Whitepaper: Audit Trail Reporting
Introduction
Manufacturers subject to Good Manufacturing Practices (GMP) are required to document system modifications as well as operational changes that could affect electronic records. This information is generally aggregated from multiple automation and manufacturing information systems.
For example, FDA data integrity guidance states “audit trail means a secure, computer-generated, time-stamped electronic record that allows for reconstruction of the course of events relating to the creation, modification, or deletion of an electronic record.”
FDA guidance further states that personnel responsible for record review should likewise review audit trail records, at a frequency consistent with record review. As a result, audit trail records must be reviewed after each significant step in manufacturing, processing, packing, or holding, as well as prior to batch release.
Audit trail reporting can be challenging in that information must be aggregated from multiple systems. In addition, there are tradeoffs between ensuring that all appropriate changes are reported in the audit trail while omitting records that are not relevant to make the review process manageable.
Informetric Audit Trail Reporting incorporates modules from InfoBatch™ batch reporting and, where necessary, AgileDoc® lifecycle management software to ensure that audit records reflect all events related to the electronic batch records. InfoBatch provides the batch context that is required to relate relevant audit records, while AgileDoc enables system design to be logically connected to manufacturing history.
Data Sources
Each site must perform an assessment to identify systems that should be associated with the audit trail. The following systems are typical sources for the audit trail related to electronic batch records.
- Manufacturing Execution System (MES)
- Automation System
- Batch Historian
- Alarm and Event Chronicle
- Electronic Logbooks
- Continuous Historian
- Calibration and Maintenance Management System (CMMS)
- Asset Management System (AMS)
The actual systems required for the audit trail will vary from site to site. For example, if electronic records rely on parameter and event information from the MES and batch historian, continuous historian audit records may not be required.
Architecture
A report server is deployed on a physical server or virtual machine. The system architecture is primarily determined by the data sources that must be accessed by the report server. Firewalls and edge devices may have to be configured to enable the required access. User access to audit trail reports, whether generated on-demand through a web client or viewed through automatically generated PDF documents, must also be considered.
Report Generation Strategies
Audit trail reports may be reviewed in conjunction with batch release or periodically based on the nature of the audit records. For example, formula changes may be reviewed in conjunction with batch execution, while equipment calibration would likely be evaluated monthly. Most sites will employ a hybrid approach that encompasses batch review where possible, augmented by periodic monitoring of records that cannot be associated with a specific batch.
Example Record Types
An assessment should be performed to identify configuration and runtime changes that must be reported on the audit trail. Some representative samples are as follows:
User Control Actions
Manual user interventions associated with equipment acquired by the batch executive are queried from the automation system HMI event chronicle.
Parameter Changes
Modifications to the bills of materials, formulas and workflow activities are queried from the MES and batch historian databases.
Configuration Version Control
Configuration changes relevant to batch equipment are queried from the automation system version control database.
Equipment Events
Equipment events can combine critical routine process steps as well as atypical events. The former provides context and assurance that the equipment was operating correctly, while the latter highlights exceptions that could impact system and product integrity.
Routine process steps include the acquisition of equipment required to produce a batch, as well as key cycle start/stop events.
Atypical events could include alarms associated with equipment utilized in the production of a batch, as well as corresponding user acknowledgements/interventions.
Equipment Maintenance and Calibration Records
Instrument calibration and equipment calibration records from a Calibration and Maintenance Management System (CMMS) demonstrate that equipment is maintained according to GMP standards. Alternatively, if CMMS records are not readily available, Electronic Logbooks can be utilized to capture maintenance activity.
Project Planning and Implementation
Audit trail reporting requires coordination across multiple functional roles to ensure that compliance requirements are met within the constraints of the site’s manufacturing and information systems. Compliance, Quality Assurance and Operations teams are likely to contribute during the requirements gathering phase of a project, while Automation and Information Technology teams will play a key role in deploying the solution.
A top-down approach is advisable to specifying the requirements:
- Specify actions/record types that should be reviewed in conjunction with batch release.
- Identify records that can be associated with specific batches.
- Identify records that cannot be associated with a batch and as a result should be subject to periodic review.
- Identify the source system that is associated with each record type.
- Define the data models for aligning and organizing the audit records. For example, batch review may use the S88 procedural model for records that are associated with recipe execution.
Informetric can assist sites by evaluating existing manufacturing systems and recommending a path forward to achieve compliance in a timely and cost-efficient manner.