Chromatogram Reintegration: What the CGMP Audit Trail Must Preserve

What Happens the Moment a Peak Is Reintegrated

Chromatographic reintegration can be justified under current good manufacturing practice (CGMP), but a new passing result does not erase the original result or establish that the batch is acceptable. Preserve the original integration, every changed result, the processing history and scientific reason, the applicable authorization, and the documented review. If the first result was out of specification (OOS), a documented investigation with scientific justification is necessary before invalidating it. FDA explains these boundaries in Questions 13 and 14 of its December 2018 data-integrity Q&A.

For a US finished-drug laboratory using a chromatography data system (CDS), four record elements organize the review. The CFR provisions below are regulations; FDA guidance explains the agency’s thinking and is nonbinding. A warning letter illustrates a site-specific deficiency and requested remediation. UK guidance and the EU consultation draft are discussed separately because their jurisdictions and status differ.

• Retention: Preserve the acquired data, original processing, every reprocessed result, and associated metadata needed to reconstruct the test. Version labels such as Version 1 and Version 2 are useful examples, rather than required software terminology.

• Reason: Record the user, date and time, integration parameters, reprocessing details, and scientific justification. A useful explanation identifies the observed chromatographic issue and the evidence supporting the change.

• Authorization: Follow the established procedure and document the applicable quality-unit oversight. Use restricted analyst permissions and an administrator independent of record content, consistent with FDA’s recommendations.

• Review: Review relevant audit trails with the underlying record. For data supporting batch release, FDA links review timing to the pre-release record review requirements. Any unresolved discrepancy remains part of the quality unit’s disposition assessment.

Keep Both Integrations: What 'Complete Data' Actually Requires

Under 21 CFR 211.194(a), laboratory records for finished pharmaceuticals must contain complete test data. Paragraph (a)(4) addresses instrument data, including graphs, charts, and spectra; (a)(5) addresses calculations; (a)(6) addresses results and comparison with specifications. Paragraph (a)(7) requires the tester’s initials or signature and test dates, while (a)(8) separately requires a second person’s initials or signature showing review of original records for accuracy, completeness, and compliance. These are different responsibilities, even when the laboratory records them in one electronic package. See 21 CFR 211.194.

FDA Question 14 directly rejects retaining only the final result after chromatographic reprocessing. It calls for established written procedures and retention of each result for review. The same answer warns against routine dependence on reprocessing. The practical question is whether another reviewer can reconstruct what happened, including versions that were not selected for reporting. See FDA Q&A, Question 14.

A final printout can be part of that package, but it cannot replace dynamic electronic records when it loses their content, meaning, or necessary metadata. FDA Questions 9 and 10 distinguish true copies from incomplete static representations. This does not mean every original paper record is invalid; the issue is whether the retained form preserves the complete original record.

For example, acquired detector data, the processing method actually used, the first integration, and a later processing version should remain linked and retrievable. Question 12 discusses saving chromatography data after each step or injection, including incomplete or aborted injections, rather than waiting until a sequence ends. A laboratory procedure should make the relationships clear without depending on one employee’s memory or a folder of unexplained exports.

The UK MHRA’s March 2018 guidance provides a separate reconstruction principle: raw data are the first captured record, with the information necessary to reconstruct the activity. Sections 6.2 and 6.13 address original data and audit trails. This UK guidance supports checking whether the original and later processing can both be understood; it does not add a separate US statutory requirement. See MHRA GXP Data Integrity Guidance.

The Reason: What the Audit-Trail Entry Must Contain

For closed electronic systems within Part 11’s scope, 21 CFR 11.10(e) requires secure, computer-generated, time-stamped audit trails for operator actions that create, modify, or delete records. Changes must not obscure prior information, and audit-trail documentation must be retained at least as long as the subject records. Paragraphs (c), (d), and (g) address retrievability, authorized access, and authority checks. These provisions concern controlled records, rather than a particular vendor’s version-lock feature. See 21 CFR 11.10.

FDA Question 1(c) describes the expected HPLC audit-trail content: user name, run date and time, integration parameters, and any reprocessing details, with change justification in the documentation. The following is a practical record checklist derived from that description; it is not a regulator-prescribed form:

• Identity and time: The attributable user and recorded event time, linked to the relevant sample and processing event.

• Original and changed processing: The method version and parameter values used for each integration, with enough context to reconstruct the change.

• Reprocessing details: The affected chromatogram or peak and a description of what was changed, rather than only a final numerical result.

• Scientific reason: The observed problem and the supporting evidence. If a separate controlled investigation holds the full rationale, link it clearly to the processing event.

• Review linkage: The applicable procedure or authorization and the reviewer’s assessment of the original data, change history, and unresolved questions.

A category such as baseline adjustment may help sort events, but the category alone does not explain an individual change. As an illustrative record entry, an analyst might document that the initial boundary crosses an observed baseline disturbance and refer to the investigation and retained comparison. The reviewer still needs evidence that the proposed treatment is appropriate. Structured reason codes can be useful when linked to sufficient explanatory evidence; a general label alone leaves the reviewer unable to assess the particular change.

