Audit Trail Steps

After the first injury the following sequence of events should have taken place  

---

A subtle shift has taken place, however. Ten years ago a laboratory might have been (appropriately) cited for poor data protection practices. Now a citation might be issued for lack of an audit trail, even with evidence that the data have never been compromised. In effect the regulatory attention has shifted back a step, from verification of data to verification of data protection devices (audit trails). The FDA now requires an automated regulatory tool as a QA monitor in all but the most unautomated laboratory environments. 

Maintenance records Application software documentation Data reproduction accuracy Documented verification of process steps Operator identification Data record review by quality control Electronic record/signature type, use, control, and audit trail... 

As part of the action of signing an electronic record, the purpose of the signature must be identified and be an element of each signed record. In the drag CGMP arena, there are relatively few purposes for a signature and these include authored by, reviewed by, and approved by The execution of an action such as a production step does not require an electronic signature, and can be documented via the audit trail. 

Hybrid audit trails electronically logging last changed by with date and link to related paper-based change records are acceptable for critical records so long as previous versions of the record are maintained. It may be possible in some cases to fulfill the audit trail requirements with a transaction database log. Some database designs require the user to execute a commit record step, while others commit the data as soon as the next field is tabbed to. In cases where a conscious decision to commit the record is required, data entered should not be defined as an electronic record until this action is taken, thus potentially simplifying the audit trail. In cases where there is no commit step, the audit trail should start as soon as each data item is entered. 

The following steps can be used to configure the audit trail facility in Microsoft Excel spreadsheets ... 

The system must have equivalent levels of controls expected of a paper system such that there are computer-generated, time-stamped audit trails of all modifications, deletions, additions, etc., the system identifies the person making these changes, and the original entry is not obscured. Operational system checks should be in place to enforce permitted sequencing of steps and events, where appropriate. 

---