Notes from the record, not a newsletter.
Written by whoever on the team had something worth documenting, usually right after a batch analysis turned up something worth flagging.
Data integrity is now the top reason FDA cites a manufacturer.
Between 2017 and 2022 alone, the FDA issued more than 160 warning letters to pharmaceutical manufacturers citing data integrity deficiencies — and it's now the single most frequently cited category in warning letters overall. Most of these findings don't involve deliberate fraud. They involve systems that were poorly designed, audit trails that didn't capture what they needed to, or paper practices that made a retroactive correction too easy. The intention was rarely bad. The record didn't protect anyone from the consequence.
Continued Process Verification is still treated as optional by too many sites.
The FDA's 2011 process validation guidance made Stage 3 — ongoing verification throughout commercial production — an equal, permanent part of the validation lifecycle, not a formality after Stage 2 qualification. Plenty of sites still treat their three qualification batches as the finish line and let CPV lapse into something closer to occasional spot-checking. The processes that drift into trouble are almost never the ones being watched continuously.
Shared logins are still one of the most common findings we see.
A shared operator login undermines attribution — one of the five core ALCOA principles — and it's one of the most frequently cited data integrity issues in FDA guidance. It's rarely intentional. It's usually a workaround from years ago that nobody revisited once the electronic system that made it a real problem got put in place. Fixing it is often more of a training and access-management issue than a technology one.
The hardest part of a new engagement is agreeing on the source of truth.
Most sites we work with have at least two systems that could plausibly answer the same question about a given parameter, and they don't always agree. Before any analysis means anything, someone has to make an explicit, documented decision about which system is authoritative for which data — a conversation that's more organizational than technical, and one we insist on having before we run a single control chart.
Recognize one of these patterns in your own manufacturing data? Get in touch — that's usually how the first conversation starts.