Data integrity is a design decision, not an audit response

Every laboratory says its systems are compliant. The question an auditor actually asks is narrower and harder: show me this result, and show me everything that happened to it.

What the standard is really asking

The shorthand is ALCOA — attributable, legible, contemporaneous, original, accurate. Underneath it is one requirement: a result must carry its own history. Who produced it, on what instrument, under which method version, and what was done to it between acquisition and the certificate of analysis.

That is why 21 CFR Part 11 compliant software matters, and it is also why buying it is not the end of the exercise. The software makes the audit trail possible. It does not make anybody use it.

Where it goes wrong in practice

Not usually through fraud. Through convenience:

• Shared logins, because individual accounts are inconvenient on a shared instrument. Now nothing is attributable.
• A re-integration with no reason recorded, because the reason was obvious at the time. Three years later it is not obvious to anyone.
• Results transcribed into a spreadsheet for a trend chart, and the spreadsheet becoming the record people actually consult.
• An audit trail that is switched on and never reviewed — which is the most common finding of all, because an unreviewed trail is evidence that nobody was watching.

The design decision

Make the compliant path the easy one. Individual accounts that are quicker than sharing. Trending pulled from the system rather than retyped out of it. Audit trail review as a scheduled task with a name against it, not as preparation for a visit.

Our chromatography runs on 21 CFR Part 11 compliant software with multi-column thermostatting, and stability-indicating assay and related substances are trended rather than merely filed. The trending is the part worth stating: a single release result tells you a batch passed. A trend tells you whether the process is still the one you validated.