PHARMACEUTICAL INSPECTION CONVENTIONPHARMACEUTICAL INSPECTION CO-OPERATION SCHEME

PI 041-1 (Draft 2)
10 August 2016

DRAFT PIC/S GUIDANCEGOOD PRACTICES FOR DATA MANAGEMENT AND INTEGRITY IN REGULATED
GMP/GDP ENVIRONMENTS© PIC/S August 2016
Reproduction prohibited for commercial purposes.
Reproduction for internal use is authorised,provided that the source is acknowledged.

Editor:PIC/S Secretariat

e-mail:web site:

info@picscheme.org
http://www.picscheme.org

PI 041-1 (Draft 2)

1 of 41

10 August 2016

TABLE OF CONTENTS
Page
1.

Document history .............................................................................................................. 32.

Introduction ....................................................................................................................... 3

3.

Purpose ............................................................................................................................ 4

4.

Scope ............................................................................................................................... 55.

Data governance system .................................................................................................. 5

5.1

What is data governance .................................................................................................. 5

5.2

Data governance systems ................................................................................................ 5

5.3

Risk management approach to data governance............................................................. 6

5.4

Data criticality ................................................................................................................... 6

5.5

Data risk ............................................................................................................................ 7

5.6

Data governance system review ...................................................................................... 7

6.

Organisational influences on successful data integrity management............................... 8

6.1

General ............................................................................................................................. 8

6.2

Code of ethics and policies ............................................................................................... 9

6.3

Quality culture ................................................................................................................. 10

6.4

Modernising the Pharmaceutical Quality Management System ..................................... 10

6.5

Regular management review of quality metrics ............................................................. 10

6.6

Resource allocation ........................................................................................................ 10

6.7

Dealing with data integrity issues found internally.......................................................... 11

7.

General data integrity principles and enablers .............................................................. 11

8.

Specific data integrity considerations for paper-based systems .................................... 13

8.1

Structure of QMS and control of blank forms/templates/records ................................... 13

8.2

Why is the control of records important? ........................................................................ 14

8.3

Generation, distribution and control of template records ............................................... 14

8.4

Expectations for the generation, distribution and control of records .............................. 14

8.5

Use and control of records within production areas ....................................................... 16

8.6

Filling out records ........................................................................................................... 16

8.7

Making corrections on records ....................................................................................... 18

8.8

Verification of records ..................................................................................................... 18

8.9

Maintaining records ........................................................................................................ 19

8.10

Direct print-outs from electronic systems ....................................................................... 20

8.11

True copies ..................................................................................................................... 20

8.12

Limitations of remote review of summary reports ........................................................... 21

8.13

Document retention ........................................................................................................ 21

8.14

Disposal of original records ............................................................................................ 22

9.

Specific data integrity considerations for computerised systems ................................... 23

9.1

Structure of QMS and control of computerised systems ................................................ 23

9.2

Qualification and validation of computerised systems ................................................... 23

9.3

System security for computerised systems .................................................................... 27

9.4

Audit trails for computerised systems ............................................................................. 29

9.5

Data capture/entry for computerised systems ................................................................ 30

PI 041-1 (Draft 2)

2 of 41

10 August 2016

9.6

Review of data within computerised systems................................................................. 32

9.7

Storage, archival and disposal of electronic data ........................................................... 33

10.

Data integrity considerations for outsourced activities .................................................. 35

10.1

General supply chain considerations ............................................................................. 35

10.2

Routine document verification ........................................................................................ 35

10.3

Strategies for assessing data integrity in the supply chain ............................................ 35

11.

Regulatory actions in response to data integrity findings ............................................... 37

11.1

Deficiency references ..................................................................................................... 37

11.2

Classification of deficiencies........................................................................................... 37

12.

Remediation of data integrity failures ............................................................................. 38

12.1

Responding to significant data integrity issues .............................................................. 38

12.2

Indicators of improvement .............................................................................................. 40

13.

Definitions ...................................................................................................................... 40

14.

Revision history............................................................................................................... 41

1

DOCUMENT HISTORY

Draft 1 of PI 041-1 presented to the PIC/S
Committee at its meeting in Manchester

4-5 July 2016

Consultation of PIC/S Participating Authorities on
publication of the Good Practices as a draft andimplementation on a trial basis

18 July – 31 July 2016

Minor edits to Draft 1

1 – 9 August 2016

Publication of Draft 2 on the PIC/S website

10 August 2016

Implementation of the draft on a trial basis and
10 August 2016 – 28 February 2017
comment period for PIC/S Participating Authorities
Review of comments by PIC/S Participating
Authorities…

Finalisation of draft…

Adoption by Committee of PI 041-1[Date]

Entry into force of PI 041-1[Date]

2

INTRODUCTION

2.1

PIC/S Participating Authorities regularly undertake inspections of manufacturers
and distributors of API and medicinal products in order to determine the level ofcompliance with GMP/GDP principles. These inspections are commonly performed
on-site however may be performed through the remote or off-site evaluation of
documentary evidence, in which case the limitations of remote review of data
should be considered.

2.2

The effectiveness of these inspection processes is determined by the veracity ofthe evidence provided to the inspector and ultimately the integrity of the underlying
data. It is critical to the inspection process that inspectors can determine and fully
rely on the accuracy and completeness of evidence and records presented to them.

2.3

Good data management practices influence the integrity of all data generated andrecorded by a manufacturer and these practices should ensure that data is
accurate, complete and reliable. While the main focus of this document is inrelation to data integrity expectations, the principles herein should also be
considered in the wider context of good data management.

PI 041-1 (Draft 2)

3 of 41

10 August 2016

2.4

Data Integrity is defined as “the extent to which all data are complete, consistent1
and accurate, throughout the data lifecycle” and is fundamental in a
pharmaceutical quality system which ensures that medicines are of the required
quality. Poor data integrity practices and vulnerabilities undermine the quality ofrecords and evidence, and may ultimately undermine the quality of medicinal
products.

2.5

Data integrity applies to all elements of the Quality Management System and theprinciples herein apply equally to data generated by electronic and paper-based
systems.

2.6

The responsibility for good practices regarding data management and integrity lies
with the manufacturer or distributor undergoing inspection. They have full
responsibility and a duty to assess their data management systems for potential
vulnerabilities and take steps to design and implement good data governancepractices to ensure data integrity is maintained.

3

PURPOSE

3.1

This document was written with the aim of:

3.1.1

Providing guidance for inspectorates in the interpretation of GMP/GDP
requirements in relation to data integrity and the conduct of inspections.

3.1.2

Providing consolidated, illustrative guidance on risk-based control strategies whichenable the existing requirements for data integrity and reliability as described in
2
3
PIC/S Guides for GMP and GDP to be implemented in the context of modern
industry practices and globalised supply chains.

3.1.3

Facilitating the effective implementation of data integrity elements into the routine
planning and conduct of GMP/GDP inspections; to provide a tool to harmonise
GMP/GDP inspections and to ensure the quality of inspections with regards to data
integrity expectations.

3.2

This guidance, together with inspectorate resources such as aide memoire (forfuture development) should enable the inspector to make an optimal use of theinspection time and an optimal evaluation of data integrity elements during aninspection.

3.3

Guidance herein should assist the inspectorate in planning a risk-based inspection
relating to data integrity.

3.4

This guide is not intended to impose additional regulatory burden upon regulated
entities, rather it is intended to provide guidance on the interpretation of existing
PIC/S GMP/GDP requirements relating to current industry practice.

3.5

The principles of data integrity apply equally to both manual and computerised
systems and should not place any restraint upon the development or adoption of
new concepts or technologies. In accordance with ICH Q10 principles, this guide
should facilitate the adoption of innovative technologies through continual
improvement.

3.6

This version of the guidance is intended to provide a basic overview of key
principles regarding data management and integrity. The PIC/S Data Integrity
Working Group will periodically update, amend and review this guidance in light ofinspectorate feedback, experience in using the guide and any other developments.

1

MHRA GMP Data Integrity Definitions and Guidance for Industry March 2015
PIC/S PE 009 Guide to Good Manufacting Practice for Medicinal Products, specifically Part I chapters 4, 5, 6, Part II
chapters 5, 6 & Annex 11
3
PIC/S PE 011 Guide to Good Distribution Practice for Medicinal Products, specifically sections 3, 4, 5 & 6
2

PI 041-1 (Draft 2)

4 of 41

10 August 2016

4

SCOPE

4.1

The guidance has been written to apply to both on-site and remote (desktop)
inspections of those sites performing manufacturing (GMP) and distribution (GDP)
activities. The guide should be considered as a non-exhaustive list of areas to beconsidered during inspection.

4.2

Whilst this document has been written with the above scope, many principles
regarding good data management practices described herein have applications forother areas of the regulated pharmaceutical and healthcare industry.

4.3

This guide is not intended to provide specific guidance for “for-cause” inspections
following detection of significant data integrity vulnerabilities where forensic
expertise may be required.

5

DATA GOVERNANCE SYSTEM

5.1

What is data governance?

5.1.1

Data governance is the sum total of arrangements which provide assurance of data
integrity. These arrangements ensure that data, irrespective of the process, format
or technology in which it is generated, recorded, processed, retained, retrieved andused will ensure a complete, consistent and accurate record throughout the data
lifecycle.

5.1.2

The data lifecycle refers to how data is generated, processed, reported, checked,
used for decision-making, stored and finally discarded at the end of the retention
period. Data relating to a product or process may cross various boundaries within
the lifecycle. This may include data transfer between manual and IT systems, or
between different organisational boundaries; both internal (e.g. between
production, QC and QA) and external (e.g. between service providers or contract
givers and acceptors).

5.2

Data governance systems

5.2.1

Data governance systems should be integral to the pharmaceutical quality systemdescribed in PIC/S GMP/GDP. It should address data ownership throughout the
lifecycle, and consider the design, operation and monitoring of processes / systems
in order to comply with the principles of data integrity, including control overintentional and unintentional changes to, and deletion of information.

5.2.2

The data governance system should ensure controls over data lifecycle which arecommensurate with the principles of quality risk management. These controls may
be:




PI 041-1 (Draft 2)

Organisationaloprocedures,e.g. instructions for completion of records andretention of completed paper records;otraining of staff and documented authorisation for data
generation and approval;odata governance system design, considering how data is
generated recorded, processed retained and used, and risks orvulnerabilities are controlled effectively;oroutine data verification;operiodic surveillance, e.g. self-inspection processes seek toverifiy the effectiveness of the data governance policy.

