Q398 · What is a “Data Integrity Audit Trail…

Q398 · Category H: Licensed operations and routine regulatory oversight (Q351–Q400)

“Audit trail review” is a key activity for ensuring the integrity of electronic record data. Modern compliant electronic systems, such as LIMS, ERP and chromatography data systems, have an “audit trail” function that automatically records all activities involving the creation, modification or deletion of data, including the operator, time, original value and new value. However, having this function is not enough: you must regularly review the audit trail records. The purpose is to proactively identify any unusual or suspicious activity. For example, has someone been making frequent changes to data late at night? Has anyone attempted to delete a failed test result? Has anyone changed the system time without a valid reason? Regular, targeted reviews can deter and detect potential data falsification. Regular audit trail reviews are essential for critical electronic systems.

📘 Regulatory basis

Data integrity guidance issued by various regulators, such as the MHRA and PIC/S, clearly states that systems with audit trail functionality must have procedures requiring regular review of the audit trail.

📗 Drew Tang's recommendations

We recommend that clients use risk assessments to determine the frequency and depth of audit trail reviews for different systems. For example, audit trails for a QC laboratory chromatography system that generates final release data may need to be reviewed batch by batch or weekly. Reviews can be less frequent for lower-risk systems. Reviews should be conducted by personnel independent of data generation (such as QA), and the review process and findings should be recorded.

📕 Risk notice

During an inspection, if the inspector asks how you review audit trails and you cannot answer or say that you have never done so, this will be regarded as a major data integrity deficiency. It shows that although you have installed a ‘camera’ (the audit trail function), you have never reviewed the footage and have no monitoring in place for potential misconduct. This may cause the inspector to fundamentally question the reliability of all your electronic records.

Plan Your Hong Kong Pharmaceutical Licensing Project with Drew Tang

Business Manager Tang Shangyong (Drew Tang) will review your products, operating model, licence type and preparation requirements with you one-to-one. The precise service scope is confirmed in writing; pharmaceutical duties are carried out by legally qualified personnel, and approvals are determined by the competent authorities.

What is a “Data Integrity Audit Trail Review”? Do we need to conduct one?

Plan Your Hong Kong Pharmaceutical Licensing Project with Drew Tang