Gap 4: What FDA Warning Letters Reveal About Data Integrity and Scientific Documentation



The Risk of Incomplete or Compromised Records

Incomplete or compromised records introduce risks beyond regulatory compliance. When data is not attributable, legible, contemporaneous, original, and accurate (ALCOA), your organization loses the ability to trace production events. These complications also hinder your ability to investigate deviations or verify that employees followed established procedures.

Compromised scientific documentation may conceal process failures or mask contamination events that should trigger corrective action.

What FDA Observations Continue to Reveal in Data Integrity

Across the FDA Warning Letters citing data integrity that we reviewed, five recurring failure patterns emerged.

Common Pitfalls in Laboratory Records and Electronic Systems

Laboratory records may not include all data generated during testing, such as unsuccessful, preliminary, or trial analyses. This leads to an incomplete dataset, which prevents professionals from demonstrating that product-quality decisions are scientifically justified.

Data-integrity risk increases when laboratories and manufacturing operations lack practical controls for time pressure, interrupted activities, instrument failures, corrections, repeat testing, and unexpected results. Personnel must understand how to preserve the complete record in these situations, while procedures, systems, supervision, and Quality Unit review must make compliant performance achievable and verifiable.

Inconsistencies in Equipment Logs and Batch Records

Shared credentials, excessive user privileges, weak audit-trail review, or inadequate system controls create opportunities for altering or deleting electronic pharmaceutical records. These control weaknesses may permit unauthorized changes, prevent reviewers from determining who performed an action, or allow alteration or loss of regulated records to go undetected.

If any of the following documents are incomplete or inconsistent, traceability within the manufacturing cycle breaks and prevents your team from verifying specification adherence:

• Equipment logbooks
• Analytical worksheets
• Batch records
• Supporting raw data

Delayed recording or selective data reporting prevents timely and accurate quality decisions. This can produce an incomplete or inaccurate reconstruction of manufacturing execution, weakening real-time process control, batch-disposition decisions, and subsequent investigations.

The Problem of Non-contemporaneous Records

Creating records after an activity or using unofficial notes and uncontrolled forms increases the risk of inaccuracies. These practices rely on memory or reconstruction of events rather than real-time, reliable evidence.

Quality-Unit Review for Existence vs. Coherence

Quality-unit review may confirm that a record exists, but not assess whether the complete dataset is coherent, attributable, and scientifically credible. Review processes may fail to detect unusual patterns or potential manipulation when reviewers lack appropriate system access, time, technical competence, clear responsibilities, or effective procedures for reviewing metadata and audit trails. This represents a weakness in the design and execution of the review system, not simply an individual reviewer's failure.

These issues signify a critical failure of oversight, allowing the quality system to accept compromised data when reviews focus on the presence of documentation rather than on scientific coherence and credibility.

Misinterpreting Data-Integrity Breaches

In some cases, a data-integrity breach is treated as an isolated employee issue rather than evidence of weak controls, supervision, governance, or quality culture. A complete assessment should consider broader organizational contributors, including production priorities, workload, timelines, staffing, supervision, reporting structures, incentives, and the availability of protected escalation channels. This misinterpretation prevents organizations from addressing systemic root causes, which causes vulnerabilities to persist and increases the risk of future breaches.

Data-Integrity Failure Patterns in Practice

Several of the letters we reviewed show these data-integrity failures in practice.

FDA's Warning Letter to Huons Co., Ltd. (320-26-95, June 15, 2026), for example, described a team leader who instructed staff to discard failing bioburden test plates and manipulated camera timestamps to backdate documentation, along with 1,897 blank, uncontrolled cGMP-related forms found in active use and logbook pages removed with a knife and replaced with newly fabricated pages. FDA treated these observations as evidence that the firm's quality system did not adequately ensure the integrity of data supporting product quality decisions.

In a separate case, FDA's Warning Letter to Fareva Amboise (723502, April 10, 2026) found that a manufacturer's computer systems allowed operators to modify system dates and adjust alarm limits with no access restrictions. When electronic particle-count monitoring repeatedly showed results exceeding contamination limits, only the passing retests were kept in batch records. The original failing results were never retained anywhere, and a vendor's calibration activity later deleted electronic data the firm had never backed up.

FDA's Warning Letter to Reliance Life Sciences Private Limited (320-26-117, August 18, 2026) found that a third manufacturer's integrity-testing software overwrote its own records because reports were never saved with unique file names, erasing evidence each time a new test ran. At another plant, the required integrity testing was not performed, leaving the firm without evidence that the tests had occurred or records through which failed results could be identified and investigated.

Beyond ALCOA as a Mnemonic

Our research shows that, even if they know the acronym, employees may struggle to apply ALCOA principles under the following circumstances:

• Busy laboratory sequences
• Interrupted production steps
• Calculation corrections
• Instrument failures
• Unexpected results

The industry commonly uses the term ALCOA+ to emphasize four additional characteristics: complete, consistent, enduring, and available. Although FDA's guidance does not depend on the "ALCOA+" label, it expressly expects data to be complete, consistent, accurate, and available for review throughout the required retention period.

Personnel should be able to apply data-integrity principles reliably when unexpected conditions arise, including instrument failures, interrupted work, corrections, repeat testing, and unusual results. That capability requires clear procedures, appropriate system controls, scenario-based instruction, supervised practice, effective review, and management oversight.

Role-Based Responsibilities and Competency

The following role-based training practices can help your organization strengthen data integrity and scientific documentation:

Clear Expectations for Analysts

Analysts require precise expectations for critical laboratory procedures such as sample injections, proper repeat testing protocols, and system suitability checks. Provide analysts with clear guidance on managing audit trails and metadata, and how these factors impact data integrity and traceability.

