June 17, 2020
Excerpts from a warning letter of interest to software professionals:
“During our inspection, our investigators observed specific deviations including, but not limited to, the following…
3. Failure to exercise sufficient controls over computerized systems to prevent unauthorized access or changes to data and failure to have adequate controls to prevent omission of data.
Your firm failed to implement adequate controls to ensure the integrity of data generated at your facility including:
• Missing raw data files associated with recovered solvent testing were observed in folders on the local hard drive of the operating system connected to the GC instrument. Your firm indicated that the files appear to have been deleted.
• Quality Control analysts shared the same username and password for the operating system on each workstation and the analytical software for the GC.
• Recovered solvent data on the stand-alone computerized system for the GC were not backed up as required per your approved procedure.
• Your firm did not have a procedure governing the audit trail or its retention. During the inspection, the GC analytical software was configured to retain the audit trail for only (b)(4).
Your firm failed to include a comprehensive, systematic plan for evaluating your practices and procedures to ensure data integrity controls are applied throughout your firm. Additionally, you failed to conduct a risk assessment addressing potential impacts to product as a result of the inadequate data integrity controls.
Data Integrity Remediation
Your quality system does not adequately ensure the accuracy and integrity of data to support the safety, effectiveness, and quality of the drugs you manufacture. See FDA’s guidance document Data Integrity and Compliance With Drug CGMP for guidance on establishing and following CGMP compliant data integrity practices at https://www.fda.gov/regulatory-information/search-fda-guidance-documents/data-integrity-and-compliance-drug-cgmp-questions-and-answers-guidance-industry.
We strongly recommend that you retain a qualified consultant to assist in your data integrity remediation. In response to this letter, provide the following:”
See the complete Warning Letter at this link.