A laboratory completes its testing, reviews the results, and approves the final report. Everything appears to be in order.
Then, during an audit, someone asks to see the original instrument data supporting a reported result.
The laboratory can produce the report, but the underlying electronic record is difficult to retrieve. Perhaps the instrument uses shared login credentials, the processing history is incomplete, or the original data were never properly retained.
Suddenly, a result that appeared acceptable becomes difficult to defend.
Data integrity isn't just about whether a result is accurate. It's about whether the laboratory can demonstrate how that result was generated, reviewed, and maintained.
FDA Expectations Go Beyond the Final Test Result
FDA's Data Integrity and Compliance With Drug cGMP guidance emphasizes the importance of complete, consistent, and accurate data throughout the record lifecycle.
These expectations align with Good Documentation Practices (GDP) and the ALCOA+ principles: attributable, legible, contemporaneous, original, accurate, complete, consistent, enduring, and available.
For regulated laboratories, meeting these expectations involves more than maintaining approved procedures or retaining final reports.
An auditor may want to understand who performed the testing, whether the original data are available, what changes occurred during processing, and how the final result was reviewed.
The question isn't simply whether the laboratory has records. It's whether those records tell the complete story.
Can Your Laboratory Trace a Result Back to Its Source?
One of the most revealing exercises during a data integrity audit is selecting a reported result and tracing it back to its original source.
Can the laboratory identify the analyst, instrument, analytical method, system suitability results, reference materials, and relevant processing history? Are the original data and associated metadata still available?
A printed chromatogram or signed report may not provide the complete picture, particularly if processing changes, repeated injections, or excluded results aren't visible.
From a Quality review perspective, unexplained changes to analytical methods or processing steps should raise concerns. If those changes weren't appropriately controlled or scientifically justified, confidence in the data supporting the batch can quickly come into question.
The same concerns apply to paper-based processes. Entries recorded after the fact, undocumented corrections, or manual transfers between systems can introduce gaps in traceability.
When a laboratory cannot trace how a result was generated, even an otherwise acceptable test result may raise questions.
Access Controls and Audit Trails Deserve a Closer Look
Shared user accounts, excessive administrator privileges, and incomplete audit trails are common areas of concern.
When multiple employees use the same credentials, determining who performed a particular action becomes difficult. Similarly, an audit trail offers limited value if important changes aren't captured or reviewed.
These weaknesses don't automatically mean data were manipulated or that a reported result is incorrect, but they can bring the integrity of the data into question.
Older instruments and standalone systems deserve particular attention. Equipment may continue functioning as intended while its data storage, access controls, or record retention capabilities no longer adequately support current expectations.
An instrument can produce accurate results while still presenting significant data integrity risks.
Repeated Testing and Reprocessed Results Can Raise Questions
Not every repeated test or reprocessed result indicates a problem.
There are legitimate scientific reasons to repeat an analysis, reintegrate a chromatogram, or exclude an invalid result.
For example, poor automatic integration during chromatography may require an analyst to manually adjust how peaks are integrated. That adjustment can be scientifically justified, but without proper documentation explaining why it was necessary, an otherwise legitimate practice can raise data integrity concerns.
The concern isn't necessarily that the data were reprocessed. It's whether the laboratory can explain what changed, why it changed, and how the final result was justified.
During an audit, unexplained repeat injections, missing sequences, undocumented exclusions, or inconsistent processing histories may warrant further investigation.
A passing result obtained after an initial failure doesn't automatically invalidate the original result.
What matters is whether the laboratory followed a scientifically justified process and preserved the evidence supporting its conclusions.
A Data Integrity Gap Doesn't Automatically Mean Misconduct
Discovering a weakness in laboratory controls is not the same as establishing intentional data manipulation.
For example, shared credentials create a data attribution problem. They don't necessarily establish that someone altered a record improperly.
The appropriate response is to understand the weakness, determine its scope, and evaluate whether it could affect the reliability of laboratory data.
That assessment may extend beyond the specific record to other samples, batches, or studies.
The distinction matters because making unsupported assumptions about misconduct can be just as problematic as dismissing legitimate data integrity concerns.
A defensible investigation should follow the available evidence.
Corrective Actions Need to Address the Actual Weakness
Identifying a data integrity gap is only the beginning.
If analysts share credentials because individual accounts were never configured, updating a procedure or conducting retraining may not resolve the underlying technical problem.
Likewise, implementing new controls doesn't automatically establish that they're effective.
Quality teams need confidence that corrective actions address the identified weakness and continue working during routine laboratory operations. That's where CAPA effectiveness checks become important.
The priority should reflect the potential impact on product quality, patient safety, and the reliability of decisions supported by the affected records.
Not every finding requires a major system overhaul. But significant weaknesses shouldn't remain unresolved simply because the laboratory has operated that way for years.
Would Your Laboratory Data Hold Up Under FDA Scrutiny?
A strong data integrity program should give a laboratory confidence that its records are complete, traceable, and available when needed.
One thing we encourage Quality teams to remember is that Good Documentation Practices need to be established from the beginning, whether the laboratory uses paper records or electronic systems.
When documentation is complete and traceable from the start, it makes everything that follows, from routine Quality review to an FDA inspection, easier to support.
If your team struggles to retrieve original data, explain processing changes, establish who performed an activity, or justify excluded results, those may be signs that existing controls deserve closer attention.
The objective isn't to create more documentation for its own sake.
It's to ensure the laboratory can stand behind the data used to make critical quality decisions.
Need Support With Laboratory Data Integrity?
At Amicus GMP Consultants, we support pharmaceutical, biotech, CDMO, and regulated laboratory teams with GMP audits, data integrity assessments, quality system remediation, and FDA inspection readiness.
Whether you're preparing for an inspection, addressing laboratory compliance concerns, or evaluating weaknesses in your existing systems, talk with an Amicus GMP expert about your specific situation.