Technicalocomputerised system control,oautomation

5 of 41

10 August 2016

5.2.3

An effective data governance system will demonstrate Management’s
understanding and commitment to effective data governance practices including
the necessity for a combination of appropriate organisational culture andbehaviours (section 6) and an understanding of data criticality, data risk and data
lifecycle. There should also be evidence of communication of expectations topersonnel at all levels within the organisation in a manner which ensures
empowerment to report failures and opportunities for improvement. This reduces
the incentive to falsify, alter or delete data.

5.2.4

The organisation’s arrangements for data governance should be documented
within their Quality Management System and regularly reviewed.

5.3

Risk management approach to data governance

5.3.1

Senior management is responsible for the implementation of systems andprocedures to minimise the potential risk to data integrity, and for identifying theresidual risk, using the principles of ICH Q9. Contract Givers should perform asimilar review as part of their vendor assurance programme, (refer section 10)

5.3.2

The effort and resource assigned to data governance should be commensuratewith the risk to product quality, and should also be balanced with other quality
resource demands. Manufacturers and analytical laboratories should design andoperate a system which provides an acceptable state of control based on the data
integrity risk, and which is fully documented with supporting rationale.

5.3.3

Where long term measures are identified in order to achieve the desired state ofcontrol, interim measures should be implemented to mitigate risk, and should bemonitored for effectiveness. Where interim measures or risk prioritisation are
required, residual data integrity risk should be communicated to senior
management, and kept under review. Reverting from automated / computerised topaper-based systems will not remove the need for data governance. Such
retrograde approaches are likely to increase administrative burden and data risk,
and prevent the continuous improvement initiatives referred to in paragraph 3.5.

5.3.4

Not all data or processing steps have the same importance to product quality andpatient safety. Risk management should be utilised to determine the importance ofeach data/processing step. An effective risk management approach to data
governance will consider:

Data criticality (impact to decision making and product quality) and

Data risk (opportunity for data alteration and deletion, and likelihood of
detection / visibility of changes by the manufacturer’s routine review
processes).

From this information, risk proportionate control measures can be implemented.
5.4

Data criticality

5.4.1

The decision that data influences may differ in importance, and the impact of thedata to a decision may also vary. Points to consider regarding data criticality
include:

Which decision does the data influence?
For example: when making a batch release decision, data which
determines compliance with critical quality attributes is of greater
importance than warehouse cleaning records.



What is the impact of the data to product quality or safety?
For example: for an oral tablet, active substance assay data is ofgenerally greater impact to product quality and safety than tablet friability
data.

PI 041-1 (Draft 2)

6 of 41

10 August 2016

5.5

Data risk

5.5.1

Data risk assessment should consider the vulnerability of data to involuntary ordeliberate alteration, falsification, deletion, loss or re-creation, and the likelihood of
detection of such actions. Consideration should also be given to ensuring complete
data recovery in the event of a disaster. Control measures which prevent
unauthorised activity, and increase visibility / detectability can be used as risk
mitigating actions.

5.5.2

Examples of factors which can increase risk of data integrity failure include
complex, inconsistent processes with open ended and subjective outcomes. Simple
tasks which are consistent, well defined and objective lead to reduced risk.

5.5.3

Risk assessments should focus on a business process (e.g. production, QC),
evaluate data flows and the methods of generating data, and not just consider IT
system functionality or complexity. Factors to consider include:Process complexity;

Methods of generating, storing and retiring data and their ability to ensure
data accuracy, legibility, indelibility;Process consistency and degree of automation / human interaction;



Subjectivity of outcome / result (i.e. is the process open-ended or welldefined?); andThe outcome of a comparison between of electronic system data andmanually recorded events could be indicative for malpractices (e.g.
apparent discrepancies between analytical reports and raw-dataacquisition times).

5.5.4

For computerised systems, manual interfaces with IT systems should beconsidered in the risk assessment process. Computerised system validation in
isolation may not result in low data integrity risk, in particular when the user is able
to influence the reporting of data from the validated system.

5.5.5

Critical thinking skills should be used by inspectors to determine whether control
and review procedures effectively achieve their desired outcomes. An indicator ofdata governance maturity is an organisational understanding and acceptance ofresidual risk, which prioritises actions. An organisation which believes that there is‘no risk’ of data integrity failure is unlikely to have made an adequate assessmentof inherent risks in the data lifecycle. The approach to assessment of data lifecycle,
criticality and risk should therefore be examined in detail. This may indicate
potential failure modes which can be investigated during an inspection.

5.6

Data governance system review

5.6.1

The effectiveness of data integrity control measures should be assessed
periodically as part of self-inspection (internal audit) or other periodic review
processes. This should ensure that controls over the data lifecycle are operating as
intended.

5.6.2

In addition to routine data verification checks, self-inspection activities should be
extended to a wider review of control measures, including:

PI 041-1 (Draft 2)

A check of continued personnel understanding of data integrity in thecontext of protecting of the patient, and ensuring the maintenance of aworking environment which is focussed on quality and open reporting ofissues, e.g. by review of continued training in data integrity principles andexpectations.



A review for consistency of reported data/outcomes against raw data
entries.
7 of 41

10 August 2016



In situations where routine computerised system data is reviewed by a4
validated ‘exception report’ , a risk-based sample of computerised
system logs / audit trails to ensure that information of relevance to GMP
activity is reported as expected

5.6.3

An effective review process will demonstrate understanding regarding importanceof interaction of company behaviours with organisational and technical controls.
The outcome of data governance system review should be communicated to senior
management, and be used in the assessment of residual data integrity risk.

6

ORGANISATIONALMANAGEMENT

6.1

General

6.1.1

It may not be appropriate or possible to report an inspection citation relating toorganisational behaviour. An understanding of how behaviour influences (i) the
incentive to amend, delete or falsify data and (ii) the effectiveness of procedural
controls designed to ensure data integrity, can provide the inspector with usefulindicators of risk which can be investigated further.

6.1.2

Inspectors should be sensitive to the influence of culture on organisational
behaviour, and apply the principles described in this section of the guidance in an
appropriate way. An effective ‘quality culture’ and data governance may be different
in its implementation from one location to another. Depending on culture, anorganisation’s control measures may be:

INFLUENCES

ON

SUCCESSFULDATAINTEGRITY

‘open’ (where hierarchy can be challenged by subordinates, and fullreporting of a systemic or individual failure is a business expectation)‘closed’ (where reporting failure or challenging a hierarchy is culturally moredifficult)

6.1.3

Good data governance in ‘open’ cultures may be facilitated by employee
empowerment to identify and report issues through the quality system. In ‘closed’cultures, a greater emphasis on oversight and secondary review may be required
to achieve an equivalent level of control due to the social barrier of communicating
undesirable information. The availability of anonymous escalation to senior
management may also be of greater importance in this situation.

6.1.4

The extent of Management’s knowledge and understanding of data integrity can
influence the organisation’s success of data integrity management. Management
must know their legal and moral obligation (i.e., duty and power) to prevent data
integrity lapses from occurring and to detect them, if they should occur.

6.1.5

Lapses in data integrity are not limited to fraud or falsification, they can beunintentional and still pose risk. Any potential for compromising the reliability ofdata is a risk that should be identified and understood in order for appropriate
controls to be put in place, (refer sections 5.3 - 5.5). Direct controls usually takethe form of written policies and procedures, but indirect influences on employee
behaviour (such as incentives for productivity in excess of process capability)
should be understood and addressed as well.

6.1.6

Data integrity breaches can occur at any time, by any employee, so management
needs to be vigilant in detecting issues and understand reasons behind lapses,
when found, to enable investigation of the issue and implementation of corrective
and preventative actions.

6.1.7

There are consequences of data integrity lapses that affect the various
stakeholders (patients, regulators, customers) including directly impacting patient4

An ‘exception report’ is a validated search tool that identifies and documents predetermined ‘abnormal’ data or
actions, which requires further attention or investigation by the data reviewer.

PI 041-1 (Draft 2)

8 of 41

10 August 2016

safety and undermining confidence in the organisation and its products. Employee
awareness and understanding of these consequences can be helpful in fostering
an environment in which quality is a priority.
6.1.8

Management should establish controls to prevent, detect and correct data integrity
breaches, as well as verify those controls are performing as intended to assure
data integrity.
To achieve success with data integrity, Management should
address the following:

6.2

Code of ethics and policies

6.2.1

A Code of Values & Ethics should reflect Management’s philosophy on quality,
achieved through policies (ie. a Code of Conduct) that are aligned to the quality
culture and develop an environment of trust, where all individuals are responsible
and accountable for ensuring patient safety and product quality.

6.2.2

The company’s general ethics and integrity standards need to be established andknown to each employee and these expectations should be communicatedfrequently and consistently.

6.2.3

Management should make personnel aware of the importance of their role inensuring data integrity and the implication of their activities to assuring productquality and protecting patient safety.

6.2.4

Code of Conduct policies should clearly define the expectation of ethical behaviour,such as honesty. This should be communicated to and be well understood by all
personnel. The communication should not be limited only to knowing therequirements, but also why they were established and the consequences of failingto fulfill the requirements.

6.2.5

Unwanted behaviours, such as deliberate data falsification, unauthorised changes,
destruction of data, or other conduct that compromises data integrity should be
addressed promptly. Disciplinary action may be taken, when warranted. Similarly,
conforming behaviours should be recognised appropriately.

6.2.6

There should be a confidential escalation program supported by company policy
and procedures whereby it encourages personnel to bring instances of possible
breaches to the Code of Conduct to the attention of management without
consequence.

6.3

Quality culture

6.3.1

Management should aim to create a work environment (ie. quality culture) that istransparent and open, one in which personnel are encouraged to freely
communicate failures and mistakes, including potential data reliability issues, sothat corrective and preventative actions can be taken. Organisational reporting
structure should permit the information flow between personnel at all levels.

6.3.2

It is the collection of values, beliefs, thinking, and behaviours demonstrated
consistently by management, team leaders, quality personnel and all personnel
that contribute to creating a quality culture to assure data integrity.

6.3.3

Management can foster quality culture:

PI 041-1 (Draft 2)

Ensure awareness and understanding of expectations (eg. Code of
Ethics and Code of Conduct);Lead by example, management should demonstrate the behaviours they
expect to see ;Ensure accountability for actions and decisions;

Stay continuously and actively involved;

Set realistic expectations, consider the limitations that place pressures on
employees;
9 of 41

10 August 2016

Allocate resources to meet expectations;

Implement fair and just consequences and rewards; and

Be aware of regulatory trends to apply lessons learned to yourorganisation.

