HPLC Audit Trail Review: Applying ALCOA+ Principles in Pharmaceutical QC

A chromatogram may look perfectly acceptable, but HPLC audit trail review can reveal important details that are not visible in the final chromatogram.

During QC review, I would not look only at the final result. I would also want to know what happened during the analysis, who performed the activity, whether any data or processing parameters were changed, why manual integration was used, whether standard or sample information was corrected, and whether the sequence was run as recorded.

This is important because pharmaceutical QC is not simply about getting a passing result. The final reported result should be supported by complete, reliable and traceable analytical data.

This is where the HPLC audit trail becomes important. It provides an electronic history of relevant activities performed in the chromatographic data system, including changes and reprocessing. FDA describes an audit trail as a secure, computer-generated, time-stamped record that allows the history of an electronic record to be reconstructed. Its guidance also gives an HPLC example involving the user, date and time, integration parameters and reprocessing information.

For me, the main purpose of HPLC audit trail review is straightforward: to establish that the final reported result is genuine, scientifically justified and supported by the applicable analytical procedure and complete data history.

Quick Summary

• An HPLC audit trail provides part of the electronic history behind an analytical result.
• A passing chromatogram does not by itself establish complete data integrity.
• Manual integration is not automatically a data-integrity violation; its scientific justification and traceability matter.
• Changes to standard or sample information, processing parameters or sequences require appropriate review and documentation.
• Electronic audit trails may not capture every physical action performed outside the computerized system.
• OOS investigations and audit-trail reviews answer different questions, although findings from one may become important to the other.
• Effective review combines the chromatogram, raw data, metadata, audit trail, analytical procedure and relevant laboratory records.

What Is an HPLC Audit Trail?

An HPLC audit trail is the electronic history generated by a chromatographic data system showing relevant actions performed on electronic records.

Depending on the system, it may capture:

• creation or modification of analytical records
• changes to processing or integration parameters
• reprocessing of chromatographic data
• sequence-related changes
• changes to sample or standard information
• user identity
• date and time of an activity
• reasons or comments associated with changes
• attempts to modify or delete electronic records

FDA guidance explains that audit trails should allow reconstruction of events associated with electronic records. It also emphasizes that electronic chromatographic records contain information that may not appear on a printed chromatogram.

That distinction matters in HPLC.

The chromatogram provides evidence of the analytical result. The electronic record provides the wider history needed to understand how that result was produced.

How ALCOA+ Principles Apply to HPLC Data Integrity

ALCOA+ provides a practical framework for assessing the reliability of laboratory data.

The original ALCOA concepts are:

• Attributable — it should be possible to identify who performed or recorded an activity.
• Legible — information should remain readable and understandable.
• Contemporaneous — data should be recorded when the activity occurs.
• Original — the original record, or an appropriate true copy, should be retained.
• Accurate — the information should correctly represent what happened.

The additional ALCOA+ expectations commonly include:

• Complete
• Consistent
• Enduring
• Available

For HPLC data, these principles become practical review questions.

If an integration parameter is changed, the reviewer should be able to determine who changed it, when it was changed, what was changed and why. If data processing is repeated with different parameters, the history should remain available rather than allowing only the final result to be reviewed.

The same principle applies to data that are excluded from consideration. MHRA guidance emphasizes that data should only be excluded where there is a valid scientific justification, with the justification documented and the original data retained.

ALCOA+ therefore is not simply a checklist. It provides a way to assess whether the analytical history remains complete, traceable and reliable.

What an HPLC Audit Trail Can Tell a QC Reviewer

An audit trail can help answer several practical questions.

Who performed the activity?

The user identity can establish which account performed a change or reprocessing activity.

When did it happen?

The date and time can be compared with the analytical sequence, worksheet, instrument log and other records.

What changed?

The reviewer can determine whether processing parameters, results, sample information or other electronic records were modified.

Why was it changed?

A documented reason can be useful, but a comment alone is not enough. The explanation should make scientific and procedural sense in the context of the data.

Did the change affect the result?

This is often the most important question.

A correction that has no effect on the final result is different from a change that converts an unfavorable result into an acceptable one.

This is why audit-trail review should not become a simple exercise of checking whether a comment box has been completed.

