Audit Trail Requirements in GMP: What a Compliant Record Must Capture

A GMP audit trail is a secure, system generated, time stamped record of every action that creates, changes or deletes a GMP record. Each entry should show who acted, what changed, including the old and new value, when, and why for changes to GMP relevant data, without obscuring the original entry. It must be kept as long as the record itself, be readable on demand, and be reviewed.

That definition comes from three main sources: EU GMP Annex 11, the US rule 21 CFR 11.10(e), and the UK MHRA's data integrity guidance. Purchasing systems that hold GMP records, such as specifications, supplier assessments, bid evaluations and vendor documents, are in scope where those records support quality decisions.

Why this matters now

The EU rules are being tightened. Draft revisions of Annex 11 and Chapter 4, published for consultation in July 2025 with comments closing on 7 October 2025, strengthen controls on data integrity and audit trails [1]. The draft Annex 11 grows from 5 to 19 pages and gives audit trails their own section [2]. The current 2011 text remains the reference until a final version is adopted, but the direction is clear.

What regulators require

Annex 11 also asks for a risk assessment to decide where an audit trail is built in [3], so not every field in every system needs one. A supplier's price on a GMP critical vessel probably does; the colour of a bid folder does not.

What audit trail review means in practice

FDA expects the people who review GMP records to review the related audit trails as well, and says that where the rules set no frequency, the frequency should be set from process knowledge and risk [6]. FDA compares audit trail review to checking the crossings out on a paper record [6].

A practical review for a procurement record looks for:

• changes made after the record was approved or signed;
• deletions, and who made them;
• changes to technical scores after commercial bids were opened;
• entries out of time sequence, or made at unusual times;
• actions by administrators, which MHRA says must themselves be recorded [5].

Record that the review happened, who did it and what was found, in the same way as any other GMP review. Our article on ALCOA+ data integrity covers the wider principles behind it.

Practical example: audit trail entries for a purchase

In this illustrative example, a buyer receives a quote for a GMP vessel, the quote is revised, the evaluation is updated, and the purchase order is approved and then amended. A compliant audit trail would show entries like these.

A reviewer would ask two questions here. Was the technical score change on 12 November made before or after commercial bids were opened, and is the technical query that justifies it on file? And was the delivery date change after approval covered by the supplier's confirmation? If both answers are yes, the trail tells a clean story. If the reason fields had been blank, it would not.

For equipment that goes on to qualification, the same discipline continues into vendor documents and test records; see IQ, OQ and PQ explained.

Where ChemCapital fits

ChemCapital logs interactions, revisions and decisions with timestamps and links every action to the person who took it. Its Trust Centre describes the audit log as tamper evident, using a SHA 256 hash chain on data changes, with timestamps in UTC that cannot be backdated and mandatory reason for change fields; the log can be exported as CSV, with tamper evident export on Enterprise. These are ChemCapital's own descriptions, to be assessed by your quality team like any supplier's; for US electronic records rules, see our guide to 21 CFR Part 11 for procurement records.

Ready to keep a full record of every quote, score and order change? Start free with ChemCapital.