SOP: Data Integrity Breach and Suspected Falsification Investigation

This is a ready-to-use SOP for the escalated path taken when the reliability of a record is in doubt, not for a routine deviation. Replace every <<FILL: ...>> placeholder with your own specifics, set your document numbers and dates, and route it through your normal document control, review, and approval. A worked filled specimen follows the template. Verify each cited regulation against the current source before you rely on it. This content is educational and general; adapt it to your own quality system and legal advice.

Document control header

1. Purpose

This procedure defines how <<FILL: COMPANY NAME>> investigates a suspected data integrity breach or falsification, where the concern is that a record itself may be inaccurate, incomplete, concealed, or manipulated, rather than that a process failed. Its objective is to determine the full extent of the problem, its effect on product and patients, and whether the affected data can still be relied upon, while preserving evidence so that the conclusion is defensible to a regulator.

2. Scope

This procedure applies to any GxP record, paper or electronic, at the sites in the header where integrity is in doubt: laboratory, manufacturing, automation, clinical, and quality records. It is invoked in addition to, not instead of, the deviation procedure. Where a concern can be shown to be an honest process failure with intact and consistent raw data, it is handled under <<FILL: SOP-ID for deviations>>; where integrity cannot be ruled out, this procedure governs.

3. Responsibilities

4. Definitions

• Data integrity breach: an event in which a GxP record may not be complete, consistent, accurate, contemporaneous, attributable, or trustworthy across its lifecycle.
• Suspected falsification: a subset in which a record may have been deliberately altered, fabricated, or concealed.
• Extent (scope): the full population of records that could share the same problem, bounded by person, system, method, product, and time.
• Data-reliability verdict: the formal per-data-set statement of whether the data can still support the decisions made from it: reliable, reliable after correction, or not reliable.
• Chain of custody: the documented, unbroken record of who held each item of evidence, when, and where, from discovery onward.

5. Procedure

5.1 Phase 1: Containment and preservation (first, before any wide conversation)

1. Limit who knows to those who must act (quality leadership, system owner, IT, legal where serious). Do not confront any suspected individual yet.
2. Preserve the electronic evidence: freeze or forensically image the relevant systems, capturing the full audit trail, raw data files (including aborted, trial, and “test” runs), instrument and operating-system logs, and the database behind the application. Capture metadata, not printed reports.
3. Restrict at-risk accounts and privileged access where there is credible risk of ongoing alteration; record the time and basis, and coordinate with IT so the lock-down does not itself destroy logs.
4. Sequester the physical evidence: logbooks, worksheets, printouts, notebooks, and local copies. Record who held each and where it was found.
5. Quarantine any product whose disposition relied on the questioned data.
6. Open the controlled investigation file with a timestamp; start the chain of custody here.

Do not begin any wide interview until the electronic and paper evidence is preserved and the questioned accounts can no longer alter it.

5.2 Phase 2: Scope and extent determination

1. Bound the population along every axis the problem could travel, and justify each boundary in writing: person (all records that individual created, modified, reviewed, or approved), system/instrument, method/product, time, and pattern (the signature of the problem).
2. Identify the signature (for example, re-integrations with blank reasons, or re-injections that always precede a passing result) and search the whole data estate for it.
3. Scope outward until you can demonstrate with evidence where the problem stops. Record that “we looked and it does not go further,” not “we have no evidence it goes further.”

5.3 Phase 3: Retrospective data review

1. Read each in-scope audit trail chronologically for edits after review sign-off, repeated changes, blank or boilerplate reasons, deletions, and reprocessing without justification.
2. Reconcile the instrument or sequence log against reported results; any run that maps to no documented outcome is an orphan to be run down.
3. Inspect file-system metadata, recycle bins, recovery folders, renamed or duplicated files, and any local copies.
4. Check operating-system and application logs for backward clock changes near contested timestamps.
5. Compare the dynamic electronic original against what was transcribed to paper or the report.

5.4 Phase 4: Product and patient impact

1. List every decision the questioned data supported (release, stability, specification, validation, submission, complaint or recall).
2. Re-evaluate each decision on reliable data only; where the questioned data are the only data, do not assume the material was acceptable.
3. Assess affected batches against their true state; trace distribution and patient exposure with supply chain and pharmacovigilance.
4. Where product is on the market, conduct a documented health-hazard evaluation to drive any field action.

