GxP audit trail review, explained.

What an audit trail review is: reading a result's history before you trust the result

An assay result's path: injection, signature, second check, audit trail review, inspector

1. The system records every actionAn analyst logs on, runs the queue of samples (the sequence) and the CDS writes a row for each step, whoever is watching. In the example, nine rows on one lot matter.
2. The result is processed and signedThe method gives 94.1%. After three manual changes the result reads 95.3%, and the analyst signs at 11:05 pm.
3. A second person checks the recordBefore a lot can be released, a reviewer should read the result and the audit trail behind it. FDA expects this with the rest of the record.1
4. Someone reviews the trail and writes down the decisionRows are exported and read, the person behind each account is identified, and each finding gets a decision: explained, ask the person, or open a deviation, a formal record of a departure from procedure. This is the step this guide is about.
5. The record stands ready for an inspectorA signed review states what was covered and what was found, including "nothing found". Inspectors ask for this evidence.2

The people, company and figures in this example are fictional.

From the rule that never says "review" to the clock as evidence: what surprises people about audit trails

Metadata, reintegration, second-person review and ALCOA+, each in a few lines

Fourteen terms are defined in the one-page summary.

Record review, system review and for-cause review: three jobs people all call audit trail review

In shortMost confusion about frequency comes from mixing three jobs. A record-level review happens with each batch or result, by the person checking that record. A periodic system review happens on a schedule set by risk, and looks for what no single record shows. A for-cause review follows a tip, a failure or an inspection. A company needs all three written into its procedure.

A weekly review of a chromatography system therefore cannot stand in for the second person reading the audit trail before a result is approved. In the fictional example the lot is still on hold when the rows surface, so the weekly review lands in time. A company that relies on the periodic layer alone would be relying on luck.

Which audit trail matters for which risk also differs by system. A plant's batch system and a lab's chromatography system carry different risks, and the map below shows where we would look first. A company's own risk assessment replaces it.

The rules on audit trail review as of November 2026: what binds, what is guidance and what is still a draft

In shortIn the US the binding text is in the regulations, and FDA's 2018 data integrity guidance explains how it reads them. In Europe the current Annex 11 of 2011 gives audit trails one short paragraph, and a far longer draft has yet to be adopted. For clinical trials, the international good clinical practice guideline ICH E6(R3) and EMA's 2023 guideline ask for planned, risk-based reviews. For GLP, OECD published its data integrity document in 2021.

How often to review an audit trail: regulators tie the clock to the decision the data supports

In shortNone of the texts in the last section prints a number of days. The common rule reads: review before the data is relied on for a decision such as batch release, and set everything else by risk. A sensible company writes that into an SOP as tiers: critical systems with each release and on a short cycle, others monthly or quarterly, each with its reason.

FDA's answer has two parts. If a rule sets the review frequency for the data, use it for the audit trail too: 211.188(b) means after each significant step, and 211.22 means before batch release.

If no rule sets it, "determine the review frequency for the audit trail using knowledge of your processes and risk assessment tools", looking at data criticality, control mechanisms and impact on product quality.1 PIC/S gives the same logic in inspectors' words: review "prior to the point that the data is relied upon to make a critical decision".2

Two things move a system up or down most: how much a change could affect a product or patient, and how easily a person could make one. PIC/S notes that well-designed permission settings "may negate the need to examine related audit trails in detail".2 A locked instrument with no manual integration needs less reading than an open one, which gives you a good reason to fix access first.

An audit trail reviewer needs enough knowledge and system access to read relevant trails, raw data and metadata.5 A reviewer who cannot read a chromatogram cannot judge a baseline.

Every entry or by exception: what a reviewer must read and what a machine may screen

In shortThe MHRA, PIC/S, OECD and EMA each accept review by exception in writing: a validated report surfaces predefined unusual events for a person to judge. FDA's 2018 data integrity guidance does not mention exception reports, and asks whoever reviews a record to read the audit trail of changes to it. A machine screening every row and a person reading the exceptions fits the first four texts, if the company validates the screen and knows what it catches and misses. For FDA-regulated records, keep the read that goes with each record.

What each regulator says about exception reports, in its own words

Put a sampling percentage against the hours. The example company estimates that it samples about 20% of its rows by hand, and it spends about 20 hours a week reading. Twenty percent of 490,574 rows is 98,115 rows. In 20 hours, that leaves less than a second per row. The hours say a person could not have read those rows with any care, so ask of any sampling claim how long each row actually got.

A sample has a second weakness: it is random and the risk is not. A small number of rows in one person's evening carries most of the concern. Review by exception starts from the other end. You write down what abnormal looks like, in your own procedure, and you ask the system for those rows. The funnel below shows what that produced in one fictional week.

