Disabled Audit Trail at a Contract QC Laboratory
During a routine audit of your contract QC laboratory, you find that the audit trail on the HPLC data system was disabled from 3 to 22 January. In that period the laboratory released 14 batches of your oral solid dosage products: 6 remain in your warehouse and 8 have been distributed. The system used a shared login ('QC1') for 11 analysts, and the raw data review signatures are present but the review did not include the audit trail. The laboratory's IT provider says the audit trail was disabled during a software update and that 'no data were affected'. There is no evidence of falsification. The 14 batches include a product with a narrow therapeutic index. The contract lab is your only approved supplier for these tests and requalifying another lab would take four months. Your commercial team wants the 6 warehouse batches released.
1. What is your immediate action for the six batches still in your warehouse?
Read the worked answer
I would quarantine all six and refuse release until data reliability has been demonstrated. Certification would assert that the analytical results are valid, and with the audit trail disabled and a shared login I cannot verify who generated, modified or reviewed the data. The shared login removes attribution entirely: 11 analysts used one identity, so the electronic record cannot show who ran which injection.
The absence of evidence of falsification is not the same as evidence of integrity. The audit trail is the mechanism that would reveal reprocessing, reintegration, deletion of injections or changes to sequence order; without it, the results are unverifiable rather than proven false. The narrow therapeutic index product raises the stakes because a marginal result has greater clinical consequence.
The IT provider's assurance that 'no data were affected' is not a quality conclusion and cannot be relied on. I would instruct the laboratory to preserve the system and backups, restore audit trail functionality immediately, and not to reprocess or delete anything. I would also inform the commercial team that the four-month lead time for an alternative laboratory does not change the release decision; supply planning must work around the hold.
2. How would you scope the impact of the audit trail gap, and what must the contract laboratory demonstrate to you?
Read the worked answer
The scope is every chromatographic result generated between 3 and 22 January, not just the 14 batches. I would require the laboratory to:
- Recover audit trails from backups and system logs, and reconcile every injection and sequence against the raw data files.
- List all analyses in the window, including standards, system suitability, failed sequences and any deleted or aborted injections, with explanations.
- Review manual integration, peak suppression, sequence reordering and any reprocessing events, and compare the reviewed result with the original acquisition date.
- Interview the analysts involved and confirm training and authorisation for the methods.
- Demonstrate that the software update genuinely required the audit trail to be disabled, and produce the change record, risk assessment and vendor documentation.
- Correct the shared-login practice and show unique user accounts, access controls and periodic audit-trail review.
Retesting is not automatically the answer, because retesting the same samples later cannot reconstruct what happened in January; it may, however, provide independent data on retained samples. The laboratory must give me a documented, evidence-based conclusion on the reliability of each result. 'No data affected' is a claim to be proven, not accepted.
3. What are your obligations for the eight distributed batches and the regulator, and how does this affect the future of the contract laboratory?
Read the worked answer
For the eight distributed batches I would conduct a documented risk assessment covering the product, the therapeutic index, the specific results generated in the window, complaint history, retain samples and any independent testing available. If data reliability cannot be established, a recall must be considered; for the narrow therapeutic index product I would set the threshold for action low. A passive 'monitor complaints' approach is not defensible where the release data cannot be verified.
I would notify the marketing authorisation holder and the competent authority in line with the applicable data integrity guidance. Serious data integrity breaches are not internal matters; the regulator expects to hear about them, and the QP should not wait for a recall decision before raising the issue. The contract laboratory should also be asked whether it has notified its own regulator and other clients.
On the future of the laboratory, supply continuity does not override data integrity. I would keep the laboratory only under a remediation plan with verified unique logins, audit-trail review, 100% data review for a defined probation period, and a follow-up audit. In parallel I would start qualifying an alternative laboratory, even knowing it takes four months, because the current arrangement cannot be relied on until the remediation is proven.