Pharmaceutical GMP • Audit readiness • Data integrity

Computerized System Audit Checklist for Pharma

A practical, risk-based guide to auditing computerized systems used in pharmaceutical quality, manufacturing, laboratory, warehouse, and distribution activities. Use the questions and evidence prompts to plan an internal audit, supplier assessment, or periodic system review.

Best forQA, CSV, IT, QC, production, and supplier-audit teams

Audit lensPatient risk, product quality, record integrity, and intended use

FormatChecklist, evidence examples, workflow, and FAQs

Quick answer: A pharmaceutical computerized-system audit checks whether a system remains fit for its intended GMP use and whether its records, data, configuration, access, audit trails, interfaces, backup, and operating procedures are controlled. The audit scope should follow documented risk to patients, product quality, and data integrity. This checklist is a planning aid—not a substitute for applicable regulations, system validation, or site procedures.

Key Takeaways

• Start by identifying the system’s GMP purpose, regulated records, data flows, interfaces, and accountable process owner.
• Trace representative records from creation through review, approval, retention, retrieval, and any required transfer or submission.
• Review user access, privileged accounts, audit-trail functionality and review, electronic signatures, backup restoration, change control, and incident handling.
• Apply a risk-based approach: test controls that protect critical decisions and records more deeply than low-impact functions.
• Record evidence, gaps, impact assessment, owners, due dates, and effectiveness checks; do not treat a completed checklist as proof of compliance by itself.

What Is a Computerized System Audit in Pharma?

A computerized system audit is a documented, evidence-based assessment of the controls around a software application and its supporting technology when they are used in a regulated pharmaceutical activity. The system may include application software, configured workflows, databases, interfaces, instruments, operating systems, infrastructure, service providers, and the procedures people follow.

Examples include a laboratory information management system (LIMS), chromatography data system (CDS), electronic batch record, manufacturing execution system (MES), ERP, quality management system, environmental monitoring system, stability platform, or a building-management application that supports a GMP environment.

An audit asks whether the approved system and its current operating state continue to support the intended process. It examines records and controls—not just whether a vendor supplied a certificate or a validation package exists. For lifecycle context, see this overview of Computerized System Validation.

Audit, Validation, Periodic Review, and Inspection: How They Differ

Activity	Main question	Typical timing
Validation	Is the system fit for its intended use, with requirements and risks addressed by documented evidence?	Before regulated use and following defined changes or lifecycle events
Computerized-system audit	Are governance, technical, procedural, and supplier controls working and supported by evidence?	According to the audit program, risk, supplier criticality, or a defined trigger
Periodic review	Has the system remained in a controlled state, and have relevant changes, incidents, access, and performance been assessed?	At a justified interval established by the quality system
Regulatory inspection	Can the organization demonstrate compliance and provide requested records to an authority?	At the discretion of the regulatory authority

These activities support one another but are not interchangeable. A supplier audit does not transfer the regulated company’s responsibility for its process, records, or system oversight. Likewise, a system audit cannot retroactively establish that the system was validated before use.

Regulatory and Guidance Framework to Consider

Determine which requirements apply based on product, market, activity, records, and the system’s intended use. Do not apply a regulation by acronym alone. For example, 21 CFR requirements may be relevant to a US-regulated operation, while EU GMP applies to activities in its scope.

Source	Audit relevance	Official reference
21 CFR Part 211	GMP controls for finished pharmaceuticals, including computer or related systems, records, review, and retention as applicable.	Electronic Code of Federal Regulations
21 CFR Part 11	Criteria for electronic records and electronic signatures when the rule applies; scope should be assessed with applicable predicate-rule records.	eCFR Part 11 and FDA Scope and Application guidance
FDA data-integrity guidance	FDA recommendations and explanations concerning CGMP data integrity, metadata, audit trails, access, and record review.	FDA Data Integrity and Compliance With Drug CGMP
EU GMP Annex 11	Principles for computerized systems used as part of GMP-regulated activities, including risk management and lifecycle controls.	European Commission EudraLex Volume 4
PIC/S PI 041-1	Inspector guidance on data management and integrity in regulated GMP/GDP environments; use it as relevant guidance, not as a replacement for local law.	PIC/S publications

Version note: The European Commission’s EudraLex page lists Annex 11 as revised in January 2011 and separately publishes consultation material on proposed revisions. Confirm the current status and applicable local implementation before treating draft text as a final requirement.

