Issue link: https://www.e-digitaleditions.com/i/1483907
www.biopharminternational.com Manufacturing and Facilities 2022 eBook BioPharm International ® 29 Audits And inspections Appropriate audit trail comments Manually entered audit trail comments should be suit- able for an auditor/inspector to read and should include the scientific rationale for why the change was made. GAMP 5 (9) provides audit trail requirements for an audit trail entry. Note: There may be character limitations, so it may be necessary to document justification outside of the electronic system and include a cross-reference. Manually entered comments will also require review and should be contemporaneous (within a reasonable exper- iment/review time frame). If time has elapsed, then the time gap should be supported with a justification. Conclusion ATR is a mechanism to detect potential critical changes to data and one means to ensure the quality and integ- rity of reported data. The authors have defined a prag- matic risk-based approach to ATR where ATR is only needed for high impact GxP data and that ATR can be targeted to focus specifically on critical changes that may be possible. This approach requires a fully doc- umented data risk assessment that encompasses the technical controls, identification of relevant high-risk impact data, which may vary on a per-organization basis. The preferred approach is to utilize technical controls wherever possible. ATR inherently remains a manual process that is resource intensive, and opportunities for automated data transfer/digitalization removes opportunity for critical changes negating the need for ATR where uti- lized. In addition, when a system has been configured to provide visual f lags for undesirable actions/states, or when the audit trail provides filtering or search- ing capabilities, these abilities may be leveraged to streamline ATR. References 1. FDA, Data Integrity and Compliance with Drug CGMP— Questions and Answers (Rockville, MD, December 2018). 2. MHRA,'GXP' Data Integrity Guidance and Definitions (London, UK, March 2018). 3. World Health Organization, Guideline on Data Integrity (Geneva, Switzerland, October 2019). 4. PIC/S, Good Practices for Data Management and Integrity in Regulated GMP/GDP Environments (Geneva, Switzer- land, November 2018). 5. US CFR, Title 21, Food and Drugs (Government Print- ing Office, Washington, DC), Part 211. 6. PIC/S Guidance PI 041-1: Good Practices for Data Man- agement and Integrity in Regulated GMP/GDP Environ- ments (July 2021). 7. J. Lippke et al., Pharm. Technol., 44 (8) (51–53) (2020). 8. ICH, Q9 Quality Risk Management (ICH, Geneva, 2005). 9. ISPE, GAMP 5: A Risk-Based Approach to Compliant GxP Computerized Systems (February 2008). ■ Evaluation of the need for system level audit trail review Mitigate high-risk system/data security elements by conducting audit trail review. Can system/data security elements be locked down from modification? System and Data security elements include: Data Security • Audit Trail security settings (such as deactivation • Ability to modify data paths/ folder structures • Ability to modify data back-up location/structure System Security • Create/modify user accounts/ roles including admin privileges • System configuration settings/ files • System policies Lock down system/data security elements from modification. No system audit trail review necessary. Yes Identify the system/data security elements that are not locked down from modification. No Evaluate these system/ data security elements based on risk assessment 7 . 7 J. Lippke, et. al., Assessing Data Integrity Risks in an R&D Environment, PharmTech 44(8), pp. 51-53, 2020. Document risk assessment for each of these system/ data security elements FIGURE 3. Decision tree for determining minimum system level audit trail review requirements. (7) J. Lippke, et. al., "Assessing Data Integrity Risks in an R&D Environment," Pharm. Technol. 44 (8) 51–53 (2020).