6.4

Modernising the Pharmaceutical Quality Management System

6.4.1

The application of modern quality risk management principles and good data
management practices to the current pharmaceutical quality management system
serves to modernize the System to meet the challenges that come with thegeneration of complex data.

6.4.2

The company’s Quality Management System should be able to prevent, detect andcorrect weaknesses in the system or their processes that may lead to data integrity
lapses. The company should know their data life cycle and integrate theappropriate controls and procedures such that the data generated will be valid,
complete and reliable. Specifically, such control and procedural changes may be in
the following areas:Risk assessment and management,

Investigation programs,

Data review practices (section 9),Computer software validation,



Vendor/contractor management ,Training program to include company’s data integrity policy and data
integrity SOPs ,

Self-inspection program to include data integrity, and

Quality metrics and reporting to senior management.

6.5

Regular management review of quality metrics

6.5.1

There should be regular management reviews of quality metrics, including thoserelated to data integrity, such that significant issues are identified, escalated andaddressed in a timely manner. Caution should be taken when key performanceindicators are selected so as not to inadvertently result in a culture in which data
integrity is lower in priority.

6.5.2

The head of the Quality unit should have direct access to the highest level ofmanagement in order to directly communicate risks so that senior management isaware and can allocate resources to address any issues.

6.5.3

Management can have an independent expert periodically verify the effectivenessof their systems and controls.

6.6

Resource allocation

6.6.1

Management should allocate appropriate resources to support and sustain gooddata integrity management such that the workload and pressures on those
responsible for data generation and record keeping do not increase the likelihoodof errors or the opportunity to deliberately compromise data integrity.

6.6.2

There should be sufficient number of personnel for quality and management
oversight, IT support, conduct of investigations, and management of training
program that are commensurate with the operations of the organisation. There
should be provisions to purchase equipment, software and hardware that areappropriate for their needs, based on the criticality of the data in question.

PI 041-1 (Draft 2)

10 of 41

10 August 2016

6.6.3

Personnel must be qualified and trained for their specific duties, with appropriate
segregation of duties, including the importance of good documentation practices.
There should be evidence of the effectiveness of training on critical procedures,such as electronic data review. The concept of data integrity applies to allfunctional departments that play a role in GMP, including areas such as IT andengineering.

6.6.4

Data integrity should be familiar to all, but data integrity experts from various levels(SMEs, supervisors, team leaders) may be called upon to work together to
conduct/support investigations, identify system gaps and drive implementation of
improvements.

6.6.5

Introduction of new roles in an organisation relating to data integrity such as a data
custodian or Chief Compliance Officer might be considered.

6.7

Dealing with data integrity issues found internally

6.7.1

In the event that data integrity lapses are found, they should be handled as any
deviation would be according to the Quality Management System. It is important todetermine the extent of the problem as well as its root cause, then correcting theissue to its full extent and implement preventative measures. This may include theuse of a third party for additional expertise or perspective, which may involve a gap
assessment to identify weaknesses in the system.

6.7.2

When considering the impact on product, any conclusions drawn should be
supported by sound scientific evidence.

6.7.3

Corrective actions may include product recall, client notification and reporting toregulatory authorities.

6.7.4

Further guidance may be found in section 12 of this guide.

7

GENERAL DATA INTEGRITY PRINCIPLES AND ENABLERS

7.1

The Pharmaceutical Quality Management System (QMS) should be implemented
throughout the different stages of the life cycle of the Active Pharmaceutical
Ingredients and medicinal products and should encourage the use of science andrisk-based approaches.

7.2

To ensure that decision making is well informed and to verify that the information isreliable, the events or actions that informed those decisions should be well
documented. As such, Good Documentation Practices (GDocPs) are key toensuring data integrity, and a fundamental part of a well designed Pharmaceutical
Quality Management System (discussed in section 6).

7.3

The application of GDocPs may vary depending on the medium used to record thedata (ie. physical vs. electronic records), but the principles are applicable to both.
This section will introduce those key principles and following sections (8 & 9) will
explore these principles relative to documentation in both paper-based andelectronic-based recordkeeping.

7.4

Some key concepts of GDocPs are summarised by the acronym ALCOA:
Attributable, Legible, Contemporaneous, Original, Accurate. To this list can be5
added the following: Complete, Consisitent, Enduring and Available (ALCOA+ ).
Together, these expectations ensure that events are properly documented and thedata can be used to support informed decisions.

5

EMA guidance for GCP inspections conducted in the context of the Centralised Procedure

PI 041-1 (Draft 2)

11 of 41

10 August 2016

7.5

Basic DI principles applicable to both paper and electronic systems (ALCOA +):Data Integrity Attribute

Requirement

Attributable

It should be possible to identify the individual who performed
the recorded task. The need to document who performed thetask / function, is in part to demonstrate that the function was
performed by trained and qualified personnel. This applies tochanges made to records as well: corrections, deletions,changes, etc.

LegibleAll records must be legible – the information must be readable
in order for it to be of any use. This applies to all informationthat would be required to be considered Complete, including all
Original records or entries. Where the ‘dynamic’ nature ofelectronic data (the ability to search, query, trend, etc) is
important to the content and meaning of the record, the ability
to interact with the data using a suitable application is importantto the ‘availability’ of the record.

Contemporaneous

The evidence of actions, events or decisions should berecorded as they take place. This documentation should serveas an accurate attestation of what was done, or what was
decided and why, i.e. what influenced the decision at that time.

Original

The original record can be described as the first-capture of
information, whether recorded on paper (static) or electronically(usually dynamic, depending on the complexity of the system).
Information that is originally captured in a dynamic state should
remain available in that state.

Accurate

Ensuring results and records are accurate is achieved throughmany elements of a robust Pharmaceutical Quality
Management System. This can be comprised of: equipment-related factors such as qualification, calibration,
maintenance and computer validation.
 policies and procedures to control actions and behaviours,
including data review procedures to verify adherence toprocedural requirements
 deviation management including root cause analysis,
impact assessments and CAPA trained and qualified personnel who understand theimportance of following established procedures anddocumenting their actions and decisions.
Together, these elements aim to ensure the accuracy of
information, including scientific data, that is used to makecritical decisions about the quality of products.

Complete

PI 041-1 (Draft 2)

All information that would be critical to recreating an event isimportant when trying to understand the event. The level ofdetail required for an information set to be considered complete
would depend on the criticality of the information. (see section
5.4 Data criticality). A complete record of data generated
electronically includes relevant metadata.

12 of 41

10 August 2016

ConsistentGood Documentation Practices should be applied throughout
any process, without exception, including deviations that may
occur during the process. This includes capturing all changes
made to data.

Enduring

Part of ensuring records are available is making sure they exist
for the entire period during which they might be needed. Thismeans they need to remain intact and accessible as anindelible/durable record.

Available

Records must be available for review at any time during therequired retention period, accessible in a readable format to allapplicable personnel who are responsible for their review
whether for routine release decisions, investigations, trending,annual reports, audits or inspections.

7.6

If these elements are appropriately applied to all applicable areas of GMP and
GDP-related activities, along with other supporting elements of a Pharmaceutical
Quality Management System, the reliability of the information used to make criticaldecisions regarding drug products should be adequately ensured.

8

SPECIFIC DI CONSIDERATIONS FOR PAPER-BASED SYSTEMS

8.1

Structure of quality management
forms/templates/records

8.1.1

The effective management of paper based documents is a key element of
GMP/GDP. Accordingly the documentation system should be designed to meet
GMP/GDP requirements and ensure that documents and records are effectively
controlled to maintain their integrity.

8.1.2

Paper records must be controlled and must remain attributable, legible,
indelible/durable, contemporaneous, original and accurate (ALCOA) throughout thedata lifecycle.

8.1.3

Procedures outlining good documentation practices and arrangements for
document control should be available within the QMS. These procedures should
specify:

PI 041-1 (Draft 2)

system(QMS)

andcontrol

of

blank



How master documents and procedures are created, reviewed andapproved for use;

Generation , distribution and control of templates used to record data
(master , logs, etc.);Retrieval and disaster recovery processes regarding records.

The process for generation of working copies of documents for routine
use, with specific emphasis on ensuring copies of documents, e.g. SOPs
and blank forms are issued and reconciled for use in a controlled andtraceable manner.



Guidance for the completion of paper based documents, specifying how
individual operators are identified, data entry formats and amendments to
documents are recorded.

How completed documents are routinely reviewed for accuracy,
authenticity and completeness;Processes for the filing, retrieval, retention, archival and disposal ofrecords.

13 of 41

10 August 2016



8.2

How data integrity is maintained throughout the lifecycle of the data.

Why is the control of records important?
Evidence of activities performed;

Evidence of compliance with GMP requirements and company policies,
procedures and work instructions;

Effectiveness of Pharmaceutical QMS;

Traceability;Process authenticity and consistency ;Evidence of the good quality attributes of the medicinal products
manufactured; and

In case of complaints, records could be used for investigational purposes.

8.3

Generation, distribution and control of template records

8.3.1

Why is managing and controlling master records necessary?
Managing and controlling master records is necessary to ensure that the risk of
someone inappropriately using and/or falsifying a record ‘by ordinary means’ (i.e.
not requiring the use of specialist fraud skills) is reduced to an acceptable level.
The following expectations should be implemented using a quality risk
management approach, considering the risk and criticality of data recorded (seesection 5.4, 5.5).

8.4

Expectations for the generation, distribution and control of records
Expectations

Potential risk of not meeting
expectations/items to be checked

Item:

Generation

1

All documents should have a unique
identification number (including theversion number) and should be checked,
approved, signed and dated.

Uncontrolled documents increase thepotential for omission or loss of critical dataas these documents may not be designed
to correctly record critical data.

The use of uncontrolled documents It may be easier to falsify uncontrolled
shouldbeprohibitedbylocal records.
procedures. The use of temporary
recording practices, e.g. scraps of paper Risk of using superseded forms if there isshould be prohibited.
no version control or controls for issuance.

2

The document design should provide Handwriting data may not be clear andsufficient space for manual data entries. legible if the spaces provided for data entry
are not sufficiently sized.
If additional pages of the documents areadded to allow complete documentation,
the number of, and reference to any pages
added should be clearly documented on
the main record page and signed.

PI 041-1 (Draft 2)

14 of 41

10 August 2016

3

The document design should make it Ambiguous instructions may lead toclear what data is to be provided in inconsistent/incorrect recording of data.
entries.
Ensures clear, contemporaneous andindelible/durable completion of entries.

