storage of change history

Availability of logs during inspections

Audit trails are not optional—they are a fundamental requirement under drug regulatory compliance protocols.

What Information Should an Audit Trail Capture?

A well-configured audit trail will capture:

• Username or user ID: Who performed the action
• Timestamp: Exact date and time of the action
• Data field name: What variable was affected
• Old value and new value: Change in data content
• Reason for change: Especially required for critical variables

This metadata is logged automatically by the Electronic Data Capture (EDC) system and should be immutable.

Where Do Audit Trails Apply?

Audit trails apply to all data-modifiable areas in a clinical study:

• CRF entries (e.g., visit dates, lab values, AE reports)
• Data queries (raised, responded, or closed)
• Randomization and dosing modules
• User access and permission changes
• Electronic signatures and approvals

In studies using ePRO/eCOA or wearable devices, audit trails also extend to patient-entered or sensor-derived data.

Best Practices for Managing Audit Trails

1. Validate Audit Trail Functionality

Ensure your EDC system undergoes rigorous testing during system validation to confirm audit trail capture for every critical data point. This should align with your process validation strategy.

2. Regularly Review Audit Logs

Integrate audit trail reviews into routine data cleaning cycles. Look for:

• High frequency of changes by specific users
• Unauthorized access attempts
• Unjustified edits or missing change reasons

3. Provide Audit Trail Training

Site staff and data managers must understand how audit trails work and what triggers an entry. Training should be part of the SOP compliance pharma curriculum.

4. Secure and Retain Logs

Ensure audit logs are retained according to the sponsor’s archiving policy and regulatory requirements—usually for 15–25 years, depending on jurisdiction.

5. Ensure Readability and Accessibility

Logs must be easily retrievable and human-readable for inspectors and auditors. Avoid raw code or formats requiring proprietary software.

Common Audit Trail Challenges

• ✘ Audit trail disabled or only partially implemented
• ✘ Missing rationale for data changes
• ✘ Unauthorized users making corrections
• ✘ Logs unavailable during inspections

These findings can result in serious observations from agencies and affect trial credibility.

Case Example: EMA Inspection Audit Trail Deficiency

During a European inspection of a diabetes study, regulators found that certain adverse event CRF fields were edited post hoc without documented rationale. The EDC system captured the changes, but the audit trail failed to store the “reason for change.” This led to a critical finding and subsequent sponsor retraining of all clinical sites and system reconfiguration.

Checklist for Audit Trail Readiness

1. ✔ Audit trail is enabled for all CRF fields
2. ✔ Logs include user, timestamp, old/new value, and rationale
3. ✔ System validated for audit trail integrity
4. ✔ Staff trained on what triggers audit entries
5. ✔ Regular audit log reviews documented
6. ✔ Logs archived and accessible for inspectors

Conclusion: Make Audit Trails a Pillar of Data Integrity

Audit trails are not just technical features—they’re vital tools to uphold data integrity, prevent fraud, and meet regulatory obligations. By embedding audit trail awareness into your EDC configuration, SOPs, and staff training, you ensure your trial data is transparent, traceable, and trustworthy. When your systems and people are aligned, audit trails become your strongest defense during inspections and audits.

Internal Resources:

• Stability testing protocols
• GMP documentation