What is an audit trail (in GxP)?
Published 10 min read
Fig. 01An audit trail is the log a computer system writes, by itself, of what happened to a record: who created, changed or deleted it, when, and what it held before. It is the electronic form of the single-line cross-out on a paper batch record, where the old entry stays readable and the change is initialled and dated. In GxP, the trail is what lets a reviewer or an inspector rebuild the history of a result without asking anyone.
What an audit trail is
FDA's definition (Data Integrity Q&A, 2018)
“a secure, computer-generated, time-stamped electronic record that allows for reconstruction of the course of events relating to the creation, modification, or deletion of an electronic record”
FDA's example is a chromatography run: the trail for an HPLC run should hold the user name, the date and time of the run, the integration parameters used, and the details of any reprocessing, with a justification for that reprocessing. The same Q&A splits trails into two kinds: those that follow the data (processing parameters, results) and those that follow actions at the record or system level, such as log-in attempts or a file renamed or deleted.
Three texts ask for one. Part 11 requires it for electronic records in its scope (§ 11.10(e)); whether your records are in scope is the question the Part 11 applicability checker answers, and what 21 CFR Part 11 is and who it binds sets out the scope. The predicate rules ask for the same history in their own words: GLP's § 58.130(e) wants every change to automated data made “so as not to obscure the original entry”, with the reason, the date and the person. EU GMP Annex 11 § 9 asks, “based on a risk assessment”, for a system-generated record of “all GMP-relevant changes and deletions”.
Takeaway
If people create, change or delete regulated records in a system during normal work, plan on an audit trail there. FDA's 2003 guidance says that is where trails are “particularly appropriate”.
What § 11.10(e) requires, phrase by phrase
The whole requirement is three sentences. Each phrase carries a test an inspector can run in a few minutes at the keyboard, so it pays to read them one at a time.
Scroll sideways for every column
| Words of § 11.10(e) | What it means in practice | What an inspector checks |
|---|---|---|
| “secure” | Nobody, administrators included, can edit or delete an entry, and the trail cannot be paused by the people whose work it records. | Who holds the rights to configure the trail, and whether a user role can switch it off or purge it. |
| “computer-generated” | The system writes the entry by itself at the moment of the action. A comment box the user fills in afterwards is not the trail. | A change made in a test: did an entry appear without anyone typing it? |
| “time-stamped” | Every entry carries a date and time from a clock the user cannot set, in a time zone your documentation names. | Where the clock comes from, and how the stamps read across a daylight-saving change. |
| “to independently record the date and time” | The stamp does not depend on what the operator enters or chooses to declare. | Whether a user can type or back-date the time of an entry. |
| “operator entries and actions that create, modify, or delete electronic records” | Three events at minimum: creation, change and deletion, each tied to the person who did it. | A deleted record or an aborted run: is it still visible in the trail? |
| “Record changes shall not obscure previously recorded information.” | The old value stays readable next to the new one. An overwrite that keeps only the latest value fails here. | The before and after values of one real change, read side by side. |
| “retained for a period at least as long as that required for the subject electronic records” | The trail lives as long as the record it describes. The period itself comes from the predicate rule, not from Part 11. | A record from the oldest year still in retention, with its trail. |
| “available for agency review and copying” | An inspector can read the trail and take a copy of it, in a form a person can follow. | An export of the trail for one record, produced on the spot. |
Left column: § 11.10(e) verbatim, eCFR read 2026-10-22. The other two columns are our reading.
Common misreading
“FDA does not enforce audit trails.” The 2003 guidance applies enforcement discretion to the Part 11 wording only (§ 11.10(e), (k)(2)). The same passage says you must still meet the predicate rules on date, time and sequence of events and on changes that do not obscure earlier entries. The trail comes back through § 58.130(e), § 211.68 and drug CGMP record review.
For how (e) sits beside the other ten controls of § 11.10, see 21 CFR Part 11 requirements, section by section.
