HANDLING OF AUDIT TRAIL
PURPOSE:
This SOP describes the procedure for Handling of system audit trail/ Batch audit trail report which is generated by the manufacturing, packing, warehouse and utility equipment.
SCOPE:
This SOP is applicable to all manufacturing, packing, warehouse and utility equipment.
RESPONSIBILITY:
User Department:
- To prepare procedure for review of system audit trail/ batch audit trail report of all applicable equipment (wherever audit trail report is generated).
- To prepare audit trail list of direct and indirect impacting equipment and its system.
- To review the system audit trail/ batch audit trail report (wherever applicable) for direct and indirect impacting equipment.
Quality Assurance:
- To prepare and review the monthly schedule of audit trail report for indirect impacting equipment.
- To verify the system audit trail/ batch audit trail report (wherever applicable) for direct and indirect impacting equipment.
User department Head/ Designee:
To check the procedure for review of system audit trail/ batch audit trail report.
For implementation and compliance of SOP.
QA Head/ Designee:
To approve audit trail list of direct and indirect impacting equipment and its system.
To approve monthly schedule of audit trail report for indirect impacting equipment.
To approve procedure for review of system audit trail/ batch audit trail report.
For implementation and compliance of SOP.
IT’S Department:
- To ensure the audit trail data backed up successfully.
- To support the user department for reviewing the audit trail data (if any).
DEFINITIONS:
Audit Trail:
Audit trail is an event log maintained by the software with respect to all the activities performed during operation of the equipment. A secure computer generated, time stamped log that independently record the date and time of user entries and action that create, modify or delete electronic records.
Record changes shall not obscure previously recorded information.
Batch Audit trail:
Audit trail which capture changes between start and end of the batch activities.
System audit trail:
Audit trail which captures change outside batch activities.
Direct Impacting Equipment:
The equipment/ system that is expected to have a direct impact on product quality, either by having a direct role in supporting or meeting a process requirement or a directories in controlling a significant risk to the patient.
Indirect Impacting Equipment:
A system that is not expected to have a direct impact on product quality, but typically will support a direct impacting system.
Data audit trail:
An audit trail (also called audit log) is a security-relevant chronological record, set of records, and/or destination and source of records that provide documentary evidence of the sequence of activities that have affected at any time a specific operation, procedure, event, or device.
PROCEDURE:
General Procedure:
The purpose of an audit trail in electronic record system is to provide the integrity of electronic record and associated raw data for any activities related to creation, modification or deletion of information during operation.
The audit trail must independently record the identity, user entries and action taken upon creation, modification of electronic record while not overwriting/ obscuring previously recorded information.
All changes to GMP data must be captured while operation of equipment.
Audit trail report must be available for review i.e. printed paper reports or electronically stored reports that can be reviewed.
Perform audit trail review, so that integrity of data and controls are guaranteed for all products, relevant processes and related regulated electronic records.
System audit trail and batch audit trail report shall be reviewed after completion of the batch activity for all direct impacting equipment wherever audit trail report is generated.
Audit trail of the electronic system shall be enabled all the time. Edit/ Delete rights shall not be granted to any user/ reviewer including system administrator (wherever applicable).
Storage period of the system and batch audit trail report shall be perpetual in line with the procedure defined in SOP (Storage, retrieval and destruction of records).
User department shall prepare the procedure for review of system audit trail/ batch audit trail report of each equipment (wherever audit trail is available in system).
Procedure for review of system audit trail:
User department reviewer shall Login the system/ equipment through HMI/ PLC/ SCADA and select the period for which audit trail data to be reviewed. Audit trail data to be reviewed for any modification of electronic record, changes in system configuration, error message/ alarm and other action tracked in audit trail.
User department shall ensure that audit trail report is generated in sequential manner with date and time and available for all the time duration. There shall be no changes in the system/ server date and time.
The system shall be allowed to access only with a secure login ID & password.
If review of system audit trail is not feasible in reviewer user role due to software limitation, it shall be reviewed by taking printout.
