Bob McDowell is an analytical chemist who has been involved with specifying laboratory informatics solutions for over 40 years and has nearly 35 years’ experience of computerized system validation in regulated GXP environments.
Data integrity problems continue to plague the pharmaceutical industry – especially in regulated laboratories – with violations still being identified by health authority inspectors over 18 years after the Able Laboratories fraud case.
The aim of this guide is to provide practical advice on how to reduce data integrity risk and ensure GxP compliance. Learn from those in the industry who have failed to comply with data integrity regulations and who have been on the receiving end of an FDA inspection.
Download this guide to discover ways to prevent data integrity issues from arising, including:
Improving manual colony counting practices
Implementing informatics solutions to automate and enforce working practices
Utilizing instrument logbooks effectively
How to Guide
How To Reduce Data Integrity Risk
Bob McDowall, PhD
Data integrity problems continue to plague the pharmaceutical industry – especially in regulated laboratories – with violations still being identified by health authority inspectors over 18 years after the Able
Laboratories fraud case.1
This is despite guidance issued by various regulators2,3,4,5,6
and industry bodies7,8,9,10,11 that include advice for ensuring that data and records are protected and comply with applicable
The aim of this guide is to provide practical advice on how to reduce data integrity risk and ensure GxP
compliance. We will learn from those in the industry who are expert at failing to comply with data integrity
regulations and who have been on the receiving end of an FDA inspection. We will use citations from a
recent and extensive 483 observation issued to a single organization in December 2022.12
We will present and analyze selected citations to identify the reasons for failure. We will then suggest
ways to prevent reoccurrence or, for readers who are more proactive, prevent the issue from arising in
their own laboratories. Some remediation suggestions will involve laboratory automation. Before senior
management has collective heart failure in response to this proposal, know that automation will be accompanied by improvements in business benefits that will more than offset the cost, including validation.
The approaches outlined here could also be useful for non-regulated laboratories to improve efficiency.
Manual colony counting
Observation 1 item 2 in the citation targeted the practice of manual colony counting on microbiological
plates. This process is slow and error prone and inevitably generates regulatory interest. The relevant
section of the citation reads:
Laboratory records do not include complete data derived from all tests … to assure compliance with established specifications and standards. For example,
1. Environmental monitoring samples were not counted accurately. On November 22, 2022, review of plates
from QC1 that had been counted by one analyst and checked by a second analyst found the reported
result to be less that the number of colonies on the plate. ….
2. Microbiology personnel reported the laboratory practice was to count colonies that merge together,
with similar morphology, as one colony. Review of plates showed this practice resulted in under counting of colonies.
HOW TO REDUCE DATA INTEGRITY RISK 2
How to Guide
Under reporting of colonies means that potential out of specification (OOS) results are hidden and failing
batches are passed or rooms that are meant to be clean become potential sources for microbiological
contamination. After manual counting and a second-person review, the plates are thrown away after with
no record other than what is written down in the analytical batch record. This provides no objective record
for an inspector or an auditor to assess if the recorded value is correct. The inspectors were able to review current plate counting on a specific day before the plates were discarded.
What the citation does not state is by how much the counts were under reported or if it was deliberate.
However, counting merged colonies is unscientific and deliberate falsification.
A solution is to use an automated colony counter that also produces a photographic record for each plate
counted. Simple manually fed colony counters can read and photograph one plate at a time. Depending
on the number of plates to be read, an automated plate feeder in combination with a bar code reader to
positively identify plates would be a better option as it removes labor from the process. Instrument purchase and validation costs will be offset with the gains in productivity.
Lack of instrument printouts
An apocryphal good manufacturing practice (GMP) saying is that if it’s not written, it’s a rumor, which can
be modified for this example, to if it’s not printed, it’s a rumor, as seen in the next 483 citation from observation 1 item 3:
b) pH printouts and recording of description associated with the <redacted> and <redacted> samples from
<redacted> could not be provided.
