Data Integrity Problems in an FDA Warning Letter: Lessons

In short: A 2022 FDA warning letter to Vi-Jon, LLC listed data integrity failures in a quality control laboratory: a shared administrator login, deletable raw data on a stand-alone computer and no audit trail review before batch release. This article summarises the findings, why FDA rejected the firm’s response, and what FDA asked for. It is written for QA, QC and IT staff who handle laboratory data.

Background

Data integrity remains a frequent topic in FDA inspections. FDA inspected Vi-Jon, LLC in October 2021 and issued a warning letter on 31 March 2022. The firm had replied to the Form FDA 483 on 3 November 2021, and FDA judged that reply inadequate. The data integrity finding was cited under 21 CFR 211.68(b): the firm had not exercised appropriate controls over computer or related systems, so that changes to production and control records, or other records, were made only by authorised personnel.

For the basics, read What is data integrity in the pharmaceutical industry first.

What the inspection found

Weak control of electronic data. Appropriate personnel were not the only ones with administrative rights. A microbiological testing instrument ran on a stand-alone computer with no safeguard against deleting raw data.
Shared account. All laboratory users logged in with one generic account that had administrative privileges, which could change and delete files. Deleted files were found in the computer’s recycle bin during the inspection.
No audit trail review before release. Laboratory management did not review the audit trail of the HPLC software before releasing drug product batches. FDA described this as a repeat of a finding from the 2017 inspection.

The firm’s response and why FDA found it inadequate

The firm said it would stop the shared login, give administrator rights only to IT staff outside the quality unit, update the software and write a user access procedure, and print the audit trail of each sample into the data packet. It also planned to let only one microbiologist use the system.

FDA considered this inadequate because:

Corrective actions to secure the software and the stand-alone computer were not sufficient.
Access levels, privileges and authorised users were not described.
Limiting access to one person is not a substitute for a system of access levels and privileges.
It did not say where data would be stored to prevent inappropriate access or deletion.
There was no retrospective assessment of earlier drug product release data from the instrument, and no wider evaluation of how the weaknesses may have affected data integrity.
Reviewing static copies of records is inadequate. A static copy does not preserve the dynamic format of the complete analytical result, and original paper and electronic records must be reviewed so that all results and associated information are reported correctly.

What FDA asked the firm to provide

FDA asked for a comprehensive, independent assessment and CAPA plan covering the integrity and security of laboratory IT systems, including:

A list of all laboratory hardware, both stand-alone and networked.
The vulnerabilities in hardware and software, for networked and non-networked systems.
Software configurations and versions, user privileges and oversight responsibilities for each system, including who holds administrative rights.
System security provisions, such as unique user names and passwords that are kept confidential.
Detailed audit trail procedures and the implementation status for each system.
Interim controls for control, review and full retention of laboratory data.
Technology improvements to bring stand-alone equipment (for example balances and pH meters) onto the network.
A summary of procedural updates and training, including second-person review of all analyses.
A remediated programme that keeps strict control over electronic and paper data, so that every addition, deletion or change is authorised and all data is retained.

How this maps to the GMP regulations and FDA’s Q&A

FDA’s guidance Data Integrity and Compliance With Drug CGMP: Questions and Answers (December 2018) explains the same expectations in plain terms:

Access control (211.68(b)). Only authorised personnel should be able to change CGMP records, and the system administrator role should sit with people independent of the record content (Q4).
Shared logins. A shared login does not identify a unique individual, so actions are not attributable (Q5; see also 211.188(b)(11) and 211.194(a)).
Audit trail review. Audit trails that capture changes to critical data should be reviewed as part of the normal record review, with the same frequency as the record review itself, for example before batch release (Q7 and Q8).
Static versus dynamic records. A printout of dynamic data does not preserve the complete original record (Q10; 211.180(d)).
Laboratory records. 211.194 requires complete data from all tests, including graphs, charts and spectra, and 211.188 requires batch records to identify who performed and checked each significant step.

Practical takeaways

Give every user a unique login and keep administrator rights away from the people who generate the data.
Treat stand-alone laboratory computers as GMP systems: access control, backup, audit trail and periodic review.
Include audit trail review in the batch record or data review checklist, before release.
When a finding repeats, expect FDA to look at the whole system, not only the one instrument.

Frequently asked questions

Can we print the audit trail and attach it to the data packet?

A printout alone was not accepted in this case. FDA said static copies do not preserve the dynamic record, so the review must cover the original electronic record and its audit trail.

FDA’s Q&A states that shared credentials mean a unique individual cannot be identified, so the system would not meet CGMP requirements.

Who should hold administrator rights?

FDA recommends the administrator role is assigned to staff independent of those responsible for the record content, for example IT personnel outside the quality unit.

How often should audit trails be reviewed?

FDA says the frequency should match the review of the associated records, and for batch release data this means before release. A risk-based approach may be used for some other audit trails.

References

US FDA. Warning Letter to Vi-Jon, LLC, 31 March 2022 (case 622087): fda.gov warning letter.
US FDA. Guidance for Industry: Data Integrity and Compliance With Drug CGMP: Questions and Answers (December 2018): fda.gov/media/119267/download.
21 CFR 211.68 (automatic, mechanical and electronic equipment), 211.188 (batch production and control records) and 211.194 (laboratory records), via eCFR.