Digital Quality • GMP Data Integrity

Audit Trail Review for Computerized Systems: A GMP Guide

A practical guide to defining the scope, reviewers, timing, investigation triggers, and records for effective audit trail review in pharmaceutical computerized systems.

GMP Audit TrailsElectronic RecordsData Integrity

Quick answer: Audit trail review is the documented examination of system-generated records that show who did what, when, and—where available—why, in relation to GMP data or system settings. A sound program identifies the records and events that matter, defines who reviews them and when, sets clear criteria for unusual activity, records the outcome, and investigates discrepancies. Review scope and timing should be risk-based, while meeting the requirements of applicable GMP regulations and the site quality system.

What Is Audit Trail Review?

An audit trail is a secure, computer-generated history of relevant actions or changes associated with an electronic record or system. Depending on the system, it may show record creation, modification, deletion, reprocessing, configuration changes, user access, approvals, and related timestamps. The audit trail preserves context that may not appear on a final report or printout.

Audit trail review is the controlled evaluation of that history to confirm that significant changes are attributable, authorized, scientifically or procedurally justified, and consistent with the approved workflow. It helps a reviewer understand whether data were entered, changed, repeated, excluded, or approved appropriately.

A review is not just opening an audit-trail screen and signing a checklist. The reviewer needs enough context to distinguish expected activity from unusual or potentially unauthorized activity, and a defined route to escalate concerns.

Why Audit Trail Review Matters in GMP

Electronic data can be changed without altering the visible final result. A result may look acceptable even when an earlier value, method, sequence, configuration, or user action is important to its interpretation. Reviewing relevant audit trails alongside the associated GMP record can help preserve the record’s history and support informed quality decisions.

Reconstruct the record historyUnderstand creation, edits, approvals, and other events related to a GMP record.

Detect unexplained activityIdentify repeated tests, deleted entries, unusual changes, or access inconsistent with the workflow.

Support quality decisionsGive reviewers context needed to assess batch, laboratory, and investigation records.

Strengthen data governanceConnect system controls, user accountability, and documented review under the site quality system.

Effective audit trail governance supports cGMP and ALCOA+ data-integrity principles by helping maintain attributable, complete, consistent, and available records.

Regulatory Expectations for GMP Audit Trail Review

Regulatory expectations depend on the applicable jurisdiction, the type of record, and the system’s intended use. Procedures should cite the requirements that apply to the organization rather than treating one statement as a universal rule for every system.

• EU GMP Annex 11, Clause 9: Based on risk assessment, organizations should consider building system-generated audit trails for GMP-relevant changes and deletions. Audit trails should be available, convertible to a generally intelligible form, and regularly reviewed. The current EudraLex listing identifies Annex 11 as the January 2011 revision. Read Annex 11.
• FDA drug CGMP data-integrity guidance: FDA states that personnel responsible for record review under CGMP should review audit trails that capture changes to critical data associated with the record as they review the rest of the record. This makes audit trail review part of the relevant record-review process, not a detached administrative exercise. Read FDA guidance.
• 21 CFR Part 11, §11.10(e): For closed systems within scope, the regulation describes secure, computer-generated, time-stamped audit trails for operator actions that create, modify, or delete electronic records; changes must not obscure previously recorded information, and the audit trail is retained at least as long as the associated electronic record. Read §11.10.
• Predicate rules and record controls: Part 11 must be considered with the underlying record requirements. FDA’s Part 11 guidance recommends a documented, justified risk assessment for evaluating system impact on product quality, safety, and record integrity. Read FDA Part 11 Scope and Application.

Interpretation note: “Regularly reviewed” does not establish one fixed review interval for every system. Define review timing and depth in approved procedures using record criticality, process risk, applicable requirements, and the point at which the record is evaluated.

Which Audit Trails Should Be Reviewed?

Define scope by record and process, not by an assumption that every log entry in every application has equal GMP significance. The system risk assessment and data-flow map should identify audit-trail events that can affect a regulated decision or the meaning, completeness, or reliability of a record.

