Shared Login and Audit-Trail Edit on a Released Batch
During a routine internal audit of a solid oral dose facility, the auditor reviews the audit trail of a calibrated analytical balance used for assay weighings. At 03:12 on 14 March, a weight entry of 0.1002 g was edited to 0.1000 g under the account QCUSER3. The printed record for batch 24A117 shows 0.1000 g with an analyst signature and date. The analyst states that QCUSER3 is a shared night-shift login used by three people because the legacy software license allows only five named accounts. The system clock is seven minutes behind the clock used on the paper printout. The SOP requires unique user accounts, no shared logins, and review of audit trails before batch release. Batch 24A117 was released five days later. The site has no data integrity remediation plan, and the QC manager says the edit was only a rounding correction and does not affect the result. The balance calibration is current, and no other analytical result for the batch is suspect.
1. Identify the data integrity and documentation deficiencies and state the immediate containment actions you would take before further release decisions.
Read the worked answer
The deficiencies are not limited to a rounding edit. The shared account destroys attribution: the record cannot show which of three analysts made the entry. The audit-trail edit conflicts with the signed paper record, and the seven-minute clock offset weakens contemporaneity and sequence reconstruction. The batch was released without the required audit-trail review, so the quality unit relied on an unreviewed electronic record.
Immediate containment should include:
- Quarantine further release of records and batches touched by QCUSER3 until review is complete.
- Preserve and copy the full audit trail, including metadata, before any account changes.
- Disable generic accounts and issue unique credentials, with interim supervised access.
- Reconcile the paper printout to the electronic record and document the discrepancy.
- Open a deviation and assess all results entered under shared accounts, not only batch 24A117.
- Notify QA management and the site quality head; the QC manager cannot unilaterally close this.
The edit may be minor analytically, but the attributable and original record requirement is breached. Treat the event as a quality-system issue, not a single transcription error.
2. Assess whether batch 24A117 can remain released. Explain what evidence you would review and what decision options exist.
Read the worked answer
A released batch is not automatically recalled, but it cannot be left without a documented impact assessment. I would review the raw chromatograms, integration events, system-suitability results, standard and sample preparation records, the second-person review, retained samples, and any repeat assay. I would check whether 0.1002 g versus 0.1000 g is material for the assay concentration and whether the edit changed the reported result or only the display precision. The seven-minute clock offset must be bounded against other timestamps to rule out sequence manipulation.
Decision options are: (1) retain release with a signed QA justification if the result is confirmed by independent data and the edit is demonstrably immaterial; (2) place the batch on hold pending re-testing or record reconstruction; or (3) recall if the result cannot be reconstructed and the product may be out of specification. Because the balance is calibrated and no other result is suspect, option 1 may be defensible, but only after QA reviews the full data package. The QC manager's statement that it was only rounding is not sufficient evidence. Document the rationale and any residual risk.
3. Design the CAPA and quality-system response. Include how you would phase remediation and measure effectiveness.
Read the worked answer
The CAPA should address technical controls and behavior. Phase 1, immediate: unique accounts, audit-trail review before release, clock synchronization, paper-to-electronic reconciliation, and a stand-down communication. Phase 2, systemic: replace or upgrade the legacy software to enforce access controls and prevent account sharing; revise the SOP to define audit-trail review frequency and escalation; add data-integrity training with case-based assessment; audit all computerized systems for shared accounts and clock accuracy. Phase 3, sustainment: periodic data-integrity audits, management-review metrics, and a culture survey or confidential reporting channel.
The root cause is not merely the license limit. The site tolerated shared accounts, had no remediation plan, and allowed release without audit-trail review. CAPA effectiveness should be measured by zero shared accounts, 100 percent audit-trail review completion, clock-offset findings reduced to zero, discrepancy rates, and successful independent audits. A single training completion rate is not an effectiveness measure. Assign owners and due dates, and require QA approval before closing.