MHRA GxP data integrity guidance, for IT

One guidance for all of GxP

The MHRA published its 'GXP' Data Integrity Guidance and Definitions (revision 1) in March 2018. It applies across GMP, GCP, GLP, GDP and pharmacovigilance and explains how the MHRA reads the existing requirements for data. Its starting point: the organisation takes responsibility for its systems and the data they generate, under a data governance policy endorsed at the highest level, with effort proportionate to the risk.

What it asks of IT

Much of it concerns how systems are configured, accessed and kept.

• Systems designed for data integrity: synchronised clocks, access rights that prevent unauthorised changes, interfaces that avoid manual transcription
• Audit trails switched on where the risk assessment requires them, not changeable by users, and reviewed as part of routine data review
• Individual accounts, no shared logins where the system supports individual ones, and system administrator access limited to as few people as possible, none of them with an interest in the data
• Validated transfer and migration, true copies that keep content, context, metadata and audit trail, and archiving before a system is decommissioned
• Backup and recovery validated, each backup verified, restores tested periodically
• Cloud and virtual services understood: data ownership, location, retrieval, retention and security set out in the contract

Legacy systems

Systems without an audit trail or individual accounts need effective alternative controls and documented, timely progress towards a compliant solution. The guidance says plainly that missing remediation may be cited as a deficiency.