Phase 1
Detection and Initial Assessment
1Identify a data integrity anomaly or concern
Anomaly identified through audit trail review, an employee report, an inspection finding, or a periodic governance review.
Internal SOP
↓
2Secure and preserve the affected data and systems
Affected records, audit trails, and system access immediately secured to prevent further alteration before the investigation proceeds.
21 CFR 211.68
↓
3Notify quality leadership and initiate formal investigation
Concern escalated to quality leadership immediately, opening a formal investigation record distinct from a routine deviation.
Internal SOP
↓
4Assemble a cross-functional investigation team
Quality, IT/system administration, and subject matter experts assembled, with independence from the area under investigation.
Internal SOP
Phase 2
Investigation Scoping and Evidence Preservation
5Define investigation scope and boundaries
Scope defined across the systems, time period, personnel, and products potentially affected by the anomaly.
FDA Data Integrity Guidance
↓
6Preserve audit trails, metadata and original records
Original electronic and paper records, complete audit trails, and associated metadata preserved for forensic review.
ALCOA+
↓
7Interview involved personnel
Structured, documented interviews conducted with personnel who generated, reviewed, or approved the records in question.
Internal SOP
↓
Does evidence indicate deliberate falsification?
YES → Escalate to executive, legal and HR
NO → Continue as unintentional gap
Phase 3
Root Cause Analysis and Impact Assessment
8Conduct root cause analysis
Systemic root cause identified, distinguishing a technology or procedural gap from an isolated individual action.
Internal SOP / QRM
↓
9Determine the full extent and time period of impact
Investigation extended to determine how long the gap existed and every record, system, or batch it may have touched.
FDA Data Integrity Guidance
↓
10Assess impact on product quality and batch disposition
Quality impact assessed for every batch or record potentially affected, including batches already released to market.
21 CFR 211.192
Phase 4
Remediation and Reporting
11Develop and implement CAPA addressing systemic gaps
Corrective and preventive actions target the systemic gap, covering process, technology, training, and governance controls.
21 CFR Part 211
↓
12Determine regulatory reporting obligations
Impact assessment reviewed against Field Alert and other regulatory notification requirements for affected batches.
21 CFR 211.198
↓
13Complete investigation report and close with quality oversight
Final investigation report documenting root cause, full impact, CAPA, and reporting decisions approved by quality leadership.
21 CFR 211.192
Data Integrity Trigger Types (Overview)
Audit Trail Anomaly
Unexplained changes, deletions, or timing inconsistencies surfaced through system audit trail review.
System-Generated
Whistleblower Report
Raised directly by an employee, often carrying the highest initial credibility and urgency.
Internal Report
Inspection or Audit Finding
Identified externally by a regulator or internally by an auditor reviewing records and access controls.
External / Internal Audit
ALCOA+ Breach Categories (Overview)
Attributable / Original
The record cannot be tied to the person who generated it, or is not the first capture of the data.
Contemporaneous / Accurate
The record was not made at the time of the activity, or does not accurately reflect what occurred.
Complete / Consistent
The record is missing required elements, or is inconsistent with other records of the same activity.
Enduring / Available
The record cannot be retrieved, reconstructed, or made available for review when required.
Key Investigation Outputs (Overview)
Investigation report
Formal record documenting root cause, full scope, and impact assessment for the data integrity concern.
Batch impact assessment
Disposition decision for every batch or record identified within the investigation's determined scope.
CAPA plan
Corrective and preventive actions addressing the systemic process, technology, or governance gap.
Regulatory notification
Field Alert Report or equivalent notification filed where the impact assessment warrants disclosure.