Beyond Periodic Audit Trail Review: Why Continuous Data Integrity Monitoring Is the New Baseline
Sampling audit trails once a quarter was a reasonable compromise when systems were few. In a connected GxP landscape, the risk lives between systems — and between reviews.
For most quality organisations, audit trail review is a scheduled, manual task. Someone exports a log from the chromatography data system, filters it, samples entries, and signs a review record. The process satisfies a procedure, but it rarely answers the question an inspector actually cares about: can you show me that the data supporting this batch decision is complete, consistent and trustworthy?
Where periodic review falls short
Periodic review has three structural weaknesses. First, it looks backwards: by the time a deleted injection or an unexplained re-integration is spotted, the batch may already be released. Second, it samples. A reviewer working through thousands of entries will inevitably miss patterns that only appear in aggregate. Third — and most importantly — it is siloed. Each system's audit trail is reviewed on its own, yet many of the most serious data-integrity failures only become visible when you look across systems.
A sample result that is re-processed in the CDS, manually edited in the LIMS and then approved in the eQMS by the same user within an hour is three ordinary events. Together, they are a finding.
What regulators expect
FDA's guidance on data integrity, EU GMP Annex 11 and the PIC/S guidance all expect audit trails to be reviewed in a way that is risk-based and proportionate to the criticality of the data. ALCOA+ — attributable, legible, contemporaneous, original and accurate, plus complete, consistent, enduring and available — is not a checklist for one system; it is a property of the whole record, which often spans several applications.
A better model: a data integrity control plane
Continuous monitoring does not replace the quality reviewer. It changes what they review. Instead of sampling raw logs, the reviewer receives a short, risk-ranked list of findings, each with the supporting evidence already assembled. A practical architecture has four layers:
- Read-only ingestion of audit trails and activity from LIMS, ELN, CDS, MES, eQMS and identity platforms — never writing back to validated systems.
- Immutable evidence: raw records preserved in write-once storage before any parsing, so the evidence itself is defensible.
- Detection and correlation: deterministic rules for known risks, plus AI to surface unusual patterns across systems and users.
- Human decision: qualified reviewers investigate, decide and e-sign. The AI prioritises; it does not make the GxP decision.
Getting started
You do not need to connect every system on day one. Start with the systems that support your highest-risk decisions — typically the CDS and LIMS behind release testing — define the integrity events that matter most, and measure how long it takes today to produce evidence for an inspector. That baseline makes the value of continuous monitoring easy to see.
This is the approach behind Data IntegrityIQ: read-only, deployed in your own cloud, and built so that people remain in control of every regulated decision.