Best Practices In Life Sciences For Avoiding Data Integrity & Quality Pitfalls

Attributable - who acquired the data or performed an action (or modification) and when

Given the inherent increase in complexity from a paper system, computerized systems must be defined, procured, and configured to meet the applicable regulatory record requirements.

Applicable Tasks/Deliverables:

1. System requirements/user requirements and/or assessments must define the intended system record types and Annex 11/21 CFR Part 11 applicability.
2. Prior to procurement, a vendor assessment and a product demonstration should be performed to aid in determining design/configuration needs and any potential compliance risks.
3. Design/configuration documentation should include the specific post-installation attributes that must be set to meet the requirements of the system.

1. There should be definition of separate user roles (based on record involvement) for all systems (e.g., Creator/User ability to write records, Reviewer ability to append/modify a record, and Administrator ability to delete).
2. Each user regardless of role must have a unique user ID to access the system.  Typically this is handled most efficiently via a centralized network (e.g., Active Directory Groups).
3. An Annex 11/Part 11 assessment should be performed to verify all expected regulatory requirements including audit trail and electronic record/signature attributes where applicable (e.g., secure).
4. Security settings within the application must be designed and configured to not allow non-administrators the ability to disable compliance related settings such as those related to audit trail, user management, and signatures.
5. Security settings outside of the application must be designed and configured to only allow the minimum user permissions for the application to function. 

Specific considerations:

1. If a database is used, have it located and administered on a qualified infrastructure independent from the application client computer with no user access to the raw data/database location outside of the application.
2. If the computer system is standalone, security controls need to be in place to limit user ability to modify or delete raw data, metadata, and audit trail information.

1. Users of the system should not have more than one role.
2. If possible utilize a system administrator who is independent from the department responsible for electronic records (e.g., IT) or one that does not have a vested interest in the data results from the given system. 
3. System administrators should not generate or review data.
4. Users who are not Administrators should not be in a Local Administrators group or Power/Super Users group.
5. The use of shared and generic log-on credentials must be avoided to ensure that personnel actions documented in electronic records and signatures can be attributed to a unique individual.
6. Implement SOP direction (and associated training) to identify the importance of data integrity and define procedural controls as necessary to secure the data flow within the process and prohibit the overwriting or deleting of data.  For some (e.g., standalone) systems, this may involve a hybrid electronic/paper approach and maintaining a continuous session on the system with additional reviews if needed.

Legible - Data is permanent and easily read (by a human)

Applicable Tasks/Deliverables:

1. Prior to procurement, a vendor assessment and a product demonstration should be performed to aid in determining design/configuration needs and any potential compliance risks.
2. Design/configuration documentation should include the specific post-installation attributes that must be set to meet the requirements of the system.

1. Controlled configuration and use of any record annotation tools in a manner that prevents data in display and print from being obscured (if possible).
2. Verification of record/report output against on-screen or originally entered (meta) data.

1. Implement SOP direction (and associated training) to identify the importance of data integrity and define procedural controls as necessary to direct that no data is to be obscured during use and output (e.g., hardcopy) is reviewed where applicable for legibility and consistency with good documentation practices. 

Contemporaneous - documented at the time of the activity (promptly)

Applicable Tasks/Deliverables:

1. Prior to procurement, a vendor assessment and a product demonstration should be performed to aid in determining design/configuration needs and any potential compliance risks.
2. Design/configuration documentation should include the specific post-installation attributes that must be set to meet the requirements of the system.
   1. Specific consideration needs to be made relative to what centralized (e.g., domain) security can be implemented versus standalone/local security configuration.
   2. Specific consideration needs to be made relative to the need for and definition of centralized and synchronized time stamping.

1. An Annex 11/Part 11 assessment should be performed to verify all expected regulatory requirements including audit trail and electronic record/signature attributes where applicable (e.g., secure).
2. Verification needs to be made that users cannot change system date, time and time zone on the computer that the application uses to stamp that information.

1. This can be controlled centrally for example by defining a specific organizational unit (group) where computers in this group only allow a network administrator to change these attributes.
2. If this has been handled locally on the standalone computer, users cannot be in the local administrators group.

3. If the system is an enterprise level system where use may span multiple time zones, verification needs to be made relative to a consistent centralized time for the system regardless of access point and that time is synchronized to a traceable source.

