Audit Trails and Record Integrity

Audit Trail Review Checklist

Structure your review of electronic manufacturing records, changes, user attribution, timestamps, review evidence, and record integrity. Create a documented checklist for eDHR and related quality records.

Start Review Review Guidance

What is an audit trail review?

An audit trail can help reconstruct relevant events associated with an electronic record, including who performed an action, when it occurred, and what changed. A review should consider the record's intended use, applicable requirements, system capabilities, and the risk associated with the process.

This checklist is a planning aid. It does not access your eDHR system, retrieve audit trail data, determine regulatory applicability, or automatically establish that a record is trustworthy.

24
Review controls
0
Reviewed as satisfactory
24
Open or unreviewed controls
0
High-priority open items
Review completion 0% reviewed as satisfactory
Completion measures controls marked “Satisfactory” out of all controls. It is not a compliance score or an assessment of audit trail effectiveness.

1. Review information

Define the record, review scope, and responsible personnel.

Use your organization's documented risk methodology.

2. Audit trail review controls

Set a status for each control and record evidence, findings, and follow-up actions.

This version stores entries only in the current page session. Export your review before leaving or refreshing the page. Do not enter sensitive personal data or confidential manufacturing details unless your use of this tool is approved.

How to review audit trails effectively

Use a documented, risk-based approach that fits the record, process, and applicable requirements.

  1. Define scope: identify the record, review period, event types, system, and selection rationale.
  2. Verify record linkage: confirm the events can be associated with the relevant record and, where appropriate, its version.
  3. Inspect attribution: examine whether the system records an identifiable user or source for relevant actions.
  4. Review changes: look for changes, deletions, corrections, overrides, and other events relevant to the process.
  5. Assess timestamps: consider time-zone conventions, clock synchronization, ordering, and any unexplained anomalies.
  6. Evaluate exceptions: investigate unusual events based on risk, procedures, and the context of the record.
  7. Document conclusions: link evidence to each conclusion and record the owner and disposition of follow-up actions.
An audit trail review is not simply a check that logging is enabled. Reviewers should consider whether the available event information is meaningful, attributable, protected, retrievable, and sufficient for the intended review.

Related eDHR tools

Use these tools alongside your audit trail review planning.

FDA 21 CFR Part 11 Readiness Checklist

Organize a preliminary review of electronic record and signature controls.

Open Part 11 checklist →

Electronic Signature Workflow Planner

Plan approval stages, signature meanings, responsibilities, and exception handling.

Open workflow planner →

eDHR Readiness Checker

Identify broader process and implementation readiness questions.

Open readiness checker →

Device History Record Template Generator

Develop a starting structure for device history documentation.

Open template generator →

Frequently asked questions

Depending on the system and applicable requirements, a review may cover event attribution, dates and times, changes to records, reasons for changes where required, security, retention, record linkage, and investigation of relevant anomalies.

No single checklist or review frequency fits every system. The approach depends on the applicable requirements, record use, process risk, system design, and approved procedures. Document the rationale for scope, sampling, and review frequency.

Record the observation and supporting evidence, assess its potential impact, and follow the organization's approved procedures for escalation, investigation, correction, and disposition. Do not silently alter records or treat an unexplained event as resolved without evidence.

No. This checklist is a planning aid and does not verify your system configuration, inspect actual audit trail data, or establish regulatory applicability. A compliance assessment needs appropriate evidence and review of the relevant requirements and implementation.

Export the checklist or generated report as CSV, or print the report to a PDF using your browser. Store the resulting files under your organization's approved document-control and information-security procedures. The page does not upload or save the entries to an account.

Regulatory references

Consult the current official text and applicable guidance. Applicability and interpretation should be assessed for the specific records and system.

This tool is for educational and planning purposes. It does not provide legal advice, replace an approved quality procedure, or guarantee compliance with FDA requirements or other regulatory obligations.