ALCOA+ · Audit Trails · E-Signatures
Data Integrity
& Part 11
Leaders in Records That Hold
When Someone Else Reads Them
Leaders in Records That Hold
When Someone Else Reads Them
An investigator never sees the batch that shipped last spring. They see the data that says it was fine — and their entire assessment of your company rests on whether that data can be believed. Data integrity is the discipline that makes it believable: records created honestly, attributable to a person, protected from convenient revision, and retrievable years later. Part 11 is the American rulebook for doing that electronically. We build integrity programs, close the gaps that draft warning letters, and remediate the ones that already did.
Contemporaneous means now: the record made at the moment of the act, not reconstructed at the end of the shift.
Five letters from FDA’s early thinking, four more from the modern guidances. Together they are the test every piece of GxP data has to pass — paper or electronic, human or instrument-generated.
Who did it, and who touched it since. Shared logins fail this letter instantly.
Readable for the record’s whole life — including the audit trail behind it.
Recorded when it happened. Backdating is the finding that ends careers.
The first capture or a verified true copy — not the tidy transcription.
Free of editing without explanation; corrections visible, never destructive.
All of it — including the failed run, the aborted sequence, the reprocessed sample.
Timestamps in order, sequences unbroken, the story coherent across systems.
On media that survives the retention period, not a thermal printout fading in a drawer.
Retrievable on demand, for review or inspection, for as long as required.
Attributable, legible, contemporaneous, original, accurate — enforced at creation, not reconstructed after.
21 CFR Part 11 is short, old, and endlessly mythologized. In practice it reduces to a handful of obligations — each one simple to state and demanding to operationalize.
Every integrity control depends on knowing, without doubt, who was at the keyboard.
These patterns fill FDA’s enforcement record year after year. None of them start as fraud; nearly all of them end up cited like it.
One account for the shift, so no result is attributable to anyone — and every signature on the batch is fiction.
Disabled “for performance,” or on but never reviewed. Either way, changes happen in the dark.
Trial injections, aborted runs, and re-integrations until the number passes — with the failures deleted or renamed.
The uncontrolled workbook where the real calculation happens, outside validation, outside backup, outside review.
Records signed before the work or after the deadline — the finding that converts a 483 into a data-integrity letter.
The instrument was replaced, the files went with it, and the retention SOP described a world that never existed.
Every modern analyzer keeps its own diary. Inspectors read it against yours.
A data governance program follows every record through six stations. Our assessments walk each one — because a gap at any station quietly corrupts all the others.
Captured at source, attributed, time-stamped — human entry or instrument interface alike.
Calculations and integrations under version control, with reprocessing visible and justified.
Second-person or system-assisted review that includes the metadata, not just the result.
Summaries that trace to raw data without manual re-keying in between.
Protected storage with backup, disaster recovery, and the retention clock enforced.
Producible for an inspector in minutes, complete with audit trail, years later.
From creation through retrieval years later, complete with audit trail, producible for an inspector in minutes.
Data integrity judgment is forensic: knowing where the bodies get buried in a chromatography system, what a metadata gap means, and which finding is sloppiness versus intent. Your leads have run integrity assessments, remediated consent-decree sites, and testified to what they found.
We audit the way FDA’s data-integrity investigators do: from the raw files up, not the SOP down.
Empower, Chromeleon, LIMS, and the instrument fleet — the places integrity actually lives and dies.
FDA, MHRA, WHO, and PIC/S data integrity expectations, applied as one coherent program instead of four.
Most breaches are pressure, not malice. We fix the incentives and the workload math, not just the settings.
Data integrity is enforced through systems and proven in inspections. These are the services most often engaged with it.
The assurance work that makes electronic systems worthy of the records they hold.
Explore CSV →A data-integrity-focused mock, run from the raw files up, before someone else runs it for real.
Explore Mock Inspections →The five disciplines whose records integrity protects, audited by the same team.
Explore GxP →Tell us about your systems, your labs, and what worries you at 2 a.m. We’ll match you with a senior data integrity lead, with a response within one business day. All inquiries are strictly confidential.
