Importance of Audit trials in Pharmaceuticals

Importance of Audit trials in Pharmaceuticals

 

Audit trial is a computer-generated and time-stamped record of who did what, when. CFR 21 Part 11 requires audit trails to be generated independently of operators. An audit trail capture all activities related to creating, modifying, and destroying records on a system. The main purpose of the audit trail is to provide assurance for the integrity of the electronic record.

 

Regulatory Requirements for Audit trials

FDA - 21 CFR Part 11

"The Agency intends to exercise enforcement discretion regarding specific part 11 requirements related to computer- generated, time-stamped audit trails (§ 11.10 (e), (k)(2) and any corresponding requirement in §11.30). Persons must still comply with all applicable predicate rule requirements related to documentation of, for example, date (e.g., § 58.130(e)), time, or sequencing of events, as well as any requirements for ensuring that changes to records do not obscure previous entries.

Even if there are no predicate rule requirements to document, for example, date, time, or sequence of events in a particular instance, it may nonetheless be important to have audit trails or other physical, logical, or procedural security measures in place to ensure the trustworthiness and reliability of the records. We recommend that you base your decision on whether to apply audit trails, or other appropriate measures, on the need to comply with predicate rule requirements, a justified and documented risk assessment, and a determination of the potential effect on product quality and safety and record integrity. We suggest that you apply appropriate controls based on such an assessment. Audit trails can be particularly appropriate when users are expected to create, modify, or delete regulated records during normal operation."

MHRA / EU Annex 11

The current text for the MHRA / EU Annex 11 states:

"The system should record the identity of operators entering or confirming critical data. Authority to amend entered data should be restricted to nominated persons. Any alteration to an entry of critical data should be authorised and recorded with the reason for the change. Consideration should be given to building into the system the creation of a complete record of all entries and amendments (an "audit trail")."

An audit trail is a series of records of computer events, about an operating system, an application, or user activities. The auditor can obtain valuable information about activity on a computer system from the audit trail.  Audit trails improve the auditability of the computer system.

Audit trails can assist in detecting security violations, performance problems, and flaws in applications.  

 

Content of the Audit Trail

The audit trail should be inextricably linked to the electronic record. It should be secure and not have the facility for editing or deleting, providing a permanent record.

The main function of the audit trail is to provide assurance for the integrity of the electronic record. For each entry the following information should be recorded.

• Date and Time Stamp
• Name of user making change (unique id)
• Link to the record (Batch No, Record Id)
• Original Value
• Changed Value
• Reason for Change

This should provide the same level of assurance to the record integrity as that of a paper record, that is where a correction or change is made and the operator makes a correction striking though the initial value, enters the new value, provides reason for change and signs and dates the entry.

The audit trail can also provide a record of invalid attempts to log on to the system, to demonstrate the security of the system.