A documented reason is not necessarily an adequate explanation.

The reviewer should consider the explanation together with the chromatogram, system suitability, analytical history, applicable SOP and effect on the reported result.

PIC/S guidance also links audit-trail review with routine data review and approval, with the approach based on the risk and criticality of the electronic data.

A Practical Three-Level HPLC Review

In a controlled pharmaceutical QC environment, HPLC data can pass through several levels of review.

At the analyst level, the analyst performs the analysis according to the approved method and applicable SOP. Before the analysis is finalized, relevant parameters such as standard and sample weights, dilutions, mobile phase, diluent, retention time, flow rate, temperature, sequence and system-suitability requirements are checked.

The analyst then verifies the data and signs off according to the applicable procedure.

At the second-review level, the reviewer independently checks the analytical record against the approved method and SOP. This may include:

• chromatographic peak condition
• integration
• retention time
• tailing factor
• theoretical plates
• resolution, where applicable
• standard and sample weights
• responses and calculations
• flow rate and temperature
• system-suitability results
• relevant audit-trail events

Manual integration receives particular attention because it can directly affect the calculated result.

Once the second-level review is completed, the reviewer signs off according to the site’s procedure.

Where an exceptional system-level intervention is required, such as reopening access to a locked record, the process should be controlled through documented authorization, administrator access and subsequent review. The exact workflow is site- and system-dependent and should be governed by the applicable SOP.

HPLC Audit-Trail Red Flags

Not every change is a violation. Concern arises when an activity is unexplained, unauthorized, inconsistent with the analytical record or appears to have been performed to obtain a desired result.

Common areas requiring closer review include:

1. Manual integration
2. Standard or sample weight changes
3. Sequence modifications
4. Changes to reported results
5. Repeated processing or injections
6. Unexplained or missing data
7. Unexpected user activity
8. Changes made close to a critical result or release decision

The reviewer should look for patterns and supporting evidence rather than treating a single event as automatic proof of manipulation.

Manual Integration: Red Flag or Legitimate Analytical Action?

Manual integration is one of the most misunderstood issues in chromatographic data review.

There can be genuine scientific reasons for manual integration. A chromatogram may show baseline problems, abnormal peak shape or other chromatographic behavior that makes automated integration unsuitable.

Column condition can also contribute to poor peak shape or system-suitability problems. A particular validated method may specify a minimum theoretical plate count—for example, N > 2,000—but such a limit belongs to that specific method or SOP. It should not be treated as a universal HPLC requirement.

The important questions are:

• Why was manual integration necessary?
• What did the original chromatogram show?
• What integration parameters were changed?
• Who made the change?
• Was the change permitted by the procedure?
• Was the reason documented?
• Did the change materially affect the reported result?

A comment such as “peak not properly integrated” may document that something happened, but it does not necessarily explain why the change was scientifically appropriate.

The reviewer should compare the explanation with the actual chromatogram, system suitability and analytical history.

Standard and Sample Weight Changes

Standard and sample weights are important inputs to many HPLC calculations, so a change can directly affect the reported result.

Some changes are legitimate. An analyst may identify a transcription or data-entry error and correct it through the approved procedure.

Other changes can be more concerning, particularly when a value is changed after the analytical result is known and the change improves the reported outcome without a scientifically justified explanation.

The reviewer should compare:

• original value
• revised value
• balance record, where applicable
• preparation record
• calculation
• audit-trail entry
• date and time
• analyst explanation
• effect on the final result

The objective is to establish what happened and whether the final calculation remains scientifically defensible.

Sequence Modification and Selective Testing

Sequence review is important because an electronic sequence may appear acceptable while physical handling of samples tells a different story.

For example, the system may show the expected vial numbers in the recorded sequence. Physical movement or substitution of vials outside the computerized system may not necessarily be captured by the software.

An electronic audit trail can show what the system recorded; it may not capture every physical action that occurred outside the system.

This is why electronic records should be considered together with sample-preparation records, worksheets, instrument records and other relevant documentation.

The concern becomes more serious when favorable samples are selectively used to obtain a passing result.

