1What an audit trail review is.
An audit trail, in FDA’s definition, is “a secure, computer-generated, time-stamped electronic record that allows for reconstruction of the course of events relating to the creation, modification, or deletion of an electronic record”. It includes trails of changes to data, such as processing parameters and results, and trails of actions at record or system level, such as attempts to access the system or to rename or delete a file.¹ MHRA and WHO describe it as capturing the “who, what, when and why” of each action.²³
An audit trail review is the documented check of those entries as part of reviewing the data. FDA compares it to “assessing cross-outs on paper when reviewing data”.¹ In the EU, Annex 11 of 2011 asks for an audit trail of GMP-relevant changes and deletions to be considered on the basis of risk, and says audit trails need to be “available and convertible to a generally intelligible form and regularly reviewed”, with the reason documented for any change or deletion of GMP-relevant data.⁴ See audit trail requirements for what the trail itself must capture.
2Who should review audit trails.
FDA’s answer is the people who review the record: “Personnel responsible for record review under CGMP should review the audit trails that capture changes to data associated with the record as they review the rest of the record.” 21 CFR 211.192 requires the quality unit to review and approve all production and control records, and FDA counts audit trails among them, so the quality unit reviews and approves those too. FDA notes that the regulations also let some activities be reviewed by a person directly supervising or checking the work.¹⁵
PIC/S expects critical audit trails to be independently reviewed by the originating department, with the quality unit verifying where necessary, for example during self-inspection or investigations.⁶ MHRA adds that reviewers need enough knowledge and system access to review the relevant audit trails, raw data and metadata.² The draft revision of Annex 11, put out for consultation in 2025, would go further: reviews by people “not directly involved in the activities covered by the review”.⁷⁸
3How often audit trails should be reviewed.
FDA ties the frequency to the data. If the CGMP regulations set a review frequency for the data, the audit trail is reviewed at that frequency. FDA’s examples are 211.188(b), which it reads as requiring review after each significant step in manufacture, processing, packing or holding, and 211.22, which requires data review before batch release. Where no frequency is set, the firm decides it using process knowledge and risk assessment, weighing “data criticality, control mechanisms, and impact on product quality”. FDA suggests that trails of instrument operational status, instrument communication logs and alert records may suit a risk-based frequency.¹
The other guidances agree on the principle and differ in detail.
| Guidance | When to review |
|---|---|
| FDA data integrity Q&A, December 2018 | At the frequency CGMP sets for the data, such as after each significant step and before batch release; otherwise by risk assessment.¹ |
| MHRA GxP data integrity guidance, March 2018 | As part of routine data review where a risk assessment calls for it.² |
| PIC/S PI 041-1, July 2021 | Critical trails with the operation’s other records, before the operation is completed, such as before batch release; non-critical trails during system reviews at a set frequency.⁶ |
| WHO TRS 1033 Annex 4, 2021 | In routine data review, with the frequency set by the system’s criticality and the category of audit trail, such as batch-specific, administrative or system activity.³ |
| EU GMP Annex 11, 2011 | “Regularly”.⁴ |
| Draft revised Annex 11, 2025 | In a timely manner according to risk, and before batch release unless the risk of later detection can be justified.⁷ |
4What reviewers look for.
Not every entry needs reading. MHRA says audit trail review need not include every system activity, such as log-ons or keystrokes, and allows review as a list of relevant data or by “exception reporting”, a validated search tool that flags predetermined abnormal data or actions.² EMA likewise accepts validated audit trail exception reports “instead of an onerous line-by-line review”.⁹ PIC/S suggests focusing on changes to data, on anomalous or unauthorised activity, and on systems that still allow parameters or data to be changed; where permissions already prevent a change, the related trail may not need detailed review.⁶
The draft Annex 11 lists the signals: repetition of activities, errors, omissions, unauthorised process deviations and loss of data integrity, with verifying the reason for each change as “a key element”.⁷ FDA expects aborted or incomplete chromatographic injections to be captured in audit trails, investigated and justified,¹ and MHRA wants repeated processing with progressively changed parameters to be visible, so that parameters are not being manipulated towards a better result.² Review by exception explains how exception reports are set up and validated.
5How to document and follow up.
PIC/S expects a written procedure that sets out how to review audit trails, what to look for and how to search, with each review documented and any significant variation from the expected outcome fully investigated and recorded.⁶ MHRA asks that the record of data review include a positive statement on whether issues were found, the date and the reviewer’s signature,² and WHO that a conclusion, where one is required, be documented, signed and dated, with a procedure for the corrective and preventive action that follows errors or omissions.³ Beyond routine review, PIC/S asks the quality unit to run a programme of ongoing audit trail reviews, both random and targeted, within its self-inspection programme.⁶
A review is only as good as the trail. PIC/S expects audit trail functions to be verified during validation and kept enabled and locked,⁶ and WHO asks for periodic verification that they remain enabled throughout the data life cycle.³
6How it runs in Seal.
