New FDA guidance on data integrity and cGMP compliance

Earlier this year, the US Food and Drug Administration (FDA) distributed draft guidance for comment purposes entitled Data Integrity and Compliance with cGMP, with applications in drug evaluation and research, including biologics as well as relevant veterinary medicines.

This guidance follows the issuance of MHRA GMP Data Integrity Definitions and Guidance for Industry in March 2015 and, similarly, is meant to define and clarify the role of data integrity according to 21 CFR Parts 210, 211 and 212 (Current Good Manufacturing Practices – cGMPs), giving careful consideration to the narrow scope and application of the FDA’s Center for Drug Evaluation and Research (CDER) 21 CFR Part 11 (Electronic Records; Electronic Signatures), pending a re-examination of Part 11 as it applies to regulated products.

The guidance was issued as a result of ‘increasingly observed cGMP violations involving data integrity during cGMP inspections,’ stating further that ‘these data integrity related cGMP violations have led to numerous regulatory actions, including warning letters, import alerts and consent decrees.’ Once finalised, the guidance will reflect the agency’s current thinking in establishing a data lifecycle approach that is compliant with cGMP requirements.

The FDA became increasingly aware of these data integrity violations during inspections outside the United States, which revealed fraudulent data manipulation. Consequently, the agency is also increasingly looking for specific controls to be put in place to prevent the inadvertent modification or deletion of cGMP data owing to a general lack of control surrounding data generation. These potential circumstances arise in such instances when there is a use of generic user accounts, uncontrolled operating system environments, lack of administrative procedural control or a lack of secured and specified group privileges. These situations may provide proximal cause for the agency to view cGMP data as adulterated.