Orlando LÃ³pez is an industry veteran holding several technical and management positions in different pharmaceutical and medical device companies in the areas of computer validation, IT Compliance, and IT Processes. He is a member of the Data Integrity Working Group (Institute of Validation Technology). He can be contacted at olopez6102@msn.com.

Orlando Lopez

	Electronic records (e-records) integrity is the validity of data and their relationships. For e-records to be trustworthy and reliable, the links between data, raw data, metadata, and records must not be compromised or broken. Without e-records integrity, it is difficult to regenerate a previous result reliably.

	This article discusses these e-records integrity maxims applicable to the medicines’ manufacturing operations.  The lifecycle, the validity and fidelity, and the reliability to the e-records integrity are maxims or fundamental rules in an effective e-records integrity program.

	These maxims are elements to consider in the e-records integrity controls to CGMP e-records.

: E-records, as information objects, have a lifecycle (1).

	E-records lifecycle refers to how e-records are generated, recorded, processed (including analysis, transformation, or migration), reported, checked, used for decision-making, retained, archived, and finally discarded at the end of the retention period (2).

	The precise management of the e-records must be performed through its lifecycle (3). 

	One element in quality management is the e-records integrity. Thisintegrity can be affected at any stage in the e-records lifecycle. It is consequently important to understand the lifecycle components for each type of e-record, and ensure controls based on the criticality and risk at all stages (2).

	During the operation stage, e-records are generated, recorded, transformed, accessed, used, logically deleted, migrated, and retired (physically deleted).  During this stage, the integrity of the e-records can be compromised. The objective of the implementation and enforcement of the e-records requirements are to preserve the e-records integrity. These requirements include: 

		Only authorized people can modify the e-records stored on data servers or any other media. 

		Entry of e-records considered critical checked by a designated person other than the one who made the records or checked by the system itself.

		Availability of a procedural control for cancellation, changes to the level of approval, and for entering or editing e-records, including changing of personal password.

	The effectiveness of the controls associated with e-records integrity must be monitored.

	To keep the focus on the e-records integrity technical controls during the operation stage, these controls can be categorized in three spaces:  e-records storage, e-records during processing, and e-records while in transit.

	FDA guidance says that data integrity is critical throughout the CGMP data lifecycle, including in the creation, modification, processing, maintenance, archival, retrieval, transmission, and disposition of data after the record’s retention period ends (4).

: As a state or condition, e-records integrity is a measure of the validity and fidelity of a data object (5). 

	E-records integrity is the foundation of GMPs. The information properly recorded is the basis for manufacturers to assure product identity, strengths, purity, and safety (6). The collected e-records also demonstrate that the manufacturing process adheres to the GMPs, including instructions.

	E-records integrity is a requirement that information, programs and configurations are changed only in a specified and authorized manner. It is necessary that e-records be protected against alteration without appropriate permission.

	All workflows associated with e-records that need to be protected against alteration without appropriate permission are carefully designed and tested (4).

	As applicable, the e-records workflows that must be carefully designed (2) and tested are:

		Security of data and associated warehouses

		Correctness and completeness of printouts

		Generation of audit trails, as applicable

		Disposal of data during the retirement of the associated system(s) and during the end of the retention period.

	For the organizational purpose of the lifecycle to the above workflows, these can be grouped one of the following: records retained by computer storage, during processing, and while in transit (7). 

	EU guidelines state, “The electronically stored data shall be protected, by methods such as duplication or back-up and transfer on to another storage system, against loss or damage of data, and audit trails shall be maintained” (8).

					Electronic record: collection of related data treated as a unit (1)

					Data: the contents of a record; it is the basic unit of information that has a unique meaning and can be transmitted (2)

					Raw data: the original record (data), which can be described as the first-capture of information, whether recorded on paper or electronically (3)

					System owner: the person responsible for the availability, and maintenance of a computerized system and for the security of the data residing on that system (4).

: As a function related to security, e-records integrity service maintains information exactly as it was inputted and is auditable to affirm its reliability (9).

	Because maintaining e-records integrity is a primary objective of the GMP principles, it is important that everyone associated with a computer system in a regulated entity is aware of the necessity for the security considerations. The regulated entity must ensure that personnel are aware of the importance of e-records security, the procedures and system features that are available to provide appropriate security, and the consequences of security gaps. Such system features could include routine surveillance of system access, the implementation of file verification routines, and exception and/or trend reporting.

	Security controls must be established for all computer systems as a mean of ensuring e-records protection.  Computer security is the principal enabler to create the integrity of e-records.

	A number of unrelated regulated entities have had problems linked to the proper control over computer systems to prevent unauthorized changes in e-records. Usually, these regulated entity sites alter or delete critical e-records.

	The system owner is the person responsible for providing the e-records protection suitable controls over the application, infrastructure (e.g., network, database server), and database components.  These record protection controls ensure that only authorized personnel can make changes to any component of the computer system and the security of the e-records residing on the system. 

	Finally, application level security and associated authority checks control the access to the computer system applications (i.e., applications security).