System or record type	Events to consider	Why review matters
Laboratory instrument or LIMS	Changes to results, calculations, integration parameters, methods, specifications, sample identity, sequence, reintegration, repeat testing, and result approval.	May affect analytical validity, sample traceability, reported results, or a release decision.
MES or electronic batch record	Changes to critical process values, instructions, material/equipment status, exception records, signatures, and batch-step completion.	May affect execution history, batch-record completeness, or disposition.
Quality management system	Changes to deviations, investigations, CAPA, controlled documents, approvals, and due dates.	May affect investigation integrity, action accountability, and controlled procedures.
Environmental monitoring system	Changes to sample locations, alert/action limits, results, invalidations, alarm acknowledgment, and trending inputs.	May affect contamination-control decisions and assessment of excursions.
Configuration and administration	Changes to roles, privileges, time settings, critical master data, audit-trail settings, and system configuration.	May affect reliability of the control environment or multiple records across workflows.
Interfaces and data transfers	Failed, duplicated, corrected, or manually reprocessed transactions; mapping or routing changes.	May affect completeness, identity, sequence, or accuracy of transferred records.

The table is a planning aid. Each site should determine applicable event types from system capability, intended use, risk assessment, and record-review responsibilities.

Who Should Review the Audit Trail?

Assign review to a trained person who understands the record and process well enough to recognize unusual activity. Independence should be appropriate to the risk and site procedure: a person reviewing their own action may not be able to provide the required independent quality oversight.

• Record or process reviewer: Reviews relevant audit trail information alongside the underlying batch, laboratory, or quality record.
• System owner: Maintains system configuration, user roles, audit-trail availability, and technical support for investigations.
• Quality Assurance: Defines or approves procedures, reviews escalations, and determines quality impact and disposition.
• IT or application administrator: Supports access, system logs, time synchronization, data retrieval, and technical investigation.
• Data owner or laboratory/manufacturing lead: Provides process context for interpreting events and assessing their significance.

Procedures should identify responsibilities for routine review, exception investigation, approval, escalation, and access to audit-trail data. Training should cover both system use and the meaning of the events being reviewed.

Risk-Based Review Frequency and Scope

Review timing should reflect the record’s criticality and the decision it supports. Where audit trails are associated with a GMP record that receives formal review, relevant critical-data changes should be considered as part of that record review in line with applicable guidance. Separately, system-level or configuration audit trails may require periodic or event-triggered review according to risk.

Do not rely on an arbitrary calendar interval without considering when a discrepancy could affect product quality or a regulated decision. Equally, do not assume that every event must be reviewed in real time. Set a justified schedule and triggers in the approved procedure, and define how temporary review backlogs are escalated.

Review approach	Best suited for	Procedure should define
Record-linked review	Audit-trail entries associated with a specific batch, test, sample, or quality record.	Which events are relevant, reviewer role, review point, acceptance criteria, and record linkage.
Periodic review	System or administrative events that affect ongoing control but are not linked to a single routine record.	Frequency rationale, population/time window, filters, sampling or full review rules, and escalation.
Event-triggered review	Security events, configuration changes, incidents, data-integrity signals, or unexpected system behavior.	Trigger source, response time, investigation owner, affected-record scope, and required approvals.
Retrospective review	Defined historical review following a confirmed issue or newly identified risk.	Time period, systems and records in scope, selection method, impact assessment, and rationale for closure.

FDA’s drug CGMP data-integrity guidance specifically describes review of audit trails capturing changes to critical data as part of review of the associated record. EU Annex 11 also says audit trails should be regularly reviewed. The local procedure should translate these principles into a risk-based, operational schedule.

Step-by-Step Audit Trail Review Procedure

1. Identify the record and review window. Confirm system, record ID, user/process context, relevant date range, and applicable SOP or review procedure.
2. Retrieve the correct audit trail. Use an approved, validated function or controlled report. Confirm that the view covers the complete period and relevant event categories.
3. Confirm reviewer readiness. Check that the reviewer has appropriate training, role permissions, and independence for the assigned review.
4. Compare changes with the underlying record. Reconcile critical values, results, methods, approvals, and timestamps against source and final records where relevant.
5. Assess the event context. For each relevant change, consider who acted, when it occurred, what changed, why, authorization, sequence, and impact on the GMP decision.
6. Evaluate exceptions and unusual patterns. Investigate repeated edits, unexplained deletions, unusual repeat tests, out-of-hours access, failed logins, role changes, or incomplete records when relevant to risk.
7. Document review outcome. Record the scope, filters or report used, date, reviewer, exceptions, references, conclusion, and any follow-up actions.
8. Escalate discrepancies promptly. Preserve relevant records, notify Quality and system owners, assess affected products or records, and initiate deviation or CAPA processes as required.
9. Close actions with evidence. Confirm corrections, investigations, impact assessments, and approvals are complete before closing the review or related record.

Use an approved SOP to define the workflow, responsibilities, and records. The system’s validation should also establish that audit-trail data can be generated, retrieved, interpreted, and retained as intended. See Computerized System Validation for the broader lifecycle context.