4

Documents should be stored in a Inappropriate storage conditions can allow
manner which ensures appropriate unauthorised modification, use of expired
version control.
and/or draft documents or cause the lossof master documents.
Master copy (in soft copy) should be
prevented
fromunauthorisedor The processes of implementation and the
inadvertentchanges. effective communication are just as
important as the document.
E.g.: For the template records stored
electronically, the following precautions Master copies should contain distinctive
should be in place:marking so to distinguish the master from a- Access to master templates copy, e.g. use of colored papers or inks soshould be controlled;
as to prevent inadvertent use.
- process controls for creating andupdating versions should be
clear
and
practicallyapplied/verified;- master documents should be
stored in a manner which
prevents unauthorised changes;

Item:

Distribution and Control

1

Updated versions should be distributed There may be a risk that obsolete versions
in a timely manner.
can be used by mistake if available for use.
Obsolete master documents and files
should be archived and their access
restricted.

2

Any issued and unused physicaldocuments retrieved and destroyed
accordingly.
Issue should be controlled by written
procedures that include the following
controls:- using of a secure stamp, or paper color Without the use of security measures,code not available in the working areas there is a risk that rewriting or falsificationor
another
appropriate
system. of data may be made after photocopying or
scanning the template record (which gives- ensuring that only the current approved the user another template copy to use).
version is available for use.
Obsolete version can be used intentionally- allocating a unique identifier to each or by error.
blank document issued and recording
the issue of each document in a register. A filled record with an anomalous data
entry could be replaced by a new rewritten- numbering
every distributed template.
copy (e.g.: copy 2 of 2) andsequential numbering of issued All unused forms should be accounted for,and either defaced and destroyed, or
pages in bound books.
returned for secure filing.

PI 041-1 (Draft 2)

15 of 41

10 August 2016

-

Where the re-issue of additional
copies of the blank template isnecessary, a controlled process
regarding re-issue should be
followed. All distributed copies
should be maintained and ajustification and approval for theneed of an extra copy should berecorded, e.g.: “the original
template record was damaged”.

-

All issued records should bereconciled following use toensure the accuracy andcompleteness of records.

8.4.1

An index of all the template records should be maintained by QA organisation. This
index should mention for each type of template record at least the following
information: title, reference number including version number, location (e.g.,documentation data base, effective date, next review date, etc.

8.5

Use and control of records within production areas

8.5.1

Records should be appropriately controlled in the production areas by designatedpersons or processes. These controls should be carried out to minimize the risk ofdamage or loss of the records and ensure data integrity. Where necessary,measures must be taken to protect records from being soiled (e.g. getting wet or
stained by materials, etc).

8.6

Filling out records

8.6.1

The items listed in the table below should be controlled to assure that a record isproperly filled out.
Expectations

Specific elements that should bechecked / Potential risk of not meeting
expectations

Item Completion of records
1.

Handwritten entries must be made by the Check that handwriting is consistent for
person who executed the task.
entries made by the same person.
Unused, blank fields within documents
should be crossed-out, dated and signed.
Check the entry is legible and clear (i.e.
unambiguous; and does not include theHandwritten entries should be made in use of unknown symbols / abbreviation,clear and legible writing.
e.g. use of ditto (“) marks.
The completion of date fields should be
Check fordone in the format defined for the site. E.g.
recorded.
dd/mm/yyyy or mm/dd/yyyy.

completeness

of

data

Check correct pagination of the records
and are all pages present.

PI 041-1 (Draft 2)

16 of 41

10 August 2016

2.

Fillingout
operations
6
contemporaneous .

3.

Records should be indelible.

shouldbe Verify that records are available within
the immediate areas in which they areused, i.e Inspectors should expect thatsequential recording can be performed at
the site of operations. If the form is notavailable at the point of use, this will notallow operators to fill in records at thetime of occurrence.
Check that written entries are in ink,
which is not erasable and/or will not
smudge or fade (during the retention
period).
Check that the records were not filled out
using pencil prior to use of pen(overwriting).
Note that some paper printouts fromsystems may fade over time, e.g. thermal
paper.

4.

Records should be signed and dated using Check that there are signature anda unique identifier that is attributable to the initials logs, that are controlled andauthor.
current and that demonstrate the use of
unique examples, not just standardized
printed letters.
Ensure that all key entries are signed &dated, particularly if steps occur overtime, i.e. not just signed at the end of thepage and/or process.
The use of personal seals is generally
not encouraged; however, where used,
seals must be controlled for access.
There should be a log which clearlyshows traceability between an individual
and their personal seal. Use of personalseals must be dated (by the owner), tobe deemed acceptable.

6

The use of scribes to record activity on behalf of another operator should be considered ‘exceptional’, and only takeplace where:The act of recording places the product or activity at risk e.g. documenting line interventions by sterile
operators.
To accommodate cultural or staff literacy / language limitations, for instance where an activity is performedby an operator, but witnessed and recorded by a Supervisor or Officer.
In both situations, the supervisory recording must be contemporaneous with the task being performed, and must
identify both the person performing the observed task and the person completing the record. The person performing
the observed task should countersign the record wherever possible, although it is accepted that this countersigningstep will be retrospective. The process for supervisory (scribe) documentation completion should be described in an
approved procedure, which should also specify the activities to which the process applies.

PI 041-1 (Draft 2)

17 of 41

10 August 2016

8.7

Making corrections on records

Corrections to the records must be made in such way that full traceability is maintained.
Item How should records be corrected?
1.

Specific elements that should bechecked when reviewing records:

Cross out what is to be changed with a Check that the original data is readable
single line.
not obscured (e.g.: not obscured by useof liquid paper; overwriting is not
Where appropriate, the reason for the permitted)
correction must be clearly recorded andIf changes have been made to criticalverified if critical.
data entries, verify that a valid reason
for the change has been recorded andInitial and date the change made.
that supporting evidence for the change
is available.
Check for unexplained
entries in records

2.

Corrections must be made in indelible ink.

symbolsor

Check that written entries are in ink,
which is not erasable and/or will not
smudge or fade (during the retention
period).
Check that the records were not filled
out using pencil prior to use of pen(overwriting).

8.8

Verification of records (secondary checks)

Item When andrecords?
1.

whoshouldverifythe Specific elements that should bechecked when reviewing records:

A- Batch production records of critical Verify the process for the handling ofprocess steps should be:
production records within processing
areas to ensure they are readily- reviewed/witnessed by designated available to the correct personnel at thepersonnel(e.g.:
production time of performing the activity to which
supervisor) at the time of operations the record relates.
occurring; and- reviewed by an authorised person Verify that any secondary checks
within production before sending performed during processing were
performed by appropriately qualified andthem to the QC department; and- reviewed and approved by the independent personnel, e.g. production
Quality Assurance Unit (e.g. supervisor or QA.
Authorised Person / Qualified
Person)beforereleaseor Check that documents were reviewed
by production and then quality
distribution of the batch produced.
personnel following completion ofoperational activities.
B- Batch production records of non-criticalprocess steps is generally reviewed byproduction personnel according to an
approved procedure.
This verification must be conducted after
performing production-related tasks andPI 041-1 (Draft 2)

18 of 41

10 August 2016

activities. This verification must be signed or
initialed and dated by the appropriate
persons.
Local SOPs must be in place to describe
the process for review of written documents.
How should records be double checked? Specific elements that should bechecked when reviewing records:
2.

Check that all the fields have been
completed correctly using the current(approved) templates, and that the data
was critically compared to the acceptancecriteria.

Inspectors should review company
procedures for the review of manual
data to determine the adequacy ofprocesses.

Check that the secondary reviews ofCheck items 1, 2, 3, and 4 of section 8.5 data include a verification of any
and Items 1 and 2 of section 8.6.
calculations used.
View original data (where possible) to
confirmthat the correct data wastranscribed for the calculation.
8.9

Maintaining Records

Item How should records be maintained?
1.

Specific elements that should bechecked when reviewing records:

Companies should implement a defined Check if the records are stored in ansystem(s) for storage and recovery of orderly manner and are easily
records.
identifiable.
All records must be stored in the specified
location in a traceable and accessible
manner.
Systems should ensure that all GMP/GDP
relevant records are stored for periods that
7
meet GMP/GDP requirements .

2.

3

7

All records should be protected fromdamage or destruction by:- fire;- liquids (e.g. water, solvents andbuffer solution);- rodents;- hygrometry etc.
- unauthorised personnel access, who
may attempt to amend, destroy orreplace records

Check if there are systems in place toprotect records (e.g. pest control andsprinklers).

Strategy for disaster recovery

Check for system is in place for therecovery of records in a disastersituation

Note: Sprinkler systems can be
implemented provided that they aredesignedtoprevent
damagedocuments,
e.g.
documents
areprotected from water (e.g. by covering
them with plastic film).

Note that storage periods for some documents may be dictated by other local or national legislation.

PI 041-1 (Draft 2)

19 of 41

10 August 2016

8.10

Direct print-outs from electronic systems

8.10.1

Paper records generated by very simple electronic systems, e.g. balances, pH
meters or simple processing equipment which do not store data provide limited
opportunity to influence the presentation of data by (re-)processing, changing ofelectronic date/time stamps. In these circumstances, the original record should besigned and dated by the person generating the record and the original should be
attached to batch processing records.

8.11

True copies

8.11.1

Copies of original paper records (e.g. analytical summary reports, validation reportsetc.) are generally very useful for communication purposes, e.g. between
companies operating at different locations. These records must be controlledduring their life cycle to ensure that the data received from another site (sistercompany, contractor etc.) are maintained as “true copies” where appropriate, orused as a “summary report” where the requirements of a “true copy” are not met(e.g. summary of complex analytical data).

8.11.2

It is conceivable for raw data generated by electronic means to be retained in an
acceptable paper or pdf format, where it can be justified that a static record
maintains the integrity of the original data. However, the data retention process
must be shown to include verified copies of all raw data, metadata, relevant audit
trail and result files, software / system configuration settings specific to eachanalytical run, and all data processing runs (including methods and audit trails)
necessary for reconstruction of a given raw data set. It would also require adocumented means to verify that the printed records were an accurate
representation. This approach is likely to be onerous in its administration to enablea GMP compliant record.

8.11.3Many electronic records are important to retain in their dynamic (electronic) format,
to enable interaction with the data. Data must be retained in a dynamic form where
this is critical to its integrity or later verification. This should be justified based on
risk.

8.11.4At the receiving site, these records (true copies) may either be managed in a paperor electronic format (e.g., PDF) and should be controlled according to an approved
QA procedure.

