Audit Trail Reviews in GCP and GVP: Expectation vs Reality

Expectation

Reality

·     Is the Scope defined in advance for review, for
example, are critical data endpoints identified such as eligibility, consent,
causality, seriousness etc.

·     When to review:
Do reviews happen at meaningful milestones throughout the trial or
case lifecycle, not just once at the end for example at the time of database
locks

·     Documentation of outcome
of  each review for example what was checked,
what was found and  what was escalated.

·     Integrated oversight. Discrepancies are
fed into Risk Based Quality Management (RBQM) than sitting in a standalone
log that nobody revisits.

·     General perception is that systems are validated and 21
CFR Part 11 compliant meaning they are audit trail enabled. Many teams equate
having an audit trail with reviewing  it. The system logs everything; almost
nobody looks.

·     Review at the wrong time.
Checks often happen retrospectively,
at database lock, at inspection prep / audits, instead of during the
trial or case lifecycle when action is still possible.

·     No prioritization: Without a defined
critical data set, reviewers either abbreviate everything superficially or
default to reviewing nothing systematically.

·     Vendor blind spots: Sponsors and MAHs
assume CRO or vendor systems are being reviewed, but rarely verify it or
cannot always even extract the trail themselves.

·     Reviews not adequately
documented to be able to demonstrate during audits / inspection