Findings library

One data integrity finding a week, taken apart

Written from the deficiency categories regulators publish, not from named reports. Each entry shows the observation in the inspector's style, why it was cited, and the practice that would have prevented it.

CriticalModule 3 15 Sept 2026

Five analysts, one login: the shared account on the HPLC data system

Computerised systems: access control and attributability

The chromatography data system in the QC laboratory was accessed by all analysts using a single generic account 'QCLAB' whose password was written on the instrument bench. The account held administrator privileges, including the ability to delete data files and modify audit trail settings. It was therefore not possible to attribute any acquisition, reprocessing or deletion in the system to an individual. The firm could not demonstrate that reported results for batches released since installation were the results originally generated.

Read the breakdown

MajorModule 4 8 Sept 2026

The audit trail that was switched on and never read

Computerised systems: audit trail review

The site's procedure required 'periodic' review of audit trails for the LIMS and chromatography data system. No frequency, scope or acceptance criteria were defined. No record of any review could be produced for the preceding two years. On examination of the audit trail during the inspection, fourteen instances of result reprocessing with manual integration were identified across nine batches, none of which had been noted on the analytical report or assessed before release.

Read the breakdown

CriticalModule 4 1 Sept 2026

Aborted runs labelled 'system suitability': testing into compliance

Laboratory controls: complete data and unofficial testing

Audit trail review during the inspection identified 23 sample injections in the preceding six months that were aborted or not processed and were named 'SST', 'test' or 'trial'. In eleven cases the sample was subsequently reinjected under the batch name and the passing result reported. No investigation, out-of-specification record or deviation existed for any of the aborted injections. Analysts interviewed stated that this was 'normal practice to check the system'.

Read the breakdown

MajorModule 2 25 Aug 2026

The batch record completed at the end of the shift

Documentation: contemporaneous recording

Comparison of manufacturing batch record entries with the electronic logs of the granulator and the cleanroom access system showed that in-process check times recorded for batch 2041 preceded the operator's entry to the suite by 40 minutes and that six entries with different recorded times were made in identical ink with identical handwriting characteristics. The operator confirmed that entries were routinely completed from memory at the end of the shift.

Read the breakdown

MajorModule 5 18 Aug 2026

Assay results from an unlocked, unvalidated spreadsheet

Computerised systems: validation of spreadsheets

Assay and content uniformity results were calculated in an Excel workbook stored on a shared network drive. The workbook had not been validated, formula cells were not protected, no version control was in place and the file could be edited by any user on the network. Three versions of the workbook with different rounding logic were found in use. The firm could not demonstrate which version had been used to generate results on certificates of analysis for the preceding eighteen months.

Read the breakdown