In the United States, 21 CFR 211.68 addresses use and control of automatic, mechanical, and electronic equipment, including routine checks and controls over changes to records. Part 11 is not a label that automatically applies to every digital tool: assess whether electronic records or signatures fall within Part 11 in light of the applicable predicate requirements and FDA guidance.

How to Use This Computerized System Audit Checklist

1. Define scope: name the system, version, sites, business process, interfaces, regulated records, and audit purpose.
2. Set the criteria: identify applicable laws, guidance, approved procedures, validation documents, contracts, and internal controls.
3. Assess risk: consider patient impact, product-quality decisions, data criticality, detectability of errors, system complexity, and supplier reliance.
4. Request evidence: obtain approved documents and read-only system demonstrations before fieldwork.
5. Sample real records: trace a small number of representative records and events end-to-end, selecting higher-risk transactions.
6. Interview and observe: compare written procedures with actual user, administrator, reviewer, and support practices.
7. Document outcomes: record evidence, objective facts, impact, classification under the site’s procedure, action owner, due date, and effectiveness criteria.

Use the checklist as a prompt set. Mark each question Yes, Gap, N/A, or Follow-up, and state the evidence reference. A “Yes” without verifiable evidence is not a sound audit conclusion.

Computerized System Audit Checklist for Pharmaceutical Facilities

The following table provides audit questions and example evidence. Tailor it to the process and system; not every item applies to every application.