	FDA states that “appropriate controls shall be exercised over computer or related systems to assure that changes in master production and control records or other records are instituted only by authorized personnel” (10).  

	1. O. López, "Electronic Records Life Cycle

Data Integrity in Pharmaceutical and Medical Devices Regulation Operations 

(CRC Press, Boca Raton, FL, 1st ed., 2017), pp. 39-45.

Pharmaceutical and Medical Devices Manufacturing Computer Systems Validation 

(Routledge/Productivity Press, New York, NY, 1st ed., 2018), pp. 138-140

SP 800-33 - Underlying Technical Models for Information Technology Security

2003/94/EC Laying down the principles and guidelines of good manufacturing practice in respect of medicinal products for human use and investigational medicinal products for human use 

(CRC Press, Boca Raton, FL, 1st ed., 2017), pp. 162-166.

	Orlando Lopez is an electronic records integrity subject matter expert. 

Articles

Managing and controlling e-records is vital for maintaining CGMP data integrity.

Maxims of Electronic Records Integrity

	An expectation pertinent to the computer systems performing good manufacturing practices (GMP) regulated-related functions is the integrity of electronic records (e-records). This expectation takes the highest priority in any worldwide health agency GMPs, including the European Medicines Agency (EMA) and its European Union (EU) member states.

	E-records comprise raw e-records, derived e-records, and associated metadata. E-records integrity is the foundation of GMPs. The electronic information, properly recorded and managed, is the basis for manufacturers assuring the competent authority of their products’ identity, strengths, purity, and safety. Reliable e-records also demonstrate that the production process of the regulated entity and the computer systems adhere to the GMPs, including manufacturing instructions. 

	Any unintended changes to e-records as the result of a storage, inputs and outputs (I/Os), or processing operation, including malicious intent, unexpected hardware failure, and human error, will compromise the integrity of e-records. 

	This article provides the key expectations of EU GMP inspectors in the area of data integrity of e-records. These expectations are based on the following EMA sources: 

		European Community (EC) Commission Directives 2003/94/EC (1) and 91/412/EEC (2)

		EC GMP Annex 11 Computerized Systems (3) 

		Chapter 4 of the EC GMP guide concerning documentation (4) 

		EMA Questions and Answers: Good Manufacturing Practices-Data Integrity (5)

		Medicines & Healthcare Products Regulatory Agency (MHRA) 

GxP Data Integrity Definitions and Guidance for Industry

		MHRA GMP Inspection Deficiency Data Trend 2016 (8).

	EMA e-records integrity technical requirements

	EMA has overall responsibility for regulating human and veterinary medicinal products within the European Commission. In terms of what all EU countries must achieve related with the manufacturing of medicinal products, all EC member states are bound by a single set of directives. Computer systems and e-records associated with GMP-related activities are delineated in the Commission Directive 2003/94/EC. 

“When electronic, photographic, or other data processing systems are used instead of written documents, the manufacturer shall first validate the systems by showing that the data will be appropriately stored during the anticipated period of storage. Data stored by those systems shall be made readily available in legible form and shall be provided to the competent authorities at their request. The electronically stored data shall be protected, by methods such as duplication or back-up and transfer on to another storage system, against loss or damage of data, and audit trails shall be maintained.”

	The veterinary medicinal products GMP requirements can be found in 91/412/EEC (2).

	As noted, EMA’s e-records integrity objectives are:

		E-records will be appropriately stored during the anticipated period of storage. 

		E-records stored by computer systems shall be made readily available in legible form.

		E-records shall be provided to the competent authorities at their request. 

		E-records shall be protected, by methods such as duplication or back-up and transfer on to another storage system, against loss or damage of data.

		There must be a record of any e-records change made, the previous entry, who made the change, and when the change was made. These audit trails shall be maintained.

	It is up to the individual countries to decide how the applicable directive is implemented into national law.

	EMA GMP inspections comprise an on-site compliance assessment. These EMA GMP assessments are performed by official(s) of the EU competent authorities, or authorities found an equivalent under a mutual recognition agreement. The method used to verify e-records integrity may vary contingent on the technology used by the regulated facility.

	There are two key guidelines associated with e-records integrity resulting from Commission Directive 2003/94/EC and 91/412/EEC; one being EMA GMP Annex 11 Computerized Systems and the other, EMA GMP Chapter 4: Documentation (1-4).

	EMA GMP Chapter 4 relates to good documentation practices. It provides key definitions of records (see 

		Records must be written evidence of what has happened and are recorded contemporaneous either by personnel or automated equipment. As an example, automated equipment may measure process parameters. 

		In automated environments, the events recorded are contemporaneous and retained in the format in which they were originally generated are considered raw data.

: Key definitions of records based on EudraLex (4).

					Records that provide a summary of testing results on samples of products or materials together with the evaluation of compliance with a stated specification.

					Provide evidence of various actions taken to demonstrate compliance with instructions (e.g., activities, events, investigations, and in the case of manufactured batches, a history of each batch of product, including its distribution).