Test	Potential concern
Assay	Favorable sample or vial repeatedly used to obtain an acceptable result
Dissolution	Additional testing performed selectively using favorable units
Content Uniformity	Unfavorable units replaced or excluded without justified procedure
General HPLC testing	Sequence altered after an unfavorable result without documented scientific reason

Additional testing is not automatically improper. There may be legitimate procedural reasons for repeat or additional testing.

The critical issue is whether the activity follows the approved procedure and whether all relevant data are retained and evaluated.

FDA enforcement actions have addressed omitted or unreported chromatographic data and testing practices that could result in testing into compliance.

Audit-Trail Review vs. OOS Investigation

These activities are related but they answer different questions.

An OOS (Out of Specification) result means a test result falls outside an approved specification.

An OOT (Out of Trend) result is different: the result may remain within specification but be unusual compared with an established historical trend.

An audit-trail finding is neither automatically OOS nor OOT.

OOS investigation:
Why did the result fail the approved specification?

Audit-trail review:
What happened to the electronic data and analytical history?

An audit-trail finding can become an important part of an OOS investigation. Conversely, an audit-trail review may identify a data-integrity concern even when the reported result is within specification.

A passing retest does not make the original OOS result disappear. The original result remains part of the laboratory record and must be evaluated as part of the investigation.

FDA has emphasized retaining relevant data, including failing, passing and suspect data, rather than selecting only the results used for reporting.

A Practical OOS Example: When the Root Cause Was in Manufacturing

Consider an anonymized pharmaceutical QC example.

A product assay produced a result of 89%, below a specification with a lower limit of 90%.

The laboratory investigation initially examined:

• approved method
• analyst performance
• HPLC system
• analytical balance
• pipettes
• volumetric glassware
• standard preparation
• sample weights
• chromatographic peaks
• calculations

No assignable laboratory cause was identified.

The investigation then moved into manufacturing.

Further investigation, including discussions with personnel and review of available site information, identified an issue during addition of the active ingredient. The manufacturing investigation established the likely root cause.

Any subsequent reprocessing, rework or adjustment must be performed under the site’s approved procedure and authorization—not simply to make an OOS result pass.

After the authorized corrective manufacturing activity, the product was retested and the result met the applicable requirement.

The important lesson is that an OOS result does not automatically mean the HPLC analysis was wrong.

A scientifically sound investigation may show that the laboratory method and equipment were functioning properly and that the actual root cause was elsewhere in the manufacturing process.

Deviation, Investigation and CAPA Are Not the Same Thing

A deviation records and evaluates a departure from an approved requirement, procedure or expected condition.

An investigation attempts to determine what happened, why it happened and what impact it may have had.

CAPA—Corrective and Preventive Action is used when corrective or preventive action is warranted based on the investigation and the site’s quality-system requirements.

These terms should not be treated as interchangeable.

For example, if equipment is expected to operate at a defined speed but operates outside the expected range, the event may be handled through a deviation and equipment correction or calibration, depending on the circumstances.

A recurring or systemic problem may require broader CAPA.

Similarly, an HPLC audit-trail finding may require investigation, impact assessment, corrective action or another QMS response depending on the facts and severity.

The appropriate response should come from the investigation rather than from a predetermined assumption that every event requires the same type of record.

How to Build an Effective HPLC Audit-Trail Review Program

A practical program should define five basic areas.

1. What data must be reviewed?

The laboratory should identify which electronic data are critical to product quality and release decisions.

2. When should the review occur?

For critical electronic data, audit-trail review may need to occur before the data are relied upon for an important quality decision such as batch release. PIC/S links audit-trail review with routine data review and approval.

3. Who performs the review?

The reviewer should have sufficient knowledge of the analytical method, chromatographic system and relevant data-integrity requirements.

4. What should the reviewer look for?

The SOP should define the review process rather than leaving it entirely to individual judgment.

Depending on the system and risk assessment, review may include:

• manual integrations
• reprocessing
• sequence changes
• changes to sample or standard information
• deleted, excluded or repeated data
• unusual user activity
• result changes
• unexpected injections
• unexplained processing changes

5. What happens when something unusual is found?

There should be a documented process for escalation, investigation and impact assessment.

MHRA guidance states that routine data review should include documented audit-trail review where determined by risk assessment, and reviewers should have appropriate access and knowledge to review audit trails, raw data and metadata.

