Data Integrity in FDA Inspections: When Documentation Becomes a Compliance Risk

In pharmaceutical operations, documentation is more than a record of work performed. It provides evidence that manufacturing, testing, investigations, and quality activities were performed as required and that decisions affecting product quality were based on reliable information.

During an inspection, the U.S. Food and Drug Administration (FDA) evaluates whether supporting those activities are reliable, accurate, complete, and appropriately controlled.

FDA’s Data Integrity and Compliance with Drug CGMP guidance emphasizes risk-based strategies to prevent and detect data-integrity issues throughout the data lifecycle.

A documentation deficiency may appear to be a recordkeeping issue. However, when information cannot be reliably attributed, reviewed, or reconstructed, the concern may extend to the underlying GMP System.

FDA’s data-integrity expectations can be understood through the ALCOA+ principles, under which data should be Attributable, Legible, Contemporaneous, Original, and Accurate, with additional expectations that data remain Complete, Consistent, Enduring, and Available.

EMA further uses the ALCOA++ framework, adding Traceable to emphasize the ability to establish the origin and history of data throughout the data lifecycle.

Records should provide reliable evidence of what was performed, when it was performed, who performed it, what data was generated, and how the information was reviewed and used.

Therefore, data integrity is not simply about maintaining documentation. It is about ensuring that the underlying data and records accurately and consistently represent the activities performed and the decisions based on those data.

The significance of a documentation deficiency depends on how the information was generated and how it supports a quality decision.

For example, if an analytical result reported on a Certificate of Analysis cannot be supported by underlying laboratory records, the assessment may need to consider whether the testing was performed as reported, whether supporting data can be reconstructed, and whether the result supported batch disposition.

This type of concern was reflected in FDA’s August 18, 2026, Warning Letter to Shoolin Pharma Chem LLP. FDA identified laboratory documentation deficiencies involving reported analytical results that could not be supported by equipment printouts, laboratory notebooks, worksheets, and analytical data. FDA requested a comprehensive assessment of the laboratory and documentation systems and their potential impact.

The timing of documentation is another important element of data integrity. Recording information after an activity has occurred, pre-signing records, backdating entries, or relying on unofficial records can make it difficult to establish the actual sequence of events.

A non-contemporaneous record can affect whether the organization can demonstrate that it accurately reflects the activity performed. This also brings Quality Unit oversight into focus, including appropriate control, review, and investigation of documentation weaknesses.

The transition from paper records to electronic systems does not automatically eliminate data-integrity risk. Electronic systems introduce controls involving user access, permissions, electronic signatures, audit trails, data changes, retention, and review.

During an FDA inspection, investigators may evaluate whether electronic data can be reconstructed and whether changes are appropriately controlled and traceable.

An audit trail provides a time-stamped history that can help reconstruct events associated with the creation, modification, or deletion of an electronic record.

FDA’s guidance emphasizes appropriate controls and review of electronic data to ensure reliability. The compliance risk therefore extends beyond the electronic record itself to the controls used to generate, modify, review, and approve the data.

When a deficiency is identified, organizations may need to evaluate whether similar practices exist across other products, batches, laboratories, departments, users, computerized systems, or historical periods. FDA’s recent enforcement actions emphasize assessment of the extent, scope, root cause, and potential impact, rather than limiting the review to the individual issue initially identified.

The objective is to determine whether the issue represents an isolated event or a broader weakness in the organization’s data governance Quality Unit oversight, quality systems, computerized-system controls, and laboratory controls.

Historical FDA inspection information can provide a broader regulatory perspective on how data-integrity weaknesses have been identified during actual inspections. Reviewing recurring observations and regulatory themes can help organizations benchmark their existing controls, identify areas requiring deeper review, and strengthen inspection readiness.

This creates practical progression:

Data Creation → Documentation → Data Integrity Controls → Risk Assessment → CAPA → Inspection Readiness

iPharmaAI Audit IQ helps pharmaceutical teams review historical FDA inspection observations related to data integrity, laboratory controls, documentation, computerized systems, and Quality Unit oversight. By identifying recurring regulatory themes across inspection records, teams can focus internal assessments on relevant data-integrity risks and evaluate existing controls. This connects historical regulatory evidence with internal risk assessment.

Audit IQ supports inspection-readiness activities but does not replace FDA requirements, applicable guidance, investigator judgment, or a firm's independent Quality Unit assessment and compliance responsibilities.

Data integrity should not be treated as a laboratory-only responsibility or an IT function. It extends across the systems, procedures, and personnel responsible for generating, recording, reviewing, modifying, approving, retaining, and using GMP data.

During an FDA inspection, documentation becomes compliance evidence when an organization can demonstrate that its data are reliable, traceable, complete, and appropriately controlled.

By applying a risk-based approach to data integrity and learning from actual FDA inspection observations, pharmaceutical organizations can strengthen data governance and quality systems and improve their ability to demonstrate reliable GMP data during an FDA inspection.