This is gross incompetence indicating a lack of basic GMP training and a total failure of the pharmaceutical quality system. Systematic failures here were:
1. The analyst failed to document their work and failed to print the pH values obtained for an instrument
check and sample analysis.
2. A failure of design in the analytical batch record, which should have prompted the analyst to document these results.
3. The second-person reviewer failed to identify the lack of documented evidence.
4. Training of the performer and reviewer has failed totally.
5. Procedures were not followed or not created in the first place.
6. Quality oversight is conspicuous by its absence.
If this is the situation for pH measurement, what other data chasms exist in this laboratory, especially for
more complex analyses? I’m not convinced that retraining analysts and reviewers would work and therefore automation is a pre-requisite to solve the problem.
Long-term remediation requires an informatics solution to automate and enforce working practices and
ensure that data are collected from any interfaced instruments. The analyst would not be able to proceed
with the analysis unless the instrument measurement was captured by the application. A solution should
not require an analyst to press a SEND button on the instrument, as this allows them to select a “correct”
result and all that is gained is electronic data falsification. Automate the whole process.
HOW TO REDUCE DATA INTEGRITY RISK 3
How to Guide
Paper records would also be eliminated by taking this approach, which would speed the analysis and
review but also enable verifiable quality oversight.
Uncontrolled manual chromatographic peak integration
In chromatography, peak integration is a critical process requiring control of manual integration parameters due to multiple instances of falsification found during inspections since 2005.1
This is an area of
great regulatory interest. Inspection of chromatograms and peak integration revealed inconsistencies
that led to observation 2, item 1:
There is no procedure describing the use of manually entered integration events, including baseline
points, tailing sensitivity and peak slice for processing chromatography data. …. The reviewers only review the final chromatogram and do not review the processed chromatogram to ensure that the manually entered integration events are justified.
Procedure SE/BQC/00165 Interpretation of Chromatograms requires manual integration be documented
clearly stating the reason the manual integration was performed and the initials of the section head for
approval. But when analysts manually enter integration events to force the software to integrate in a specific way, there is no similar documented justification and approval process ... For example (this is one of
several observations that has been selected for discussion here):
... Additionally, the 6-month accelerated time point for the same lot <redacted> was integrated manually
by adding a fronting sensitivity and a tailing sensitivity factor to the peak for impurity <redacted> but not
for the standard of the same impurity. This reduced the area of the impurity compared and gave a result
of <redacted>% compared to a limit of <redacted>%. When the fronting and tailing sensitivity factors are
removed to ensure integration of the impurity compared with the standard, the reportable result changes
to <redacted>%, a value that would have required an investigation.
First and foremost, there needs to be a procedure for integration of chromatographic peaks that is applicable to all laboratory staff. Changes made by an analyst must be justified. The journey from first to last
processing must be traceable and complete to ensure data integrity. While there is a procedure, it was not
The major problem with the laboratory work is a failure to be scientifically sound as required by 21 CFR
211.160(b): … the establishment of scientifically sound and appropriate specifications, standards, sampling
plans, and test procedures….13 Chromatography is a comparative and not an absolute analytical technique,
therefore standards and samples must be integrated the same way. As the inspectors found, treating
samples and standards differently has hidden an out-of-specification result and avoided an investigation.
This is data falsification.
We have moved on from test injections in the early days of data integrity violations to subtle changes in
integration that may be difficult for an auditor or inspector to identify unless they take sufficient time to
look in detail at manual peak integration.
