FDA recently cited an organization for egregious data integrity mistakes.
Throughout time, staff developed workarounds prioritizing convenience over compliance. Although each step represented a small compromise that felt insignificant in the moment, the breakdown of data integrity was serious and dangerous.
The 483 reads:
….. Appropriate controls are not exercised over computers or related systems to assure that changes in master production and control records or other records are instituted only by authorized personnel.
Specifically, the following data integrity issues were found with the documentation, equipment, and software used for cGMP testing:
a. Analytical instrumentation located in the Instrument Lab utilizes software programs that have limited or no electronic audit trail capabilities.
b. Analytical instrumentation located in the Instrument Lab are run on software that does not require a unique username and password to sign on. Additionally, employees were observed using one communal username to log in to Microsoft Windows on … and … and stated that all chemists use this username.
c. An employee who formerly had administrator access to the software operating the NMR still retained his administrator access despite a change in user roles and the formal loss of the role of administrator as part of his job duties.
d. Apparent GMP related data records were observed in the electronic Recycle Bin on the computer desktops connected to LC MS … and the NMR.
e. An employee using the communal Microsoft Windows username on GS MS-FID … displayed that she had the capability to ‘Delete’ and ‘Restore Previous Versions’ of analytical software on the computer desktop.
f. The … balances used for cGMP projects in the Prep Lab have password protection capabilities that are not being utilized. The administrator for these instruments stated that the balances have both administrator and operator roles. However, the password protection on the devices is not currently being used to enforce this restriction.
g. Unique user names and passwords on analytical equipment are not being secured or protected from being used by other employees. LIR … for Study … shows that an employee used HPLC … while another employee was logged in. The LIR also includes a handwritten note from an employee stating that the study director could sign for them.
In reference to your facility, these observations should prompt uncomfortable questions: Are our own systems vulnerable to similar failures? Have we allowed convenience to squander compliance? Are we truly able to trace every action back to an individual and reconstruct the history of our data?
Reference 21 CFR Part 211.68, which requires appropriate controls over computer systems to ensure that only authorized personnel can institute changes to master production and control records.
Schedule a demo to learn how GMP Trends Reports will inform your Quality System and keep your team informed of FDA inspection trends. Reading 483’s is important. GMP Trends has assisted thousands of quality teams globally for 47 years. Use this link to schedule a call: https://gmptrends.com/schedule-a-demo/
