FDA Findings: Uncontrolled Forms and Unofficial Records

A blank form looks harmless. But if anyone can print or copy one, nobody can tell how many versions of a record exist, whether a page was quietly redone, or whether a failing result was simply written up again on a fresh sheet. That is why FDA treats form control as a data integrity control, not an administrative detail. Three Warning Letters show the problem from different sides.

Background: data integrity and ALCOA+ in practice.

What FDA found

Company X1 — nearly two thousand loose forms

Cited under 21 CFR 211.194(a), within a wider finding on incomplete and non-original laboratory data. The letter states: “we found 1,897 blank uncontrolled CGMP-related forms” during the walkthrough of the microbiology laboratories. The same letter describes alleged backdating, discarded plates and replaced logbook pages (see discarded and shredded original records) — exactly the behaviours that uncontrolled forms make easy and hard to detect.

Company X2 — personal diaries as lab records

A contract testing laboratory. Cited under 21 CFR 211.22. According to the letter, staff recorded procedures, results and method changes in personal diaries, and the firm had no procedure controlling their use. FDA also notes that eight audit forms were found after the firm had denied using them.

Company X3 — pre-populated worksheets, no quality oversight

A contract testing laboratory, in a letter from 2021 that FDA describes as a repeat of a 2016 violation. Under 21 CFR 211.160(a), FDA cited changes to laboratory worksheets made without quality unit oversight, including “changes to microbial testing worksheets pre-populated with analyst identification”, and electronic worksheets for standards and reagents implemented without QU oversight.

Why this happens

Interpretation — the letters state findings, not root causes. These are common patterns, not claims about these firms.

• Convenience wins. Printing a form from a shared drive is faster than requesting one from QA. Over time, the controlled process becomes the exception.
• Templates drift. Analysts “improve” worksheets — pre-filling names, adding fields — and nobody routes the change through document control.
• The real record moves elsewhere. When the official form is impractical, people keep the working information in notebooks or diaries and copy a clean version later.
• No reconciliation. If issued forms are never counted back, a missing or extra copy is invisible.

What good looks like

Example: a fictional QC lab using controlled paper worksheets alongside a LIMS.

1. Issue, number, reconcile. Blank forms for GMP records are issued by QA or document control, uniquely numbered, and reconciled when returned — used, voided or spoiled. FDA’s guidance (question 6) expects blank forms to be controlled by the quality unit or another document control method.
2. Templates under change control. Worksheet and form templates are controlled documents. Pre-filling fields that should be completed at the time of work — like the analyst’s identity — is not allowed.
3. One official place per record. Each activity has one defined record. Personal notebooks, diaries and loose paper are prohibited for GMP data, and the rule is checked during walkthroughs.
4. Electronic forms are systems too. Spreadsheet or electronic worksheets used for GMP data are validated and access-controlled, not created ad hoc (see unvalidated and uncontrolled laboratory systems).
5. Walk the floor. QA walkthroughs look specifically for uncontrolled copies, unofficial notebooks and stray forms — before an investigator does.

Perspective: what FDA’s requests tell you

In X1, FDA did not issue a separate request about the forms; it folded them into a full data integrity investigation covering omissions, alterations, deletions and record destruction. That is the point: uncontrolled forms are rarely the finding on their own. They are the enabler that makes other findings possible and the reason an inspector will doubt the completeness of everything else. Controlling them is one of the cheapest data integrity controls a site can have.

Regulatory basis

• 21 CFR 211.194(a) — laboratory records must include complete data derived from all tests.
• 21 CFR 211.160(a) — laboratory control mechanisms, including changes, must be reviewed and approved by the quality control unit, followed and documented at the time of performance.
• 21 CFR 211.22 — quality control unit responsibilities.
• FDA guidance: Data Integrity and Compliance With Drug CGMP — Questions and Answers (December 2018), question 6 (how blank forms should be controlled) and question 12 (recording on paper to be discarded). Guidance is non-binding; the regulations are.

EU angle

Check current versions on EudraLex before relying on specific clauses. Document and form control sits in EudraLex Volume 4, Part I, Chapter 4 (Documentation), under revision since the July 2025 consultation draft.

Takeaways

• If anyone can print a blank form, you can’t prove a record wasn’t redone.
• Number, issue, reconcile.
• Templates are controlled documents — no pre-filled identities.
• Personal notebooks are not GMP records.