Resolution may be found by using technical controls to limit manual integration for main assays within
a chromatography data system. However, there is a problem with impurity analysis as we may be very
close to limits of quantification and manual integration may be the only way of measuring peaks. Training is essential along with effective review and quality oversight, coupled with management leadership
about what are acceptable and unacceptable practices. However, there is much doubt if this company can
HOW TO REDUCE DATA INTEGRITY RISK 4
How to Guide
Instrument logbooks are critical for data integrity
Instrument maintenance and use logbooks are mandatory under both US and EU GMP regulations13,14 and
are the unsung heroes of data integrity. Logbooks provide corroborating evidence of activities performed
with instrumentation and are also used to correlate activities in the controlling computerized system including the audit trail entries with printouts from the system. If the system is electronic or there are only
printouts from an instrument, the role of the logbook remains the same.
The 483 observation 3 item 1(a) is quoted at some length for you to understand that instrument logs must
be completed and analysts must be trained to do this every time with no exceptions. Reviewers also
must be trained to ensure that entries are complete and consistent. As for QA and Management they are
conspicuous by their absence except when it comes to making excuses.
There were no weight-specific entries in your LIMS Instrument Usage Logbook for the time recorded in
any of the balance printouts. Your Associate Executive Vice-President of Corporate Quality and Compliance and Manager of QC stated that the weighing activities recorded on the Instrument Usage Log is not
a true representation of samples weight with start and end time for each weighing activities for a specific
lot of a product. Further, there is no consistency among QC employees in term of recording information in
LIMS logbook pertaining to a total number of lots tested. Some QC employees may enter this information
whereas others may not, leaving no traceability for the exact number of lots tested and their start and
end time of analysis.
This issue is applicable to all analytical instrument in your QC laboratory …. For example, the time stamp
on each of the balance printout and <redacted> spectrum did not match with your LIMS Instrument Usage Log record for samples weighed and analyzed. There follows a list of time differences, torn balance
printouts, suspicious balance weights between “real” and torn printouts. 12
To have an associate executive vice-president of corporate quality and compliance state to an FDA inspector that only some analysts complete logbook entries implies that the individual knows of the problem. The individual is in a senior management role with the power to do something but has done nothing
The main problem is that instrument logbooks are still paper and must be completed manually. A suggested fix involves incorporating automatic instrument logs, like audit trails, into instrument data systems
but software suppliers only respond to market forces.
Have you got a GMP shredder?
I leave the worst citation to the last as Observation 3, item 1 has the following citation:
The responsibilities and procedures applicable to the quality control unit are not fully followed.
As we shall see this is a vast understatement.
Specifically, there is a cascade of failure in your Quality Unit’s lack of oversight on the control and management of GMP documents that are critical in ensuring the drug products manufactured and tested at
your site are safe and effective.
Summarizing the observation: QC, Production and Engineering employees destroying GMP documents by
tearing it into pieces and disposed in scrap areas. Additionally, we found a truck full of transparent plastic bags
containing shredded documents and black plastic bags containing document torn randomly into pieces….12
HOW TO REDUCE DATA INTEGRITY RISK 5
How to Guide
This is industrial-scale destruction and falsification of records for which there are no excuses. The 483
obervation identifies several torn records in detail as well as attempts to hide destroyed evidence and
lying to the inspectors.
My resolution for this violation is very simple. Fire all employees and raze the facilities to the ground.
There is an apocryphal phrase never assume malice when stupidity will suffice. However, the citations in
this 483 Form provide ample evidence of both malice and stupidity.12 This conclusion arises from evaluating the systematic problems with the pharmaceutical quality system, lack of record keeping, inconsistent
documents, inadequate review in the lab coupled with abysmal quality and management oversight highlighted in the 483 observations. Many of the observations discussed suggest incompetence, and we have
highlighted how automation can be used to remediate these processes.
However, peak integration manipulation, manual colony counting, hiding destroyed records, lying to
inspectors and the evidence of a truck full of shredded and torn GMP records being driven off-site shows
that malice in the form of industrial scale falsification is abundantly present.
Learn from this company to avoid data integrity citations.
