Review Controls
Audit Trails & Audit Trail Review
An audit trail that exists but is never reviewed provides evidence of activity to an inspector and no assurance to the organization. Design, verification and review are three separate obligations.
Audit trail design and verification
- Secure, computer-generated and time-stamped, independent of the user
- Captures creation, modification and deletion with old and new values
- Records who, what, when and — where required — why
- Cannot be disabled, edited or purged by ordinary users
- Retained with the record and retrievable in reviewable form
- Verified during qualification, not assumed from the vendor brochure
Risk-based review procedures
Reviewing every entry is neither feasible nor useful. A defensible procedure defines which events matter — deletions, result modifications, integration parameter changes, aborted runs, privilege changes, date/time alterations — and sets review frequency by risk, with escalation criteria and documented outcomes.
- Defined scope of critical events per system
- Frequency tied to risk and data criticality
- Reviewer independence from the data originator
- Documented review outcome, including “no exceptions”
- Escalation path when anomalies are found
Tooling
Audit trail review tools can filter noise and surface exceptions, which makes review sustainable at scale. The tool itself becomes part of the assurance scope when its output drives quality decisions.
Primary references
- FDA — Process Validation: General Principles and Practices
- FDA — Computer Software Assurance for Production and Quality System Software
- FDA — 21 CFR Part 11, Electronic Records; Electronic Signatures
- FDA — Data Integrity and Compliance With Drug CGMP
- FDA — General Principles of Software Validation
Information published on ValidationEngineering.com is educational and informational. It is not legal or regulatory advice and is not a guarantee of regulatory compliance or of any inspection outcome. Organizations remain responsible for their own quality decisions.
Next step
Building an audit trail review program?
Tell us how many systems are in scope and what review currently exists.