Authorization: Defined Circumstances, Approved Protocol, Separated Privileges

In its December 8, 2022 warning letter to Nortec Quimica SA, an API manufacturer, FDA described inadequate quality-unit review of electronic chromatography records and requested stronger manual-integration controls. The correspondence also discusses UV-Vis and IR systems, so it should not be read as a finding solely about HPLC. The laboratory-control lesson comes from FDA’s specific requests in Warning Letter 320-23-07.

• Define the limited circumstances for manual integration in a protocol approved and supervised by the quality unit.

• Review past manual integrations within the scope specified in the letter and provide scientific justification for the parameters used.

• Plan appropriate reintegration where scientific justification was absent, assess the resulting data against acceptance criteria, and address any identified OOS results.

A more recent inspection example is the February 20, 2026 Form FDA 483 for Staska Pharmaceuticals, an outsourcing facility. Observation 2 describes missing electronic-data review and analyst administrator privileges capable of changing integration parameters, reprocessing data, and modifying or disabling audit trails. A Form 483 records inspectional observations and explicitly is not a final agency compliance determination. The redacted document does not establish that every capability was actually misused. See Staska Form FDA 483, Observation 2.

FDA Question 4 recommends assigning system administration to personnel independent of those responsible for record content. That recommendation separates permission to perform authorized processing from powerful permissions that can conceal changes or alter controls. Review the actual access matrix and oversight, rather than treating job titles as proof of separation. A laboratory supervisor’s approval is not automatically quality-unit approval unless that responsibility is assigned under the site’s approved system. See FDA Q&A, Question 4.

Review: Who Reads the Audit Trail, and Before What

The second-person signature required by 21 CFR 211.194(a)(8) represents review of the original records. FDA Question 7 explains that reviewers should examine audit trails capturing changes as they review the rest of the record. It also connects production and control record approval to the quality unit’s responsibility under 21 CFR 211.192. This is an integrated review process; it does not necessarily require two people to inspect the same screen simultaneously. See FDA Q&A, Questions 7 and 8.

Timing follows the underlying record, according to Question 8. Its pre-release example is important, but it does not turn every system log into an identical review task:

• Data supporting release: Complete the relevant record and audit-trail review before batch release, following FDA’s explanation of the underlying CGMP review duties. The review should address unexplained changes before the data support disposition.

• Other audit trails: Where CGMP does not specify a review frequency, establish it using process knowledge and a documented risk assessment considering criticality, controls, and product-quality impact. A non-release label alone does not establish low risk.

The Staska observation makes the difference concrete: the QC pharmacist reportedly reviewed printed summaries and calculations without reviewing electronic chromatograms, integration events, injection sequences, relevant user activities, and metadata. A practical review should reconcile those records with what was reported, including repeated or deleted injections. The observation illustrates why an apparently complete certificate of analysis may still rest on an incomplete review. See Staska Form FDA 483, Observation 2(A)–(B).

UK MHRA guidance, section 6.13, allows review of relevant audit-trail entries or validated exception reporting. Review need not include every system activity. An exception report identifies predetermined abnormal actions for attention; an empty report is meaningful only within its validated scope. It cannot establish that no unmonitored change occurred or substitute for assessment of the underlying data. This is a UK guidance approach, not a blanket exemption from US release review. See MHRA guidance, section 6.13.

Where Reintegration Becomes Testing Into Compliance

FDA Question 13 describes testing into compliance as testing aimed at obtaining a desired result or overcoming an unacceptable one. It also requires retained and reviewed records to include failing, passing, suspect, and obviously erroneous data. Invalidating data requires an investigation with documented scientific justification. Applied to reintegration, a passing replacement result therefore cannot be the evidence that the original was invalid. See FDA Q&A, Question 13.

An independent chromatographic reason and an adequate investigation answer different questions. The reason explains why processing should be examined; the investigation evaluates whether the original result can be invalidated and what the data mean for product quality. An approved procedure and a recorded reason do not settle that investigation by themselves.

For the reviewer, repeated parameter changes ending at the first passing number warrant scrutiny. So do unexplained differences between standard and sample processing, or omitted injections. These are practical review questions drawn from the completeness and oversight principles, not proof that any single manual event is misconduct. Their significance depends on the method, retained evidence, and investigation.

Ask the analyst to reconcile the entire processing history, including versions that did not become the reported result:

• Was the proposed processing change justified by observable data and the established procedure, rather than by the desired specification outcome?

• Are all acquired data, processing iterations, unsuccessful attempts, and related sequence events accounted for?

• Does the investigation explain any invalidation scientifically, and does the reviewer have enough evidence to assess that explanation?

• If reprocessing is frequent, has the laboratory examined whether its method or processing procedure needs improvement, consistent with FDA’s caution in Question 14?

What the EU Draft Annex 11 Would Change

The European Commission’s July 2025 consultation draft of Annex 11 provides a separate planning reference for computerized systems. The points below describe that draft, not adopted replacement requirements or a confirmed implementation timetable. A laboratory can use the text to identify possible control gaps while checking applicable requirements before making a compliance decision. See draft Annex 11, section 12.