8.11.5Care should be taken to ensure that documents are appropriately authenticated as“true copies” either through the use of handwritten or digital signatures.

Item

How should the “true copy” be issued
and controlled?

Specific elements that should bechecked when reviewing records:

1.

Creating a “true copy” of a paper document.
At the company who issues the true copy:- Obtain the original of the document
to be copied- Photocopy the original document
ensuring that no information fromthe original copy is lost;- Verify the authenticity of the copied
document and sign and date the
new hardcopy as a “true copy”;

Verify the procedure for the generationof true copies.

The “True Copy” may now be sent to theintended recipient.

Check that true copies issued are
identical (complete and accurate) tooriginal records. Copied records should
be checked against the original
document records to make sure there isno tampering of the scanned image.
Check that scanned or saved records
are protected to ensure data integrity.

After scanning paper records andCreating a “true copy” of a electronic verifying creation of a ‘true copy’, it may
document.
be possible to permit destruction of theA ‘true copy’ of an electronic record should original documents from which the

PI 041-1 (Draft 2)

20 of 41

10 August 2016

be created by electronic means scanned images have been created.
(electronic file copy), including all required There should be a documented
metadata. Creating pdf versions of approval process for this destruction.
electronic data should be discouraged, as
this is equivalent to a printout from theelectronic system, which risks loss of
metadata.
The “True Copy” may now be sent to theintended recipient.
A distribution list of all issued “true copies”(soft/hard) should be maintained.
2.

At the company who receives the true copy:- The paper version, scanned copy
or electronic file should be reviewed
and filed according to good
document management processes.
The document should clearly indicate that it
is a true copy and not an original record.

Check that received records arechecked and retained appropriately.
A system should be in place to verify
the authenticity of “true copies” e.g.
through verification of the correct
signatories.

8.11.6

A quality agreement should be in place to address the responsibilities for thegeneration and transfer of “true copies” and data integrity controls. The system forthe issuance and control of “true copies” should be audited by the contract giverand receiver to ensure the process is robust and meets data integrity principles.

8.12

Limitations of remote review of summary reports

8.12.1

The remote review of data within summary reports is a common necessity;
however, the limitations of remote data review must be fully understood to enable
adequate control of data integrity.

8.12.2

Summary reports of data are often supplied between physically remotemanufacturing sites, Market Authorisation Holders and other interested parties.
However, it must be acknowledged that summary reports are essentially limited intheir nature, in that critical supporting data and metadata is often not included andtherefore original data cannot be reviewed.

8.12.3

It is therefore essential that summary reports are viewed as but one element of theprocess for the transfer of data and that interested parties and inspectorates do notplace sole reliance on summary report data.

8.12.4

Prior to acceptance of summary data, an evaluation of the supplier’s quality systemand compliance with data integrity principles should be established through on-site
inspection when considered important in the context of quality risk management.
The inspection should ensure the veracity of data generated by the company, andinclude a review of the mechanisms used to generate and distribute summary data
and reports.

8.13

Document retention (Identifying record retention requirements and archiving
records)

8.13.1

The retention period of each type of records should (at a minimum) meet those
periods specified by GMP/GDP requirements. Consideration should be given toother local or national legislation that may stipulate longer storage periods.

8.13.2

The records can be retained internally or by using an outside storage service
subject to quality agreements. A risk assessment should be available to

PI 041-1 (Draft 2)

21 of 41

10 August 2016

demonstrate retention systems/facilities/services are suitable and that the residual
risks are understood.
Item Where and how
archived?
1.

should records be Specific elements that should bechecked when reviewing records:

A system should be in place describing thedifferent steps for archiving records(identification of archive boxes, list ofrecords by box, retention period, archiving
location etc.).

Check that the system implemented for
retrieving archived records is effective
and traceable.
Check that access to archived
documents is restricted to authorised
personnel ensuring integrity of thestored records.
The storage methods used should
permit efficient retrieval of documents
when required.

2

All hardcopy quality records should bearchived in:- secure locations to prevent damage
or loss;- such a manner that it is easy
retrievable.
- Ensure that records are likely
durable for their archived life

Check for the outsourced archived
operations if there is a quality
agreement in place and if the storage
location was audited.
Ensure there is some assessment of
ensuring that documents will still belegible/available for the entire archival
period.
Check that access to archived
documents is restricted to authorised
personnel ensuring integrity if the stored
records.
The storage methods used should
permit efficient retrieval of documents
when required.

8.14

Disposal of original records

8.14.1

A documented process for the disposal of records should be in place to ensure thatthe correct original records are disposed of after the defined retention period. The
system should ensure that current records are not destroyed by accident and that
historical records do not inadvertently make their way back into the current record
stream (eg. Historical records confused/mixed with existing records.)

8.14.2

A record/register should be available to demonstrate appropriate and timely
destruction of retired records.

8.14.3

Measures should be in place to reduce the risk of deleting the wrong documents.
The access rights allowing deletion of records should be limited to few persons.

8.14.4

In case of printouts which are not permanent (e.g. thermo transfer paper) a verified(‘true’) copy may retained, and it is possible to discard the non- permanent original

8.14.5Paper records may be replaced by Scans provided that the principles of ‘true copy’are addressed (see section 8.11.5)

PI 041-1 (Draft 2)

22 of 41

10 August 2016

9

SPECIFIC DATA INTEGRITYSYSTEMSCONSIDERATIONS FOR

9.1

Structure of the QMS and control of computerised systems

9.1.1

A large variety of computerised systems are used by companies to assist in asignificant number of operational activities. These range from the simple
standalone to large integrated and complex systems, many of which have an
impact on the quality of products manufactured. It is the responsibility of eachregulated entity to fully evaluate and control all computerised systems and manage
89them in accordance with GMP and GDP requirements.

9.1.2

Organisations should be fully aware of the nature and extent of computerised
systems utilised, and assessments should be in place that describe each system,
its intended use and function, and any data integrity risks or vulnerabilities that may
be susceptible to manipulation. Particular emphasis should be placed ondetermining the criticality of computerised systems and any associated data, inrespect of product quality.

9.1.3

All computerised systems with potential for impact on product quality should be
effectively managed under a mature quality management system which is designed
to ensure that systems are protected from acts of accidental or deliberate
manipulation, modification or any other activity that may impact on data integrity.

9.1.4

When determining data vulnerability and risk, it is important that the computerised
system is considered in the context of its use within the business process. For
example, data integrity of an analytical method with computerised interface isaffected by sample preparation, entry of sample weights into the computerised
system, use of the computerised system to generate data, and processing /recording of the final result using that data.

9.1.5

The guidance herein is intended to provide specific considerations for data integrityin the context of computerised systems. Further guidance regarding good practices
for computerised systems may be found in the PIC/S Good Practices for
Computerised Systems in Regulated “GxP” Environments (PI 011).

9.2

Qualification and validation of computerised systems

9.2.1

The qualification and validation of computerised systems should be performed inaccordance with the relevant GMP/GDP guidelines; the tables below provide
clarification regarding specific expectations for ensuring good data governancepractices for computerised systems.
Expectations

COMPUTERISED

Potential risk of not meeting
expectations/items to be checked

Item:

Validation Documentation

1

Regulated users should have an Companies that do not have adequate
inventory of all computerised systems in visibility of all computerised systems inuse. This list should include reference to: place may overlook the criticality of- The name, location and primary systems
and
may
thus
createfunction of each computerised vulnerabilities within the data lifecycle.
system;- Assessments of the function and An inventory list serves to clearly
criticality of the system and communicate all systems in place and their

8

PIC/S PE 009 Guide to Good Manufacting Practice for Medicinal Products, specifically Part I chapters 4, Part II
chapters 5, & Annex 11
9
PIC/S PE 011 GDP Guide to Good Distribution Practice for Medicinal Products, specifically section 3.5 XXX

PI 041-1 (Draft 2)

23 of 41

10 August 2016

-

associated data; (e.g. direct criticality, ensuring that any changes or
GMP/GDPimpact,indirect modifications to these systems are
impact, none)
controlled.
The current validation status ofeach system and reference toexisting validation documents.

Risk assessments should be in place foreach system, specifically assessing thenecessary controls to ensure data
integrity. The level and extent ofvalidation for data integrity should bedetermined based on the criticality of thesystem and process and potential risk to
product quality,e.g. processes orsystems that generate or control batch
release data would generally require
greater control than those systems
managing less critical data or processes.

Verify that risk assessments are in place
for critical processing equipment and dataacquisition systems. A lack of thoroughassessment of system impact may lead toa lack of appropriate validation and system
control. Examples of critical systems toreview include:-

Consideration should also be given to
those systems with higher potential fordisaster, malfunction or situations inwhich the system becomes inoperative.
Assessments should also review thevulnerability of the system to inadvertentor unauthorised changes to criticalconfiguration settings or manipulation ofdata. All controls should be documented
and their effectiveness verified.
2

A Validation Summary Report for eachcomputerised system written by the
Quality Unit should be in place and state
at least the following items:
-

-

-

-

PI 041-1 (Draft 2)

Critical system configuration
detailsandcontrolsforrestricting
accesstoconfiguration and any changes(change control).
A list of currently approved
users,
specifying the usersname and surname, and any
specific usernames.
Identity and permitted activities(privileges) for each user of thesystem.
Identity and role of the System
Administrator.
Frequency of review of audit
trails and system logs.
Procedures for:o how a new system useris created;o the process for themodification (change ofprivileges)
foranexisting user;

24 of 41---

Systems used to control thepurchasing and status of products
and materials;
Systems for the control and dataacquisition
forcriticalmanufacturing processes;
Systems that generate, store orprocess data that is used todetermine batch quality;
Systems that generate data that isincluded in the Batch processing or
packaging records;
Systems used in the decision
process for the release of
products.

Check that validation systems and reports
specificallyaddress
data
integrity
requirements
following
GMP/GDPrequirements and considering ALCOA
principles.
System configuration and segregation ofduties (e.g. authorisation to generate data
should be separate to authorisation to
verify data) should be defined prior tovalidation, and verified as effective during
testing.
Check the procedures for system access toensure modifications or changes tosystems are restricted and subject tochange control management.
Ensure that system administrator access is
restricted to authorised persons and is not
used for routine operations.
Check the procedures for granting,modifying and removing access tocomputerised systems to ensure these
activities are controlled. Check thecurrency of user access logs and privilege
levels, there should be no unauthorised
10 August 2016

o

-

3

the process of deleting users to the system and access accounts
users;
should be kept up to date. There shouldo arrangements for back- also be restrictions to prevent users fromup and frequency;
amending audit trail functions.
o A description of therecovery process incase of an incident;o Processandresponsibilities for dataarchiving;o Approved locations fordata storage.
It should be clearly stated thatthe original data are retainedwith relevant metadata in a form
that permits the reconstructionof the manufacturing process or
the analytical activity.