Audit area	Questions to ask	Evidence to sample	Result
1. Scope and ownership	Is the system in the inventory? Is its GMP purpose, process owner, system owner, data owner, site, version, and boundary documented?	System inventory, process map, ownership matrix, intended-use statement	☐ Yes ☐ Gap ☐ N/A
2. Risk classification	Is risk assessed for patient safety, product quality, and data integrity? Are critical records, decisions, and functions identified?	Approved risk assessment, data-flow map, criticality rationale, mitigations	☐ Yes ☐ Gap ☐ N/A
3. Requirements and design	Are requirements clear, approved, traceable, and consistent with intended use? Are configuration and design decisions controlled?	URS, functional/design specifications, traceability matrix, configuration baseline	☐ Yes ☐ Gap ☐ N/A
4. Validation status	Is there documented evidence that the current version and configuration were tested for intended use? Are deviations and unresolved defects assessed?	Validation plan/report, test scripts/results, defect log, release approval, IQ/OQ/PQ where used	☐ Yes ☐ Gap ☐ N/A
5. User access	Are accounts unique? Are role privileges appropriate? Are access grants, changes, periodic reviews, leavers, and emergency access controlled?	User list, role matrix, access approvals, recertification, joiner/mover/leaver records	☐ Yes ☐ Gap ☐ N/A
6. Administrator and vendor access	Are privileged accounts limited, attributable, monitored, and periodically reviewed? Is remote vendor access approved, time-bound, and logged?	Admin roster, privileged activity logs, service tickets, remote-access records, vendor agreement	☐ Yes ☐ Gap ☐ N/A
7. Audit trails	Where required or risk-justified, do audit trails capture relevant creation, modification, deletion, and configuration events with attributable user, date/time, and change context? Are they protected and reviewable?	Audit-trail settings, sample events, time synchronization, permissions, review records	☐ Yes ☐ Gap ☐ N/A
8. Audit-trail review	Does the procedure define what is reviewed, by whom, when, and how exceptions are handled? Are critical-data changes reviewed with the associated record where applicable?	Review SOP, completed reviews, exception investigations, evidence of reviewer independence where needed	☐ Yes ☐ Gap ☐ N/A
9. Electronic records and signatures	Are record meaning, signature meaning, signer identity, date/time, and record-signature linkage clear? Is Part 11 applicability documented where relevant?	Applicability assessment, signature settings, sampled signed records, signature manifestation, policies	☐ Yes ☐ Gap ☐ N/A
10. Data and metadata	Can the complete record—including relevant metadata and context—be retrieved and understood? Are raw/source data retained when required, not merely a summary or printout?	Original electronic records, metadata, processing method, sequence, report, exported/printed record comparison	☐ Yes ☐ Gap ☐ N/A
11. Master data and configuration	Are recipes, methods, specifications, templates, calculations, and permissions approved, version-controlled, tested, and protected from unauthorized change?	Master-data change history, approvals, effective dates, verification, change-control records	☐ Yes ☐ Gap ☐ N/A
12. Interfaces and transfers	Are data transfers complete, accurate, attributable, and reconciled? Are failed, duplicate, delayed, or manually re-entered transactions detected?	Interface specifications, mapping, error queues, reconciliation reports, transfer tests, manual-entry controls	☐ Yes ☐ Gap ☐ N/A
13. Change and release control	Are software, infrastructure, configuration, and vendor changes assessed for impact, approved, tested, documented, and released under control?	Change requests, impact assessments, regression tests, release notes, rollback plans, approvals	☐ Yes ☐ Gap ☐ N/A
14. Backup and recovery	Are backups scheduled, protected, monitored, and periodically restored to demonstrate recoverability? Are recovery objectives aligned with business and GMP needs?	Backup logs, failure alerts, restore test, disaster-recovery plan, recovery evidence	☐ Yes ☐ Gap ☐ N/A
15. Retention and retrieval	Are records retained for the required period in a readable, complete, secure form? Can authorized staff retrieve records, metadata, and audit trails throughout retention?	Retention schedule, archive controls, retrieval demonstration, migration plan, readability checks	☐ Yes ☐ Gap ☐ N/A
16. Incidents, deviations, and CAPA	Are errors, outages, data-integrity concerns, and security incidents logged, assessed for record/product impact, investigated, and closed with effective actions?	Incident/deviation records, impact assessments, investigations, CAPA, effectiveness checks	☐ Yes ☐ Gap ☐ N/A
17. Supplier and cloud oversight	Are suppliers assessed according to risk? Do contracts define responsibilities for hosting, security, change notification, access, backup, incident support, data return, and exit?	Supplier assessment, audit reports, quality/technical agreements, service reports, exit and data-portability plan	☐ Yes ☐ Gap ☐ N/A
18. Procedures and training	Are approved procedures current and followed? Are users, reviewers, administrators, and support staff trained for assigned duties?	SOPs, training records, role-based training matrix, observed task demonstration	☐ Yes ☐ Gap ☐ N/A
19. Periodic review	Does the review consider incidents, changes, access, supplier performance, backup/restore, deviations, open risks, and system performance?	Periodic review report, action tracking, management/quality approval, overdue items	☐ Yes ☐ Gap ☐ N/A
20. Business continuity and retirement	Are manual fallback, outage communication, reconciliation after recovery, decommissioning, migration, and long-term record access defined?	Continuity plan, outage exercise, reconciliation evidence, decommissioning or migration records	☐ Yes ☐ Gap ☐ N/A

Evidence Sampling: Trace a Record, Not Just a Document

Document review is important, but an audit becomes more meaningful when the auditor follows a real regulated transaction through the system. Select an example according to process risk and trace the record from its source to its final use.

Example: Laboratory result in a chromatography data system

1. Identify the sample, analyst, instrument, method, sequence, and original acquired data.
2. Confirm that the method and processing parameters were approved and effective for the analysis.
3. Review the full record and related metadata; confirm that relevant original data are retained and retrievable.
4. Examine changes, reprocessing, reintegration, repeat injections, aborted runs, and audit-trail entries where applicable.
5. Check that the reviewer’s evaluation and approval are attributable and that exceptions were investigated.
6. Compare the reported result with the underlying electronic record and verify that the approved report did not omit material context.

