Audit Trail

Why Audit Trails Matter in Clinical Trials

Audit trails are the backbone of data integrity in electronic clinical trial systems. They provide an immutable, chronological record of every action taken on regulated data — who made a change, what was changed, when it happened, and why. Without robust audit trails, electronic records cannot satisfy the requirements of 21 CFR Part 11, ICH GCP, or EU Annex 11.

Regulatory inspectors routinely review audit trails during site inspections and sponsor audits to verify that data has not been improperly altered, that corrections follow documented procedures, and that the timing of data entries is consistent with clinical activities.

Key Components of an Audit Trail

• User identification — The unique identity of the person who performed each action
• Timestamp — The date and time of each action, synchronized to a reliable time source
• Original value — The data as it existed before modification
• New value — The data after modification
• Reason for change — A documented explanation for why the modification was made
• Action type — Whether the entry was a creation, modification, deletion, or system-generated event

Regulatory Requirements

FDA 21 CFR Part 11.10(e) requires that audit trails be computer-generated, secure, and available for FDA review. ICH GCP E6(R2) Section 5.5.3 requires sponsors to ensure the integrity of electronic data through audit trail controls. EU Annex 11 mandates that audit trails cover all GMP-relevant changes and be available in a readable format.

Common Audit Trail Deficiencies

• Gaps in audit trail coverage — some system actions not captured
• Insufficient timestamp granularity or unsynchronized server clocks
• Audit trails that can be modified or disabled by system administrators
• Reason-for-change fields that are optional rather than mandatory
• Inability to produce human-readable audit trail reports for inspectors

Best Practices

1. Ensure audit trails are system-generated and cannot be turned off or modified by any user
2. Require reason-for-change entries for all data modifications
3. Synchronize all system clocks to a common, validated time source
4. Conduct periodic audit trail reviews as part of ongoing monitoring
5. Maintain audit trail data for the required retention period (typically 15+ years for clinical trials)
6. Train site staff on the importance of timely, accurate data entry to minimize corrections