Several draft details are useful for a gap assessment, provided their qualifications stay attached:

• Draft 12.2 proposes capturing the user and relevant role, old and new values, event time, and reason for a change. Recording at the time of the event is part of this clause.

• Draft 12.3 proposes enabled, locked audit trails and no editing of audit-trail data. It also anticipates changes to settings, system time, or deactivation: these would themselves be logged and restricted to an administrator uninvolved in GMP activities. It is not an absolute statement that deactivation is technically impossible.

• Draft 12.4 addresses efficient searching, sorting, or export for review. Draft 12.5–12.7 address documented procedures, independent peer review, and a targeted, risk-based scope.

• Draft 12.8 proposes review before release unless the risk of detecting unwarranted changes later can be justified. Draft 12.10 would make reviews affecting release available to the Qualified Person at batch release.

The Worked Record: One Reintegration, Documented End to End

The following hypothetical finished-drug QC example is an editorial illustration assembled from the cited record principles. Sample X, its values, processing labels, protocol identifiers, and event times are invented to show how the record fits together. They are not findings from Nortec or Staska, validated method settings, compendial limits, or evidence that a particular integration is scientifically correct.

Assume the original processing reports an impurity at 0.19% against a fictional limit of not more than 0.15%. An analyst observes a suspected baseline problem. If authorized reprocessing later produces 0.08%, the numerical crossing of the limit is recorded, but neither value proves which processing is appropriate. The initial OOS remains subject to investigation; the batch is not cleared by the lower number.

The table shows what the reviewer would need to locate and reconcile. Version 1 and Version 2 are illustrative labels. A real record must contain the actual parameter values and technical evidence under the applicable method. The labels below show the documentation relationship without specifying a replacement integration algorithm. References in the last column distinguish regulatory text from guidance and site-specific correspondence.

This conceptual flow makes the investigation a required decision point whenever the original result fails or remains suspect. Documentation supports review; it does not predetermine disposition. The flow synthesizes FDA Q&A Questions 7, 8, 13 and 14, with protocol oversight illustrated by the Nortec letter.

flowchart TD
    A["Preserve acquired data and original integration"] --> B{"Original result OOS or suspect?"}
    B -- Yes --> C["Initiate documented investigation; retain initial result"]
    B -- No --> D["Review original data and relevant audit trail"]
    C --> E{"Scientific basis and authorization for reprocessing?"}
    E -- No --> F["Resolve investigation; no result-driven reprocessing"]
    E -- Yes --> G["Record reason, user, time and parameters; retain every result"]
    G --> H["Assess processing evidence and any proposed invalidation"]
    H --> I{"Investigation and review adequately resolved?"}
    I -- No --> F
    I -- Yes --> J["Second-person record and audit-trail review"]
    D --> J
    J --> K["Quality unit evaluates complete package before disposition"]

Laboratory Inspection-Readiness Checklist

A targeted readiness check should test whether the laboratory can retrieve and explain a real reintegration package. Use the same evidence questions for internal and contract laboratories, with responsibilities assigned under the applicable quality system:

• Retrieve both versions and all intervening processing, acquired data, sequence events, and metadata. Confirm that retained records remain usable for their required retention period, rather than merely appearing in a backup inventory.

• Check that the reason explains the observed issue and connects to scientific evidence. A complete field is not necessarily a persuasive rationale.

• Compare actual user privileges with the independent-administration recommendation and verify that ordinary processing permissions cannot conceal data changes.

• Confirm that the second-person review addresses original records and relevant audit trails, is attributable, and leaves unresolved findings visible to the quality unit.

• Where an OOS result changed to a passing number, locate the investigation and scientific basis for any invalidation. If those are missing, the record remains unresolved regardless of the final printout.

Sources

Regulatory text, nonbinding guidance, site-specific correspondence, and consultation material are identified separately below. Section and question numbers in the article provide navigation within these public primary documents.

• FDA: Data Integrity and Compliance With Drug CGMP, Questions and Answers (December 2018) — Nonbinding guidance; Q1(c), Q4, Q7–Q10 and Q12–Q14 support the record, access and review discussion.

• 21 CFR 211.194 — Laboratory records — US finished-pharmaceutical CGMP regulation; complete data, calculations, results and second-person review. eCFR is continuously updated and authoritative but unofficial.

• 21 CFR 11.10 — Controls for closed systems — Regulatory text applicable to closed electronic systems within Part 11’s scope; retrieval, access and audit-trail controls.

• Staska Pharmaceuticals: Form FDA 483 issued February 20, 2026 — Observation 2 addresses electronic review and administrator privileges at one outsourcing facility. Inspectional observations are not a final agency compliance determination.

• Nortec Quimica SA: Warning Letter 320-23-07, December 8, 2022 — Site-specific API enforcement correspondence; electronic review, manual-integration controls and retrospective assessment. No remediation outcome is asserted.

• MHRA GXP Data Integrity Guidance and Definitions, Revision 1 (March 2018) — UK guidance; sections 6.2 and 6.13 address reconstruction, original data, audit trails and validated exception reporting.

• European Commission: Draft revised Annex 11, Computerised Systems (July 2025 consultation) — Draft proposals in section 12, with no adoption or implementation date asserted here.