Most data integrity failures do not begin with fraud. They begin with a shortcut that saved someone ten minutes, was never questioned, and quietly became the way the lab or the line works. By the time an inspector finds it, the habit is years old, everyone does it, and nobody thinks of it as a problem. That is exactly why it turns into a major finding: the inspector sees a system that cannot prove who did what, when, and why.
This guide covers five everyday habits that look harmless, explains why regulators treat them seriously, and sets out what to put in their place. If you are searching for data integrity GMP audit support, MHRA data integrity inspection findings, ALCOA+ compliance consultants, or how to prevent data integrity observations in a pharma lab, this is written for you.
Why Regulators Take This So Seriously
The MHRA’s GxP data integrity guidance, revised in March 2018, defines data integrity as the extent to which data are complete, consistent and accurate throughout their lifecycle. It builds on the ALCOA+ principles: data should be attributable, legible, contemporaneous, original and accurate, and also complete, consistent, enduring and available.
The reason inspectors care is simple. Every release decision, every stability conclusion and every regulatory submission rests on records. If the records cannot be trusted, nothing built on them can be trusted either, which is why a data integrity finding often triggers a wider review of the entire site rather than being treated as an isolated fault. Looking ahead, the draft revision of EU GMP Annex 11 moves from interpretive guidance to prescriptive rules on identity and access management and audit trail control, and the revised Chapter 4 formally treats electronic records as primary GMP records. The direction of travel is toward more scrutiny, not less.
Habit 1: Shared or Generic Logins
The habit: Several analysts or operators use one login on an instrument or system, often a generic account named after the department, because it avoids password resets and keeps the queue moving.
Why it triggers a major finding: A shared login makes the record unattributable. If three people could have run a sequence, the audit trail cannot say which of them did. The MHRA’s guidance is explicit that shared logins and generic user access should not be used, and that every individual should have a unique login that is never shared. It is one of the first things inspectors check because it is quick to verify and undermines everything else in the system.
What to do instead:
- Give every user a named account, with access limited to what their role requires
- Remove or lock generic accounts, and document the exception if one is technically unavoidable
- Restrict administrator rights, and keep a log of who holds them
- Include a user access review in your periodic system review
Habit 2: Audit Trails That Exist but Are Never Reviewed
The habit: The system captures an audit trail, so the box is ticked. Nobody looks at it unless there is a problem.
Why it triggers a major finding: A captured but unreviewed audit trail is evidence that the control exists and is not being used. MHRA expectations are that routine data review includes a documented audit trail review, and that QA has enough knowledge and system access to review relevant audit trails and raw data. The guidance also makes a point that is often missed: the review does not need to cover every system activity, it can be limited to entries with GxP relevance, such as changes, deletions, reprocessing and result modifications. That makes a risk-based, repeatable review perfectly achievable.
What to do instead:
- Define in an SOP what a GxP-relevant audit trail entry is for each system
- Build the review into the batch record or data review checklist, so it happens every time
- Train reviewers on what suspicious patterns look like, such as repeated reprocessing before a passing result
- Ensure that only a system administrator can alter audit trail settings, and that the audit trail is never switched off
Habit 3: Informal Notes, Scrap Paper and Unofficial Testing
The habit: Readings are jotted on a sticky note or the back of a glove box and copied into the official record later. A sample is run informally first to check that the system is behaving, and only the next injection is recorded.
Why it triggers a major finding: Data must be recorded at the time the activity happens, in the permanent record. Temporary notes that are later transcribed are a breach of the contemporaneous principle, and the original data is the note that was thrown away. Test runs outside the formal record raise the question of what else was run and not reported. Inspectors treat this as a sign that results may have been selected rather than reported in full.
What to do instead:
- Provide controlled, pre-numbered notebooks or electronic record fields at every point of use, so there is no reason to write elsewhere
- Define in a procedure what counts as a system suitability or test injection, and make sure it is recorded
- Make clear that all data generated, including failing results, must be retained and investigated
- Reinforce the point through supervision, not just training
Habit 4: Uncontrolled Spreadsheets and Hybrid Records
The habit: Calculations are done in a spreadsheet that anyone can edit, saved on a shared drive, and printed for the batch file. Part of the record is on paper and part is electronic.
Why it triggers a major finding: An uncontrolled spreadsheet has no audit trail, no access control and no validation, so any figure can be changed without trace. Hybrid systems are harder still because the paper and the electronic parts must be linked and reviewed together. MHRA guidance notes that increased data review is likely to be needed for hybrid systems, because they are vulnerable to non-contemporaneous recording and loss of context. It also says that where a system has no audit trail, a paper-based audit trail demonstrating changes can be an acceptable alternative, but only if it achieves equivalent control.
What to do instead:
- Validate and lock any spreadsheet used for GxP calculations, with protected cells and controlled versions
- Store them in an access controlled location, with a record of who changed what
- Define clearly which record is the primary record in each hybrid process
- Where possible, replace spreadsheets with validated, audit trailed systems
Habit 5: Undocumented Reprocessing, Backdating and “Tidying Up” Records
The habit: A chromatogram is reintegrated until the result looks right. An entry is added a day later and dated for the day of the activity. A signature is added to a record that was reviewed but not signed.
Why it triggers a major finding: Each of these changes the story the record tells. Reprocessing without a documented, justified procedure suggests testing into compliance. Backdating breaches the contemporaneous principle outright. Both are treated as potentially deliberate, which moves a finding from a quality system weakness into a question of integrity and culture.
What to do instead:
- Write a clear procedure for reintegration and reprocessing, including who may do it, when, and with what justification
- Retain the original and all reprocessed results with their audit trail
- Define how late entries are made, which should be dated with the actual date, with a reason
- Make it safe to report mistakes, so that people correct records openly rather than quietly
The Common Thread: Culture, Not Just Controls
All five habits share a root cause. They grow where people are under time pressure, where the system makes the right behaviour harder than the wrong one, and where nobody has been told why the control exists. Technology helps but does not fix this on its own. A well governed system with named data owners, clear review responsibilities and honest reporting of errors does more than any single tool.
Practical Steps for the Next 90 Days
- Run a short, unannounced walk-through of one lab and one production area, looking only for these five habits
- Map your critical data flows, from generation to archive, and identify where records leave a controlled system
- Review user access lists for every GxP system and remove shared and orphaned accounts
- Confirm that audit trail review is documented for every batch release decision
- Retrain supervisors first, since they set the real standard on the floor
- Record findings, actions and owners in the quality system, and follow them to closure
Closing Data Integrity Gaps Before an Inspector Finds Them
Finding these habits yourself is far less painful than having an inspector find them. Quality and Vigilance Ltd supports pharmaceutical companies with this kind of quality system review, alongside its core pharmacovigilance and regulatory affairs services covering the MHRA, EMA and FDA. An external view tends to spot the habits that internal teams have stopped noticing. The support that helps most usually includes:
- Data integrity gap assessments that follow data from generation to archive, rather than just reviewing SOPs
- Reviews of user access, audit trail configuration and audit trail review practice across GxP systems
- Practical SOPs and checklists for reprocessing, late entries, spreadsheets and hybrid records
- Training for supervisors and reviewers that explains why each control exists
- Mock inspections that test data integrity the way a regulator would
Get in touch with Quality and Vigilance Ltd today to close your data integrity gaps before the next inspection finds them.