Four ways review by exception can miss a problem

How a chromatography result moves: a worked reintegration from 94.1% to 95.3%

In shortA chromatography result comes from the area under a peak. Move where the baseline starts and ends, and the area changes. In the fictional case, widening the baseline in three steps raised the peak area by 1.3% and took an assay from below its limit to above it. Manual integration can be sound science, which is why the rules ask for a reason and for every version to be kept.

Each sample enters the instrument as an injection, and a CDS turns the detector's signal into a graph with peaks. Each peak stands for a substance. The software draws a baseline under the peak and measures the area, and the area gives the amount of drug. An approved method fixes the settings. When the software draws the line in the wrong place, for instance on a noisy baseline, an analyst may redraw it by hand. That is manual integration, and running the data through again is reprocessing.

Here is the fictional case, with the numbers from the log. The peak window widens at each step, the area rises and the assay crosses the limit on the third try.

What the rules say about each move in that log

Eight audit trail patterns, each with the innocent explanation you must rule out

In shortMost review procedures look for the same families of event: results changed, data deleted, shared accounts, self-approval, clock changes, elevated rights, late entries and unusual rates. Each one has an ordinary explanation as well as a worrying one. A good review states the pattern, asks, and writes down the answer. It presumes nothing about the person.

FDA's data integrity guidance also tells you what to do once a problem looks real: find its scope and root causes, assess the risk, and put in a corrective action plan, which "may include retaining a third-party auditor and removing individuals responsible for data integrity lapses from positions where they can influence CGMP-related or drug application data".1 Those are serious consequences for a person, so a flag should reach a person as a question first, with the rows beside it.

What FDA warning letters say about audit trails, read from FDA's own copies

In shortBy our count, of 515 FDA CGMP warning letters to drug and active ingredient sites issued from January 2021 to October 2026, about one in five mentions data integrity and about one in twelve uses the words "audit trail". We read those 44 by hand: 35 describe an audit trail problem at the site. They describe the same few failures: no procedure for review, quality units that never looked, shared logins, and analysts with administrator rights.

Other counts use other methods. A separate review of 85 drug-product warning letters posted January 1 to December 9, 2025 reports that 15% cite data integrity concerns, by its own method.28 FDA's report on pharmaceutical quality counts 105 quality-related warning letters to human drug sites in fiscal 2024, the highest in five years, and it gives no data integrity share.29

Twelve FDA letters on audit trails, in the agency's words

A warning letter records FDA's position at its date. Firms respond, and some correct the problem and receive a close-out. These letters are cited here only for what each one says.

What data integrity failures have cost: a lost merger, suspended generics and doubt over earlier batches

In shortWe found no published average cost of a data integrity failure. The public record holds two cases that show how far one can reach. A Delaware court put about $900 million on one company's data integrity problems. EMA recommended suspending generics tested at one contract research organization over flawed study data. The first cost of a single case is often doubt about everything else the same person or system produced.

The Akorn opinion shows how audit trails enter a case like this. The court recorded that the company's own quality team found, at one site in April 2016, that audit trails "were not being reviewed for even 'minimum criteria,' including 'data deletion' and 'data manipulation.'" It returned in December 2017 and found the problems had not been fixed.41

The court's $900 million is wider than the cost of fixing a laboratory: it estimates the value lost to the regulatory delay and remediation together, and it says it cannot be precise. It also warns against reading the percentage as a bright line.41 The Delaware Supreme Court affirmed on December 7, 2018, in a short order that declined to comment on the lower court's wider reasoning.42

Clinical data carries the same risk through a different door. In March 2024 EMA's medicines committee confirmed its recommendation to suspend or refuse the marketing authorizations of a number of generic medicines tested by one contract research organization, after a GCP inspection "showed irregularities in study data and inadequacies in study documentation and in the computer systems and procedures to manage study data".43 Companies with enough other data kept their authorizations.43

FDA's guidance asks firms to assess the "impact on data used to support submissions to FDA".1 A review that catches one result early keeps that spread small, and a signed record of what was clean limits how far the doubt has to run.

Audit trails in EDC and GLP systems: reviewing by site and study instead of by batch

In shortA clinical study has no batch release, so its review clock follows monitoring and the data lock, the point when a study's data is frozen. EMA expects ongoing review unless justified, E6(R3) asks for a planned one, and FDA is softer. Patterns matter more than single rows: a site's entry lag, changes after a query (a question sent to the site about its data), entries at odd hours. GLP labs face an older problem: instruments with no audit trail at all.