5.5 Phase 5: The data-reliability verdict

For each affected data set, state one verdict with its supporting evidence:

• Reliable: the questioned activity did not affect integrity, proven with evidence.
• Reliable after correction: the true data are recoverable from valid originals; re-derive and re-issue the decision, and assess the period the wrong value was in use.
• Not reliable: integrity cannot be established, or data were falsified and no valid original survives; every decision built on the data is now unsupported.

5.6 Phase 6: Root cause, system gap versus intentional act

1. Identify and address the systemic enabler regardless of intent (shared login, deletable folder, movable clock, absent review).
2. Determine, from the documentary pattern gathered before any interview, whether the cause is a control gap, an intentional act, or both, and justify it.
3. Conduct interviews after the documentary evidence is in hand, with two interviewers and contemporaneous notes, and legal involved where intent is credible.
4. For an intentional act, add a wider trust review of that person’s other work and address the culture and pressure that produced it; do not close a deliberate act as “retraining.”

5.7 Phase 7: Reportability and disclosure

1. Assess reportability jointly with legal against the actual extent and impact: field actions, submission corrections, safety reporting, and contractual notifications.
2. Do not decide reportability before the extent is known.
3. Where the firm found the problem itself, senior quality and legal decide on proactive disclosure; any disclosure made must be consistent with the evidence and not later contradicted by a wider extent.

6. Acceptance criteria

The investigation is acceptable when all of the following are true:

• Evidence was preserved before any wide interview, with an unbroken chain of custody.
• Each scope boundary has a written, evidence-based justification, and the pattern search was run site-wide.
• Cross-system reconciliation closes to zero unexplained items or each item is explained.
• Every decision the data supported has been listed and re-evaluated on reliable data.
• A per-data-set reliability verdict is stated with its evidence.
• The systemic enabler is addressed regardless of intent, and intent is determined and justified.
• Reportability was assessed jointly with legal against the true extent and impact.

7. References

21 CFR 211.192 (investigation of discrepancies, extension to other batches). 21 CFR Part 11 (electronic records and signatures). FDA Guidance, Data Integrity and Compliance With Drug CGMP: Questions and Answers (final, December 2018). MHRA GXP Data Integrity Guidance and Definitions (March 2018). PIC/S PI 041, Good Practices for Data Management and Integrity in Regulated GMP/GDP Environments. WHO Guideline on data integrity, TRS 1033 Annex 4 (2021). EU GMP Chapter 1 (Pharmaceutical Quality System) and Annex 11 (Computerised systems).

Confirm the current version and clause numbers of each reference before issue.

8. Records generated

• Investigation file with timestamped opening entry.
• Chain of custody log for every evidence item.
• Scope statement with per-axis justification.
• Retrospective review and reconciliation records.
• Product and patient impact assessment, including any health-hazard evaluation.
• Per-data-set reliability verdict.
• Root cause record and CAPA.
• Reportability assessment.

9. Revision history

10. Approvals

Filled specimen

The following shows how the file reads for an example laboratory case. The company, system, and numbers are illustrative; replace them with your own.

In this example the extent search turned one blank-reason re-integration into three unreported failing results and a field action, which is exactly the difference between a closed deviation and a defensible integrity investigation.

Common inspection findings this SOP prevents

• Scope set by assumption (“limited to one batch”) with no examination of the analyst’s other work, the instrument’s other runs, or the method’s other uses.
• Evidence altered or deleted because the concern was discussed openly before preservation.
• A “no product impact” conclusion asserted with no re-evaluation on reliable data.
• The file closed with no per-data-set reliability verdict, leaving downstream decisions unsupported.
• A deliberate act closed as “human error, retrained,” leaving the systemic gap open.
• Reportability decided before the extent was known.

How to adapt this SOP

1. Set your document number, owner, and effective date in the header.
2. Point the cross-references to your real deviation, CAPA, health-hazard-evaluation, and retention procedures.
3. Name your forensic capture method and the media used, and reference its qualification where you have one.
4. Define when an independent third party is mandatory (for example, when the quality unit is implicated) in your own risk terms.
5. Confirm every regulation in section 7 against the current published version before issue.