1. United States Food and Drug Administration. Able Laboratories Form 483 Observations. Silver Spring, MD: United States
Food and Drug Administration. 2005. Available from: https://www.fda.gov/media/70711/download
2. Medicines and Healthcare products Regulatory Agency. MHRA GMP Data Integrity Definitions and Guidance for Industry 2nd
Edition. London: Medicines and Healthcare products Regulatory Agency. 2015. Available from: https://assets.publishing.
3. Medicines and Healthcare products Regulatory Agency. MHRA GXP Data Integrity Guidance and Definitions. London: Medicines and Healthcare products Regulatory Agency. 2015. Available from: https://www.gov.uk/government/publications/
4. World Health Organisation. WHO Technical Report Series No.996 Annex 5 Guidance on Good Data and Records Management
Practices. Geneva: World Health Organisation. 2016. Available from: https://www.who.int/publications/m/item/trs-966---annex-5-who-good-data-and-record-management-practices
5. United States Food and Drug Administration. FDA Guidance for Industry Data Integrity and Compliance With Drug CGMP
Questions and Answers. United States Food and Drug Administration. Silver Spring, MD: United States Food and Drug
Administration. 2018. Available from: https://www.fda.gov/regulatory-information/search-fda-guidance-documents/data-integrity-and-compliance-drug-cgmp-questions-and-answers
6. Pharmaceutical Inspection Convention / Pharmaceutical Inspection Cooperation Scheme. PIC/S PI-041 Good Practices for
Data Management and Integrity in Regulated GMP / GDP Environments Draft. Geneva: Pharmaceutical Inspection Convention
/ Pharmaceutical Inspection Cooperation Scheme. 2021. Available from: https://picscheme.org/docview/4234
7. International Society for Pharmaceutical Engineering. GAMP Guide Records and Data integrity. Tampa, FL: International
Society for Pharmaceutical Engineering. 2017. Available from: https://ispe.org/publications/guidance-documents/gamp-records-pharmaceutical-data-integrity
8. International Society for Pharmaceutical Engineering. GAMP Good Practice Guide: Data Integrity - Key Concepts. Tampa, FL:
International Society for Pharmaceutical Engineering. 2018. Available from: https://ispe.org/publications/guidance-documents/gamp-good-practice-guide-date-integrity-key-concepts
HOW TO REDUCE DATA INTEGRITY RISK 6
How to Guide
9. International Society for Pharmaceutical Engineering. GAMP Good Practice Guide: Data Integrity by Design. Tampa, FL:
International Society for Pharmaceutical Engineering. 2020. Available from: https://ispe.org/publications/guidance-documents/gamp-rdi-good-practice-guide-data-integrity-design
10. Parenteral Drug Association (PDA). Technical Report 80: Data Integrity Management System for Pharmaceutical Laboratories. Bethesda, MD:Parenteral Drug Association (PDA). 2018. Available from: https://www.pda.org/bookstore/product-detail/4542-tr-80-data-integrity-management
11. Active Pharmaceutical Ingredients Committee. Practical risk-based guide for managing data integrity, version 1. Brussels:
Active Pharmaceutical Ingredients Committee.2019. Available from: https://apic.cefic.org/pub/Data_Integrity_Best_Practices_Guide_for_API_FINAL_March-2019.pdf
12. United States Food and Drug Administration. Intas Pharmaceuticals Limited Form 483 Observations. Silver Spring, MD:
United States Food and Drug Administration. 2022 Available from: https://www.fda.gov/media/164602/download
13. United States Food and Drug Administration. 21 CFR 211 - Current Good Manufacturing Practice for Finished Pharmaceuticals. Silver Spring, MD. United States Food and Drug Administration. 1978. Available from: https://www.ecfr.gov/current/
14. European Commission. EudraLex - Volume 4 Good Manufacturing Practice (GMP) Guidelines, Chapter 4 Documentation. Brussels: European Commission. 2011. Available from: https://health.ec.europa.eu/medicinal-products/eudralex/eudralex-volume-4_en