Digital transformation has profoundly changed the way pharmaceutical companies manage information associated with manufacturing, he quality control and the regulatory compliance. Currently, much of the data that supports batch release, process monitoring or laboratory management are generated, processed and stored in computerized systems. In this context, ensuring data integrity has become a top priority for both organizations and regulatory authorities.

Inspections carried out by organizations such as FDA, EMA O MHRA have shown that many of the deficiencies detected are not related to process or product failures, but rather to weaknesses in information management. Incomplete data, an unmapped modification, or improper access to a system can compromise confidence in the entire set of quality records. For this reason, internal audits of automated systems are a basic tool to evaluate the an organization's actual level of control over its critical data.

The purpose of this type of audits goes far beyond verifying compliance with a procedure. Its objective is to determine whether the systems, users and associated processes ensure that the information remains reliable, exact and available throughout its life cycle. In short, it is about verifying that the principles of data integrity are integrated into the company's daily operations.

The role of ALCOA+ principles in an audit

Any data integrity assessment must be supported by the ALCOA+ principles, widely recognized by international regulatory agencies. These principles establish that data must be attributable, legible, contemporaneous, original and accurate. Furthermore, they must be complete, consistent, durable and be available when necessary.

During an internal audit, these concepts should not be analyzed solely from a documentary perspective. The auditor must go through the entire process, from the initial generation of the data to its final file, verifying that at each stage there are mechanisms that preserve its reliability. This involves reviewing both procedural aspects as technical controls implemented within automated systems.

ALCOA+ principle	What does it mean	Examples of verifications during the audit
Attributable	Who generated or modified the data must be identified.	Review of unique users, electronic signatures and access records.
Legible	Information must be able to be read and interpreted throughout its life cycle.	Checking file formats, viewing historical records and archiving.
Contemporary	The data must be recorded at the time the activity occurs.	Verification of timestamps and synchronization of system clocks.
Original	The original registration or an equivalent certified copy must be retained.	Review of source data storage and protection mechanisms against overwrites.
Exact	The information must correctly reflect the observed reality.	Evaluation of automatic calculations, interfaces and revision controls.
Full	All data, including changes and corrections, must be retained.	Review of the audit trail and canceled or modified records.
Consistent	The data must maintain a logical sequence of events.	Checking dates, times and traceability between related records.
Durable	The information must be kept intact during the retention period.	Evaluation of backups, archiving and data migrations.
Available	Data must be retrievable when needed.	Documented restoration testing and recovery times.

Data integrity governance and culture

One of the first aspects that should be evaluated is the governance structure established by the organization. In many cases, systems have adequate functionalities to guarantee data integrity, but internal procedures do not clearly define who is responsible for monitoring or reviewing them.

An effective audit must check:

• The existence of a corporate data integrity policy.
• The clear definition of roles and responsibilities.
• The availability of updated procedures.
• Periodic training of staff.
• The existence of mechanisms to communicate deviations and incidents.
• The integration of data integrity principles into daily activities.

Furthermore, it is essential to verify that the organization maintains a culture oriented towards data quality. Integrity should not be considered an activity exclusive to quality or validation departments, but rather a responsibility shared by all users who generate, review or approve electronic records.

Access control and user management

User management continues to be one of the most sensitive points during regulatory inspections. The existence of shared accounts, excessive permissions O users that remain active after leaving the company are situations that raise significant concerns from a GMP compliance perspective.

During the audit, it is advisable to review a representative sample of users and verify that each account is associated with a specific person, that the assigned privileges are consistent with the functions performed and that there is a formal process for the creation, modification and deletion of accesses.

The correct segregation of functions must also be analyzed. A system in which the same person can create, modify and approve records without independent oversight presents a significant risk to data integrity.

Audit Trail: the evidence of what really happened

If there is one element that concentrates much of the inspectors' attention, it is the audit trail. This functionality constitutes the main mechanism to reconstruct the history of a data and demonstrate what actions have been carried out, when they were executed and who was responsible for them.

However, having an audit trail is not enough. Authorities expect organizations to periodically review these records and investigate any unusual activity detected. During an internal audit, it is advisable to select critical records and analyze whether the modifications made are justified, approved and adequately documented.

The absence of systematic reviews of audit trail is one of the most common findings in inspections related to data integrity and is often interpreted as a significant weakness in the control system.

Validation and change management

The validation of computerized systems provides the documented evidence that a system functions according to its intended use. However, an initially validated system may no longer be under control if subsequent changes are not properly managed.

For this reason, any audit must assess whether a robust change management procedure is in place and whether the modifications implemented have been subjected to an appropriate impact assessment. Software updates, configuration changes, database migrations or infrastructure modifications can directly affect the integrity of the information.

Likewise, it is important to verify that the validation documentation remains updated and that critical features for data integrity have been specifically evaluated during testing.

Backup and recovery of information

Data availability is an essential part of integrity. Data that cannot be retrieved when needed no longer meets regulatory requirements, even if it was generated correctly.

For this reason, audits must include a detailed review of backup and recovery strategies. It is not enough to confirm the existence of backup copies; It is also necessary to verify that periodic restoration tests are carried out and that the data can be fully recovered after an incident.

Many organizations discover during these verifications that they have technically valid backup copies, but lack evidence that demonstrates the actual ability to recover the information in operational conditions.

The growing importance of cybersecurity

In recent years, cybersecurity has gone from being a purely technological aspect to becoming an essential component of data integrity. Automated systems are increasingly interconnected, which increases the exposure to threats that could affect the confidentiality, availability O accuracy of information.

Therefore, modern audits must consider aspects such as:

• Vulnerability management.
• Application of patches and updates.
• Protection against malware and ransomware.
• Monitoring of security events.
• Remote access management.
• Network segmentation.
• Backups protected against cyber attacks.
• Security incident management.

Conclusion

Internal audits of automated systems represent one of the most effective tools for assessing the state of data integrity within a pharmaceutical organization. When carried out with a risk-based approach, they allow vulnerabilities to be identified before they become regulatory observations or affect product quality.

Beyond regulatory compliance, these audits help reinforce confidence in the information used to make critical decisions. In an environment where data underpins virtually all quality-related activities, ensuring its integrity is not only a regulatory obligation, but an essential requirement to maintain the reliability of the processes and the credibility of the organization with patients, clients and health authorities.

Have you recently reviewed the data integrity status of your critical systems? Maybe it's time to perform an in-depth evaluation and confirm that your controls are still effective.