FDA Findings: Audit Trails Off, Gappy or Never Reviewed

An audit trail can fail you in three ways: it is switched off, it is switched on but has gaps, or it records everything and nobody reads it. Three recent FDA Warning Letters show one of each. Together they make a simple point: what matters is not whether the system has an audit trail but whether the audit trail is complete, trustworthy and reviewed.

For the basics, see audit trail review: how to actually do it and data integrity and ALCOA+ in practice.

What FDA found

Company X1 — audit trail never enabled

Cited under 21 CFR 211.68(b). According to the letter, a gas chromatograph used for component testing was not adequately qualified, because “you failed to validate the control software or enable audit trails”. FDA also reported that:

• GC data file creation and modification dates were not accurate;
• several chromatographic data files could not be located in the storage folders on the GC computer;
• there were no proper controls to prevent deletion or manipulation of electronic raw data;
• electronic data on the GC computer was not backed up.

FDA found the firm’s response inadequate because, among other things, it did not explain how traceability would be ensured for files with inaccurate timestamps and no audit trail data. Its requests include detailed procedures for the use and review of audit trail data, and the implementation status of audit trails on each system.

Company X2 — audit trail on, but silent

Cited under 21 CFR 211.194(a). The letter states that the audit trail of an FTIR spectrometer showed no activity from 23 to 30 September 2025, although testing records show the instrument was used in that period. The analyst attributed this to the system crashing frequently.

Separately, under 21 CFR 211.160(a), FDA noted that the quality unit had not established a written procedure to review audit trails and raw analytical data. The same letter also describes trial injections — see trial injections and testing into compliance.

Company X3 — audit trail full of signals nobody assessed

Cited under 21 CFR 211.194(a). Here the audit trail worked — and that is how the problems were found. According to the letter, the investigator observed:

• multiple “deleted system” and “deleted project” errors, with no assessment report completed as the firm’s own procedure required;
• a stability sample injected with results never processed in the HPLC system or documented in the laboratory notebook;
• another stability sample injected with no reported results, re-injected later the same day, with passing results subsequently reported.

FDA notes that deficiencies in the firm’s electronic data security controls had been identified and discussed during previous inspections.

Why this happens

Interpretation — the letters state findings, not root causes. These are common patterns, not claims about these firms.

• Audit trail treated as a product feature, not a control. The software can do it, so it is assumed to be done. Nobody checks whether it is enabled, configured for the right events, and protected from being switched off.
• Stand-alone instruments fall outside the net. Networked chromatography systems get attention; a single GC or FTIR on a local PC often has no validation, no backup and no audit trail configuration at all.
• No defined review. Without a procedure saying who reviews what, when, and what counts as a red flag, the audit trail is just storage.
• “Errors” normalised. Repeated crashes, deletion messages or aborted runs get explained away instead of investigated.

What good looks like

Example: a fictional QC lab with a stand-alone GC running a chromatography data system we’ll call ChromaLog.

1. Enable and lock it. The audit trail is enabled at installation, the configuration is documented, and ordinary users cannot disable it. Any change to audit trail settings is restricted to an administrator who does not run tests, and is itself recorded.
2. Prove it in validation. OQ testing creates, modifies and deletes records and confirms the audit trail captures who, what, when, the old and new values and, where required, the reason. A test that only says “audit trail works as expected” does not prove this — see writing good test scripts.
3. Trust the clock. System time is synchronised and protected from user changes; otherwise timestamps — and the audit trail built on them — are not reliable.
4. Review it, risk-based. A written procedure defines which audit trail events are reviewed (deletions, aborted or unprocessed injections, reprocessing, manual integration, configuration changes), by whom, when, and how the review is documented. FDA’s data integrity guidance says the people responsible for record review should review the audit trails; where a regulation sets when the data must be reviewed (for example before batch release), the audit trail follows the same timing, otherwise frequency is set by risk assessment.
5. Cross-check against other evidence. Compare audit trail activity against instrument usage logs, sequence counts and notebook entries. A week of testing with an empty audit trail (X2) or injections without reported results (X3) should be caught by the lab before an investigator finds them.
6. Treat system errors as events. Crashes and “deleted” messages trigger a documented assessment, as the firm’s own procedure required in X3.
7. Back it up and prove the restore. Raw data and audit trails are backed up, and a restore is actually tested. A successful backup job does not prove the data can be restored.

Regulatory basis

• 21 CFR 211.68(b) — appropriate controls over computer or related systems so that changes to records are instituted only by authorised personnel; backup data must be exact, complete and secure from alteration, erasure or loss.
• 21 CFR 211.194(a) — laboratory records must include complete data derived from all tests necessary to assure compliance with specifications.
• 21 CFR 211.160(a) — laboratory control requirements must be followed and documented at the time of performance.
• 21 CFR Part 11, §11.10(e) — secure, computer-generated, time-stamped audit trails that independently record operator entries and actions that create, modify or delete electronic records.
• FDA guidance: Data Integrity and Compliance With Drug CGMP — Questions and Answers (final, December 2018), questions 7 (who reviews audit trails) and 8 (how often). Guidance is non-binding; the regulations above are.

EU angle

Outside FDA jurisdiction, the closest equivalent is EudraLex Volume 4, Annex 11 (in operation since 30 June 2011): clause 9 expects audit trails, based on risk assessment, for GMP-relevant changes and deletions, with the reason documented and the audit trails regularly reviewed; clause 12 covers security. A revised Annex 11 was published as a draft for consultation in July 2025; check EudraLex Volume 4 for whether the final text has been adopted.

Takeaways

• Enabled ≠ configured ≠ reviewed.
• A silent audit trail during active testing is a finding, not a technicality.
• If your own procedure says assess deletion events, an unassessed deletion is a deviation from your own procedure.
• Investigators read your audit trails. Read them first.