Companies should have a Validation
Master Plan in place that includes
specific
policiesandvalidation
requirements for computerised systems
and the integrity of such systems andassociated data.
The extent of validation for computerised
systems should be determined based on
risk.
Furtherguidance
regardingassessing validation requirements forcomputerised systems may be found in
PI 011.
Before a system is put into routine use, it
should be challenged with defined tests
for conformance with the acceptancecriteria.

Check that validation documents include
specific provisions for data integrity;
validation reports should specificallyaddress data integrity principles anddemonstrate through design and testingthat adequate controls are in place.
Unvalidated systems may present asignificant vulnerability regarding data
integrity as user access and system
configuration may allow data amendment.
Check that end-user testing includes testscripts designed to demonstrate thatsoftware not only meets the requirementsof the vendor, but is fit for its intended use.

It would be normally expected that aprospective validation for computerised
systems is conducted; however, forsystems already installed, it may be
acceptable to perform retrospective
validation based on an assessment of all
historical records for the existing
computerised system.
In case of a retrospective qualification, adocumented evaluation of system history
i.e. error logs, changes made, evaluationof user manuals and SOPs would be
expected to have taken place.
IT validation should be designed
according to GMP Annex 15 with URS,
PI 041-1 (Draft 2)

25 of 41

10 August 2016

FAT, SAT, IQ, OQ and PQ tests.
Qualification testing includes Design
Qualification(DQ);
Installation
qualification(IQ);
Operational
Qualification (OQ); and Performance
Qualification (PQ). In particular, specifictests should be designed in order tochallenge those areas where data
integrity is at risk.
Companies
shouldensurethatcomputerised systems are qualified fortheir intended use. Companies should
therefore not place sole reliance onvendor qualification packages; validation
exercises should include specific tests toensure data integrity is maintained
during operations that reflect normal andintended use.
The number of tests should be guided bya risk assessment but the critical
functionalities should be at least
identified and tested, e.g., certain PLCs
and systems based on basic algorithms
or logic sets, the functional testing may
provide adequate assurance of reliabilityof the computerised system. For critical
and/or more complex systems, detailed
verification testing is required during IQ,
OQ & PQ stages.
4

Check that re-validation reviews forcomputerised systems are outlined within
Computerised systems should be validation schedules.
evaluated periodically in order to confirm
they maintain the validated status and Verify that systems have been subject toperiodic review, particularly with respect toare GMP compliant. The evaluation
any potential vulnerabilities regarding data
should include deviations, changes, integrity.
upgrade history, performance andmaintenance.
Any issues identified, such as limitations ofcurrent software/hardware should be
addressed in a timely manner andcorrective and preventative actions, andThe frequency of the re-evaluation interim controls should be available andshould be based on a risk assessment implemented to manage any identified
depending on the criticality of the risks.
computerised systems. The assessment
performed should be documented.
Periodic Evaluation

PI 041-1 (Draft 2)

26 of 41

10 August 2016

Item:

Data transfer between systems

1

Interfaces should be assessed andaddressed during validation to ensure
the correct and complete transfer ofdata.

Interfaces between computerised systems
present a risk whereby data may be
inadvertently lost, amended transcripted
incorrectly during the transfer process.

2

Where system software is installed or
updated, the user should ensure thatarchived data can be read by the newsoftware. Where necessary this may
require conversion of existing archived
data to the new format.

It is important that data is readable in its
original form throughout the data lifecycle,
and therefore users must maintain both thereadability of data and access tosuperseded software.

Where conversion to the new data
format of the new software is notpossible, the old software should bemaintained installed in one PC and alsoavailable as a hard copy (e.g. installationCD) in order to have the opportunity toread the archived data in case of aninvestigation.

9.3

System security for computerised systems
Expectations

Potential risk of not meeting
expectations / items to be checked

Item:

System security

1

User access controls, both physical andelectronic, shall be configured andenforced to prohibit unauthorised accessto, changes to and deletion of data. For
example:--PI 041-1 (Draft 2)

Check that the company has taken all
reasonable steps to ensure that thecomputerised system in use is secured,andprotected
fromdeliberateorinadvertent changes.

Systems that are not physically andIndividual
Login
IDs
and administratively secured are vulnerable topasswords should be set up and data integrity issues. Inspectorates should
assigned for all staff needing to verify that verified procedures exist thataccess and utilise the specific manage system security, ensuring thatelectronic system. Shared login computerised systems are maintained incredentials do not allow for their validated state and protected fromtraceability to the individual who manipulation.
performed the activity. For thisreason, shared passwords, even Itisacknowledged
that
some
for reasons of financial savings, computerised systems support only amust be prohibited.
single user login or limited numbers of user
Input of data and changes to logins. Where no suitable alternative
computerised records must be computerised
systemisavailable,
madeonly by authorised equivalent control may be provided by third
personnel. Companies should party software, or a paper based method of
maintain a list of authorised providing traceability (with version control).
individuals and their access27 of 41

10 August 2016

-

-

-

-

2

privileges for each electronicsystem in use.
Administrator
accesstocomputer systems used to run
applications
shouldbecontrolled. General users should
not have access to criticalaspects of the software, e.g.
system clocks, file deletionfunctions, etc.
System administrators should
normally be independent fromusers performing the task, andhave no involvement or interestin the outcome of the data
generated or available in theelectronic system. For example,
QC supervisors and managers
should not be assigned as thesystemadministratorsforelectronic systems in theirlaboratories (e.g., HPLC, GC,
UV-Vis). Typically, individuals
outside of the quality andproduction organisations (e.g.,
Information
Technology
administrators) should serve as
the system administrators andhave
enhancedpermission
levels.
For smaller organisations, it may
be permissable for a nominatedperson to hold access as thesystem administrator; however,in these cases the administrator
access should not be used for
performing routine operations
and the user should hold asecond and restricted access for
performing routine operations.
Any request for new users, newprivileges of users should be
forwarded to the IT administrator
in a tracebeable way inaccordance with a standard
procedure.

The suitability of alternative systems
should be justified
and documented.
Increased data review is likely to berequired for hybrid systems.

Computerised
systemsmust
beprotected from accidental changes ordeliberate manipulation. Companies
should assess systems and their design
to prevent unauthorised changes tovalidated settings that may ultimately
affect data integrity. Consideration
should be given to:- Thephysicalsecurityofcomputerised system hardware:o Location of and accessto servers;o Restricting access to

PI 041-1 (Draft 2)

28 of 41

10 August 2016

--

PLC nodules, e.g. bylocking access panels.
Vulnerabilityof
networked
systems from local and external
attack;Remote network updates, e.g.
automated
updatingof
networked systems by thevendor.

3

Electronic signatures used in the placeof handwritten signatures must haveappropriate controls to ensure theirauthenticity and traceability to thespecific person who electronically signed
the record(s).

Check that electronic signatures areappropriately validated, their issue to staff
is controlled and that at all times, electronic
signatures are readily attributable to anindividual.
Any changes to data after an electronic
signature has been assigned should
The use of advanced forms of electronic invalidate the signature until the data has
signatures is becoming more common, been reviewed again and re-signed.
e.g., the use of biometrics is becoming
more prevalent by firms. The use ofadvanced forms of electronic signatures
should be encouraged.

9.4

Audit trails for computerised systems
Expectations

Potential risk of not meeting
expectations / items to be checked

Item:

Audit Trails

1

documentation
shouldCompanies
shouldendeavorto Validation
demonstrate
that
audit
trailsarefunctional,
purchase and upgrade software that
includeselectronic
audit
trail and that all activities, changes and othertransactions within the systems arefunctionality.
recorded, together with all metadata.
Where available, audit trail functionalities
for electronic-based systems should be
configured properly to capture generalsystem events as well as any activities
relating to the acquisition, deletion,
overwriting of and changes to data foraudit purposes.
It is acknowledged that some simple
systems lack appropriate audit trails;
however, alternative arrangements toverify the veracity of data must be
implemented,
e.g.
administrative
procedures, secondary checks andcontrols.

Verify that audit trails are regularly
reviewed (in accordance with quality risk
management
principles)andthatdiscrepancies are investigated.
If no electronic audit trail system exists a
paper based record to demonstratechanges to data may be acceptable until afully audit trailed (integrated system or
independent audit software using avalidated interface) system becomes
available. These hybrid systems are
permitted, where they achieve equivalence
to integrated audit trail, such as describedin Annex 11 of the PIC/S GMP Guide.

Failure to adequately review audit trails
Audit trails should be verified during may allow manipulated or erroneous data
to be inadvertently accepted by the Quality
validation of the system.
Unit and/or Authorised Person.
Audit

PI 041-1 (Draft 2)

trail

functionalities

must

be

29 of 41

10 August 2016

enabled and locked at all times. For
example, an individual involved in the
input of and changes to HPLC data must
not have access to enable and disable
the audit trail as they desire.
Companies
shouldimplement
procedures that outline their policy andprocesses for the review of audit trails inaccordance with risk management
principles. Audit trails related to the
production of each batch should be
independently reviewed with all otherrecords related to the batch and prior to
the batch’s release, so as to ensure thatcritical data and changes to it are
acceptable. This review should be
performed by the originating department,
and where necessary verified by thequality unit, e.g. during self-inspection or
investigative activities.

2

The company’s quality unit should
establish a program and schedule toconduct ongoing reviews of audit trails
based upon their criticality and thesystem’s complexity.

Verify that self-inspection programs
incorporate both random and targeted
checks of audit trails, with the intent toverify the effectiveness of existing controls
and compliance with internal procedures
regarding the review of data.

Procedures should be in place toaddress and investigate any audit trail
discrepancies,
includingescalation
processes for the notification of senior
management and national authorities
where necessary.
9.5

Data capture/entry for computerised systems
Expectations

Potential risk of not meeting
expectations / items to be checked

Item:

Data capture/entry

1

Systems should be designed for the Ensure that manual entries made into
correct capture of data whether acquired computerised systems are subject to an
through manual or automated means.
appropriate secondary check.
For manual entry:- The entry of data should only bemade by authorised individuals
and the system should record
details of the entry, theindividual making the entry andwhen the entry was made.
- Data should be entered in a
specifiedformatthatiscontrolled by the software,
validation activities should verify
that invalid data formats are not

PI 041-1 (Draft 2)

30 of 41

Validation records should be reviewed forsystems using automated data capture toensure that data verification and integrity
measures are implemented and effective.