What a good entry looks like
One reprocessing of an HPLC result, written twice. The complete entry answers who, what, when, the values before and after, and why, and names the text that asks for each field. The weak entry proves something changed and little else.
Illustrative entry for one HPLC reprocessing. Sample, SOP and user ID are invented.
Scroll sideways for every column
| Field | Value (illustrative) | Asked for by |
|---|---|---|
| Record | Assay result, sample QC-26-0412, injection 03 | § 11.10(e): the electronic record acted on |
| Action | Modify: reprocess with new integration events | § 11.10(e): create, modify or delete |
| Previous value | Peak end 4.82 min; assay 98.7 % | § 11.10(e): changes do not obscure what was recorded |
| New value | Peak end 4.95 min; assay 99.1 % | FDA 2018 Q&A 1.c: details of the reprocessing |
| User | qc.analyst02 (one login, one person) | § 11.10(e) operator; Annex 11 § 12.4 identity of the operator |
| Date and time | 2026-10-22 14:07:31 UTC | § 11.10(e): computer-generated time stamp |
| Reason | Baseline cut through peak tailing on first pass; reintegrated per SOP QC-014 section 6.2 | § 58.130(e) GLP; Annex 11 § 9; FDA 2018 Q&A 1.c change justification |
Scroll sideways for every column
| Field | Value (illustrative) | What a reviewer cannot tell |
|---|---|---|
| Record | Result table | Which sample, which injection: the entry cannot be tied to one record |
| Action | Updated | Whether the result was reprocessed, re-entered or replaced |
| Previous value | (not kept) | The 98.7 % is gone: the change obscures what was recorded |
| New value | 99.1 | Units, and the integration events that produced the number |
| User | admin | A shared administrator login: no one person is attributable |
| Date and time | 22/10/26 | Time of day and time zone; is that 22 October or 26 October? |
| Reason | (blank) | Why a reportable result changed after the run |
Read the two side by side and the point of § 11.10(e) is plain: the weak entry cannot show that 98.7 % was ever the result, so a reviewer cannot judge whether the reprocessing was justified or a result was tested into specification. Chromatography is where this bites hardest; the chromatography data system comparison reads vendors on audit trails for reprocessing.
Takeaway
During validation, make one real change of each type (create, modify, delete, reprocess) and print the entry it produced. If any field of the complete entry above is missing, record it as a gap before go-live. The audit trail review checklist lists the events worth testing for one system.
Fig. 02Metadata vs audit trail
FDA's 2018 Q&A defines metadata as “the contextual information required to understand data”: the number 23 means nothing until metadata says it is 23 mg. Its list of metadata includes the time stamp, the user ID, the instrument ID, the material number, and audit trails. So the audit trail is one kind of metadata, the kind that records history rather than context.
Scroll sideways for every column
| Topic | Metadata | Audit trail |
|---|---|---|
| The question it answers | What does this value mean? | What happened to this record, by whom, and when? |
| HPLC example | Units, instrument ID, analyst's user ID, sample and material number, acquisition time stamp | Run started, processed, reprocessed with new integration events, result signed: each with user, time and old and new values |
| When it is written | With the data, at acquisition | At every create, modify or delete, for as long as the record lives |
| FDA's 2018 wording | “the contextual information required to understand data” | “allows for reconstruction of the course of events” |
| Kept for | The record's retention period, linked to its data | At least as long as the record (§ 11.10(e)) |
Both travel with the record. FDA says data should be kept for the retention period “with all associated metadata required to reconstruct the CGMP activity”, and an electronic copy counts as a true copy only if it keeps that metadata. A PDF of the final result with no trail behind it is a report, not the record. The ALCOA+ principles name the attributes the two protect together: attributable, contemporaneous, original, complete.
