Audit Trail Corruption: How to Correct and Document It

Q: We’re a laboratory software developer. Recently, while examining a customer’s data, we discovered some corruption in their audit trail data — a few duplicate records.

We’re tracking down how this happened, and of course we will correct the root cause. However, my question is about how to correct or document audit trail corruption. We can run a special process to “fix” this data, removing the duplicate records, but it makes me nervous to touch the sacred audit trail data. Barring correcting the audit trail, how would I document that I’ve touched the audit trail?

Would it be enough for the laboratory to document it in the external maintenance logs for the database?

A: You’re right to be concerned about audit trail corruption — keeping the audit trail secure and “sacred”.The audit trail should not be modified by ordinary means or by the operators of the system.

[pullquote align=”right” cite=”” link=”” color=”” class=”” size=””]Document any changes to the audit trail as part of a Change Request and as part of the incident report.  [/pullquote]

Here’s what I suggest: document any changes to the audit trail as part of a Change Request and as part of the incident report. The incident report or non-conformance report should include what you’re doing to correct the problem (fixing the audit trail) and the corrective action taken to fix why the problem occurred in the first place.

As you suggested, I also would document your actions in the external maintenance log for the database. If possible, I would keep a copy of the corrupted audit trail in an archive — just in case the investigation finds that the audit trail was not corrupted at all, or if the “fix” causes additional deletions from the audit trail.

Answered by Janis Olson, Vice President of Regulatory & Quality Services at EduQuest (22 years as an expert FDA field investigator and Manager of Information Resources in FDA’s Atlanta Regional Office).


Leave a Reply

Your email address will not be published. Required fields are marked *