10 August 2016

--

accepted by the system.
All manual data entries shouldbe verified, either by a second
operator, or by a validated
computerised means.
Changes to entries should be
captured in the audit trail andreviewed by an appropriately
authorised and independent
person.

For automated data capture:-2

The interface between theoriginating
system,dataacquisition
andrecordingsystems should be validated toensure the accuracy of data.
- Data captured by the systemshould be saved into memory ina format that is not vulnerable tomanipulation, loss or change.
- The system software shouldincorporate validated checks toensure the completeness of dataacquired, as well as any
metadata associated with thedata.
Any necessary changes to data must be Verify that appropriate procedures exist toauthorised and controlled in accordance control any amendments or re-processing
with approved procedures.
of data. Evidence should demonstrate an
appropriate process of formal approval for
For example, manual integrations and the
proposedchange,reprocessing of laboratory results must controlled/restricted/defined changes andbe performed in an approved and formal review of the changes made.
controlled manner. The firm’s quality
unit must establish measures that
ensure that changes to data are
performed only when necessary and by
designated individuals.
Any and all changes and modifications
to original data must be fully
documented and should be reviewed
and approved by at least one
appropriately trained and qualified
individual.

PI 041-1 (Draft 2)

31 of 41

10 August 2016

9.6

Review of data within computerised systems
Expectations

Potential risk of not meeting
expectations / items to be checked

Item:

Review of electronic data

1

The regulated user should perform a risk
assessment in order to identify all the
GMP/GDP relevant electronic data
generated by the computerised systems.
Once identified, this critical data should
be audited by the regulated user andverified to determine that operations
were performed correctly and whether
any change (modification, deletion or
overwriting) have been made to original
information in electronic records. Allchanges must be duly authorised.

Check local procedures to ensure thatelectronica data is reviewed based on its
criticality (impact to product quality and/or
decision making). Evidence of each review
should be recorded and available to theinspector.
Where data summaries are used forinternal or external reporting, evidence
should be available to demonstrate thatsuch summaries have been verified inaccordance with raw data.

The review of data-related audit trails
should be part of the routine data review
within the approval process.
Audit trails records should be in an
intelligible form and have at least thefollowing information:-

Name of the person who madethe change to the data;
Description of the change;
Time and date of the change;
Justification for the change;
Name of any person authorising
the change.

The frequency, roles and responsibilities
of audit trails review should be based ona risk assessment according to the
GMP/GDP relevant value of the data
recorded in the computerised system.
For example, for changes of electronic
data that can have a direct impact on thequality of the medicinal products, itwould be expected to review at each andevery time the data is generated.
The regulated user should establish a
SOP that describes in detail how toreview audit trails. The procedure should
determine in detail the process that theperson in charge for the audit trail review
should follow. The audit trail activity
should be documented and recorded.

PI 041-1 (Draft 2)

32 of 41

10 August 2016

The records should be maintained
together with the other GMP/GDP
relevant documents.
Any significant variation from theexpected outcome found during the audit
trail review should be fully investigatedand recorded. A procedure should
describe the actions to be taken if a
review of audit trails identifies serious
issues that can impact the quality of the
medicinal products.
The company’s Quality Unit (QU) should
also review a sample of the audit trails
records during the routine selfinspection.

9.7

Storage, archival and disposal of electronica data
Expectations

Potential risk of not meeting
expectations / items to be checked

Item:

Storage, archival and disposal of electronica data

1

Storage of data must include the entire
original data and metadata, including
audit trails, using a secure and validated
process.

Check that data storage, back up andarchival systems are designed to capture
all data and metadata. There should be
documented evidence that these systems
have been validated and verified.

If the data is backed up, or copies of it
are made, then the backup and copies
must also have the same appropriate
levels of controls so as to prohibit
unauthorised access to, changes to anddeletion of data or their alteration. For
example, a firm that backs up data onto
portable hard drives must prohibit theability to delete data from the hard drive.
Some additional considerations for the
storage and backup of data include:--

PI 041-1 (Draft 2)

True
copiesofdynamic
electronic records can be made,with the expectation that theentire content (i.e., all data andmetadata is included) andmeaning of the original records
are preserved.
Suitable software and hardware
needs to be readily available foraccessing data backups or
copies.

33 of 41

10 August 2016

--

Routine backup copies should
be stored in a remote location(physically separated) in theevent of disasters.
Back-updata
shouldbereadable for all the period of thedefinedregulatory retention
period, even if a new version of
the software has been updated
or substituted for one with better
performance.

2

The record retention procedures must
include provisions for retaining themetadata. This allows for future queries
or investigations to reconstruct theactivities that occurred related to abatch.

3

Data should be archived periodically in There is a risk with archived data that
accordance with written procedures. access and readability of the data may be
Archive copies should be physically lost due to software application updates orsuperseded equipment. Verify that the
secured in a separate and remotecompany has access to archived data, andlocation from where back up data are that they maintain access to the necessary
stored.
software to enable review of the archived
data.
The data should be accessible andreadable and its integrity maintained for Where external or third party facilities are
utilised for the archiving of data, these
all the period of archiving.
service providers should be subject toThere should be in place a procedure for assessment, and all responsibilities
restoring archived data in case an recorded in a quality technical agreement.
investigation is needed. The procedure Check agreements and assessment
records to verify that due consideration has
in place for restoring archived data
been given to ensuring the integrity ofshould be regularly tested.
archived records.
If a facility is needed for the archiving
process then specific enviromental
controls and only authorised personnel
access should be implemented in orderto ensure the protection of records fromdeliberate or inadvertent alteration or
loss. When a system in the facility has
to be retired because problems with longterm access to data are envisaged,
procedures should assure the continued
readability of the data archived. For
example, it could be established totransfer the data to another system.

4

It should be possible to print out a legible Check validation documentation forand meaningful record of all the data systems to ensure that systems have been
generated by a computerised system validated for the generation of legible andcomplete records.

PI 041-1 (Draft 2)

34 of 41

10 August 2016

(including metadata).
Samples of print-outs may be verified.
If a change is performed to records, it
should be possible to also print out thechange of the record, indicating whenand how the original data was changed.
5

Procedures should be in place that
describe the process for the disposal ofelectronicallystoreddata.
These
procedures should provide guidance forthe assessment of data and allocation ofretention periods, and describe themanner in which data that is no longer
required is disposed of.

Check that the procedures clearly stipulate
the conditions for the disposal of data, andthat care is taken to avoid the inadvertent
disposal of required data during its
lifecycle.

10

DATA INTEGRITY CONSIDERATIONS FOR OUTSOURCED ACTIVITIES

10.1

General supply chain considerations

10.1.1

Data integrity plays a key part in ensuring the security and integrity of supply
chains. Data governance measures by a contract giver may be significantly
weakened by unreliable or falsified data or materials provided by supply chain
partners. This principle applies to all outsourced activities, including suppliers of
raw materials or contract manufacture / analytical services.

10.1.2

Initial and periodic re-qualification of supply chain partners and outsourced
activities should include consideration of data integrity risks and appropriate control
measures.

10.1.3

It is important for an organisation to understand the data integrity limitations of
information obtained from the supply chain (e.g. summary records and copies /printouts), and the challenges of remote supervision. These limitations are similar
to those discused in section 8.11 of this guidance This will help to focus resources
towards data integrity verification and supervision using a qualiity risk management
approach.

10.2

Routine document verification
The supply chain relies upon the use of documentation and data passed from one
organisation to another. It is often not practical for the contract giver to review allraw data relating to reported results. Emphasis should be placed upon robust
supplier and contractor qualification, using the principles of quality risk
management.

10.3

Strategies for assessing data integrity in the supply chain

10.3.1Companies should conduct regular risk reviews of supply chains and outsourced
activity that evaluate the extent of data integrity controls required. Informationconsidered during risk reviews may include:The outcome of site audits, with focus on data governance measures



Review of data submitted in routine reports, for example:

PI 041-1 (Draft 2)

35 of 41

10 August 2016

Area for review

Rationale

Comparison of analytical data reported by thecontractor or supplier vs in-house data fromanalysis of the same material

To look for discrepant data which may be anindicator of falsification

10.3.2

Quality agreements should be in place in place between manufacturers andsuppliers/contract manufacturing organisations (CMOs) with specific provisions for
ensuring data integrity across the supply chain. This may be achieved by settingout expectations for data governance, and transparent error/deviation reporting by
the contract acceptor to the contract giver. There should also be a requirement to
notify the contract giver of any data integrity failures identified at the contract
acceptor site.

10.3.3

Audits of suppliers and manufacturers of APIs, critical intermediate suppliers andservice providers conducted by the manufacturer (or by a third party on theirbehalf) should include a verification of data integrity measures at the contractorganisation.

10.3.4

Audits and routine surveillance should include adequate verification of the source
electronic data and metadata by the Quality Unit of the contract giver using aquality risk management approach. This may be achieved by measures such as:

Site audit

Review the contract acceptors organisational behaviour, andunderstanding of data governance, data lifecycle, risk andcriticality.

Material testing vs CoA

Compare the results of analytical testing vs suppliers reported
CoA. Examine discrepancies in accuracy, precision or purity
results. This may be performed on a routine basis, periodically,or unannounced, depending on material and supplier risks.

Remote data review

The contract giver may consider offering the Contracted
Facility/Supplier use of their own hardware and software system(deployed over a Wide Area Network) to use in batch
manufacture and testing. The contract giver may monitor thequality and integrity of the data generated by the Contracted
Facility personnel in real time.
In this situation, there should be segregation of duties to ensurethat contract giver monitoring of data does not give provision for
amendment of data generated by the contract acceptor.

Quality monitoring

Quality and performance monitoring may indicate incentive fordata falsification (e.g. raw materials which marginally comply withspecification on a frequent basis.

10.3.5Contract givers may work with the contract acceptor to ensure that all clientconfidential information is encoded to de-identify clients. This would facilitate
review of source electronic data and metadata at the contract giver’s site, without
breaking confidentiality obligations to other clients. By reviewing a larger data set,
this enables a more robust assessment of the contract givers data governancemeasures. It also permits a search for indicators of data integrity failure, such as
repeated data sets or data which does not demonstrate the expected variability.