What Reviewers Should Look For

A good review is guided by specific questions. A reviewer should not treat every unusual entry as evidence of misconduct, but should ensure that unexplained or unauthorized activity is not ignored.

• Do the user, date, time, and action correspond to the approved workflow and personnel records?
• Are original values preserved and changes attributable, with an adequate reason where required by procedure or system design?
• Are repeated tests, injections, calculations, or processing steps explained and properly linked to the final result?
• Were records invalidated, deleted, overwritten, or excluded? Is the rationale approved and documented?
• Were methods, specifications, calculations, limits, or master data changed before the relevant result or decision?
• Do timestamps, sequence numbers, and associated records tell a coherent chronology?
• Are signatures, approvals, and roles appropriate for the action performed?
• Do interface logs reconcile with source and receiving systems?
• Are there failed or unusual access attempts, privilege changes, or administrator actions that need investigation?
• Are audit-trail settings enabled and retention controls consistent with the system requirements?

Red Flags That Require Follow-Up

Observation	Possible concern	Suggested response
Critical value changed after review or approval	Approval sequence, authorization, or record integrity may be affected.	Preserve the history, determine the reason and approver, assess impact, and route through deviation/change control.
Repeated tests or processing with only a passing result reported	Unexplained selection or exclusion of data may affect the scientific conclusion.	Review all attempts and rationale, evaluate procedure compliance, and assess associated samples/batches.
Deleted or invalidated entries without an adequate reason	Record history may be incomplete or the change may be unauthorized.	Confirm that the original remains retrievable, investigate the action, and assess whether other records are affected.
Audit-trail entries missing or time sequence inconsistent	System configuration, clock synchronization, retention, or record generation may be deficient.	Engage system owner/IT, determine scope, preserve evidence, and assess validated state and data impact.
Shared accounts or administrator changes without review	Actions may not be attributable or privileges may be misused.	Investigate access control, review relevant activity, correct accounts/roles, and evaluate the period of exposure.
Review completed without identifying the exact report or period	Evidence may not demonstrate what was reviewed.	Improve review record template and retrain reviewers; reassess whether affected reviews need repetition.

These are investigation signals, not automatic conclusions. Assess each observation using facts, system behavior, process context, and documented quality risk management.

How to Document Audit Trail Review

Review records should be complete enough for another qualified reviewer to understand what was examined and what conclusion was reached. A checklist can help standardize the process, but it should not replace meaningful evaluation.

• System name, unique record identifier, module, and version where relevant.
• Record type, process, review period, and audit-trail report or query used.
• Event categories or filters included and any justified exclusions.
• Reviewer name, role, date/time, and required second-person or QA approval.
• Relevant changes, rationale, authorization, and reconciliation to the underlying record.
• Exceptions, investigation/deviation/CAPA references, and affected-record or product assessment.
• Conclusion, open actions, escalation, and documented closure.

Records should be attributable and contemporaneous, and the audit-trail output should remain readable and retrievable. Preserve the audit-trail data itself along with the reviewed record for the applicable retention period.

Responding to an Audit Trail Discrepancy

When a reviewer identifies unexplained, unauthorized, or potentially consequential activity, the immediate response is to protect the evidence and understand the scope. Do not edit or “clean up” the audit trail. Follow the site procedure and involve Quality promptly.

1. Preserve the electronic record, audit-trail output, relevant system logs, and any source data.
2. Open a deviation or investigation according to the quality system and define an initial risk assessment.
3. Identify affected records, users, products, time periods, interfaces, and related systems.
4. Determine whether the event was authorized, technically explainable, procedural, or potentially intentional.
5. Assess impact on data validity, product quality, release decisions, patient safety, and regulatory records.
6. Implement containment or interim controls where needed; document rationale and approvals.
7. Establish root cause, corrective/preventive actions, effectiveness checks, and retrospective review scope when justified.

Link the investigation to the organization’s CAPA process when systemic corrective action is needed. A risk-based retrospective review should have a defined population and rationale, not an arbitrary sample chosen for convenience.

Common Audit Trail Review Mistakes

• Reviewing only the final value: The history and context may explain how the reported value was generated.
• Signing a generic “reviewed” box: The record should show what was reviewed and the outcome.
• Ignoring critical-data changes: Changes to values tied to decisions should be considered with the associated record review.
• Using a system-wide one-size schedule: Different record types and risks may require different timing or review depth.
• Relying only on audit-trail review: Prevention, access management, system validation, training, and data governance are also needed.
• Failing to investigate repeated processing: Repeat tests, re-integrations, and invalidations need scientifically and procedurally sound explanations.
• Allowing administrators to self-review high-risk changes: Define suitable independence and quality oversight.
• Not verifying the audit trail is complete and readable: A review cannot be effective if events are missing, filtered incorrectly, or not retained.

