Data integrity in drug manufacturing

On Dec. 13, 2018, FDA announced in the Federal Register² that it had finalized a guidance titled "Data Integrity and Compliance With Drug CGMP: Questions and Answers." The notice said the document had "been developed in response to an increase in findings of data integrity lapses in recent inspections." A draft had been published in April 2016.

At 13 pages of numbered questions, the guidance is short. It deals with records most patients never see, the laboratory and production files that show a batch of medicine passed its tests. FDA's position, stated in the guidance itself¹, is that "FDA expects that all data be reliable and accurate." When records cannot be trusted, neither can the test results they contain.

Data integrity sits underneath many recalls and warning letters without always being named. GxRadar read the 2018 guidance and the regulations it cites, and checked how the issue appears in FDA's own records. This piece explains the ALCOA standard at the center of the guidance, the record-keeping rules behind it, and how lapses surface in enforcement.

What the guidance covers

FDA's guidance page⁷ lists it as a final Level 1 guidance issued by its drug, biologics and veterinary centers, among other offices. It applies to the current good manufacturing practice rules for drugs in 21 CFR parts 210, 211 and 212. It defines data integrity as "the completeness, consistency, and accuracy of data," and it works through 18 questions, from what an audit trail is to whether FDA may read a company's emails. (It may. "An email to authorize batch release is a CGMP record that FDA may review," the guidance says.)

Like all FDA guidance, it does not create new legal requirements. Its background section points to existing regulations instead, including the requirement that records be kept as "original records" or "true copies" under 21 CFR 211.180⁵, the rule that computer backup data be "exact and complete" and "secure from alteration, inadvertent erasures, or loss," in 21 CFR 211.68³, and the rule that laboratory records include "complete data derived from all tests," in 21 CFR 211.194⁴. Our CGMP explainer covers the wider set of manufacturing rules.

ALCOA, letter by letter

Complete, consistent and accurate data, according to the guidance, "should be attributable, legible, contemporaneously recorded, original or a true copy, and accurate (ALCOA)." A footnote ties each quality to specific regulations.

Source: FDA (2018), Data Integrity and Compliance With Drug CGMP, Question 1 and footnote 5. Part 212 citations for PET drugs omitted.

Several answers turn those letters into concrete rules. Shared login accounts fail the "attributable" test, because "a unique individual cannot be identified through the login." Blank forms should be controlled and numbered, and the guidance gives bound, paginated notebooks as an example of good document control. Jotting results on scraps of paper for later transcription "is not acceptable."

Metadata, the guidance says, is "data about data." Its example: "the number '23' is meaningless without metadata, such as an indication of the unit 'mg.'" An audit trail is "a secure, computer-generated, time-stamped electronic record" that lets reviewers reconstruct who created, changed or deleted a record. For a chromatography run, the guidance lists the user name, the date and time, the integration settings and any reprocessing. Audit trails are part of the production and control records that the quality unit must review and approve under 21 CFR 211.192⁶, the guidance says.

Testing into compliance

FDA's sharpest language concerns a practice it calls testing into compliance. "FDA prohibits sampling and testing with the goal of achieving a specific result or to overcome an unacceptable result (e.g., testing different samples until the desired passing result is obtained)," the guidance says. It singles out the use of actual product samples in "system suitability" or trial runs, a step that is supposed to check the instrument, as a way of disguising such testing, and notes that FDA has cited the practice in warning letters.

A failing result cannot simply be set aside either. Invalidating a result requires "a valid, documented, scientifically sound justification," and even then the original data stay in the batch record for the quality unit to see. The guidance says all data, "including obvious errors and failing, passing, and suspect data," must be kept in the records that are retained and reviewed.

Concern over drug data is not new. In the late 1980s, investigators found falsified data in generic drug applications, a story told in our piece on the generic drug scandal of 1989. FDA's Application Integrity Policy, which covers applications affected by "wrongful acts that raise significant questions regarding data reliability," was published in the Federal Register on Sept. 10, 1991, according to Chapter 10 of FDA's Regulatory Procedures Manual⁸. The 2018 guidance says its expectations for fixing data integrity problems "mirror those developed for the Application Integrity Policy."

How lapses show up in enforcement

According to the guidance, data integrity violations "have led to numerous regulatory actions, including warning letters, import alerts, and consent decrees." The usual path runs through an inspection. An investigator lists observations on a Form 483, and if FDA judges the problems serious, a warning letter follows. Our explainer on FDA inspections, 483s and warning letters covers that sequence, and FDA posts the letters in its public warning letter database¹⁰.

Inspections are not the only route. FDA's FY2024 Report on the State of Pharmaceutical Quality⁹ says warning letters that year were issued "on the basis of inspection, §704(a)(4) records requests, and product testing." It counted 105 quality-related warning letters to human drug manufacturing sites that year, "the highest number of human drug, quality-related warning letters issued in the past five years." Letters to foreign sites rose from 35 to 64 while domestic letters fell from 59 to 41. For sites in China, 8 of 13 letters stemmed mainly from those records requests, which FDA can make under section 704(a)(4) of the Food, Drug, and Cosmetic Act.

For a company that finds a problem, the guidance lists what FDA wants to see: an investigation of the problem's scope and root causes, "a scientifically sound risk assessment" of its effects, and a management strategy "including a global corrective action plan." That can mean hiring a third-party auditor and "removing individuals responsible for data integrity lapses from positions where they can influence CGMP-related or drug application data."

What the recall file shows

GxRadar searched the openFDA drug enforcement data¹¹ through Oct. 28, 2026, and found the phrase "data integrity" in none of the 18,076 recall reasons. Recalls tied to record-keeping or quality-system failures are usually filed under a broader label. An openFDA search finds the phrase "CGMP deviations" in 3,316 recall records¹¹. GxRadar counted recall events whose reason opens with that phrase.

Source: GxRadar analysis of openFDA drug enforcement records, all classes, by year of first report. Includes the singular and "GMP" spellings. The full file has 714 such events.

Only 19 of those 714 events mention an inspection in FDA's reason text. The label covers quality-system failures of every kind, so the count cannot isolate data integrity cases. For recall trends across reasons, see the reasons drugs get recalled and our recall charts.

FDA also invites outside tips. Anyone with information about suspected data integrity problems that may affect drug quality can write to DrugInfo@fda.hhs.gov with "CGMP data integrity" in the subject line, the guidance says. New recalls appear on the GxRadar feed as FDA posts them.