Data integrity and GxP compliance reviews
A clear view of data integrity risk in your laboratories and plants before a regulator forms one, with actions ranked by severity.
Diagnostic reviews and mock inspections of laboratory and manufacturing records against data integrity principles and 21 CFR Part 11.
Regulators judge a pharmaceutical company by whether its records can be trusted. Batch records, laboratory data, stability studies and audit trails must be attributable, legible, contemporaneous, original and accurate. When they are not, the consequences range from inspection observations to warning letters and import restrictions.
We run diagnostic assessments of computerised systems and paper records: who can create, change or delete data, whether audit trails are switched on and reviewed, how backups and retention work, and whether results are reprocessed or tested into compliance. Mock inspections put laboratories and plants through the questions an inspector would ask.
Where manipulation or backdating is suspected, we investigate with digital forensics and interviews, so the response to the regulator rests on established facts. Every review ends with a ranked plan of corrective and preventive actions, and training for the people who generate and review data.
An inspection is due, a warning letter or observation has been received, or you need assurance that GxP records can be trusted.
Signs we see most often
- 01An inspection by a domestic or overseas regulator is due.
- 02You have received inspection observations or a warning letter.
- 03Audit trails are disabled, unreviewed or unavailable on some systems.
- 04Results appear to have been re-run, reprocessed or backdated.
- 05A contract manufacturer's or laboratory's data cannot be verified.
- 06Compliance with Revised Schedule M has to be evidenced.
Scoped in writing, run by one accountable team.
Every engagement starts with agreed questions, a reporting line and a confidentiality protocol. The steps below are how this service usually runs; we adapt them to your matter.
- 01ScopeAgree the sites, systems, products and records to review.
- 02DiagnoseAssess systems, access, audit trails, backup and retention.
- 03InspectRun mock inspections of laboratories and production areas.
- 04InvestigateInvestigate suspected manipulation with digital forensics and interviews.
- 05RankRank observations by severity and regulatory impact.
- 06CorrectAgree corrective and preventive actions and train the teams.
A clear view of data integrity risk before the regulator forms one, with actions ranked by severity.
- A data integrity diagnostic report
- Mock inspection observations by site
- Investigation findings where manipulation is suspected
- A ranked corrective and preventive action plan
- Training on data integrity principles for laboratory and production teams
The law and frameworks this work is aligned to
- US FDA 21 CFR Part 11 on electronic records and electronic signatures
- US FDA guidance on data integrity and compliance with drug CGMP
- WHO guidance on good data and record management practices
- PIC/S guidance on good practices for data management and integrity in regulated GMP and GDP environments
- Revised Schedule M, Drugs and Cosmetics Rules, 1945
References show the standard the work is built to. They do not imply accreditation or endorsement by the bodies that publish them.
This is a summary of the service. For a deeper understanding of how it would work for your organisation, please reach out to us.
Talk to a BDI partnerQuestions clients ask before we start.
Can you help us respond to a warning letter?
We establish the facts behind the observations, investigate where needed and help build the corrective action plan. Correspondence with the regulator stays with your regulatory affairs team and counsel.
Do you review contract manufacturers?
Yes, where your quality agreement allows it. Data integrity at a contract site is your risk too.
Is this a GMP audit?
It focuses on whether data and records can be trusted, which sits at the heart of GMP. It complements your quality audits rather than replacing them.