The Recurring Patterns Behind Data Integrity Findings

Shared accounts and unmanaged privileges

A shared login means no record attributable to an individual. Analyst-level administrative rights mean audit trails and system clocks can be altered by the same person generating the data. Both are structural problems: no amount of procedural control makes the resulting records attributable.

Data that exists outside the official record

Local instrument workstations, personal spreadsheets, screenshots pasted into reports and temporary folders all create records that the quality system does not manage. The question that exposes this is simple: if this workstation's drive failed today, what would be lost, and would anyone know?

Incomplete data

• Trial or equilibration injections not retained or explained
• Aborted runs deleted rather than documented
• Reprocessing without recorded justification
• Manual integration applied without controlled criteria
• Repeat testing without an investigation trail

Audit trails configured but never reviewed

An audit trail that nobody reviews is a control on paper only. Risk-based review means defining which events matter — changes to results, methods, integration parameters, clocks, privileges — and reviewing those on a defined frequency, with the review itself recorded.

Hybrid workflows with no declared official record

When a system produces electronic data and the workflow prints a report for signature, the organization must state which is the official record and control it accordingly. Ambiguity here undermines both the paper and the electronic side.