FDA Findings: Unvalidated and Uncontrolled Lab Systems

This is the finding closest to the day job of a CSV engineer. In each of these letters a computerised system was used for GMP decisions — often batch release — without the basics: qualification, validation for intended use, audit trail, user roles, change control. The data integrity failures that followed were predictable from the gaps.

Background: what is computer system validation, GAMP 5 software categories and risk-based validation.

What FDA found

Company X1 — a GC that was never qualified

Cited under 21 CFR 211.68(b). The letter states that a gas chromatograph used for component testing was not adequately qualified, because the firm “failed to validate the control software or enable audit trails.” File timestamps were inaccurate, data files could not be located and data was not backed up. FDA found the response inadequate partly because it gave no timeline for validation and qualification, and requested an inventory of hardware and software with versions, user roles and privileges, and better integration of stand-alone equipment data.

Company X2 — release testing on a system with no controls

Cited under 21 CFR 211.68(b). According to the letter, the computer system of a UV-Vis spectrophotometer used for release testing “lacked appropriate controls to assure the integrity of electronic test data” — no audit trail and no defined user access levels. The firm responded with a vendor quotation for a software update. FDA found that inadequate: no timeframe, no interim data integrity measures, and no assessment of whether other systems had the same problem. It requested a timeline for software implementation and qualification, and an independent assessment of all stand-alone and networked systems.

Company X3 — unvalidated electronic worksheets, uncontrolled audit trail activation

A contract testing laboratory. Under 21 CFR 211.68(b), the letter states the firm “failed to validate electronic worksheets” used for microbial challenge testing, and that unvalidated formulas produced erroneous results. HPLC and GC instruments had operated without an activated audit trail for almost three years; under 21 CFR 211.160(a), FDA cited the eventual activation of audit trails “without any governing procedures or change control”. Analysts also had administrative privileges allowing them to delete sequences, change methods and disable audit trails.

Why this happens

Interpretation — the letters state findings, not root causes. These are common patterns, not claims about these firms.

• “The vendor validated it.” Supplier documentation is treated as validation of the user’s system and intended use.
• Instruments fall between QC and IT. Equipment qualification covers the hardware; nobody owns the software, data and security of the attached PC.
• Spreadsheets aren’t seen as systems. Calculation sheets are built by analysts and used for results without specification, verification or protection.
• Fixes without change control. Turning on an audit trail is a configuration change; doing it without change control and testing leaves no evidence of what the system did before and after.

What good looks like

Example: a fictional QC lab with networked chromatography, two stand-alone spectrometers and a set of calculation spreadsheets.

1. System inventory with GxP impact. Every computerised system and spreadsheet that creates or processes GMP data is listed with owner, intended use, GxP impact and validation status.
2. Risk-based validation for intended use. Each system gets a proportionate validation: requirements, risk assessment, configuration specification, and testing of the functions that matter — including audit trail, access roles, data storage and calculations. Supplier documentation is leveraged, not substituted. FDA’s guidance (question 3) addresses which workflows need validation.
3. Qualify the instrument and validate the software together. IQ/OQ covers hardware and software, configuration, security and data flow — see IQ, OQ and PQ explained.
4. Spreadsheets validated and locked. Formulas verified against independent calculation, cells protected, versions controlled.
5. Every configuration change through change control. Enabling an audit trail, changing roles or updating software is assessed, tested and documented.
6. Interim controls while you remediate. If a system can’t be fixed immediately, define compensating controls (second-person verification, paper logs, restricted use) and document them — FDA asked for exactly this in X2.

Perspective: what FDA’s requests tell you

In all three letters FDA asked for an inventory of all systems — stand-alone and networked — with versions, user privileges and audit trail status. A complete, current system inventory with validation status is the document that answers the inspector’s first question. If you can produce it in minutes, you have shown control; if you can’t, every system becomes a question. In X2, a vendor quote was not an answer: FDA wanted a timeline, interim controls and an extent-of-problem assessment.

Regulatory basis

• 21 CFR 211.68(b) — appropriate controls over computer or related systems; input/output checked for accuracy; a written record of the program with appropriate validation data.
• 21 CFR 211.160(a) — laboratory controls established, changed and approved under the quality control unit, and followed.
• 21 CFR Part 11, §11.10(d) (access limited to authorised individuals) and §11.10(e) (audit trails).
• FDA guidance: Data Integrity and Compliance With Drug CGMP — Questions and Answers (December 2018), question 3 (whether each CGMP workflow needs to be validated), questions 4 and 5 (access and shared logins), and question 10 (printouts from stand-alone instruments). Guidance is non-binding; the regulations are.

EU angle

Check current versions on EudraLex before relying on specific clauses. EudraLex Volume 4, Annex 11 (2011) covers validation (clause 4), audit trails (clause 9), change and configuration management (clause 10) and security (clause 12). A revised Annex 11 was published as a draft for consultation in July 2025.

Takeaways

• Supplier documentation supports validation; it doesn’t replace it.
• A spreadsheet that calculates GMP results is a computerised system.
• Turning on an audit trail is a change — control it.
• Keep a live system inventory; it is the first thing an inspector will ask for.