1. Users who are not Administrators should not be in a Local Administrators group or Power/Super Users group.
2. Implement SOP direction (and associated training) to identify the importance of data integrity and overall good documentation practices (even if the computer system is providing the necessary information). 

Original - the first recording of data, raw or source data, or a certified true copy

Applicable Tasks/Deliverables:

1. Prior to procurement, a vendor assessment and a product demonstration should be performed to aid in determining design/configuration needs and any potential compliance risks.
2. Design/configuration documentation should include the specific post-installation attributes that must be set to meet the requirements of the system.

1. Specific consideration needs to be made relative to what centralized (e.g., domain) security can be implemented versus standalone/local security configurations.
2. If a standalone system, consideration needs to be made relative to process/procedural data flow and if automatic or manual functions will be needed.  Folders may need to be set for either write permissions with deny append or read and execute with allow to write.  Also permission inheritance needs to be accounted for.

1. An Annex 11/Part 11 assessment should be performed to verify all expected regulatory requirements including audit trail and electronic record/signature attributes where applicable (e.g., secure).
2. Security settings outside of the application must be designed and configured to only allow the minimum user permissions for the application to function. 

Specific considerations:

1. If a database is used, have it located and administered on a qualified infrastructure independent from the application client computer with no user access to the raw data/database location outside of the application.
2. In a standalone situation, a user should not have full control of the records or audit trail location.  Ideally users should only have read, write, execute permissions with the functional denial of modify/write-over and delete. 

1. A formal system development/implementation life cycle should be followed and if process specific considerations/evaluations are needed, a development or test environment is advantageous for proving out a design prior to formal end-use environment verification. 
2. A procedure or procedures (and associated training) should dictate the acceptable and consistent data management practices for the system including how an original data record is processed/saved, how it may be reviewed or how it can have metadata associated with it (e.g., signed), and how it can be historically retrieved, backed-up, and restored.

Accurate - data is correct including context/meaning (e.g., metadata) and edits

Applicable Tasks/Deliverables:

1. Prior to procurement, a vendor assessment and a product demonstration should be performed to aid in determining design/configuration needs and any potential compliance risks.
2. Design/configuration documentation should include the specific post-installation attributes that must be set to meet the requirements of the system.

1. Specific consideration needs to be made relative to defining any custom or process-specific calculations, reporting, or critical process parameters/critical quality attributes that may require data validation, calibration, or supplemental risk assessment and verification.  

1. An Annex 11/Part 11 assessment should be performed to verify all expected regulatory requirements including audit trail and electronic record/signature attributes where applicable (e.g., secure).
2. Specific verification/validation documentation (e.g., test plans, scripts, protocols, traceability matrix) should define, challenge, confirm, and trace the accuracy of the defined data collection, processing, and reporting for the system.

1. A procedure or procedures (and associated training) should dictate the acceptable and consistent data management practices for the system including how an original data record is processed/saved, how it may be reviewed or how it can have metadata associated with it (e.g., signed), and how it can be historically retrieved, backed-up, and restored.
2. A procedure or procedures (and associated training) should dictate the required calibration frequency of any instrumentation associated with critical data in the system.

Complete - Data includes all data (passing or otherwise) from all actions taken to obtain the required information, including metadata (e.g., audit trail) and edits

Applicable Tasks/Deliverables:

1. Prior to procurement, a vendor assessment and a product demonstration should be performed to aid in determining design/configuration needs and any potential compliance risks.
2. Design/configuration documentation should include the specific post-installation attributes that must be set to meet the requirements of the system.

1. An Annex 11/Part 11 assessment should be performed to verify all expected regulatory requirements including audit trail and electronic record/signature attributes where applicable (e.g., secure).

1. A procedure or procedures (and associated training) should clearly identify the company’s data integrity definitions and expectations. 
2. A procedure or procedures (and associated training) should clearly dictate the acceptable and consistent data management practices for the system including how an original data record is processed/saved, how it may be reviewed or how it can have metadata associated with it (e.g., signed), and how it can be historically retrieved, backed-up, and restored.
3. A procedure or procedures (and associated training) should dictate the required steps for addressing out of tolerance results and process deviations. 
4. A procedure or procedures (and associated training) should dictate the required steps for how to perform an audit trail review and at what frequency.

