FDA Findings: Fabricated Records and Falsified Data

Most data integrity findings are about controls that could allow manipulation. Fabrication is the case where it actually happened: a record describes a test, an investigation or a production step that never took place. It is the most serious data integrity failure, and it is rarely one person’s problem — it usually survives because the system around it never asked the right question.

Background: data integrity and ALCOA+ in practice.

What FDA found

Company X1 — investigations that were never performed

Cited under 21 CFR 211.194(a). The letter states that laboratory records lacked complete and reliable original data to support chromatographic analyses, and that investigators documented “multiple examples of fabricated laboratory records”. The laboratory manager said several investigations had been fabricated and never performed, and a senior QA manager confirmed that fabrication had occurred before the inspection. The firm also had not kept original data from testing of raw materials and finished products.

FDA found the response inadequate because it did not evaluate the full scope of data integrity deficiencies across manufacturing operations.

Company X2 — falsified manufacturing records, admitted

An API manufacturer (FDA cites adulteration under FD&C Act section 501(a)(2)(B)). According to the letter, batch records and equipment logbooks showed the same equipment being used simultaneously for two different APIs. Excel files seen on a production office computer on the first morning of the inspection had all been deleted by the second day and could not be recovered. In its response the firm stated that its production head “directed the creation of falsified manufacturing records” to misrepresent API production.

FDA found the response inadequate: the firm had not evaluated how widespread record fabrication was, had not identified which records were legitimate, and had not explained how it would prevent and detect non-contemporaneous records.

Company X3 — samples recorded but never taken

Cited under 21 CFR 211.194(a). The letter describes a microbiologist who documented collecting routine samples, and states that “your microbiologist admitted that the samples were never actually taken.” FDA also describes colony counts routinely read after a shorter incubation than the firm’s procedure required — a practice the firm affirmed. FDA asked for a retrospective assessment of data validity and a gap analysis of data integrity controls.

Why this happens

Interpretation — the letters state findings, not root causes. These are common patterns, not claims about these firms.

• Workload versus schedule. When the plan requires more tests, samples or investigations than people can actually do, the paperwork can be completed without the work.
• Authority without oversight. In X1 and X2, the people involved held senior roles. Where a manager directs the work and the record, no ordinary review will catch the gap.
• Review checks the form, not the facts. A complete-looking record passes review. Nobody compares it with independent evidence — logs, timestamps, sample inventories, equipment use.
• No safe way to speak up. Staff who know records are false have no channel to report it without personal risk.

What good looks like

Example: a fictional mid-size manufacturer with a QC lab and a microbiology section.

1. Cross-check records against independent evidence. Routine review compares records with data the author does not control: equipment usage logs, system timestamps, access-card logs, sample and plate reconciliation. Two products on one machine at the same time (X2) is exactly what this catches.
2. Resource the plan. Capacity planning shows whether the testing and investigation workload is achievable. A plan that is impossible on paper will be “completed” on paper.
3. Independent QA oversight of senior functions. Records approved by department heads get the same — or more — independent checking as anyone else’s.
4. Unannounced self-inspection. QA walks the lab and production without notice and compares what is happening with what is being recorded.
5. A real reporting channel. Staff can report suspected falsification anonymously, and every report enters the documented quality system. FDA’s guidance (question 15) says such tips should not be handled informally outside the CGMP quality system.
6. Training that names the problem. Training explains what fabrication looks like, why it is never acceptable, and how to report it — FDA’s guidance (question 16) expects data integrity training as part of routine CGMP training.

Perspective: what FDA’s requests tell you

In all three letters FDA asked for essentially the same package: an investigation with a documented protocol, interviews of current and former employees (ideally by a qualified third party), a retrospective evaluation, a risk assessment for patients, a global CAPA plan — and, in X1 and X2, whether the firm will appoint a Chief Integrity Officer. That standard response tells you how FDA sees fabrication: not as an individual’s misconduct to be disciplined, but as a failure of the system that allowed it and did not detect it. Removing the person is necessary; it is never sufficient.

Regulatory basis

• 21 CFR 211.194(a) — laboratory records must include complete data derived from all tests.
• 21 CFR 211.22 — quality control unit responsibilities.
• API manufacturers: FDA evaluates API CGMP against ICH Q7 expectations.
• FDA guidance: Data Integrity and Compliance With Drug CGMP — Questions and Answers (December 2018), questions 15 (handling internal tips about potential falsification), 16 (data integrity training) and 18 (how data integrity problems should be addressed). Guidance is non-binding; the regulations are.

EU angle

Check current versions on EudraLex before relying on specific clauses. EU GMP addresses accurate and truthful records mainly in EudraLex Volume 4, Part I, Chapter 4 (Documentation), under revision since the July 2025 consultation draft.

Takeaways

• Fabrication survives where records are never compared with independent evidence.
• Senior authors need independent review too.
• An impossible plan invites paper compliance.
• FDA’s response to fabrication is systemic — plan your remediation the same way.