Instruction should cover appropriate responses and documentation during anomalies, including reviewing audit trails and metadata, to ensure data remains accurate.

Analysts require clear procedures, controlled systems, appropriate access, and competency in responding to unexpected results.

Practical Instruction for Manufacturing Personnel

Manufacturing teams require hands-on training for real-time data entry to ensure records are contemporaneous and accurately reflect the activity. Instruction must cover procedures for making corrections to records and performing reconciliation tasks for batch documentation. 

Manufacturing personnel require usable records and systems that support contemporaneous entry at the point of work.

Review Competency for Supervisors and Quality Personnel

Training should equip supervisors and quality personnel with the ability to assess data for completeness and understand its full context within the operational workflow. Reviewers must learn to recognize unusual patterns, discrepancies, or anomalies that could indicate data manipulation. Every person in the review chain needs to understand their role in creating, protecting, retaining, and escalating information, so the organization can trust the evidence behind every quality decision.

Reviewers require adequate time, access to complete data and metadata, defined escalation authority, and demonstrated review competency.

Access Control and Security for System Owners and IT

System owners and IT staff require expertise in implementing robust access controls and managing user privileges to prevent unauthorized data alteration. Training must cover data security, backup procedures, system configuration, and ongoing validation to maintain system integrity.

IT and system owners require governance for access, configuration, backup, validation, security, retention, and periodic review.

How Organizations Can Strengthen Data-Integrity Capability

Organizations can strengthen data-integrity capability through the following practices:

• Managing the pharmaceutical data life cycle: Mapping the complete data life cycle, from creation through review, reporting, retention, and destruction, helps to identify all points where data is generated or stored and proactively surface vulnerabilities.
• Risk-based controls: Applying controls based on data criticality and the risk that an error could affect product-quality decisions helps organizations allocate resources to protect the most critical information.
• Restricting access: Organizations restrict access based on job responsibilities and maintain independent oversight of privileges. A "least privilege" principle limits access to essential personnel, reducing the potential for unauthorized changes.
• Risk-based audit-trail review: Organizations should define which audit trails require review, when reviews occur, who performs them, what constitutes an anomaly, how findings are escalated, and how the review is documented. Reviewers must be qualified to perform those responsibilities.
• Protected escalation channels: Organizations should provide confidential, nonretaliatory mechanisms for raising concerns about documentation practices, data reliability, system controls, or operating pressures. Management should define how concerns are assessed, investigated, escalated, and resolved.
• Periodic assessments: Periodic data-integrity assessments help verify that written expectations align with actual practices, fostering continuous improvement. 

A Four-Level Standard From Training to Competency

Training is not the same thing as competency. Training provides knowledge. Competency is the demonstrated ability to apply that knowledge correctly, and the difference matters most in data integrity, where a signed training log and a trustworthy record are not the same evidence.

Our research points to four levels that organizations need to build toward:



1. Awareness: The analyst understands why a control exists, not just that it exists.
2. Application: The analyst can explain the right response to an unexpected result or an instrument failure, rather than simply reciting ALCOA.
3. Demonstration: The analyst performs that response correctly under real working conditions, not in a classroom.
4. Sustainment: That performance holds up over time, reinforced by observation, coaching, and periodic reassessment, not a once-a-year refresher.



When competency development stops at awareness, the organization still lacks evidence that personnel can perform correctly in real-world working conditions. A multiple-choice quiz on ALCOA can confirm awareness, but it can't confirm that an analyst will handle an actual instrument failure correctly, or that a supervisor will catch a subtle inconsistency in a batch record during a busy shift. Depending on the role and risk, verification may include observed performance, review of completed records, simulations, proficiency exercises, case analyses based on actual deviations, and monitoring of relevant quality outcomes.

The Competency Standard for Effective Data-Integrity Training in Life Sciences

Look beyond annual data-integrity training to ensure your organization can rely on the complete body of information for quality decisions. Training is effective only when personnel understand the following factors:

• What must be recorded: Personnel must know which information requires documentation and the level of detail necessary.
• Why it matters: Personnel should understand how incomplete or unreliable records can affect product-quality decisions and patient risk. Reinforce this understanding through effective controls, supervision, accountability, and management behavior.
• How controls work: Employees need practical knowledge of systems and procedures designed to protect data integrity.
• When to escalate: Personnel should recognize situations that require supervisor involvement to prevent potential compromises.
• How incomplete information risks patient safety: Training must illustrate the real-world consequences of inadequate documentation, connecting daily activities to patient outcomes.

At the same time, leadership attention remains critical. When the same data-integrity findings keep surfacing, that's a signal for management review. Leaders need to ask whether the organization's data-integrity capability is actually adequate for its risk profile, whether repeat issues point to a work system problem rather than a person problem, and whether the review process itself is catching what it's supposed to catch.

Supporting Role-Based Data-Integrity Competency

Data integrity cannot be ensured by an annual refresher or a signed training record alone. Organizations also need appropriate system configuration, access controls, procedures, resources, supervision, independent review, protected escalation, and management oversight.

When competency needs are identified, CfPIE offers instructor-led programs for roles in laboratory, manufacturing, quality, documentation, and computerized systems. These include GMP Training for the QC Laboratory, Pharmaceutical Production Batch Record Review, Computer System Validation, Writing Effective SOPs and Other Process Documents, and customized on-site training.

Training provides the greatest value when it is integrated with the organization's data-governance framework, technical controls, role qualifications, performance observations, periodic assessments, and management review.



To discuss a role-based training program for your organization, contact CfPIE at 610-708-2264 or through our online contact form.