Audit trail
An audit trail is a secure, computer-generated, time-stamped record of who created, changed or deleted electronic records, and when. 21 CFR § 11.10(e) requires one for FDA-regulated electronic records in scope; EU GMP Annex 11 asks companies to consider one based on risk and review it.
On this page · 6 sections
How does Audit trail apply to your shop floor?
Pick your industry and scale — Ask V5 rewrites the definition in your context, gives a worked example, and shows what V5 does on day one.
01What an audit trail records
Part 11 describes secure, computer-generated, time-stamped audit trails that independently record the date and time of operator entries and actions that create, modify or delete electronic records. Changes must not obscure previously recorded information, and the trail must be kept at least as long as the underlying record and be available for FDA review and copying.
Annex 11 clause 9 adds that, for changes or deletions of GMP-relevant data, the reason should be documented, and audit trails should be available, convertible to a readable form and regularly reviewed.
02US and EU compared
| Point | 21 CFR 11.10(e) | EU GMP Annex 11 clause 9 |
|---|---|---|
| Status | U.S. regulation for records in Part 11 scope | EU GMP guideline |
| When needed | Required control for closed systems in scope | Considered based on risk |
| Reason for change | Not stated in 11.10(e) | Should be documented for GMP-relevant changes |
| Review | Covered by predicate-rule record review (FDA Q&A) | Should be regularly reviewed |
03Who reviews it and how often
FDA's 2018 Q&A says people responsible for reviewing CGMP records should review the audit trails that capture changes to that data as part of the same review — for example, the quality unit's review under 211.192. Where regulations set a review frequency, the audit trail follows it; otherwise frequency is set by risk assessment based on data criticality and controls.
04Worked example
A recorded fill weight is changed from 49.6 g to 50.1 g. The audit trail shows the original value, new value, user, date and time and the reason 'transcription error, corrected against balance printout'. When QA reviews the batch record, it reviews that entry, checks the printout and decides whether the explanation is acceptable.
05Common failure modes and checks
- Audit trail switched off or configurable by ordinary users.
- Trail exists but is never reviewed, or reviewed only during inspections.
- Review of a full system log rather than changes relevant to the record.
- Reasons for change left as free text like 'update'.
06Where V5 fits
V5 keeps an audit history of record changes with user and time, alongside electronic signatures and role-based access. Customers decide which records are in scope, set review procedures and perform the review; using the feature does not by itself establish compliance or a validated state.
Frequently asked questions
Q.Does Part 11 require a reason for change?+
11.10(e) does not state one; EU Annex 11 clause 9 expects reasons for GMP-relevant changes and deletions, and many firms record them for both.
Q.How long must an audit trail be kept?+
Under Part 11, at least as long as the subject record. Record retention periods come from the predicate rules.
Q.Who should review audit trails?+
FDA's 2018 Q&A says the people who review the associated CGMP records, as part of that review.
Q.Is audit trail review required for every record?+
Frequency follows the record's review requirement, or risk where none is specified.
Primary sources
Further reading
Explore this topic
Audit trail sits inside 2 overlapping topic clusters in our glossary. Every neighbour is one click away.
Electronic records, signatures, audit trail and ALCOA+ data-integrity principles.
HCT/Ps, blood cGMP, donor eligibility, ISBT 128 labeling and forward-tracing lookback.
Want to see how Audit trail could fit into your own records and workflows? Explore the related V5 pages or talk to our team about what applies to your operation.