Audit Trail Review for Computerised Systems in Analytical Laboratories

Audit Trail Review for Computerised Systems in Analytical Laboratories

Vienna, Austria

Course No 19022

This course is part of the GMP Certification Programme "ECA Certified Data Integrity Manager". Learn more.



ECA-Member*: EUR 1590,--
Non ECA Member*: EUR 1790,--
EU/GMP Inspectorates*: EUR 895,--
APIC Member Discount*: EUR 1690,--

(All prices excl. VAT)

* payable by credit card American Express Visa Mastercard

If you have any questions, please contact us:
Tel.: +49 (0)6221 / 84 44 0 E-Mail:


Dr Markus Dathe, F. Hoffmann-La Roche AG, Basel, Switzerland
Dr Bob McDowall, Member of the ECA IT Compliance Interest Group
Dr Frank Sielaff, GMP Inspector, c/o Regierungspräsidium Darmstadt, Germany


The objectives of this ECA educational course are to provide:
  • An understanding of the regulatory requirements for Audit Trail Review of laboratory computerised systems
  • Understand how to manage the  review by exception
  • Who should perform the Second Person Review?
  • Discuss Audit Trail examples for attendees to identify potential Data Integrity issues
  • Present examples of Audit Trail Entries for attendees to identify potential Data Integrity issues


EU GMP Annex 11 on computerised systems has required a “regular review” of Audit Trail Entries since its publication in 2011.  In addition, the Data Integrity guidance documents  issued by MHRA, WHO, FDA, EMA and PIC/S over the past few years reiterate the need for review of Audit Trail Entries as part of a Second Person Review of analytical data.  However, like all regulations and guidance these documents emphasise the “what” that must be done but leave the “how” to each laboratory to interpret and then implement.  For example:
  •  Do I need an Audit Trail function for all computerised systems?
  •  What is meant by a regular review of Audit Trail Entries?
  •  In some organisations, there is confusion about who should review Audit Trail Entries - is this a laboratory or quality assurance role? 
  •  What does a risk-based or review by exception of Audit Trail Entries really mean and do all laboratory informatics applications offer this approach?
This is also compounded by the fact that most laboratory software applications were initially designed before Data Integrity issues took centre stage in the eyes of the regulators.  How can GMP regulated organisations influence software suppliers?

This course is designed to help GMP organisations understand what is included in a review of Audit Trail Entries and how to conduct a risk-based review.

Target Group

  • Managers and staff from Quality Control and Analytical Development Laboratories of pharmaceutical companies
  • Contract Research Organisation and Contract Manufacturing Organisation laboratory personnel
  • Quality Assurance staff  involved in reviewing laboratory data or performing Data Integrity audits
  • Auditors (internal and external) responsible for performing self-inspections or external Audits

Presentations/Certificate/Hygiene Measures

The presentations for this event will be available for you to download and print before and after the event. Please note that no printed materials will be handed out on site and that there will not be any opportunity to print the presentations on site. After the event, you will automatically receive your certificate of participation.

On site, we will implement the necessary and required hygiene measures in close co-operation with the hotel. If infection rates and/or
travel restrictions generally do not permit an on site event, it will be conducted live online. In this case, you will be informed in due


Introduction to the Course

Regulations and Guidance for Audit Trails and their Review
  •  An overview of the regulatory framework: EU, FDA, MHRA, WHO and PIC/S regulations
  •  Data life cycle in Analytical Laboratories
  •  Audit Trails in GMP-Inspections: What are the expectations of the inspector?
Audit Trail Review as Part of a Data Integrity Strategy
  •  Define ATR as element of the DI Strategy
  •  Risk-based Approach – how to apply
  •  Apply a systematic approach to define ATR
  •  Audit Trail Review concepts 
Validation of Audit Trail Functionality
  • Specification of Audit Trail requirements in the URS: dos and don’ts
  •  Documentation of the application configuration for Audit Trail functionality
  • Leveraging the supplier’s development and testing into your validation effort
  • User acceptance testing of Audit Trail functionality
Workshop 1: 
Validation of Audit Trail Functionality
  •  The attendees will review user requirements for Audit Trail functions to highlight good and bad practices and from good requirements design tests to verify correct functionality
  •  Documenting the assumptions, exclusions and limitations of your chosen test approach
Audit Trail Review in Context of Second Person Review
  • Overview of the analytical  process from sample to reportable result
  • Highlight the use of computerised systems and Audit Trails
  •  Use technical controls to focus  review effort
  •  Audit Trail Review issues for manually entered data into a laboratory system and electronic transfer between systems
When is an Audit Trail not an Audit Trail?
  •  What do we look for in an application for auditing?
  •  Which Audit Trail(s) should I review?
  •  Event logs vs. audit logs
Where do Suppliers help us and where do they let us down?
  • What do we expect from the suppliers to support data and Audit Trail Review?
  • Identify and avoid typical pitfalls
  • Data ownership
  • Data packaging and storage – supplier vs. business 
Workshop 2:
Which Audit Trail to review?
Attendees will be presented with an overview of the Audit Trails within a chromatography data system and the content of each one. 
Which Audit Trails should be reviewed and when?

What are GMP-Relevant Data?
  •  Annex 11 requires that audit trails monitor GMP-relevant data – what are GMP relevant data?
  •  What are critical data and how can they be determined?
  •  Direct/indirect, static/dynamic data
  •  Data, Audit Trail and criticality? 
Workshop 3:
Identifying GMP Relevant Data
Using facilitated discussion, attendees will develop amatrix for risk-based Audit Trail Review. Then they will apply the principles to a list of laboratory records to identify if they are GMP records to help focus the Second Person review of Audit Trail data.
Review of Audit Trail Entries
  • Guidance for “regular review” of Audit Trails
  • Process versus system: avoiding missing Data Integrity issues when only focussing on a per system review
  • What are we looking for in an Audit Trail Review?
  • Suspected Data Integrity violation - What do we need to do?
Workshop 4:
Reviewing Audit Trail Entries Part 1
Attendees will be provided with a series of Audit Trail Entries at the system level to review. Are there any potential Data Integrity issues to be followed-up?

Workshop 5:
Reviewing Audit Trail Entries Part 2
Attendees will be provided with a series of Audit Trail Entries at the data capture and interpretation level to review. Are there any potential Data Integrity issues to be followed-up?
Controls to Aid Second Person Review of Audit Trails
  •  Technical considerations for Audit Trail Review e.g. identifying data that has been changed or modified –
  • how the system can help documenting the audit trail review has occurred
  • Review by exception – how technical controls can help
  • Have you specified and validated these functions?
Key Learning Points and Final Discussion

Go back

GMP Conferences by Topics