FDA’s data-integrity guidance recommends review of audit trails capturing changes to critical data with the associated record and before final approval. The exact implementation should be defined through applicable requirements, documented risk, and approved procedures. This focused test complements broader ALCOA+ data-integrity controls.

Questions to Ask During Interviews and Demonstrations

• “Show how a user receives access, changes roles, and loses access when responsibilities end.”
• “Show one completed record from source data through review and approval, including its relevant metadata.”
• “Show how a correction is made without obscuring the original entry or its history.”
• “Show the audit trail for a sample change and explain who reviews it and how an unusual event is escalated.”
• “Show the most recent backup restoration test and the evidence that recovered data were usable.”
• “Show how a system change is evaluated, tested, approved, and released.”
• “What happens when the system or an interface is unavailable, and how are transactions reconciled afterward?”
• “How do you retrieve records, metadata, and audit trails if the application or supplier is no longer available?”

Ask staff to demonstrate the normal workflow using an approved test environment or read-only records. Avoid making unapproved changes to production records during an audit.

Risk-Based Audit Planning and Finding Classification

Not every computerized system warrants the same audit depth. Prioritize systems that create, modify, review, approve, or retain records affecting product release, patient safety, product quality, or regulatory reporting. Consider the sensitivity and volume of data, complexity of interfaces, degree of automation, supplier dependency, history of incidents, and ability to detect errors.

Use the site’s approved procedure to classify observations. A useful finding describes the requirement or control expectation, the objective evidence, the actual condition, and the potential impact. Do not assign “critical,” “major,” or “minor” labels by personal preference; apply the site’s definitions consistently and assess actual or potential impact.

Example finding structure: “The procedure requires periodic review of privileged access. In the sampled review period, two administrator accounts had no documented owner or current business justification. The site should assess whether the accounts were used, evaluate any impact on GMP records, and implement risk-appropriate corrective action.”

From Audit Finding to CAPA and Effectiveness Check

1. Contain immediate risk: preserve records and logs, restrict access if justified, and protect ongoing operations.
2. Assess impact: identify affected systems, records, products, batches, decisions, time periods, and interfaces.
3. Investigate cause: determine whether the issue is isolated or indicates a weakness in design, procedures, training, supplier oversight, or governance.
4. Define actions: assign specific owners and due dates for correction, corrective action, and preventive action.
5. Verify completion: review objective evidence that actions were implemented and approved.
6. Check effectiveness: set a measurable follow-up test to confirm the problem has not recurred and the control works in practice.

Use the organization’s established CAPA process and link audit outcomes to change control, training, validation, supplier management, or data-integrity investigations when relevant.

Common Audit Gaps to Watch For

• System inventories that omit interfaces, spreadsheets, locally managed tools, or supplier-hosted applications used for GMP records.
• Validation files that describe an earlier version or configuration rather than the system currently in use.
• Shared accounts, excessive privileges, dormant accounts, or unmonitored vendor access.
• Audit trails enabled in configuration but not meaningfully reviewed or not retained with the record.
• Printed reports or PDFs retained while source data, metadata, methods, or processing context are unavailable.
• Changes to master data, calculations, templates, or workflows made without documented impact assessment and approval.
• Backups reported as successful without evidence of a tested restoration and readable records.
• Cloud or supplier agreements that do not clearly address data access, incident notification, change management, retention, and exit support.
• Procedures that describe ideal controls but do not match actual user practice.
• CAPA closure based only on training or document revision, without checking whether the technical or process control is effective.

Practical Audit Preparation Checklist

• Confirm audit objective, scope, applicable markets, criteria, and auditor independence.
• Obtain the system inventory entry, intended use, process map, risk assessment, and data-flow diagram.
• Review the approved validation status, current version, open defects, and recent changes.
• Request role and user lists, privileged-account controls, access reviews, and training evidence.
• Choose representative records and define a trace from creation to retention and retrieval.
• Plan demonstrations for audit trails, signatures, interfaces, backup restoration, and outage recovery.
• Review recent incidents, deviations, CAPAs, periodic reviews, supplier issues, and overdue actions.
• Prepare a secure evidence log that records document identifiers, sample IDs, date, and objective observations.
• Agree how urgent risks will be escalated during fieldwork and how findings will be fact-checked.
• Ensure the final report distinguishes confirmed evidence from assumptions and records accepted actions.