10.3.6

Care should be taken to ensure the authenticity and accuracy of supplied
documentation, (refer section 8.11). The difference in data integrity and traceability
risks between ‘true copy’ and ‘summary report’ data should be considered when
making contractor and supply chain qualification decisions.

PI 041-1 (Draft 2)

36 of 41

10 August 2016

11

REGULATORY ACTIONS IN RESPONSE TO DATA INTEGRITY FINDINGS

11.1

Deficiency references

11.1.1

The integrity of data is fundamental to good manufacturing practice and therequirements for good data management are embedded in the current PIC/S
Guides to GMP/GDP for Medicinal products. The following table provides areference point highlighting some of these existing requirements.

ALCOA principle

PIC/S Guide
to Good
Manufacturing
Practice for
Medicinal
products,
PE009 (Part I):

PIC/S Guide
to Good
Manufacturing
Practice for
Medicinal
products,
PE009 (PartII):

Annex 11
(Computerised
Systems)

PIC/S Guide toGood
Distribution
Practice for
Medicinal
products,
PE011:

Attributable[4.20, c & f],[4.21, c & i],[4.29, e][6.14], [6.18],[6.52][2], [12.4], [15][4.2.4], [4.2.5]

Legible[4.1], [4.2],[4.7], [4.8],[4.9], [4.10][5.43] [6.11],[6.14], [6.15],[6.50][7.1], [9], [10],[17][4.2.3], [4.2.9]

Contemporaneous[4.8][6.14][12.4], [14][4.1], [4.2.9]

Original[4.9], [4.27],[Paragraph"Record"][6.14], [6.15],[6.16][8.2], [9][4.2.5]

Accurate[4.1], [6.17][5.40], [5.45],[6.6][Paragraph"Principles"] [5],[6], [10], [11][4.2.3]

11.2

Classification of deficiencies

Note: The following guidance is intended to aid consistency in reporting andclassification of data integrity deficiencies, and is not intended to affect the inspecting
authority’s ability to act according to national legal frameworks.
11.2.1

Deficiencies relating to data integrity failure may have varying impact to productquality. Prevalence of the failure may also vary between the action of a single
employee to an endemic failure throughout the inspected organisation.

11.2.2The draft PIC/S guidance

10

on classification of deficiencies states:“A critical deficiency is a practice or process that has produced, or leads to a significant risk of
producing either a product which is harmful to the human or veterinary patient or a productwhich could result in a harmful residue in a food producing animal. A critical deficiency also
occurs when it is observed that the manufacturer has engaged in fraud, misrepresentation or
falsification of products or data”.
11.2.3

Notwithstanding the “critical” classification of deficiencies relating to fraud,
misrepresentation or falsification, it is understood that data integrity deficiencies
can also relate to:10Data integrity failure resulting from bad practice,This draft guidance has not been published yet.

PI 041-1 (Draft 2)

37 of 41

10 August 2016

11.2.4

Opportunity for failure (without evidence of actual failure) due to absenceof the required data control measures.

In these cases, it may be appropriate to assign classification of deficiencies bytaking into account the following (indicative list only):

Impact to product with risk to patient health: Critical deficiency:Product failing to meet specification at release or within shelf life.

Reporting of a ‘desired’ result rather than an actual out of specification
result when reporting of QC tests, critical product or process parameters.

Impact to product with no risk to patient health: Major deficiency:Data being miss-reported, e.g. original results ‘in specification’, butaltered to give a more favourable trend.

Reporting of a ‘desired’ result rather than an actual out of specification
result when reporting of data which does not relate to QC tests, criticalproduct or process parameters.



Failures arising from poorly designed data capture systems (e.g. using
scraps of paper to record info for later transcription).

No impact to product; evidence of widespread failure: Major deficiency:

Bad practices and poorly designed systems which may result inopportunities for data integrity issues or loss of traceability across anumber of functional areas (QA, production, QC etc). Each in its own
right has no direct impact to product quality.

No impact to product; limited evidence of failure: Other deficiency:

Bad practice or poorly designed system which result in opportunities fordata integrity issues or loss of traceability in a discrete area.



Limited failure in an otherwise acceptable system.

11.2.5

It is important to build an overall picture of the adequacy of the key elements (datagovernance process, design of systems to facilitate compliant data recording, useand verification of audit trails and IT user access etc.) to make a robust
assessment as to whether there is a company-wide failure, or a deficiency oflimited scope/ impact.

11.2.6

Individual circumstances (exacerbating / mitigating factors) may also affect finalclassification or regulatory action. Further guidance on the classification of
deficiencies and intra-authority reporting of compliance issues will be available in
the PIC/S guidance on the classification of deficiencies, once it has been
published.

12

REMEDIATION OF DATA INTEGRITY FAILURES

12.1

Responding to Significant Data Integrity issues

12.1.1

Consideration should be primarily given to resolving the immediate issues identified
and assessing the risks associated with the data integrity issues. The response by
the company in question should outline the actions taken. Responses should
include:12.1.1.1 A comprehensive investigation into the extent of the inaccuracies in data records
and reporting, to include:
PI 041-1 (Draft 2)

38 of 41

10 August 2016

A detailed investigation protocol and methodology; a summary of alllaboratories, manufacturing operations, and systems to be covered by
the assessment; and a justification for any part of the operation that theregulated user proposes to exclude;Interviews of current and former employees to identify the nature, scope,and root cause of data inaccuracies. These interviews may be conductedby a qualified third party;An assessment of the extent of data integrity deficiencies at the facility.
Identify omissions, alterations, deletions, record destruction, noncontemporaneous record completion, and other deficiencies;

determination of the scope and extent and timeframe for the incident,with justification for the time-boundaries applied;

data, products, processes and specific batches implicated in any
investigations;

A description of all parts of the operations in which data integrity lapses
occur, additional consideration should be given to global corrective
actions for multinational companies or those that operate across multiple
differing sites;

A comprehensive retrospective evaluation of the nature of the testing andmanufacturing data integrity deficiencies, and the potential root cause(s).
The services of a qualified third-party consultant with specific expertise in
the areas where potential breaches were identified may be necessary;A risk assessment of the potential effects of the observed failures on thequality of the drugs involved. The assessment should include analyses of
the risks to patients caused by the release of drugs affected by a lapse ofdata integrity, risks posed by ongoing operations, and any impact on theveracity of data submitted to regulatory agencies, including data related
to product registration dossiers;12.1.1.2 Corrective and preventative actions taken to address the data integrity
vulnerabilities and timeframe for implementation, and including:

12.1.2

Interim measures describing the actions to protect patients and to ensure
the quality of the medicinal products, such as notifying customers,
recalling product, conducting additional testing, adding lots to the stability
program to assure stability, drug application actions, and enhanced
complaint monitoring.

Long-term measures describing any remediation efforts andenhancements to procedures, processes, methods, controls, systems,
management oversight, and human resources (e.g., training, staffing
improvements) designed to ensure the data integrity.

Whenever possible, inspectorates should meet with senior representatives from theimplicated companies to convey the nature of the deficiencies identified and seek
written confirmation that the company commits to full disclosure of issues and theirprompt resolution. A management strategy should be submitted to the regulatory
authority that includes the details of the global corrective action and preventive
action plan. The strategy should include:

PI 041-1 (Draft 2)

A detailed corrective action plan that describes how the regulated user
intends to ensure the reliability and completeness of all of the data
generated, including analytical data, manufacturing records, and all datasubmitted to the Competent Authority.

A comprehensive description of the root causes of your data integrity
lapses, including evidence that the scope and depth of the current action
plan is commensurate with the findings of the investigation and risk

39 of 41

10 August 2016assessment. This must indicate if individuals responsible for data
integrity lapses remain able to influence GMP/GDP-related or drug
application data.

12.1.3

Inspectorates should implement policies for the management of significant data
integrity issues identified at inspection in order to manage and contain risks
associated with the data integrity breach.

12.2

Indicators of improvement

12.2.1

An on-site inspection is required to verify the effectiveness of actions taken toaddress data integrity issues. Some indicators of improvement are:12.2.1.1 Evidence of a thorough and open evaluation of the identified issue and timely
implementation of effective corrective and preventative actions;12.2.1.2 Evidence of open communication of issues with clients and other regulators.
Transparent communication should be maintained throughout the investigation andremediation stages. Regulators should be aware that further data integrity failures
may be reported as a result of the detailed investigation. Any additional reaction tothese notifications should be proportionate to public health risks, to encouragecontinued reporting;
12.2.1.3 Evidence of communication of data integrity expectations across the organisation,
incorporating processes for open reporting of potential issues and opportunities for
improvement without repercussions;12.2.1.4 The regulated user should ensure that an appropriate evaluation of the vulnerabilityof any sophisticated electronic systems to data manipulation takes place to ensurethat follow-up actions have fully resolved all the violations, third party expertise may
be required;
12.2.1.5 Implementation of data integrity policies in line with the principles of this guide;
12.2.1.6 Implementation of routine data verification practices.
13

DEFINITIONS

13.1

Archive
Long term, permanent retention of completed data and relevant metadata in its final
form for the purposes of reconstruction of the process or activity.

13.2

Audit Trail
GMP/GDP audit trails are metadata that are a record of GMP/GDP criticalinformation (for example the change or deletion of GMP/GDP relevant data), which
permit the reconstruction of GMP/GDP activities.

13.3

Back-up
A copy of current (editable) data, metadata and system configuration settings (e.g.
variable settings which relate to an analytical run) maintained for the purpose ofdisaster recovery.

13.4

Data
Facts, figures and statistics collected together for reference or analysis.

13.5

Data Governanace
The sum total of arrangements to ensure that data, irrespective of the format inwhich it is generated, is recorded, processed, retained and used to ensure acomplete, consistent and accurate record throughout the data lifecycle.

PI 041-1 (Draft 2)

40 of 41

10 August 2016

13.6

Data Integrity
The extent to which all data are complete, consistent and accurate throughout thedata lifecycle.

13.7

Data Lifecycle
All phases in the life of the data (including raw data) from initial generation andrecording through processing (including transformation or migration), use, dataretention, archive / retrieval and destruction.

13.8

Exception report
A validated search tool that identifies and documents predetermined ‘abnormal’
data or actions, which requires further attention or investigation by the data
reviewer.

13.9

Flat fileA ‘flat file’ is an individual record which may not carry any additional metadata withit, other than that which is included in the file itself.

13.10

Meta-data
data that describe the attributes of other data, and provide context and meaning.

14

REVISION HISTORY

Date

PI 041-1 (Draft 2)

Version Number

Reasons for revision

41 of 41

10 August 2016