					Records that are used to generate other records. For e-records, regulated users should define which data are to be used as raw data. At least, all data on which quality decisions are based should be defined as raw data.

					Records that document the conduct of particular exercises, projects, or investigations, together with results, conclusions, and recommendations.

	Explicitly, the EMA GMP Chapter 4 establishes that suitable controls to ensure integrity of documents must be established (4).

	The key EMA GMP Annex 11 e-records integrity-related clauses are depicted in 

. The e-records integrity controls listed are the most observed as part of the associated non-compliance report located at the EudraGMDP database (6).

: Data integrity-related clauses relating to e-records, based on the European Medicines Agency Good Manufacturing Practice Annex 11 (3).

					The validation of computer systems must be performed in accordance with the relevant GMP guidelines and based on a risk assessment. It must be taken into account the integrity of the data. When determining data vulnerability and risk, it is important to consider the intended use of the computer system and associated data. (Note: As a result of computer systems validation not properly performed or not performed, the EU inspectors affirm that the integrity, reliability, up-to-date, originality and authenticity of the e-records cannot be assured.)

					“Data should be secured by both physical and logical means against damage.”

					“Management systems for data and for documents should be designed to record the identity of operators entering, changing, confirming, or deleting data including date and time.”

					“Physical and/or logical controls should be in place to restrict access the computerized system to authorized persons. Suitable methods of preventing unauthorized entry to the system may include personal codes with passwords, restricted access to computer equipment and data storage areas.”

	There are many other e-records integrity-related clauses in Annex 11 (9, 10). These clauses are also implemented during the design phase or during the operational and retirement phases as part of procedural controls.

	Based on a collection of non-compliance reports by EU inspectors (July 2013-February 2017), located at file://OLOPEZ6102/Google%20Drive/Erecs, the following tabulations about e-records integrity-related issues were obtained (

: Data integrity-related issues identified from a collection of non-compliance reports by EU inspectors (July 2013-February 2017).

					No logical access controlled to computer systems

					Computer systems not properly validated

	Comments such as “integrity and security of analytical data,” as part of the non-compliance reports, do not provide relevant information to assign the deviation to a particular cause. The tabulation of these comments is not part of 

. Records retained in computer storage must be secured by both physical and logical means against loss, damage, and/or alteration. The main clauses applicable to these e-records actions are Clauses 7.1 and 12.4 of Annex 11 (3). It excludes the issue related to the unauthorized entry to the storage area in Clause 12 of Annex 11. 

	E-records warehouses security design must make provisions to protect original or true copy e-records and the associated metadata. These e-records cannot be deleted or changed without recording the modification. As an element of the e-records integrity in storage, there must be a record of any modification made that includes the previous entry, who made the change, and when the change was made (5, 11).

	The modification of an e-record can be documented by an electronic- or paper-generated audit trail. The paper-based audit trail may be acceptable until an electronic audit trailed functionality becomes available. To reduce the risk of losing e-records in the storage and guarantee e-records readiness to the users, periodic back-ups must be performed. The back-up must be stored separate from the primary storage location, and at a frequency based on an analysis of risk to GMP e-records and the capacity of the storage device.

	Any rights to alter files must be assigned to personnel independent from those responsible for the record content. Segregation of duties between data lifecycle stages provides safeguards against data integrity failure by reducing the opportunity for an individual to alter, misrepresent, or falsify data without detection (5).

No logical access controlled to computer systems

. The main Annex 11 clause applicable to this item is 11-12.1 (3). All personnel must be provided with appropriate levels of access and defined responsibilities to carry out their assigned duties. This requirement must be backed up by an authorization policy specifying logical access rights to domains, computers, applications, and e-records. As a function related to security, e-records integrity service maintains information exactly as it was recorded, and is auditable to affirm its reliability. For this reason, controlled access to the short- and long-term storage must be implemented.

	Security must be instituted at several levels. Procedural controls must govern the physical access to computer systems (

). As part of the physical security, it must be considered putting security to devices used to store programmes, such as disks.

	The access to individual computer system platforms is controlled by network specific security procedures (

). Access to these devices should be controlled (

). User access controls should be configured and enforced to prohibit unauthorized 

access and the attributes of the e-records.

 systems not properly validated. The main clause applicable to this deviation is 4. As part of the inspection, the validation of the computer system is evaluated. The validation process must take into account the interface between the data acquisition function and the data recording function. These functions must be verified, tested, and periodically verified to check the accuracy of the data. I/Os errors can result in severe production errors and distribution of adulterated or misbranded products. The extent and frequency of I/Os checking will be assessed on an individual basis and should be determined based upon the risk and built in controls. These built-in checks provide the accurate exchange of electronic data to decrease the issues of data integrity while the electronic data are in transit.

	The computer system must incorporate validated checks to ensure the completeness of data acquired (4). For systems using automated data capture, the EU inspector should review validation records to ensure correct I/Os and processing of data are implemented and are effective.

	Audit trails and the validation records of the associated functionality for computer systems should be verified as well. 

The author reviews key technological expectations of EU GMP inspectors on the integrity of e-records.