An audit trail is a system-generated change log that makes it possible to trace relevant actions and changes to data or electronic records. It records at least who acted, what changed, and when the action took place; in the case of changes, the reason must often also be documented. In clinical trials, the audit trail is part of the metadata that enables the reconstruction and assessment of a data history.<\/p>\n
An effective audit trail records the original entry as well as subsequent changes or deletions, without obscuring the original value. ICH E6(R3) describes audit trails as metadata records for reconstructing events during data capture and activities in computerised systems. For critical data, they must be legible, accessible, and designed in such a way that they can be evaluated.<\/p>\n
Typical information includes user identity, date and time, old and new value, the action, and, where applicable, a justification. The specific design follows the criticality of the data and the risk assessment. An audit trail must not merely be a technical log inventory that collects data but cannot be understood or reliably exported. Access rights must also prevent ordinary users from subsequently manipulating or disabling change logs.<\/p>\n
The mere existence of a change log is not sufficient. Audit trail review is the separate, documented activity of evaluating records on a risk-based basis and investigating conspicuous patterns, implausible corrections, or violations of established procedures. ICH E6(R3) requires procedures for reviewing study-specific data, audit trails, and other relevant metadata. Annex 11 requires audit trails to be available, convertible into an understandable form, and reviewed regularly.<\/p>\n
The review plan should specify which data and events are to be checked, to what extent, by whom, and at what time. For critical safety or endpoint data, more frequent review may be appropriate than for fields of low criticality. Results, deviations, follow-up, and closure must be documented in a traceable manner. A review does not replace the correction itself; it assesses whether the documented changes and the underlying process are acceptable.<\/p>\n
Before a system is used in production, it must also be assessed whether the audit trail functions actually meet the defined requirements. This includes the complete recording of relevant events, the correct assignment of users, the display of old and new values, and an understandable export. Changes to configuration or interfaces may require a renewed risk-based assessment of this function.<\/p>\n
An audit trail is a record within or associated with a system. An audit, by contrast, is an independent quality assurance measure in which processes, systems, or documents are checked against requirements. An audit may use the audit trail as an audit subject and as evidence, but it is neither the record nor its ongoing evaluation.<\/p>\n
Audit trail review is also not a complete quality audit. It is an operational or quality-assurance control activity for the recorded system events. An audit typically also examines governance, validation status, roles, standard operating procedures, training, and the effectiveness of corrective actions. The clear distinction prevents an existing log from being mistakenly understood as evidence of an independent audit.<\/p>\n
Audit trails protect the credibility of clinical data because they make changes in the eCRF, in central data sources, or in other electronic records transparent. They support monitoring, data management, quality management, and inspections in assessing whether data were entered correctly, corrected according to established rules, and adequately reviewed. Particularly relevant are critical data, unblinding protection, changes to permissions, and subsequent adjustments shortly before database lock.<\/p>\n
Full-service CROs such as Mediconomics support risk-based concepts for audit trails and their review, the definition of roles and escalation pathways, and integration with monitoring, data management, and quality management. Specific services include reviewing system requirements and validation documentation, preparing review plans, evaluating conspicuous data changes, and documenting findings and actions in a traceable manner.<\/p>\n
Must every data change generate an audit trail?<\/strong><\/p>\n Traceability must be ensured for relevant electronic data changes. Which events are recorded and reviewed, and at what level of detail, must be defined on a risk-based basis; critical changes require particularly robust traceability.<\/p>\n Is an audit trail the same as an audit?<\/strong><\/p>\n No. The audit trail is the change log. An audit is an independent assessment of quality and compliance that may, among other things, be based on audit trail data.<\/p>\n Why is it not sufficient to archive audit trails only?<\/strong><\/p>\n Because they must be evaluable for the control of data and metadata. Only the documented review can identify conspicuous changes or process weaknesses and initiate appropriate follow-up.<\/p>\n An audit trail is a system-generated change log that makes it possible to trace relevant actions and changes to data or electronic records. It records at least who acted, what changed, and when the action took place; in the case of changes, the reason must often also be documented. In clinical trials, the audit trail […]<\/p>\n","protected":false},"author":10,"featured_media":0,"parent":0,"template":"","meta":{"_acf_changed":false,"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"glossary-cat":[],"class_list":["post-6584","glossary","type-glossary","status-publish","hentry"],"acf":[],"related_terms":"","external_url":"","internal_reference_id":"","_links":{"self":[{"href":"https:\/\/mediconomics.com\/en\/wp-json\/wp\/v2\/glossary\/6584","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mediconomics.com\/en\/wp-json\/wp\/v2\/glossary"}],"about":[{"href":"https:\/\/mediconomics.com\/en\/wp-json\/wp\/v2\/types\/glossary"}],"author":[{"embeddable":true,"href":"https:\/\/mediconomics.com\/en\/wp-json\/wp\/v2\/users\/10"}],"version-history":[{"count":1,"href":"https:\/\/mediconomics.com\/en\/wp-json\/wp\/v2\/glossary\/6584\/revisions"}],"predecessor-version":[{"id":7488,"href":"https:\/\/mediconomics.com\/en\/wp-json\/wp\/v2\/glossary\/6584\/revisions\/7488"}],"wp:attachment":[{"href":"https:\/\/mediconomics.com\/en\/wp-json\/wp\/v2\/media?parent=6584"}],"wp:term":[{"taxonomy":"glossary-cat","embeddable":true,"href":"https:\/\/mediconomics.com\/en\/wp-json\/wp\/v2\/glossary-cat?post=6584"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}Regulatory references<\/h2>\n
\n