Data Integrity Risk and Gap Assessment (Per System)

This is a ready-to-use per-system data integrity risk and gap assessment. It is the fillable record a DI program is built on: one completed assessment per GxP system, refreshed on a defined cycle and after any significant change. Replace every <<FILL: ...>> placeholder with your own specifics, set your document numbers and dates, and route it through your normal document control, review, and approval. A worked filled specimen follows the template so you can see how a completed version reads. Confirm each cited regulation against the current source before you rely on it.

Document control header

1. Purpose

This assessment evaluates the data integrity risk of <<FILL: SYSTEM NAME / ID>> and identifies gaps between the controls in place and the controls the data criticality requires. The objective is to confirm that records the system creates, modifies, stores, or transmits stay attributable, legible, contemporaneous, original, accurate, and complete across their lifecycle, and to drive any shortfall into a tracked CAPA.

2. Scope

This assessment covers the system named in the header, its records, its interfaces to other systems, and the people and procedures that operate it. It assesses controls across five layers: physical, configuration, procedural, work-practice, and culture. It does not re-perform computerized system validation, which is governed by <<FILL: CSV SOP-ID>>; it consumes the validation state as an input.

3. Responsibilities

4. Definitions

• ALCOA+: the data integrity expectations, attributable, legible, contemporaneous, original, accurate, plus complete, consistent, enduring, and available.
• Data criticality: the impact of the data on a product-quality or patient-safety decision; it sets how much control the data needs (see related article on data criticality and data risk).
• Inherent risk: the data integrity risk before any control is credited.
• Residual risk: the risk that remains after the current controls are credited at their assessed effectiveness.
• Gap: a required control that is absent, weak, or unverified for the data criticality at hand.
• Five-layer model: physical, configuration, procedural, work-practice, and culture controls, assessed together because a strong control at one layer can be defeated by a weak one at another.

5. System and data profile

Capture what the system is and what its data drives before scoring anything. The criticality recorded here sets the bar every later layer is measured against.

6. Five-layer control checklist

Assess each layer below. For every line, record the control state, rate its effectiveness, and note the evidence you saw (screenshot, configuration export, SOP number, observation, interview). A “No” or “Partial” is a candidate gap; carry it to section 8. Do not credit a control you could not verify.

Effectiveness rating used throughout: E (effective, verified), P (partial or unverified), N (absent or ineffective).

6.1 Layer 1, physical

Controls over the hardware, the room, and the media that hold the records.

6.2 Layer 2, configuration

Technical settings that make the electronic record trustworthy.

6.3 Layer 3, procedural

Whether the written rules that govern the system exist and cover the right things.

6.4 Layer 4, work practice

What people actually do, which is where written controls succeed or fail. Establish this by observation and interview, not by reading the SOP.

6.5 Layer 5, culture

Whether the environment lets people report problems and disincentivizes shortcuts. Soft to score, but it is the layer that decides whether the other four hold under pressure.

7. Scoring

Score in two steps so the assessment is repeatable rather than a gut feel.

7.1 Inherent (pre-control) risk

Set inherent risk from data criticality and the system’s exposure (manual steps, interfaces, prior history). Use a simple band.

7.2 Control effectiveness and residual risk

Roll up the five layers. The weakest material layer caps the credit, because a perfect configuration is undone by a culture that hides deletions, and a strong culture cannot fix an audit trail that is switched off.

Residual risk grid (inherent risk versus overall control effectiveness):

8. Gaps and CAPA

List every line scored P or N as a gap. Each High or Medium residual gap needs a dated, owned action. Low residual gaps may be accepted with a recorded rationale.

Open CAPA from data integrity gaps under your CAPA procedure <<FILL: CAPA SOP-ID>> so the actions are tracked and effectiveness-checked, not just listed here.

9. Acceptance criteria

This assessment is complete and acceptable when all of the following are true:

• Every line in section 6 has a state, an effectiveness rating, and recorded evidence; no control is credited without verification.
• Inherent risk, control effectiveness, and residual risk are scored per section 7 with the basis recorded.
• Every P or N line appears in section 8 as a gap.
• Every High and Medium residual gap has a dated, owned CAPA; every accepted Low gap has a recorded rationale.
• QA has reviewed and approved the assessment and the residual risk position.

10. References

21 CFR Part 11 (electronic records and electronic signatures). 21 CFR 211.68, 211.180, 211.188, 211.194 (records and controls). EU GMP Annex 11 (computerized systems). MHRA GxP Data Integrity Guidance and Definitions. PIC/S PI 041, Good Practices for Data Management and Integrity. WHO Annex 4, Guideline on Data Integrity (TRS). FDA Data Integrity and Compliance With Drug CGMP, Questions and Answers. ICH Q9, Quality Risk Management (for the risk-based scoring).

Confirm the current version and clause numbers of each reference before issue.

11. Revision history

12. Approvals

Filled specimen

The following shows the assessment completed for an example chromatography data system used for release testing, so you can see the level of detail an inspector expects. The company, system, and numbers are illustrative; replace them with your own.

System and data profile:

Five-layer scoring, with the lines that drove the result:

Scoring roll-up:

Gaps and CAPA:

In this example the configuration looked strong on paper, but a segregation-of-duties gap (analysts holding admin rights) plus a work-practice gap (review done weekly instead of daily for High-criticality data) capped the overall control at Partial and held residual risk at High, so QA did not accept it and two CAPAs were opened with owners and dates. That sequence, layered findings to capped effectiveness to residual risk to tracked CAPA, is exactly what a reviewer is expected to demonstrate.

Common inspection findings this assessment prevents

• A data integrity program with policy and training but no per-system risk assessment showing where the actual gaps are.
• Assessments that score only the configuration layer and never look at how the system is really used.
• Controls marked “in place” with no evidence the assessor verified them.
• A risk rating with no method behind it, so the same system scores differently each year.
• Gaps identified in an assessment that were never turned into tracked, dated CAPA.
• Review frequency or access rights set once for every system with no link to data criticality.

How to adapt this assessment

1. Set your document number, owner, and assessment date in the header, and your review cycle.
2. Fill the system and data profile in section 5 first; the criticality you record there sets the bar for every layer.
3. Work the five-layer checklist in section 6 with evidence, not memory; observe and interview for the work-practice and culture layers.
4. Adjust the scoring bands and the residual risk grid in section 7 to match your quality risk management procedure, then keep them fixed so assessments are comparable year over year.
5. Point the cross-references in sections 2 and 8 to your real CSV and CAPA procedures.
6. Confirm every regulation in section 10 against the current published version before issue.