Data Integrity Assessment

A fixed-scope review of your QC and manufacturing systems, the data they produce and the procedures around them. You’ll know exactly where your gaps are, how serious each one is, and what to fix first.

Request an assessment See the deliverables

When an assessment makes sense

An assessment is most valuable when you need an independent, evidence-based view of your data integrity posture, and need it quickly.

  • An FDA, EMA or other regulatory inspection is on the horizon.
  • You’ve received observations, a 483 or audit findings related to data integrity.
  • Your labs rely on older instrument systems that predate current expectations.
  • You’ve acquired a site or product line and inherited its systems.
  • You’re planning a system replacement and need to know what to fix now versus later.
  • Leadership wants a clear, defensible picture of risk before committing budget.

What we review

Scope is agreed up front and can cover a single lab, a production area or a whole site. Within that scope, we look at technology, process and people together, because that’s how inspectors look at it.

Access and security

User accounts, shared logins, role and privilege assignments, administrator rights, and how access is granted, reviewed and removed.

Audit trails

Whether audit trails are enabled, complete and protected, and whether they’re reviewed as part of routine data review and batch release.

Data lifecycle

How data is created, processed, reviewed, reported, retained and retrieved, including where the true original record lives.

Backup, archival and recovery

Whether raw data and metadata are backed up, whether restores have been tested, and whether archived data remains readable for the full retention period.

Hybrid and paper records

Printouts, logbooks, worksheets and spreadsheets used alongside electronic systems, and how the two are reconciled.

Validation status

Whether each system’s validation is current, proportionate to its risk, and reflects how the system is actually configured and used today.

Procedures and practice

SOPs, training and review practices, and whether what’s written matches what happens on the floor.

How it works

The process is designed to minimize disruption to your operations. Most of our time with your staff is spent in short, focused interviews and system walkthroughs.

  1. Scoping call

    We agree on the systems, areas and processes in scope, the people we’ll need to speak with, and your timeline. You receive a fixed quote.

  2. Document and configuration review

    We review your SOPs, system inventory, validation records and existing audit or inspection findings before arriving on site.

  3. On-site walkthroughs and interviews

    We observe systems in use, examine configurations and audit trails, follow data from creation to reporting, and talk with analysts, operators, reviewers and system owners.

  4. Analysis and risk ranking

    Each finding is evaluated against regulatory expectations and ranked by its potential impact on product quality and data reliability.

  5. Readout and roadmap

    We walk your team through the findings and the remediation roadmap in a working session, then deliver the final report.

What you receive

Deliverables are written to be used, not filed. Your QA team can act on them directly, and your leadership can use them to make budget decisions.

Gap register

Every finding with its location, description, supporting evidence, the requirement it relates to, and a risk ranking. Delivered as a working spreadsheet your team can track remediation in.

Remediation roadmap

Recommended actions grouped into immediate, short-term and longer-term priorities, with interim controls for gaps that can’t be closed right away.

Executive summary

A short, plain-language summary of overall posture, the most significant risks and the recommended investment.

Readout session

A working session with your QA, operations and IT leads to review findings, answer questions and agree on next steps.

Example gap register entries

Illustrative entries showing the format. Real registers reflect your systems and evidence.

IDSystemFindingReferenceRisk
DI-007 FTIR workstation, QC lab 2 Single shared analyst account; results can’t be attributed to an individual. 21 CFR 11.10(d), 11.100; ALCOA+ Attributable High
DI-012 HPLC data system Audit trail enabled but not included in routine data review before release. FDA Data Integrity Guidance (2018); Annex 11 §9 High
DI-019 Refractometer, MFG suite B Printouts treated as original records; no procedure defines the record of truth. MHRA GXP DI Guidance (2018); PIC/S PI 041-1 Medium

Regulations and guidance we assess against

  • FDA 21 CFR Part 11, and the predicate rules in Parts 211, 212 and 820
  • EU GMP Annex 11, Computerised Systems
  • FDA guidance, Data Integrity and Compliance With Drug CGMP (2018)
  • MHRA ‘GXP’ Data Integrity Guidance and Definitions (2018)
  • PIC/S PI 041-1, Good Practices for Data Management and Integrity
  • ISPE GAMP 5 (Second Edition) and FDA Computer Software Assurance principles

Common questions

We expect a single-area assessment to take two to four weeks from kickoff to readout. Larger or multi-site scopes are planned in phases. Your quote includes a timeline.

Assessments are fixed-fee, based on the scope agreed in the scoping call. You’ll know the full cost before any work begins.

No. The assessment is a standalone engagement and the deliverables are yours. We’re glad to help with remediation afterward, but you’re free to carry it out internally or with another partner.

Only when it’s genuinely the right answer. Most gaps in legacy systems can be closed or controlled through configuration, data capture improvements and procedural controls, at a fraction of the cost and validation effort of replacement.

We sign your NDA or provide ours before the scoping call if you prefer. Findings and evidence are shared only with the people you designate.

Document review and much of the analysis are done remotely. System walkthroughs and interviews are most effective on site, though some can be done by video depending on your systems and policies.