Questions and Answers on Audit Trail (Review) – Part 2
Requirements for an Audit Trail can be found in all relevant regulations. It is intended to ensure that changes to and deletions of data – and in future possibly also the creation of data – can be traced. In the current draft of EU GMP Guideline Annex 11, the requirements are described in significantly more detail than before. Six experts from the pharmaceutical industry and regulatory authorities answer an extensive catalogue of questions, which essentially refers to the Annex 11 currently still in force.
The Experts
- Klaus Feuerhelm, Local GMP Authority of Baden-Württemberg
- Eberhard Kwiatkowski, PharmAdvantageIT, Neuschoo
- Dr Ullrich Opitz, Merck, Darmstadt
- Yves Samson, Kereon, Basel
- Dr Wolfgang Schumacher, formerly F. Hoffmann-La Roche, Basel
- Dr Arno Terhechte, Regional Government Muenster
Question 10: Who is the process owner for the Audit Trail review – QA or the system owner?
The Audit Trail Review is normally carried out by the department that generated the data (for example QC or production), but not by the same person who created the data – rather by a colleague (peer review). In the first FDA data integrity guidance, the quality unit (Quality Assurance) was still mentioned for this; this was later amended to require review by a function with appropriate expertise. All other guidance documents share this view.
Question 11: Who is responsible for preparing the specific Audit Trail Review SOP – the process owner (e.g. Operations) or QA? And who must prepare an SOP on the general framework conditions for Audit Trail Review?
To carry out Audit Trail Review, an SOP is first required which lays down, for the company, the risk assessment, responsibilities for conducting the review and the review frequency. This general SOP is usually prepared by the Quality Assurance department.
For carrying out Audit Trail Reviews in a specific computer system (for example a chromatography data system, CDS), the data fields to be reviewed must be defined in a checklist. This checklist is drawn up by the specialised department that operates the system.
Question 12: Is there a regulatory basis for the risk-based definition of Audit Trail Review intervals and scope?
Pharmaceutical regulations do not, in principle, require any specific method for determining risk. However, it is recommended to apply ICH Q9, which has been available in a new version since 2023. It sets out a whole range of methods that can be used as options; the method most commonly used in the pharmaceutical industry is FMEA, in which a numerical value is assigned to the estimated risk. Value ranges of 0–10 and 0–5 are most commonly used, although there is a preference for ranges of 0–4 or 0–6, where the mid-point is not used as the exact value for medium risk.
When defining intervals, it should be taken into account that initially all batches are reviewed, and that – after considering a long period of time (for example one year) – the review frequency can, where appropriate, be reduced. However, such a practice may lead to observations during an authority inspection.
Question 13: As a general rule, how is Audit Trail Review carried out: “by hand” by a member of staff or electronically supported?
In practice, the audit trail review is carried out in very different ways. In the laboratory, a specific checklist is usually used, which is finally commented on and signed by the reviewer. It is important that this checklist identifies all data fields to be checked in order to ensure a complete review. It is advisable to carry out the review on screen, in order to avoid time-consuming printing with subsequent filing/archiving of the documentation. The conduct of the audit trail review (responsibility, frequency, documentation) must be defined in an SOP.
Question 14: Is the four-eyes principle always necessary for the Audit Trail Review? Production and QA review, or QA review and the releasing person?
The audit trail review is normally carried out by one person; a second member of staff to check the reviewer does not have to be involved in the review. For example, a member of production reviews the audit trail of the production data; the same applies analogously in quality control. Involvement of Quality Assurance (QA) is not required. The documentation of the audit trail review (completed and assessed checklist) is forwarded to the Qualified Person (QP), who reviews the result in relation to batch release.
Question 15: Which person, in which role, usually carries out the double-check – that is, the substantive review of the Audit Trail Review performed?
The audit trail review is a review of the changes/additions made after the initial data entry. It is not necessary for another person to check this review again. The substantive review of the audit trail must in any case be ensured; that is, the reviewer must in all cases have a sound knowledge of the relevant process. A purely formal ATR is not permissible. To clarify: only one person with appropriate expertise is needed to carry out the ATR.
Question 16: Does QA not also come into play in the review, as a check that the review has been performed?
As part of its regular self-inspections, the Quality Assurance department should check that the audit trails of all manufactured batches have been reviewed for deviations/changes.
Question 17: If the system does not offer the option of entering a comment when an operator changes a parameter, how can this problem be solved?
If an electronic system does not allow entries relating to parameter changes, documentation must be made manually on paper. This documentation must then be reviewed together with the rest of the – where applicable electronic – batch record.
Question 18: Must adjustments and/or repairs to the underlying SQL database, carried out by the manufacturer, be captured in the Audit Trail? By analogy with repairs to equipment, which are entered in the logbook.
For programming work/changes/updates/patches to a database, the change control process must be applied; it is irrelevant who carries out these changes. An entry in the audit trail is not required.
Question 19: If set point changes are foreseen in the batch record and are also verified there by means of double-checking, can the Audit Trail Review in a process control system be omitted on a risk basis for this purpose?
No. Changes – even if they are foreseen – should be traceably documented, and the audit trail is the appropriate tool for this.
Question 20: If the ATR is reviewed electronically, can the result then be documented on paper? Or should this also be done electronically?
To avoid a hybrid solution, the result should also be documented electronically. Documentation on paper should be avoided, but is not prohibited.
| For Part 1 of the Q&As please see the previous issue of the GMP Journal. |
About the Author
Dr Andreas Mangel is Operations Director at CONCEPT HEIDELBERG and organises and conducts courses and conferences for the ECA Academy in the areas of sterile production and computer validation.
