Audit trail review checklist for Part 11 systems

A person reads the system's own record of who created, changed or deleted data, and decides whether each change was authorized, explained and still visible. § 11.10(e) requires the trail itself: “secure, computer-generated, time-stamped audit trails to independently record the date and time of operator entries and actions that create, modify, or delete electronic records”, where “record changes shall not obscure previously recorded information.” It sets no review schedule. That expectation comes from the predicate rules and from FDA's 2018 data integrity Q&A, which says “audit trail review is similar to assessing cross-outs on paper when reviewing data.”

The Q&A splits trails in two: those that track “creation, modification, or deletion of data (such as processing parameters and results)” and those that track “actions at the record or system level (such as attempts to access the system or rename or delete a file).” They get read by different people at different times.

For what a trail has to capture in the first place, and how long it is kept, read what an audit trail is in GxP. For where § 11.10(e) sits among the other controls, see Part 11 requirements, section by section.

Step 1The system and the period

One worksheet per system. The period runs from the last system-level review to today; name the records it covers.

Step 2How often

Answer the rule question first, then rate the three risk factors FDA names. The interval is a starting point for your procedure, not a verdict.

Step 3What to review

Filter the trail by date and work down the eight event types. Count what you see, pick the outcome word, and say where the evidence is. If a create, modify or delete event is Not trailed, that is a § 11.10(e) gap for the Part 11 compliance checklist, not a review finding.

Step 4Findings

Every Found, raised event needs at least one finding, and every finding not closed in the review needs a number from your deviation, CAPA form or change control. The status line will not read Complete until both are true.

Step 5Sign-off

Print the record and sign it, or attach it to your quality system and sign there. Check that the e-signature shows name, date and time, and meaning with the signature manifestation check. The written procedure that makes this routine fits in an SOP template of its own.

FDA's 2018 Q&A answers this in two steps. First: “If the review frequency for the data is specified in CGMP regulations, adhere to that frequency for the audit trail review.” For a QC lab that point is the second-person review of § 211.194(a)(8), which wants the initials or signature of a second person “showing that the original records have been reviewed for accuracy, completeness, and compliance with established standards”; for batch records it is the quality unit's review before release under § 211.192.

Second, where no rule sets the point, “determine the review frequency for the audit trail using knowledge of your processes and risk assessment tools,” and the risk assessment “should include evaluation of data criticality, control mechanisms, and impact on product quality.” Its footnote names the risks to data as “the potential to be deleted, amended, or excluded without authorization or without detection,” and gives instrument operational status, instrument communication logs and alert records as trails that may suit a risk-based frequency.

The worksheet turns the three factors into a score from 0 to 6 and the score into an interval. The bands below are our practice for a small lab, not FDA's; write your own into the procedure and say why.

Criticality, controls and impact each score 0, 1 or 2. Where a rule sets the review point, the record-level trail follows the rule whatever the score.

Whatever you choose, the Q&A sets the test: your approach “should ensure that CGMP requirements are met, appropriate controls are implemented, and the reliability of the review is proven.” A review that always reads Nothing to report on a busy system does not prove much.

A QC lab runs release and stability testing on three HPLC instruments feeding one chromatography data system on its own server, with nine users. Two senior analysts also hold admin rights, so controls are partial; the data decides batch release, so criticality is high and impact direct. Score 5 of 6: the system-level trail is reviewed monthly, and the record-level trail with each record, before it is approved, because § 211.194(a)(8) already sets that point for lab records. This is the 2026-09 system-level review.

Nothing to report: the events are there and in order. Found, explained: closed in the review with a reason. Found, raised: written up as a finding. Not trailed: the system does not record this event.

Result: Complete. 4 findings, 3 sent on. Finding 1 matters most: a manual integration with no reason, on an impurity just under its limit. FDA's 2018 Q&A says that for most lab analyses reprocessing “should not be regularly needed”, and that when chromatography is reprocessed, written procedures must be followed and each result kept for review. Finding 3 is the cheapest to fix for good: take admin rights away from the people who generate the data.

FDA's audit trail definition uses an HPLC run as its example: the trail “should include the user name, date/time of the run, the integration parameters used, and details of a reprocessing, if any,” and “documentation should include change justification for the reprocessing.” These are the patterns worth stopping on.

• Q&A, Q14Reprocessing with no reason, or one injection processed several times until the result moves. Every processed result has to be kept for review, not only the last.
• Q&A, Q12Aborted or incomplete injections nobody looked into. FDA says they "should be captured in audit trails and should be investigated and justified."
• Q&A, Q13Actual samples injected in test, prep or equilibration runs, or used for system suitability outside a written procedure. FDA calls the first, used to disguise testing into compliance, a violative practice.
• §§ 11.10(e), 11.70A result edited after it was signed, or a signature that sits on a version older than the result it approves.
• Q&A, Q5Changes made under a shared or generic login. A shared read-only account is fine for viewing; it cannot carry a change or a second-person review.
• Q&A, Q1.c; § 11.10(e)The trail switched off, the system clock moved, or files renamed and deleted at the system level, outside the application's own record.

If your data system cannot filter its trail by event type or show reprocessing side by side, the review gets slow and patchy; see how chromatography data systems compare on audit trails. To test one record against all of ALCOA at once, use the ALCOA+ record check.

The rule text and guidance this worksheet is built from, each read on the date shown.

1. 21 CFR Part 11, Electronic Records; Electronic Signatures (eCFR), National Archives and FDAread 2026-10-22
2. Data Integrity and Compliance With Drug CGMP: Questions and Answers (guidance, December 2018), FDAread 2026-10-22
3. 21 CFR Part 211, CGMP for Finished Pharmaceuticals (eCFR), National Archives and FDAread 2026-10-22
4. EudraLex Volume 4, Annex 11: Computerised Systems (2011), European Commissionread 2026-10-22