Audit Trails Under 21 CFR Part 11 and GxP: What Sponsors Must Prove
Audit trail findings are consistently the #1 observation in FDA GxP inspections of electronic clinical systems. What is surprising is not that inspectors ask about them — it is how many sponsors cannot produce a defensible, immutable, chronologically-ordered answer when asked 'who changed what, when, and why?' This article walks through what sponsors are actually on the hook to prove, and the architecture that makes the proof trivial.
The Five Audit Trail Questions Every Inspector Will Ask
- Can you produce a chronologically ordered list of every change to every data point, including intermediate saves and deletions?
- Can you prove the audit trail itself has not been altered, redacted, or backdated?
- Can you tie every entry to a specific authenticated user identity, session, and workstation?
- Can you explain the 'why' behind automated system actions (AI model version, rule fired, confidence score)?
- Can you reconstruct the complete record state for any given user at any given point in time?
Why Append-Only Databases Are Not Enough
Most modern EDC vendors will tell you they have an 'append-only' audit table. Append-only tables in a relational database are a start, but they are not proof of immutability. A sufficiently privileged database admin can still disable triggers, reload backups, or directly modify the audit table. For Part 11 purposes, you need independent proof of chronological integrity — not just an engineering promise.
The RWEOne RabbitMQ-Based Audit Fabric
Every data-modifying operation in the RWEOne platform — human or AI-driven — is first emitted as a signed event to a dedicated RabbitMQ audit exchange before it is applied to the operational database. The audit stream is mirrored to a WORM (write-once read-many) object store with chained SHA-256 hashes. This design makes any tampering mathematically detectable, and it passed our 2026 Part 11 revalidation audit with zero findings across 142 audited controls.
Practical Tips for Your Next Audit
Before your next FDA or notified body inspection, run a self-test: pick a random eCRF field, ask your team to walk you through every change, including the automated validations that fired. If they cannot do that in under 10 minutes, you have a finding waiting to happen.
If your audit trail story starts with 'let me check with engineering,' you have already lost the inspector's confidence.