FDA Findings: Limiting Access to Records

Available is the last letter of ALCOA+ and the easiest to overlook: records must be retrievable for review and inspection throughout their retention period. When records cannot be produced — because a laptop left the site, because staff try to remove documents, or because a firm simply does not answer FDA — the consequence can be as serious as a quality failure. Three Warning Letters show this in and out of the inspection room.

Background: data integrity and ALCOA+ in practice.

What FDA found

Company X1 — the data left with the analyst

According to the letter, the only computer holding all of the site’s electronic CGMP data was not backed up and was unavailable because the analyst had taken it home and could not be reached; a QC manager’s laptop was presented with recent files apparently deleted; certificates of analysis had been sent to a personal phone and then deleted. FDA stated this “limited FDA’s access to records”, citing FD&C Act section 501(j). Data on the same events is covered from the backup angle in deleted data and missing backups.

Company X2 — removing documents as the inspection began

A contract testing laboratory. Under FD&C Act section 501(j), the letter describes staff attempting to remove two large garbage bags of analytical documents at the start of the inspection, some QC laboratory documents not being provided, and eight audit forms found after the firm had denied using them.

Company X3 — no answer to a records request

No inspection took place. FDA sent a records request under section 704(a)(4) of the FD&C Act; it went unanswered, as did numerous follow-up requests. The letter cites the prohibited act in section 301(e) and states that “we have no indication of the level of quality assurance” for the drugs listed at the facility. FDA warned that shipments appearing adulterated may be detained or refused, and that approvals listing the firm may be withheld.

Why this happens

Interpretation — the letters state findings, not root causes. These are common patterns, not claims about these firms.

• Fear of what the records show. Withholding or removing records is often a reaction to records that would reveal other problems — and it turns one finding into two.
• No inspection readiness process. Nobody owns record retrieval, so requests are answered slowly, partially or not at all.
• Records on personal devices. If data lives on laptops and phones, it can’t be produced on request.
• Unmonitored regulatory inbox. A records request sent to an outdated contact address in the registration file goes unread.

What good looks like

Example: a fictional mid-size manufacturer preparing for inspections and remote records requests.

1. Know where every record is. A record map shows where each GMP record type lives (system, archive, location) and who can retrieve it.
2. Records on controlled systems only. No GMP data on personal devices or unmanaged laptops; company devices are backed up and managed.
3. Inspection readiness procedure. Defines a front room/back room, a request log, who retrieves what, and target turnaround times. Every request and what was provided is logged.
4. Answer remote requests too. Registration contact details are current and monitored; 704(a)(4) requests are logged, assigned and answered on time through the same process.
5. Never remove, alter or “tidy” records before or during an inspection. The procedure states it explicitly, and staff are trained that doing so is itself a serious violation.
6. Electronic records are open to review. Reviewers and inspectors can be given read access to electronic records and audit trails; FDA’s guidance (question 17) confirms that FDA may look at electronic records.

Perspective: what FDA’s requests tell you

X3 is a reminder that FDA increasingly uses records requests instead of, or before, inspections. A site that cannot quickly assemble complete, accurate records for a remote request is exposed even if no investigator ever visits. For X1 and X2, the point is harsher: limiting access converts a data integrity problem into an adulteration finding in its own right. Availability is not a filing issue; it is part of being able to show that the data exists and supports your decisions.

Regulatory basis

• FD&C Act section 501(j) — a drug is deemed adulterated if the owner or operator of the facility delays, denies, limits or refuses inspection (as cited in X1 and X2).
• FD&C Act section 704(a)(4) — FDA may request records in advance of or instead of an inspection; section 301(e) — refusal to permit access to or copying of records is a prohibited act (as cited in X3).
• 21 CFR 211.180(c) — records required under Part 211 must be readily available for authorised inspection during the retention period.
• FDA guidance: Data Integrity and Compliance With Drug CGMP — Questions and Answers (December 2018), question 17 (whether FDA may look at electronic records). Guidance is non-binding; the statute and regulations are.

EU angle

Check current versions on EudraLex before relying on specific clauses. In EU GMP, record availability and retention sit in EudraLex Volume 4, Part I, Chapter 4 (Documentation); Annex 11 (2011) clauses 7 and 17 cover data storage and archiving.

Takeaways

• If you can’t produce a record, you can’t rely on it.
• Limiting access is a violation in itself — and it never hides the original problem.
• Remote records requests deserve the same readiness as inspections.
• Keep GMP records off personal devices.