This is a ready-to-use checklist. Replace every <<FILL: ...>> placeholder with your own specifics and route completed copies through your normal review and retention process. A worked filled specimen follows the template. Verify each cited regulation against the current source before you rely on it.
Purpose
An application audit trail can only record what passes through the application. A direct database edit, made with a SQL client or script, leaves no application audit entry at all. This checklist reconciles the two independent records, the application audit trail and the native database audit log, for a defined table and period, so that a mismatch (a database-level change with no matching application entry) surfaces and is investigated rather than passing unnoticed.
Scope and frequency
| Field | Entry |
|---|---|
| System / database | <<FILL>> |
| GxP table(s) in scope | <<FILL>> |
| Reconciliation frequency | <<FILL: e.g. quarterly, or tied to periodic review>> |
| Performed by | <<FILL: role, independent of the DBA function>> |
Reconciliation checklist
| # | Item | Pass / Fail / NA |
|---|---|---|
| 1 | Export the application audit trail for the table and period in scope, including all INSERT, UPDATE, and DELETE events the application recorded | <<FILL>> |
| 2 | Export the native database audit log for the same table and period, including all INSERT, UPDATE, and DELETE statements captured at the database engine level | <<FILL>> |
| 3 | Confirm the database audit log was continuously enabled for the entire period with no gaps or disablement | <<FILL>> |
| 4 | Count application-audit entries and database-audit entries for the period; record both counts | <<FILL>> |
| 5 | For every database-audit entry attributed to the application service account, confirm a corresponding application-audit entry exists | <<FILL>> |
| 6 | For every database-audit entry attributed to a named human or DBA account (not the application service account), confirm whether a corresponding application-audit entry exists | <<FILL>> |
| 7 | List every database-audit entry from step 6 with NO corresponding application-audit entry; this is the direct-edit signature | <<FILL>> |
| 8 | For each entry listed in step 7, confirm whether it is a documented, pre-approved emergency database edit per <<FILL: SOP-ID for controlled emergency database edits>> | <<FILL>> |
| 9 | For any entry in step 7 that is NOT a documented emergency edit, open a deviation per <<FILL: SOP-ID for deviations>> the same day | <<FILL>> |
| 10 | Confirm no entries exist showing the audit-configuration itself was changed or disabled during the period without a corresponding change record | <<FILL>> |
Investigation trigger
Any unexplained entry from item 7, a database-level change with no matching application audit entry and no documented emergency-edit authorization, triggers an immediate deviation. Do not close the reconciliation until every such entry is either explained by a documented emergency edit or escalated.
Acceptance criteria
The reconciliation is acceptable when: both exports cover the full period with no logging gaps; every database-audit entry attributed to a human or DBA account either matches an application entry or is fully explained by a documented emergency edit; no unexplained database-level changes remain open; and the record is signed by a reviewer independent of the DBA function.
References
21 CFR Part 11.10(e) (secure, computer-generated, time-stamped audit trails). EU GMP Annex 11, clause 9 (audit trails). PIC/S PI 041, Good Practices for Data Management and Integrity in Regulated GMP/GDP Environments.
Confirm the current version and clause numbers of each reference before issue.
Filled specimen
| Field | Entry |
|---|---|
| System / database | LIMS, table SAMPLE_RESULT |
| Reconciliation period | 01 January 2026 to 31 March 2026 |
| Performed by | R. Gomez, QA (independent of DBA function) |
| # | Item | Result |
|---|---|---|
| 1 | Application audit trail exported | 4,118 entries |
| 2 | Native database audit log exported | 4,121 entries |
| 3 | Continuous logging confirmed, no gaps | Pass |
| 4 | Counts recorded | App: 4,118; DB: 4,121 |
| 5 | Application-service-account entries matched | Pass, all 4,115 matched |
| 6 | Named-account entries checked | 3 entries from account slindqvist, not the service account |
| 7 | Unexplained entries listed | 3 entries: 14 Mar, 15 Mar (x2), all Saturday, outside scheduled activity |
| 8 | Checked against emergency-edit records | 2 of 3 matched CHG-2026-0301 (a documented, approved patch-window fix); 1 had no matching record |
| 9 | Deviation opened for unmatched entry | DEV-2026-0142 opened same day |
| 10 | Audit-configuration change check | Pass, no unauthorized changes found |
The one unexplained entry turned out, on investigation under DEV-2026-0142, to be a result changed from out-of-specification to passing with no authorization anywhere. That finding existed only because the two independent logs were reconciled; the application audit trail alone showed nothing wrong.
Common inspection findings this checklist prevents
- Reconciliation described in a procedure but never actually performed or evidenced.
- A mismatch found once and never followed up to a documented conclusion.
- Reconciliation performed by someone who is not independent of the DBA function.
- The native database audit log not exported at all, so the reconciliation only ever checks the application trail against itself.
How to adapt this checklist
- Set your system, table scope, and reconciliation frequency based on the criticality of the data.
- Point the cross-references to your real emergency-edit and deviation procedures.
- If your database platform’s native audit log does not capture prior values, note that limitation and pair this checklist with a point-in-time recovery capability for prior-value reconstruction when an unexplained entry needs deeper investigation.