In a trial, a site enters what happened at each visit into the EDC system. The audit trail shows who entered each value, when and whether it changed. EMA's guideline lists what data review can do: "identify missing data, detect signs of data manipulation, identify abnormal data/outliers and data entered at unexpected or inconsistent hours and dates".12

It says reviews can use "technologies to facilitate the review of larger datasets", and it asks for an export of the entire trail "as a dynamic data file" so patterns across sites can be seen.12

The industry's own position paper, from the eClinical Forum and the Society for Clinical Data Management, said in April 2021 that "we are at the start of our routine ATR journey". It lists reasons for review that go well beyond misconduct: process problems, misunderstood instructions, "up to the rare cases of manipulation from data originators".44

Its authors estimate that "as much as 80%" of the effort to get insight from audit trails may go into preparing the data.44 That is an informed opinion in a position paper, with no study behind the number.

A survey of GLP facilities by Japan's quality assurance society, shared with its partner groups in March 2026 across nine countries, gives a rare look at this end of the work. It reports audit trail functions on only some instruments, with most facilities having no plan to replace those that lack them. More than half of respondents had SOPs for audit trail review, and QA most often reviewed trails during study-based inspections.46

Many facilities combined usage records with access limits as an alternative control.46 The MHRA also allows alternatives for older systems, if they are "proven to be effective" and a firm shows progress.5

AI on audit trails: what regulators have said so far, each statement dated

In shortExact rules that screen every row fit what the MHRA, PIC/S, OECD and EMA already accept, and FDA's 2018 guidance does not address them. Generative AI, the kind that writes text, is where the open question sits. Draft EU GMP Annex 22 says such models "should not be used in critical GMP applications", EMA's 2026 workshop report says that may change, and nothing is final. Keep the person's decision, the exact rows and the line between rule and model visible, and decide which of your uses are critical.

Software can pull exports and screen every row; it cannot read intent

Export, map, read, ask, sign: how QA teams review audit trails today

In shortA typical periodic review runs through a system owner's export, a mapping of accounts to people, hand reading against an SOP, chasing context from rosters and change controls, and a signed form. We found no public study of how long this takes. In the fictional example, less than half the hours go to reading rows, and the rest to getting data, working out who is who, chasing context and writing. Teams do it in house with reports and spreadsheets, through consultants, or with software.

Six roles around an audit trail review, from the analyst to the site quality head

Built-in reports, outside specialists or review software: how the work gets staffed

We found no public market figure for GxP audit trail review tools, and no independent study of how much time they save. Reports that size general audit trail software exist, but they cover other buyers and disagree widely. Part C shows you how to measure your own.

Week 40 at a fictional drug maker: from half a million audit trail rows to one Thursday night

In shortPriya Ranvelle, the data integrity lead, opens the week as one lane per person: twelve lanes across seven days, with eight flags. She clicks the flag on a QC analyst's Thursday, sees the hour, opens the finding with nine rows cited, and chooses to open a deviation. The site quality head approves it before it reaches the quality system. The lot stays on hold.

1

The week as one lane per person

Each lane is a person or an account, across seven days. Blue bands are rostered shifts, and shaded bands are the out-of-hours window, 8:00 pm to 6:00 am. Every screened event is a tick, and flags sit on the lanes.

The footer counts 12 people, 2,219 events of interest and 7 of 8 flags still open. Two lanes at Plant 5 read "not yet screened", because its chromatography export arrived that morning.

2

One flag, zoomed to its hour

Clicking "Reprocessed ×3" opens the hour on a time strip, with the three integrations bracketed: "Reprocessed 3 times in 21 min, then reported." Below it sit the story, the checks that raised it and a suggested decision.

Four checks raised it: three rules (repeated reprocessing, manual integration without a reason, trial injection before a sequence) and one pattern (out-of-hours edits to critical data).

3

Every sentence cites its row

Finding F-112 tells it in order, with a numbered citation after each statement. The automatic integration gave 94.1%. Over 21 minutes the baseline moved three times. The third version reported 95.3% and was signed three minutes later. "No OOS investigation is linked to the lot."

The right side shows the export's rows as exported, with the file's checksum verified at the top. Row 7's reason reads "baseline drift". Rows 5 and 6 read "no reason recorded".

4

Four versions of one result, side by side

The chromatogram shows injection 4's main peak and the reported baseline below it, marked in red. Beside it are the four versions, and the table lists time, who, reason, peak area and assay for each. A reviewer can compare them without opening the CDS.

5

Which checks fired, and why this suggestion

A trace shows each step: the export and its checksum, the account resolved to a person and roster, the rules that fired, the pattern against 90 days of history, and the finding written. The reasoning gives the analyst's usual rate, 0.4 manual integrations per sequence.

It suggests a deviation, with a confidence of 92, and the suggestion stays a suggestion. The screen says "three rules" and its card says four hits: the fourth is the out-of-hours pattern.

6

A deviation, drafted from the rows and approved by QA

Priya picks "Open a deviation" and notes "Possible OOS not investigated". The draft, DEV-2026-0612, takes its description from the same nine rows. It keeps the lot on hold, lists three other lots the analyst tested after 8:00 pm in September, and proposes an OOS investigation, restricted manual integration pending review, a look back since July 1, and a class of Major.