In Seal, each record keeps its own audit log, and the audit-trail export from a vendor system, such as a chromatography data system, is attached and reviewed beside the batch, test or result it belongs to. Events are prioritised by criticality, rules that suppress expected events are versioned, justified, tested and approved, and a required review can gate the result or disposition, so the review comes before the decision rather than in a later log check. The data integrity and audit trail review blueprint follows an integration change made after an out-
Neil can prepare an audit-trail review: it reads the export, the records in scope and the review criteria, and drafts a brief with an indexed set of exceptions. The authorised reviewer decides what is significant and signs the review. The validation and AI assurance guide covers what to demonstrate about records, audit trails and signatures during qualification.
References
- 1Data Integrity and Compliance With Drug CGMP: Questions and Answers, Guidance for Industry, FDA, December 2018. https:/
/ www. fda. gov/ media/ 119267/ download (read 6 November 2026) - 2‘GXP’ Data Integrity Guidance and Definitions, Revision 1, MHRA, March 2018. https:/
/ assets. publishing. service. gov. uk/ media/ 5aa2b9ede5274a3e391e37f3/ MHRA_ GxP_ data_ integrity_ guide_ March_ edited_ Final. pdf (read 6 November 2026) - 3Guideline on data integrity, WHO Technical Report Series No. 1033, Annex 4, World Health Organization, 2021. https:/
/ cdn. who. int/ media/ docs/ default- source/ medicines/ norms- and- standards/ guidelines/ inspections/ trs1033- annex4- guideline- on- data- integrity. pdf (read 6 November 2026) - 4EudraLex Volume 4, Annex 11: Computerised Systems, European Commission, in operation since 30 June 2011. https:/
/ health. ec. europa. eu/ system/ files/ 2016- 11/ annex11_ 01- 2011_ en_ 0. pdf (read 6 November 2026) - 521 CFR 211.192, Production record review, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ section- 211. 192 (read 6 November 2026) - 6PI 041-1, Good Practices for Data Management and Integrity in Regulated GMP/GDP Environments, PIC/S, 1 July 2021. https:/
/ picscheme. org/ docview/ 4234 (read 6 November 2026) - 7Annex 11: Computerised Systems, draft revision for consultation, EMA GMDP Inspectors Working Group and PIC/S, July 2025. https:/
/ picscheme. org/ docview/ 9714 (read 6 November 2026) - 8Stakeholders’ Consultation on EudraLex Volume 4, Chapter 4, Annex 11 and New Annex 22, European Commission, consultation 7 July to 7 October 2025. https:/
/ health. ec. europa. eu/ consultations/ stakeholders- consultation- eudralex- volume- 4- good- manufacturing- practice- guidelines- chapter- 4- annex_ en (read 6 November 2026) - 9Guidance on good manufacturing practice and good distribution practice: questions and answers, data integrity section, European Medicines Agency, undated. https:/
/ www. ema. europa. eu/ en/ human- regulatory- overview/ research- development/ compliance- research- development/ good- manufacturing- practice/ guidance- good- manufacturing- practice- good- distribution- practice- questions- answers (read 6 November 2026)
AQuestions and answers
Do you have to review every audit trail entry?
No. MHRA says the review need not cover every system activity, such as log-ons and keystrokes, and PIC/S and the draft revised Annex 11 expect reviews to be targeted by risk. What must be reviewed, how often and by whom should be set out in a procedure based on the criticality of the data.
What is review by exception for audit trails?
A validated report or search that picks out predetermined abnormal data or actions, such as changes after a result or deleted injections, for the reviewer to assess. MHRA and EMA accept it in place of line-by-line review, provided the report itself has been validated.
Can the person who made a change review its audit trail?
Independence is the clear direction. PIC/S expects changes to manually entered data to be reviewed by an appropriately authorised and independent person, and the draft revised Annex 11 proposes that audit trail reviews be done by people not directly involved in the activities reviewed.
What should happen when a review finds a problem?
Investigate any significant variation from the expected outcome and record it. A procedure should say what to do when the review finds issues that could affect product quality or data integrity, including escalation to senior management and, where necessary, the regulator, and the corrective and preventive actions that follow.
Are system audit trails such as login records in scope?
They are part of the audit trail, since FDA’s definition covers actions such as attempts to access the system. They usually suit a risk-based periodic review rather than review with every record: FDA gives instrument communication logs and alert records as examples, and MHRA says routine review need not include every log-on.
Does audit trail review apply to paper records?
The paper equivalent is the single-line correction that shows who made the change, when and why. FDA compares audit trail review to assessing those cross-outs when reviewing a paper record, so the same reviewer checks both as part of the same review.