Reviewing the trail: what FDA's 2018 Q&A says
A trail nobody reads proves little. FDA's “Data Integrity and Compliance With Drug CGMP: Questions and Answers” (final, December 2018) gives the clearest US answer on review. It is written for drug CGMP (parts 210, 211 and 212); GLP and device teams often borrow its logic, but it does not bind them by name.
Who reviews
FDA's answer starts with a comparison every QA reviewer knows: “Audit trail review is similar to assessing cross-outs on paper when reviewing data.” The people responsible for reviewing a record review the trail of changes to its data at the same time as the rest of the record. Production and control records, trails included, are reviewed and approved by the quality unit (§ 211.192).
How often
Scroll sideways for every column
| When | What FDA says to do |
|---|---|
| The rule sets a review point for the data | Review the trail at the same point. FDA's examples: § 211.188(b), review after each significant step, and § 211.22, data review before batch release. |
| The rule sets no review point | Set the frequency “using knowledge of your processes and risk assessment tools”, weighing data criticality, control mechanisms and impact on product quality. |
| System-level trails | FDA names instrument operational status, instrument communication logs and alert records as trails that may be reviewed on a risk-based frequency rather than with every result. |
Whatever the schedule, FDA's test is that the approach meets CGMP, the controls are in place, “and the reliability of the review is proven”. In practice that means a written procedure, a review that leaves its own record, and evidence that reviewers find things.
Who should not hold the keys
The same Q&A says the system administrator role, “including any rights to alter files and settings”, should go to people independent of those responsible for the record content. A reviewer reading a trail that the analyst could have reconfigured is reading a trail that proves nothing.
Part 11 itself
§ 11.10(e) requires the trail, its retention and its availability to FDA. It sets no review cadence. “Regularly reviewed” is EU Annex 11 § 9; a lab under both answers to the stricter reading.
Takeaway
Build the review for one system with the audit trail review checklist: the events to trail, the frequency by risk, and what the reviewer signs. Then write the review step into the record-review procedure, not a separate one nobody opens.
Where audit trails fail
Most audit trail findings are not about a missing feature. The software can record the right things; the way it is set up and used defeats it. Eight patterns, each with the text it runs into:
Scroll sideways for every column
| Failure | What it looks like in the lab | Where the rule says so |
|---|---|---|
| Shared logins | One account for the instrument PC, used by every analyst on the shift. | FDA 2018 Q&A 5: a unique individual cannot be identified; § 211.68(b) |
| Analysts as administrators | The person whose results are on the system can also change its settings and file rights. | FDA 2018 Q&A 4: the administrator role should be independent of record content |
| Overwrite without the old value | The trail says a result was edited but keeps only the latest number. | § 11.10(e): changes “shall not obscure previously recorded information” |
| No reason captured | Reprocessing and edits sit in the trail with a blank or default reason. | § 58.130(e) (GLP); Annex 11 § 9; FDA 2018 Q&A 1.c |
| Saved only at the end | Data written once per sequence, so an aborted injection leaves no entry. | FDA 2018 Q&A 12: save each step or injection; aborted ones trailed and investigated |
| Trail never read | Results are approved from the summary report; nobody opens the trail. | FDA 2018 Q&A 7: reviewed with the rest of the record |
| Trail lost or unreadable | A system migration moved the results but left the trail behind, or it exports only as a raw database dump. | § 11.10(e) retention and copying; Annex 11 § 9 “generally intelligible form” |
| Clock nobody controls | Workstation time set by hand; stamps across sites mix time zones with no note of which. | § 11.10(e) time stamps; FDA 2003 guidance: document time-zone references |
Inspection risk
A shared login turns every entry in the trail into “someone on that shift”. FDA's 2018 Q&A says that with shared credentials “a unique individual cannot be identified through the login”, and the system does not conform to parts 211 and 212.
Takeaway
Check the four that are settings first: one login per person, administrators independent of the data, reason-for-change required, and the trail switched on for every regulated record type. Tools built around locked records and edit trails are compared in data integrity software for GxP labs.