Audit Trail Review Checklist

• Is the audit-trail review procedure current, approved, and linked to applicable records?
• Are systems and GMP-relevant record types identified through a documented risk assessment?
• Does the review include changes to critical data associated with the record?
• Are audit trails retrievable, readable, time-aligned, and retained with the relevant records?
• Are review roles, qualifications, independence, timing, and escalation paths defined?
• Do reviewers compare changes with source data, results, approvals, and process context?
• Are repeated tests, reprocessing, deletions, invalidations, and failed actions evaluated?
• Are review results, query parameters, exceptions, and conclusions documented clearly?
• Are discrepancies investigated, impact assessed, and CAPA actions tracked to effectiveness?
• Are audit-trail settings, system updates, and access changes included in change control and periodic review?

Frequently Asked Questions

What is audit trail review in a pharmaceutical computerized system?

It is the documented examination of system-generated history for relevant electronic records or settings. The reviewer evaluates who performed an action, when it occurred, what changed, and whether the event was authorized and consistent with the record and process.

Does every audit trail entry need to be reviewed?

The review scope should be defined by applicable requirements, intended use, and documented risk assessment. Procedures should identify GMP-relevant events and critical data changes that need review, while also addressing system-level events that could affect records or controls.

How often should GMP audit trails be reviewed?

There is no single interval appropriate for all systems and records. Define timing in an approved procedure based on record criticality, process risk, applicable requirements, and when the associated record is reviewed. EU GMP Annex 11 says audit trails should be regularly reviewed.

Who is responsible for reviewing audit trails?

Trained personnel with process and record context should perform the review, with roles assigned in the quality system. Quality Assurance, process owners, system owners, IT, and data owners may support review or investigation depending on the event and risk.

What should an audit trail show?

Depending on system design and applicable requirements, it should preserve relevant history such as the identity of the user, date and time, action or change, prior and new values where applicable, and reason or context when captured. Changes should not obscure the original record history.

Is an audit trail review the same as a system log review?

No. An audit trail is associated with records or system actions and supports reconstruction of changes. Technical logs may capture events such as errors, access, services, or infrastructure activity. Both may be relevant, but they have different purposes and review criteria.

Should audit trails be reviewed with batch or laboratory records?

Relevant audit trails should be reviewed alongside associated GMP records when applicable. FDA drug CGMP data-integrity guidance states that record reviewers should review audit trails capturing changes to critical data as they review the rest of the record.

What should happen if an unexplained change is found?

Preserve the record and audit-trail evidence, notify Quality, open the appropriate investigation, identify affected records and products, assess quality and data-integrity impact, and implement documented corrective actions through the site quality system.

Are audit trail reviews required under 21 CFR Part 11?

21 CFR Part 11 §11.10(e) describes controls for secure, time-stamped audit trails in closed systems within scope. Whether Part 11 applies depends on the electronic records and signatures involved and should be assessed together with applicable predicate rules and FDA guidance.

Can software filters be used during audit trail review?

Filters can make review efficient, but they should be validated or otherwise controlled as appropriate, defined in the procedure, and shown to include the relevant event population. Document the query, date range, filters, exclusions, and rationale so the review is reproducible.

Conclusion

Effective audit trail review connects electronic history with the GMP record and the decision it supports. Define the relevant events, assign qualified reviewers, set risk-based timing, investigate anomalies, and keep a clear record of the review and its conclusion. When these steps are part of a broader Computerized System Validation and data-integrity program, audit trails become useful evidence rather than a collection of unread logs.

For related reading, see ALCOA+ data integrity, 21 CFR regulations, and CAPA in pharmaceuticals.

Official References

• European Commission: EU GMP Annex 11 — Computerised Systems
• European Commission: EudraLex Volume 4 — EU GMP Guidelines
• FDA: Data Integrity and Compliance With CGMP Guidance for Industry
• FDA: Part 11, Electronic Records; Electronic Signatures — Scope and Application
• Electronic Code of Federal Regulations: 21 CFR §11.10 — Controls for Closed Systems

Use note: This article is an educational guide, not a substitute for current regulations, qualified quality-system decisions, or site-specific procedures. Confirm applicable jurisdiction, record type, system scope, and current controlled requirements before implementation.