About this case: this is a composite case. It combines patterns that recur across data integrity remediation projects into one anonymised story. Company details, findings and timelines are representative, not a description of a single client.

Data integrity is no longer a niche finding. FDA issued 303 drug warning letters in 2025, 59% more than in 2024, and roughly one in seven referenced data integrity. This is how a mid-sized generics manufacturer went from an uncomfortable mock inspection to an inspection-ready laboratory in 120 days.

303
FDA drug warning letters in 2025
+59%
compared with 190 in 2024
~15%
of FY2025 letters cited data integrity

The starting point

The company makes oral solid generics for several MENA markets and was preparing for its first FDA pre-approval inspection. A mock inspection of the QC laboratory produced findings that every data integrity auditor will recognise:

Shared logins
Analysts on two HPLC workstations used one generic account.
No audit trail review
Audit trails were enabled but nobody reviewed them before batch release.
Orphan injections
Injections existed in the system that never appeared in reported results.
Admin rights everywhere
Laboratory supervisors could change system dates and delete data.

The 120-day plan

Day 0306090120 ContainAssessRemediateProve 0–14Data-flow mapping, 15–45Configuration, SOPs, training, 30–90Checks, mock, 90–120
Figure 1. Four overlapping phases. Containment starts on day one; proof of effectiveness closes the project.
Days 0–14 · Contain. Shared accounts disabled, individual logins created, administrator rights moved from the lab to IT, system clocks locked. A retrospective review of audit trails for batches still on the market or awaiting release, with a documented product impact assessment.
Days 15–45 · Assess. Data-flow maps for every GMP computerised system in QC: where data is created, processed, reviewed, reported and archived. Each step rated for ALCOA+ risk. Root cause analysis showed the real problem was not individual behaviour but a quality system that never asked anyone to look at electronic data.
Days 30–90 · Remediate. Chromatography data system reconfigured with role-based access. A risk-based audit trail review procedure built into data review before release. A data integrity policy, revised good documentation practice training, and an escalation route for analysts who see something wrong.
Days 90–120 · Prove. Effectiveness checks on a sample of released batches, access reviews, and a second mock inspection by auditors who had not seen the first one.

Before and after

AreaBeforeAfter
User accessShared accounts, broad admin rightsIndividual accounts, role-based, reviewed quarterly
Audit trailsOn, never reviewedRisk-based review before every release
KnowledgeData integrity seen as an IT topicData-flow maps owned by the lab, trained staff
EvidencePolicies on paper onlyEffectiveness checks and a clean second mock inspection

Five lessons that travel

1Contain before you analyse. Access and clock controls take days, not months, and stop the problem growing.
2Assess product impact explicitly. Inspectors want to see that you asked whether released batches are affected.
3Map data flows, not just systems. Most gaps sit at hand-overs between systems and people.
4Fix the system before blaming people. The root cause is usually a process that never required anyone to look.
5Prove effectiveness independently. A second mock inspection by fresh eyes is the best test.

Want to know where your site stands? Try our free GMP Mock Audit, which includes a data integrity area, or book a mock inspection with a Molgenium auditor.

Sources and references