FDA Findings: Reviewing Printouts Instead of Electronic Data

A chromatography printout shows what someone chose to print. The electronic record behind it shows everything: every injection, every reprocessing, every manual integration, every aborted run. When second-person review looks only at the paper, it reviews the story — not the data. Three Warning Letters show what that misses.

Background: audit trail review and data integrity and ALCOA+ in practice.

What FDA found

Company X1 — printed results only, OOS injections unseen

A contract testing laboratory. Under 21 CFR 211.194(a), the letter states: “Your quality unit (QU) only reviews printed analytical results.” Investigators found unprocessed HPLC injections for several batches that, when analysed, were out of specification for an assay; the printed data did not include those results, did not show that additional analysis had been done, and did not show that manual integration had been performed. Under 21 CFR 211.160(b), procedures did not require evaluation of electronic data such as reprocessed integrations, aborted runs, single injections and audit trails, and manual integration had no governing procedure. Under 21 CFR 211.68(b), analysts could delete HPLC data and two HPLC systems had no audit trail enabled.

Company X2 — no electronic data review at all

An API manufacturer evaluated against ICH Q7 expectations. FDA describes multiple unreported sample injections for related substances and assay, including an OOS assay injection left out while a passing one was reported for a batch that was released to the US. The firm had no procedure for electronic data review, and the quality unit did not review electronic data.

Company X3 — photocopies instead of originals

An API manufacturer. Under the quality-unit finding, the letter states that laboratory personnel “reviewed photocopies of the original data rather than the original records”, and signed off on analysts’ notebooks without verifying changes to the underlying data. Under a separate computerised-systems finding, an analyst used another analyst’s login credentials to perform calibrations and sample testing.

Why this happens

Interpretation — the letters state findings, not root causes. These are common patterns, not claims about these firms.

• Review designed for paper labs. Review procedures were written when results were paper, and never updated when instruments became computerised.
• Reviewers without access or skills. QA reviewers may have no account on the chromatography system, or no training in what to look for in it.
• Time pressure. Reviewing a summary report is quick; reviewing sequences, integration events and audit trails takes longer — and the release date doesn’t move.
• Trust in the analyst. “They printed it, so that’s the result” — a reasonable instinct that removes the independence the review exists to provide.

What good looks like

Example: a fictional QC lab where reviewers work directly in a CDS we’ll call ChromaLog.

1. Review in the system, not from the printout. Second-person review is performed on the electronic record, with reviewer accounts and training. The printout, if any, is a convenience copy. FDA’s guidance (question 10) explains that a printout or static record does not satisfy the requirement to retain original records where the original is dynamic electronic data.
2. A defined review checklist. For each sequence: all injections acquired versus reported; aborted, unprocessed or single injections; reprocessing and version history; manual integration with justification; method and processing-parameter changes; relevant audit trail entries. FDA’s guidance (question 14) addresses why saving only the final reprocessed result is not acceptable.
3. Manual integration under a procedure. When it is allowed, who may do it, how it is justified and documented, and how the reviewer checks it.
4. Exception reports. Where the system supports it, reports that list deletions, reprocessing and manual integrations for the review period make the review faster and more reliable.
5. Originals, not copies. Reviewers verify against the original record. Copies are acceptable only when they are verified true copies.
6. Attributable review. Reviewers sign electronically or on the record, with date, and the review itself is part of the record — so “reviewed” means someone specific looked at something specific.

Perspective: what FDA’s requests tell you

In X1, the out-of-specification injections were in the system all along; the review simply never looked there. That is why FDA, in these and similar letters, asks not only for corrected procedures but for a retrospective review of past data and invalidated OOS results. For a validation team, the practical point is that CSV of a chromatography system is not complete until the review process that depends on it — reviewer roles, exception reports, audit trail views — has been designed and tested as well. A validated system reviewed through printouts is a validated system nobody is using properly.

Regulatory basis

• 21 CFR 211.194(a) — laboratory records must include complete data, including all graphs, charts and spectra, and a second-person review for accuracy, completeness and compliance.
• 21 CFR 211.160(b) — scientifically sound laboratory controls.
• 21 CFR 211.68(b) — controls over computer systems so only authorised personnel change records.
• FDA guidance: Data Integrity and Compliance With Drug CGMP — Questions and Answers (December 2018), questions 7 (who should review audit trails), 10 (printouts versus original electronic records) and 14 (saving only final reprocessed results). Guidance is non-binding; the regulations are.

EU angle

Check current versions on EudraLex before relying on specific clauses. EudraLex Volume 4, Annex 11 (2011) clause 9 expects audit trails to be regularly reviewed; second-person checking of QC results sits in Part I, Chapter 6 (Quality Control). A revised Annex 11 was published as a draft for consultation in July 2025.

Takeaways

• A printout is a summary someone chose. Review the data.
• Reviewers need accounts, training and a checklist in the system.
• Count injections: acquired versus reported, every time.
• Validation isn’t finished until the review process is designed too.