The last setting is the easiest to miss in a system bought for another job: the results a LIMS holds, the entries in an electronic lab notebook, the alarm and excursion records of a temperature monitoring system. Where a predicate rule requires those records, each needs its trail switched on and tested.
An audit trail on one sheet
- Who
- One named person per entry. No shared logins, no generic admin.
- What
- The record, the action (create, modify, delete) and the field.
- Before and after
- Old and new values both readable; nothing overwritten.
- When
- Computer-generated date and time, with a documented time-zone reference.
- Why
- A reason for each change: GLP § 58.130(e) and Annex 11 § 9 ask for it; Part 11 does not name it.
- Kept
- At least as long as the record; the predicate rule sets the period.
- Readable
- An inspector can review it and take a copy, in a form a person can follow.
- Reviewed
- With the data it describes, by the person who reviews that record (FDA 2018 Q&A 7).
Questions
Does Part 11 require audit trail review?
Not in its own words. § 11.10(e) requires the trail to exist, to be kept and to be available to FDA; it sets no review cadence. Review comes from the predicate rules: FDA's 2018 data integrity Q&A ties it to drug CGMP record review, and EU Annex 11 § 9 says audit trails should be “regularly reviewed”. The guide to EU Annex 11 covers the EU side.
Does Part 11 require a reason for every change?
§ 11.10(e) names the date, time, operator and action, not a reason. GLP does: § 58.130(e) says a change to automated data “shall indicate the reason for change”. Annex 11 § 9 says the reason “should be documented”, and FDA's 2018 Q&A expects a change justification for reprocessing. Most labs answer to at least one of these, so configure the reason as a required field.
How long must an audit trail be kept?
At least as long as the record it describes (§ 11.10(e)). Part 11 sets no period of its own; the predicate rule does. For drug batch records, § 211.180(a) says at least 1 year after the batch's expiration date; GLP study records follow § 58.195.
Did FDA stop enforcing audit trails in 2003?
Only the Part 11 version of the requirement. The 2003 guidance applies enforcement discretion to § 11.10(e) and (k)(2), and in the same passage says you “must still comply with all applicable predicate rule requirements” on date, time and sequence of events and on changes that “do not obscure previous entries”. It adds that audit trails “can be particularly appropriate when users are expected to create, modify, or delete regulated records during normal operation.”
Must the time stamp be in each user's local time?
No. The 2003 guidance says that for systems spanning time zones FDA does “not expect you to record the signer's local time”, and that system documentation “should explain time zone references”. UTC with a written note is the plain answer.
Is a system log the same as an audit trail?
FDA counts both. Its 2018 Q&A says audit trails include those that track changes to data and those that track actions at the record or system level, such as attempts to access the system or to rename or delete a file. It names instrument operational status, communication logs and alert records as trails worth reviewing on a risk-based schedule.
Sources
Regulation text quoted from the eCFR and EudraLex; guidance quoted from FDA. General information, not regulatory advice.
- 21 CFR Part 11, Electronic Records; Electronic Signatures, § 11.10(e) (eCFR, up to date as of 2026-10-20), eCFRread 2026-10-22
- Data Integrity and Compliance With Drug CGMP: Questions and Answers (December 2018), FDAread 2026-10-22
- Part 11, Electronic Records; Electronic Signatures — Scope and Application (2003 guidance), FDAread 2026-10-22
- 21 CFR Part 58, Good Laboratory Practice for Nonclinical Laboratory Studies (§ 58.130(e), § 58.195), eCFRread 2026-10-22
- 21 CFR Part 211, CGMP for Finished Pharmaceuticals (§ 211.68, § 211.180, § 211.192), eCFRread 2026-10-22
- EudraLex Volume 4, Annex 11: Computerised Systems (2011), § 9 and § 12.4, European Commissionread 2026-10-22