Related Pharmaceutical Validation Resources

• Computerized System Validation in Pharmaceuticals
• ALCOA+ and data integrity
• 21 CFR regulations for pharmaceuticals
• User Requirement Specification (URS)
• Installation Qualification (IQ), Operational Qualification (OQ), and Performance Qualification (PQ)
• Design Qualification (DQ) and pharmaceutical SOPs
• CAPA in pharmaceuticals and the cGMP overview

Frequently Asked Questions

What is a computerized system audit checklist for pharma?

It is a structured set of questions used to assess whether a computerized system and its operating controls support their intended regulated use. It commonly covers governance, risk, validation, access, records, audit trails, signatures, interfaces, change control, backup, suppliers, training, and issue management.

How often should pharmaceutical computerized systems be audited?

There is no single interval that fits every system. Establish frequency through the quality system using documented risk, system criticality, supplier oversight, incident history, changes, and applicable requirements. Periodic system review and supplier audit schedules should be defined separately where appropriate.

Does every software application in a pharmaceutical company require GMP validation?

No. First determine whether the application supports a regulated activity or creates, changes, maintains, or reports records used to demonstrate GMP compliance. Document the rationale and assess the risk of the system’s intended use.

Is a system audit the same as computerized system validation?

No. Validation provides documented evidence that a system is fit for intended use. An audit evaluates whether governance and controls are adequate and operating as intended. An audit does not replace validation or ongoing system management.

Does 21 CFR Part 11 apply to every electronic record?

Part 11 applies within its defined scope to electronic records and signatures covered by FDA record requirements or submitted to FDA. Assess applicability with the relevant predicate rules and FDA guidance rather than assuming that every electronic file is automatically in scope.

What should an auditor check in an audit trail?

Check that relevant events are attributable, time-stamped, protected, retrievable, and reviewable; that changes do not obscure prior information; and that review procedures define who reviews which events, when, and how exceptions are investigated. Tailor the checks to applicable requirements and documented risk.

What records should be sampled during a computerized system audit?

Select records that demonstrate important system functions and risk controls. Trace representative records from source data through processing, review, approval, transfer, retention, and retrieval. Include atypical events such as corrections, rejected transactions, repeat analyses, or system incidents where relevant.

What evidence should be retained from the audit?

Retain the approved plan, scope and criteria, sampled evidence references, interviews or demonstrations, objective observations, report, responses, impact assessments, actions, approvals, and effectiveness checks in accordance with the site’s record-retention procedure.

Can a vendor’s compliance certificate replace a supplier audit?

A certificate can be supporting information, but it does not by itself demonstrate that the supplier’s controls meet the organization’s intended use and risk requirements. Evaluate supplier evidence, responsibilities, service controls, and oversight proportionately to risk.

How should a computerized system audit finding be closed?

Document the risk and impact, investigate the cause, define correction and preventive actions, assign accountable owners and due dates, verify implementation, and perform an effectiveness check appropriate to the issue.

Official References and Further Reading

1. U.S. Food and Drug Administration, Data Integrity and Compliance With Drug CGMP: Questions and Answers.
2. U.S. Food and Drug Administration, Part 11, Electronic Records; Electronic Signatures—Scope and Application.
3. Electronic Code of Federal Regulations, 21 CFR Part 211 and 21 CFR Part 11.
4. European Commission, EudraLex Volume 4: EU Guidelines for Good Manufacturing Practice.
5. Pharmaceutical Inspection Co-operation Scheme, Publications and PI 041-1 data-management and integrity guidance.

This educational checklist is a starting point for audit planning. Apply the regulations, approved procedures, and quality agreements relevant to the specific product, site, system, and market. It does not establish compliance by itself.

Audit conclusion: A strong computerized-system audit follows regulated data through the real workflow, tests whether key controls work in practice, and links every finding to documented risk, impact, and effective corrective action.