'Audit logs' not acceptable under Part 11; audit trail more desirable: Hill.

Software that manufacturers use in production or QC labs that provides an "audit log," instead of an "audit trail," will not meet requirements of FDA's electronic signature/records rule, a leading agency chemist told PDA Sept. 12.

Jean Blackston Hill, senior supervisory chemist, Philadelphia district, said: "Some software has no audit trial but an audit, or data, log, which prompts you what you want to do with it [the file in question]," she said. "An audit log does not comply with Part 11."

Hill explained that such logs "allow you to go in and change" the information. "It doesn't document why you changed it, so if you do change it, you should have in your documentation the reasons why you changed it."

She also said that if firms are using vendor-supplied software, they should make sure the audit trail "has all integration parameters capable of changing or altering data."

Hill used as an example content uniformity tests on new drugs. She said some systems might allow one to go in and not identify what someone did with a chromatogram.

What Hill views in audits

"This is what I look at when I come in [on an inspection]," she said. "Will those parameters allow you to alter or change the data? This is an area you should talk over with your vendor; to see if these specific parameters were changed and if so, it should be audit trailed."

Among information Hill said FDA would like to see include:

1. Description and data on interoperability.

2. Vendor name and address

3. Software name and verison.

4. Historical data.

5. Programming language.

6. Source code availability.

7. She said FDA would also like to see "complete SOPs," including a validation protocol, security procedures, backup and recovery (at least every day), disaster recovery and hardware and software change control documentation. "Revalidation should be spelled out in SOPs," she added.

Hill said FDA would like to see some "stress testing" on computer systems. "We want you to slightly exceed the program's limits" to see if it "gracefully grades down, or just crashes. That's what you're looking for."

Hill was skeptical of validation software programs. "The first question we're going to ask is - -can you show me documentation to demonstrate that this software package you used is validated. And, you don't have the source code for this since it's a commercial package, and they won't give it to you."

She advised firms to "test the algorithms."

"Be careful of the software packaging you use," she warned. " It's easier and cheaper to make your own package, but if you want to purchase it, we'll look at it."