Audit trail regulations

When you start working across the Internet, the chromatography data system becomes an open system and the FDA rule requires controls. Using FDA s definition of electronic records, the laboratory chromatography data system generates electronic records. Based upon the definition, laboratories will need to consider more than just the raw data tiles. One must also include the method tiles, mn sequence tiles, and the integration parameters used for the data analysis. The need for a comprehensive audit trail is a critical component of the FDA regulations. The audit trail is an electronic record and is subject to the same controls. 

Automated dissolution equipment in most cases must be compliant with the FDA electronic records and electronic signatures regulation (21 CFR Part 11). The requirements of the regulation include use of validated systems, secure storage of records, computer generated audit trails, system and data security via limited access privileges, and the use of electronic signatures. 

Samples should be accessioned into a computerized database, consistent with federal regulations (21CFR). Most rules concerning a compliant database have to do with whether the structure provides for an audit trail, so that anyone who has viewed or written to the database can be traced. Handwritten accessioning procedures are strongly encouraged as well. 

Those records that are considered subject to Part 11 will be subject to enforcement discretion with regard to the requirements for validation, audit trails, record retention, and record copying in the manner described and with regard to all Part 11 requirements for systems that were operational before the effective date of this regulation. 

The review process of filled-out spreadsheets will be in question from a regulation perspective. Incorrectly completed spreadsheets will normally be revised and reprinted. The first, incorrect version will be destroyed. An audit trail of the review process is not possible. This can be overcome by keeping the incorrect version(s). Another system to track the review process is the introduction of check boxes close to data-entry cells or columns on the spreadsheet that will demonstrate the correctness of the entry. It should be noted that the requirements for ER/ES compliance and for an appropriate audit trail is needed only if a spreadsheet is saved. If the PC is used as a typewriter, the requirements are not applicable. 

The creation of strong audit trails is also not mentioned in the Regulations and is a precept often not properly adhered to. 

In the context of Part 11, one of the differences between Parts 211 and Part 820 is the scope of the electronic records that must be maintained. Part 21 requires the maintenance of electronic regulated data including raw data. Part 820 requires that the results of acceptance activities are recorded, but not necessarily all of the raw regulated data. The exception in 820 is that raw data is required during failure investigations. As in Part 211, results under Part 820 must have audit trails. Refer to Part 820 preamble, pp. 52631 and 52646. 

As a result of the fundamental principles above, all computer systems performing regulated operations must protect their electronic records by means of access controls, audit trail controls, and Part 11-associated operational checks. For those computer systems that implement electronic signatures, the security and control of electronic signatures must also provided. 

It is very important to ensure that having a signed paper-based record (e.g., a report) associated with one or more electronic records, the electronic file(s) associated with these records must not be deleted. The Part 11 regulation is very specific regarding this issue. Electronic files in hybrid systems must be maintained electronically. The interpretation of this requirement in the medical devices CGMP regulations (21 CFR 820) is different. Part 820 requires that the results of acceptance activities are recorded, but are not necessarily raw data, and these results must have audit trails. This interpretation is contained in the medical device quality system preamble (pp. 52631 and 52646). 

The current good manufacturing practices (GMP) state that Laboratory records shall include complete data derived from all tests necessary to assure compliance with established specifications and standards [5]. This includes all electronic and hard copies of raw data, laboratory notebooks, and/or worksheets and reports. Additionally, the regulations require that records shall be readily available for authorized inspection [6]. Consequently, the organization must have a well-defined audit trail for the generation, storage, and retrieval of reports and raw data. It must also be shown that there is adequate document management and security of all raw data and reports in terms of both disaster recovery and prevention of falsification of results. 

Assists with completion of form R. Provides list of synonyms and copy of regulations in software. Maintains audit trail. 

Audit trails log who created, modified, or deleted the record, and when ( timestamp ). They should explicitly identify either who or what made the change or allow that information to be unambiguously determined. The FDA has suggested that predicate regulations may be used to determine whether or not audit trails on specific records are warranted. The FDA stresses that it is particularly important to track users who created, modified, or deleted records. 

Those regulated records required for normal operation require an audit trail and the means to copy the records to an appropriate portable format. 

The electronic record strategy is fikely to be focused on the role of the Data Historian. General audit trail requirements may be satisfied by the implementation of a transaction log. Particularly critical records may warrant electronic audit trails implemented for individual records. Consideration should also be given to how copies of regulated records, including audit trails, may be provided during inspections and submissions to regulatory authorities. 

There is no need to implement an audit trail for the parameter settings, but the completeness of the logbook entries must be ensured, e.g., via double check and/or additional training of the employees. Nevertheless, the data in the monitoring system must be assessed regarding their Part 11 relevance. In this case all data are printed, and the printout is used for the batch record review. There is no further regulated activity based on the electronic data... 

Understanding of the potential for robotic laboratories has led to a further reinterpretation of the good laboratory practice regulations, placing new emphasis on the importance of electronic audit trails and data controls. As reliance on human review and intervention decreases, concerns about the need for automated checks grows. 

Authentication is usually performed by entering a unique user identification (ID) and password. If data are transferred automatically from external software, the source system either must provide a similar mechanism to identify a valid user or the external system has to log on to the record manager with a unique identifier. In any case, data that are entering a compliant-ready record manager require this identification. The authentication needs to be logged with a date and time stamp in an audit trail. The same requirement applies to the modification of data that already exist in the record, if the user is not already in an authenticated session. In fully regulated environments, a reason for the modification has to be supplied before changes can be made. 

Paperless laboratories can also be of great help in complying with governmental regulations. Systems ihal are in accord with regulations can automate the compliance process atid load to better detection if laboratory practices do not conform to prescribed regulations, lltc audit trail is more easily tracked and any potential alterations more readily found with eicctroitic-bascd systems. 

An electronic record is any combination of text, pictures, data, audio or information represented in digital form that is created, modified, maintained, archived, retrieved or distributed on computer systems. These records were formerly printed, and the printed data became the master copy. The purpose of this regulation is to turn the emphasis toward the electronic version being the master. It must be possible to identify when, where and by whom changes are made to a record. This means that it must not be possible to make a correction that obscures the original entry nor should it be possible to amend the audit trail. 

Have a quality management that is particularly important in regulated environments and can be achieved through audit trail and validation facilities. Quality control is enhanced through specification libraries and action triggers with graphical data interpretation. 

---