Zamann Pharma Support logo

Siedlerstraße 7 | 68623 Lampertheim, Germany

info@zamann-pharma.com

Request an appointment now

How a Pharma Company Closed Audit Trail Review Gaps Under Annex 11 and 21 CFR Part 11

During a project with a German pharmaceutical company, Zamann Pharma Support was asked to assess data integrity compliance as part of the company’s effort to strengthen CSV compliance with EMA and FDA expectations.

The company believed its system was compliant because the audit trail was active. However, activation alone did not provide sufficient control. Our review found no periodic audit trail review, incomplete event capture, no backup restore testing, and poorly defined storage for raw and interim data.

These weaknesses created potential exposure to FDA 483 and EMA inspection findings, even though the system initially appeared controlled.

Our team reviewed the data integrity controls, identified the main compliance gaps, and defined the actions the company needed to strengthen audit trail review, backup restoration, data storage, and access control.

Challenges Faced

A detailed GAP analysis in Quality Management Systems is essential for identifying process deficiencies effectively.
  • Missing Audit Trail Reviews: The audit trail was active, but the company did not review it periodically. This meant potentially important changes could remain undetected.
  • Incomplete Audit Trail Capture: The system recorded only major events. As a result, smaller modifications could be overwritten without sufficient traceability.
  • Untested Backup Restoration: The company had not performed a restore test on backup data. This created potential data-loss and inspection risks.
  • Poor Data Segregation: Raw, interim, and final data were not clearly separated. The folder structure therefore weakened data traceability.
  • Undefined Data Storage: Raw and interim data were stored in poorly defined folders. This reduced control over how data were managed and retrieved.
  • False Sense of Compliance: Because the audit trail was enabled, the system appeared compliant. However, the supporting review and data-control processes were incomplete.

Zamann Pharma Support’s Approach

  • Data Integrity Assessment: Our team reviewed the controls behind the audit trail instead of checking only whether the function was enabled.
  • Audit Trail Review Evaluation: We assessed how audit trails were reviewed and identified the absence of a periodic review process.
  • Event Capture Review: We examined what the system recorded and found that only high-level changes were captured.
  • Backup and Restore Assessment: We identified that backup data had not been tested through a restore process and highlighted this as an immediate area for action.
  • Data Storage Review: Our team examined how raw, interim, and final data were stored and identified weaknesses in folder structure and segregation.
  • Regulatory Expectation Review: The assessment considered FDA Data Integrity Guidance from 2018, EMA Annex 11, and MHRA GXP Data Integrity Guidance in relation to audit trails, lifecycle data integrity, storage, and restoration.
  • LIMS Investigation: During LIMS sampling, several results had been modified without corresponding audit trail records. Further investigation showed that only high-level changes were being tracked.
  • Remediation Actions: We recommended a structured audit trail review SOP, defined review frequencies, risk-based event classification, backup restore testing, user training, stronger folder access controls, and clearer data segregation.

Results Achieved

  • Major Data Integrity Issue Identified: The LIMS investigation confirmed that some modified results had no corresponding audit trail record. According to the case, the EMA inspector classified this as a major data integrity issue.
  • CAPA Requirements Defined: The resulting CAPA required revalidation and restructuring of user roles.
  • Compliance Gaps Became Clear: The assessment showed that an active audit trail did not compensate for missing reviews, incomplete event capture, weak backup controls, or poor data segregation.
  • Remediation Priorities Established: The company received clear priorities for strengthening audit trail review, backup restoration, user training, access control, and data management.
  • A Clear Compliance Lesson Emerged: An audit trail cannot function as a simple checkbox. Its value depends on what it captures, how it is reviewed, and how the surrounding data controls are managed.
Laboratory
GMP qualification and lifecycle validation activities including IQ, OQ, and PQ supporting inspection readiness in pharmaceutical manufacturing.
Services

Qualification and Validation for GMP Systems

Our team supports the planning, execution, and maintenance of qualification and validation activities, including IQ, OQ, and PQ, to keep GMP-regulated systems compliant and under control.

Read More

Contact Us

Need help? Don't hesitate to get in touch
Zamann pharma support is committed to protecting and respecting your privacy, and we’ll use your personal information to administer your account and to provide the products and services you requested from us.

FAQ

1. What CSV compliance risk exists when a LIMS audit trail captures only high-level changes?

If the audit trail records only major or high-level events, smaller result modifications may not remain traceable. In this case, several LIMS results had been modified without corresponding audit trail records, creating a major data integrity issue.

2. Why should backup restore testing be included in a pharmaceutical data integrity assessment?

A backup is not enough if restoration has never been tested. In this case, no restore test had been performed, creating potential data-loss and inspection risks. Zamann therefore identified backup restore testing as an immediate remediation priority.

3. How can weak data segregation affect LIMS traceability during an EMA or FDA inspection?

Poorly defined folders and unclear separation of raw, interim, and final data can weaken traceability. In this case, Zamann identified folder structure, access control, and data segregation as key areas requiring stronger controls.