Procedure for review of batch audit trail report:
After completion of batch, process printout of equipment (such as Manufacturing Tanks, Steam sterilizer, Filling machine, Compression machine, Capsule filling machine, Fluid bed equipment, Rapid mixer granulator etc.) shall be taken.
Batch audit trail report shall be reviewed by user department for user login access, details of recipe, sequence of event, creation and deletion of any event, alarm details, details of operational parameter (but not limited to).
If any operational parameter found out of the specified limit in batch audit trail report, remark for the same shall be written in the printouts / BMR and event shall be handled through deviation.
QA department shall verify the checklist of system audit trail and batch audit trail report for completeness and accuracy before releasing the batch. If any discrepancy observed, shall be recorded (Checklist for review of system and batch audit trail report).
After review of batch audit trail report it shall be attached with respective BMR/BPR (If applicable).
If process print out are not generated due to malfunctioning of printer, then print out shall be generated through SERVER/ any recording (data backup) or If any equipment / machine does not have provision for the data backup then same shall be handled through deviation.
Follow below for action to be taken during audit trail review:
If Audit trail review is satisfactory with no discrepancy – No action needed.
If any change is identified during system and batch audit trail review- Check for supporting documents i.e. Change control, work request etc.
If any discrepancy observed during audit trail review – Handle the activity though deviation.
User department shall prepare a list of all available equipment i.e. Equipment name, Equipment id, categorization for direct/ indirect product impacting system, data availability for audit trail/ batch audit trail report.
Quality Assurance department shall archive the original signed copy as a master copy and controlled copy of the same shall be issued to the concerned department. If any equipment is added or removed, accordingly Annexure-3 shall be updated and previous list shall be made obsolete.
QA department shall prepare monthly audit trail schedule at the end of year (preferably in December month) for review of indirect impacting equipment.
Frequency for review of system audit trail/ batch audit trail report System audit trail & batch audit trail report for direct Impacting Equipment and related system shall be reviewed prior to batch release.
System audit trail for indirect Impacting Equipment /System shall be reviewed monthly (+/- 7 ”days from last review) as per review checklist.
ABBREVIATIONS:
HMI: Human Machine Interface
PLC: Programmable Logic Controller
SCADA: Supervisory Control and Data Acquisition
CHECKLIST FOR REVIEW OF SYSTEM AND BATCH AUDIT TRAIL REPORT
Are there any changes in system policies and system configurations?
If yes, check whether changes done through formal change control procedure and are in line with the IT administrative control SOP.
Is there any edit/delete of data or event observed?
If yes, check whether investigation done / initiated through QMS documents.
Is there any back-up failure observed?
If yes, check for action initiated by IT.
Is there any critical error message, repetitive error message or audit trail events that may have impact on accuracy and integrity of electronic data?
If yes, Check for necessary action taken?
Are there any login-logout events via generic ID?
If yes, verify the activity performed through authorized person.
Is audit trail generated in sequential date and time manner?
Is audit trail for entire duration available for selected period?
Is there any data overlapping observed where oldest data is omitted due to limited storage capacity?
User access details (User ID and name, who made the changes) is captured in report?
Is there any modification of date and time in audit trail log/ batch report?
Is date and time recording in batch audit trail report is matched with equipment operation log or respective BMR/ BPR?
Were any modifications in recipes/ parameter?
Were any user creation/ deletion found in audit trail?
Were any aborted cycle history (If applicable)?
Were any operational parameter found out of limit?
Is there any modification of user privilege group?
Numbers of batch/ cycle runs is matched with equipment operational usage logbook (wherever applicable)?
User Log in and Log out details is captured in audit trail log/ report?
Alarm details are captured in audit trail log/ report?
Any abnormal or unusual, alarm events are captured in audit trail log/ report?
Any other events captured or generated by the system?
Note: Site shall prepare the checklist for audit trial and batch audit trail review considering above point as reference. Any other checkpoint can be added along with above mentioned points.
