US FDA Computer system validation findings

Your firm failed to exercise sufficient controls over computerized systems to prevent unauthorized access or changes to data and failure to have adequate controls to prevent omission of data.

Appropriate controls are not exercised over computers or related systems to assure that changes in master production and control records or other records are instituted only by authorized personnel.

Failure to exercise sufficient controls over computerized systems to prevent unauthorized access or changes to data. Our investigators observed significant data-integrity violations at your facility involving the sharing of usernames and passwords that are used to gain access to your electronic computerized system for GMP analysis. For example, your electronic computerized system, (b)(4) , interfaces with laboratory equipment (b)(4) and restricts access through individual, unique usernames and passwords. Despite this control, your laboratory analyst used another analyst's login credentials to conduct (b)(4) calibrations and to perform (b)(4) -sample testing. The sharing of credentials constitutes a serious violation of data-integrity principles and is inconsistent with GMP requirements. Your quality system failed to detect and prevent repeated occurrences of this practice. Your response acknowledges that your written procedure SOP-RLS-000438, “The Use of Computerized Systems for GMP Operations,” prohibited username and password sharing. Your retrospective review under Protocol RQA-P-0560 was limited to 12 stand-alone analytical instruments for the period from February 10, 2025, through February 4, 2026. This review does not encompass all computerized equipment requiring username and password access, nor does it evaluate discrepancies beyond the stated review period. In response to this letter, provide the following: A retrospective review of all computerized equipment for all your facilities, including but not limited to stand-alone systems that require username and password authentication to gain access, and all products for which the equipment was used for testing, limited to distributed products currently within expiry and on the U.S. market. A comprehensive, independent assessment covering all GMP-integrated computerized systems for a three-year period to fully characterize the scope of this data-integrity failure. A management strategy for your firm that includes the details of your global CAPA plan to implement attributable, legible, complete, original, accurate, contemporaneous (ALCOA) records throughout your operation. The detailed corrective action plan should describe how you intend to ensure the reliability and completeness of all data, including microbiological and analytical data, manufacturing records, and all data submitted to FDA. A comprehensive, independent assessment of your laboratory practices, procedures, methods, equipment, documentation, and analyst competencies. Based on this review, provide a detailed plan to remediate and evaluate the effectiveness of your laboratory system.

Records of the inspections of automatic, mechanical or electronic equipment, including computers or related systems are not maintained.

Appropriate controls are not exercised over computers or related systems to assure that changes in master production and control records or other records are instituted only by authorized personnel.

Your firm failed to exercise sufficient controls over computerized systems to prevent unauthorized access or changes to data and failure to have adequate controls to prevent omission of data.