ICH Q9(R1) provides the broader quality-risk-management framework for applying appropriate effort and formality according to risk and criticality.

What FDA, MHRA, PIC/S and EU GMP Expect

The central regulatory principle is that electronic laboratory data must remain reliable, traceable and capable of supporting reconstruction of relevant activities.

FDA describes audit trails as secure, computer-generated and time-stamped records capable of reconstructing creation, modification and deletion of electronic records. FDA has also taken enforcement action involving inadequate control of electronic chromatographic data and HPLC audit trails.

MHRA emphasizes traceability of data processing, retention of original data and documented justification for excluding data. Its guidance also addresses routine audit-trail review where the risk assessment determines that such review is appropriate.

PIC/S PI 041-1 states that audit-trail review should form part of routine data review within the approval process and that the review process should be defined in an SOP.

EU GMP Annex 11 addresses computerized systems within the GMP framework, including controls relevant to electronic records and computerized-system integrity. The European Commission currently lists Annex 11 as the January 2011 revision. A revised Annex 11 was the subject of an EU consultation in 2025, so proposed revisions should not be confused with the currently listed requirements.

Frequently Asked Questions

What is HPLC? +

HPLC stands for high-performance liquid chromatography. It is an analytical separation technique widely used in pharmaceutical QC to identify, assay and quantify components in samples.

What is an HPLC audit trail? +

It is the electronic history generated by the chromatographic data system that helps reconstruct relevant actions involving electronic records, including changes, processing and other system activities.

What are ALCOA+ principles? +

ALCOA+ is a data-integrity framework built around data being attributable, legible, contemporaneous, original and accurate, with additional expectations for completeness, consistency, endurance and availability.

How do ALCOA+ principles apply to pharmaceutical HPLC data? +

They provide a framework for assessing whether chromatographic data and associated records can be trusted, traced to the person and time of the activity, understood in context, preserved in their original form and reconstructed when required.

Is manual integration an HPLC data-integrity violation? +

Not automatically. Manual integration can be scientifically justified. The important issues are the reason for the change, procedural control, traceability, documentation and its effect on the reported result.

What should be reviewed in an HPLC audit trail? +

Depending on the system and applicable SOP, the review may include integration changes, reprocessing, sequence modifications, sample or standard changes, result changes, deleted or excluded data, unexpected injections and other unusual activities.

What is the difference between an HPLC audit-trail finding and an OOS result? +

An OOS result concerns a result outside an approved specification. An audit-trail finding concerns the history or integrity of electronic data. One can contribute to the investigation of the other, but they are not the same thing.

Bottom Line

An HPLC audit trail is not simply another document attaché to a chromatogram.

It is part of the evidence needed to understand how an electronic analytical result generated, processed and reported.

The strongest review does not begin with the assumption that every change is wrong. It asks what changed, why it changed, whether the change was authorized, whether the explanation is scientifically credible and whether the reported result remains supported by the complete analytical record.

For pharmaceutical QC, the ultimate purpose of HPLC audit-trail review is straightforward:

to establish that the final reported result is genuine, scientifically justified and supported by the applicable analytical procedure and complete data history.

A good chromatogram is important.

A trustworthy analytical history is essential.

References

1. U.S. Food and Drug Administration (FDA). Data Integrity and Compliance With Drug CGMP: Questions and Answers — Guidance for Industry. December 2018.
2. Medicines and Healthcare products Regulatory Agency (MHRA). GxP Data Integrity Guidance and Definitions. Revision 1, March 2018.
3. Pharmaceutical Inspection Co-operation Scheme (PIC/S). PI 041-1: Good Practices for Data Management and Integrity in Regulated GMP/GDP Environments. 1 July 2021.
4. European Commission. EudraLex Volume 4 — Good Manufacturing Practice Guidelines, Annex 11: Computerised Systems. Revision January 2011.
5. International Council for Harmonisation (ICH). ICH Q9(R1): Quality Risk Management. 2021.
6. U.S. Food and Drug Administration (FDA). International Trading Pharm Lab Inc. — Warning Letter, April 24, 2020. FDA observations concerning electronic HPLC/GC data, audit trails, injection sequences and retention of relevant data.

Further Reading

Life Science Daily. Pharmaceutical Quality Beyond QC Testing. 2026.