Consistent - Data is created in a repeatable and comparative manner (traceable)

Applicable Tasks/Deliverables:

1. Prior to procurement, a vendor assessment and a product demonstration should be performed to aid in determining design/configuration needs and any potential compliance risks.
2. Design/configuration documentation should include the specific post-installation attributes that must be set to meet the requirements of the system.
   1. Specific consideration needs to be made relative to defining any custom or process-specific automated processing/workflows or specific sequencing of events. 

1. Specific verification/validation documentation (e.g., test plans, scripts, protocols, traceability matrix) should define, challenge, confirm, and trace the consistency of the defined data collection, processing, and reporting for the system.
   1. This may include but not be limited to the following:
      1. Equipment/Instrument qualification
      2. Software/System qualification
      3. Method Validation
      4. Process Validation

1. Formal policy, plan or procedure documentation should exist (along with associated training) dictating the system development and maintenance life cycle along with the applicable method and process validation expectations associated with the system. 
2. A procedure or procedures (and associated training) should clearly dictate the acceptable and consistent data management practices for the system including how an original data record is processed/saved, how it may be reviewed or how it can have metadata associated with it (e.g., signed), and how it can be historically retrieved, backed-up, and restored.

Enduring - Stored on media proven for the record retention period

Applicable Tasks/Deliverables:

1. Prior to procurement, a vendor assessment and a product demonstration should be performed to aid in determining design/configuration needs and any potential compliance risks.
2. Requirements/design/configuration documentation should include the specific post-installation attributes that must be set to meet the intended use/future state functions of the system.
   1. Specific consideration and definition needs to be made relative to identifying the specific record types (e.g., records dictated by regulation, i.e., predicate rule) and what is the record’s respective retention period. 
   2. Specific consideration and definition needs to be made relative to what technology and media type will best satisfy the day-to-day use and long-term retention/usability of the affected stored records.

1. Specific verification/validation documentation (e.g., test plans, scripts, protocols, traceability matrix) should define, challenge, confirm, and trace the ability of the system to store and retrieve records for the entire duration of a record’s retention period.
   1. This may include but not be limited to the following:
      1. Vendor/Media life span information
      2. Media reliability information
      3. Media use schedules
      4. Restoration verification

1. Formal policy, plan or procedure documentation should exist (along with associated training) dictating the minimum retention period for the record types affected by the system. 
2. A procedure or procedures (and associated training) should clearly dictate the acceptable and consistent data backup processes, schedules, media types, on-site and off-site schedules, archive, and restoration activities. 

Available - Readily accessible in human readable form for review throughout the retention period for the record

Applicable Tasks/Deliverables:

1. Prior to procurement, a vendor assessment and a product demonstration should be performed to aid in determining design/configuration needs and any potential compliance risks.
2. Requirements/design/configuration documentation should include the specific post-installation attributes that must be set to meet the intended use/future state functions of the system.
   1. Specific consideration and definition needs to be made relative to identifying the specific record types (e.g., records dictated by regulation, i.e., predicate rule) and what is the record’s respective retention period. 
   2. Specific consideration and definition needs to be made relative to what technology and media type will best satisfy the day-to-day use, long-term retention capability, and retrieval time requirements. 

1. Specific verification/validation documentation (e.g., test plans, scripts, protocols, traceability matrix) should define, challenge, confirm, and trace the ability of the system to store records for the entire duration of a record’s retention period and be able to retrieve/restore in the time frame necessary for internal and external review.
   2. This may include but not be limited to the following:
      1. Verification of restoration capability from all media types
      2. Verification of restoration capability from all backup schedules (e.g., on-site and off-site)
      3. Verification of archive retrieval capability

1. Formal policy, plan or procedure documentation should exist (along with associated training) dictating the minimum retention period for the record types affected by the system. 
2. A procedure or procedures (and associated training) should clearly dictate the acceptable and consistent data backup processes, schedules, media types, on-site and off-site schedules, archive, and restoration activities. 
3. Procedural and periodic tests should be performed to verify the ability to retrieve archived electronic data from storage locations.
4. Considerations for decommissioned/retired or archived systems, there may be need for provisioning of suitable reader equipment, such as software, operating systems and virtualized environments, etc., to view the archived electronic data when required.