She sends it to Omar Haddad, the site quality head. Only after he approves does it enter the quality system.

A shared shift login, self-approved stability results, a moved clock and 37 late visit dates

In shortThe same week holds eight other findings, across lab, plant, study and quality systems. Each is laid out the same way, rows first. Some look serious and some close with an ordinary answer: an aborted run with a pump alarm in the instrument log was suggested as justified, and nine failed sign-ins turned out to be a password reset.

A risk-based review schedule that tightens after a bad week, with the procedure's rule beside every date

In shortEach system's tier sets its review frequency, and each date shows the section of the company's own procedure behind it. After a High finding, the schedule proposes moving that system up one tier for 8 weeks. QA has to approve. On the sample, environmental monitoring goes from 10 reviews in ten weeks to 26.

A chromatography review run, a signature with its meaning, and a clean month still signed

In shortThe Plant 5 export arrives and the review runs while Priya watches: 121,906 rows, two findings. The Plant 3 record is signed once every finding is decided, then locked. A quiet month in the lab notebook is signed too, with "no anomalies" stated rule by rule, which is the evidence of each review that Part A said inspectors ask for.

The screening rules, the coverage dashboard and the settings your SOP controls

In shortTwelve exact rules and two pattern checks, each with its definition and its hit count. A dashboard for coverage, findings and hours. Settings for frequency, out-of-hours windows, independence and approvers, all versioned, so the SOP stays yours.

What this solution aims for: every row screened, 73% less reviewer time, 1.6 days to a signed record

From log collector to signed record: what the seven audit trail agents do and where people take over

In shortFive agents collect, map and screen each trail into one lane per person, and two more draft deviations and the review record. Each has a job and a place it stops. People decide every finding, sign every record, and approve every deviation, rule set and schedule change.

Who decides findings, approves deviations and signs each review record

Rules, statistics and generated text: which step uses which

Part A said draft EU GMP Annex 22 draws a line at generative AI in critical GMP uses, and that the line may move.47,48 This solution divides the work as follows.

Which of those steps count as critical in your GMP use is your classification to make, and we will go through it with your quality team.

The audit trail exports going in, the signed evidence coming out

Works with the systems your audit trails already live in

Controls that support your compliance, and the credentials we hold

The controls you have seen support your own compliance work: a review record for each period, exports kept unchanged with a checksum, every statement traced to a row, role-based access, reviewer independence checks, signatures with meaning, name and time, locked records, and an audit trail of the review itself.

Compliance with GxP, Part 11 and Annex 11 remains yours to show, through your validation and your procedures. Botminds' own credentials are SOC 2 Type II, audited, and information security managed to ISO 27001. The solution runs at enterprise scale, across sites and study portfolios, with maker-checker approvals: one person prepares and another approves.

The people in the week 40 sample, in their own words

What a rushed or sampled audit trail review costs you, and how to find your own number in a week

In shortYour yearly review hours are easy to count, and the larger costs are harder: a hold on a lot while someone reads, and the rare case that reaches a regulator or a buyer's due diligence. We found no public benchmark for hours or rows per review, so measure your own. A week of plain counting gives you the numbers the calculator below needs.

Where your audit trail review hours and holds hide, and how to count them

The patient, the analyst's name, the next inspection: costs no spreadsheet prices

Your return on automated audit trail review: three levers and a calculator with every assumption showing

In shortThree things can pay for this: reviewer hours released, days taken out of lot release, and a share of the time spent on outside audits. The fourth value, a problem caught early, is real and unpriced. Every input below is an assumption until you replace it. If your volume is small and your systems are locked, a report and a form may be enough.

What reviewer hours, lot-days and outside audits add up to after your yearly cost

Can your audit trails be screened by software yet? Score your exports, accounts, procedure and ownership

In shortSoftware can only apply a procedure you have written, to exports you can get, for accounts that map to people. Score each question from 0 to 2. The total places you in one of three bands, and each band says what to do next.

Choosing audit trail review software: ten questions on exports, planted events, generated text and who decides

In shortAsk any vendor, us included, to show it on your own exports, with your own rows on the screen. The answers that matter concern completeness of the export, what the rule set catches and misses, where a generative model is used, who decides, and whether the record can stand in front of an inspector.

Testing audit trail review on one chromatography system in eight weeks

In shortPick one critical system with volume. Measure your current review for two weeks, plant known events in a copy of the export, and run the screen alongside your current review for four, leaving a week to decide. Decide on rows found, false alarms and hours. You keep your current review throughout, so nothing depends on the pilot.

What to count in an audit trail review pilot

Audit trail review FAQ: how often, who reads it, Part 11, exception reports, manual integration and AI

In shortFifteen questions readers search for, with answers that stand alone and a date on anything that may change.