting the chart.

Close the audit with its scope, sample limits, findings, unresolved evidence, containment, action owners and follow-up criteria. Record which claims are supported and which remain unusable for the intended decision. A completed audit does not guarantee inspection acceptance or certify every record outside the sample.

For a regulatory-document workflow under evaluation, bring one representative evidence chain to an Assyro discussion: source, exact revision, required metadata, approval and retrieval path. Use that concrete example to establish the proposed workflow's boundary and the evidence needed to assess it.