FDA data integrity guidance: what CGMP records need from IT
How FDA reads the CGMP record requirements for computerized systems, and which of it the IT department implements and has to show.
What the guidance says
FDA's guidance "Data Integrity and Compliance With Drug CGMP: Questions and Answers" (December 2018) describes data integrity as the completeness, consistency and accuracy of data, which should be attributable, legible, contemporaneously recorded, original or a true copy, and accurate (ALCOA). It ties these expectations to the CGMP regulations, among them 21 CFR 211.68 on computerized systems and 211.180 and 211.188 on records. It is guidance: it explains how FDA reads the regulations, which are what bind.
What falls to IT
The questions the guidance answers are, for the most part, IT questions.
- Individual accounts: no shared logins for CGMP records, privileges limited to the role
- Audit trails: switched on for CGMP data and reviewed, for example before batch release
- Workflows validated for their intended use, so data can't be changed or deleted outside the controlled process
- Backups that are true copies, keeping content, meaning and metadata, with restores that have been tested
- Electronic data as the original record where the system keeps it; printouts are not a substitute for dynamic data
With the GxP Validation Assistant
How the assistant helps
The guidance as a rule pack
The parts that concern computerized systems and their records, labeled guidance, cited by the SOPs and the self-assessment.
Access as a process
Joiners, movers and leavers, privileged and service accounts, and access reviews per system, with records and due dates.
Audit trail reviews
Reviews recorded with what was looked at and what was found, and the next one on the Today page.
Incidents and CAPA
Data integrity incidents are triaged, investigated and followed up with effectiveness checks.
Guidance represents FDA's current thinking; the regulations are in 21 CFR. The assistant supports your data integrity program; it does not replace it.
See it with your own systems.
Watch the webinar, or install the assistant and try it for 14 days.