Records you can rely on, and prove
This is about the integrity of your GxP records. Batch documentation, laboratory results, the data behind a release decision. It is not about cybersecurity, IT infrastructure or protecting your network from anyone.
What I do is assess whether the records your organisation produces would hold up: to an investigator, to a customer auditing you, or to your own investigation when something goes wrong twelve months from now.
28 years in life sciences across three continents
Experience with USFDA, TGA and MHRA audits
What good data integrity actually gets you
Records that stand up without anyone reconstructing them.
If the week before an inspection involves piecing together what happened, that's the finding.
Findings that don't repeat.
Most integrity problems have a workflow cause. Fix the workflow and they stop.
People recording properly when they're under pressure.
Which is the only time it matters. Anyone records properly on a quiet Tuesday.
Data you can make decisions on.
Integrity is a business problem before it's a compliance one. If you can't trust the number, you can't use it.
Documentation that fits the way the work runs.
Recording at the point it happens, not from memory at the end of a shift.
A position you can demonstrate on request.
To a regulator, a client or a partner.
Why data integrity findings keep happening
Almost never because someone set out to falsify anything.
Recording designed for the file rather than the task. The form suits whoever will review it, not the person filling it in with gloves on.
Workflows that force late entry or double handling. Every transcription between systems is a place where integrity leaks. So is every delay between doing something and writing it down.
Nobody quite owning the records or the systems. Ask who is accountable for a particular dataset and you often get three answers or none.
Training on the rules but not the judgement. People can recite ALCOA. Far fewer know what to do at four o'clock on a Friday when the instrument has produced something odd.
You'll recognise some of these
Entries getting completed after the activity, not during
Unofficial notebooks and scrap paper that somehow feed the official record
Data transcribed by hand from one system into another
Audit trails that exist and that nobody has ever reviewed
Corrections that don't explain themselves
Shared logins still in use because it's easier
Each of those usually has a sensible reason behind it. That's the point. Finding the reason is the work.
ALCOA+
The framework everyone knows. Attributable, legible, contemporaneous, original, accurate. Then complete, consistent, enduring and available.
I'm not going to explain each of them at length here, because every training provider in the sector has already done that and you can find it in thirty seconds.
What matters more is this: failing ALCOA is a symptom. It tells you something in the system that produces your data isn't working. The useful question isn't which letter you've failed, it's why the workflow made failing it the easier option.
Paper, hybrid and electronic
Data integrity is not a software problem. That assumption is common and it's expensive, because it sends people looking in the wrong place.
Paper. Contemporaneous recording, controlled forms, how corrections get made, true copies, retention. Paper records fail in different ways than electronic ones, and the failures are often easier to spot and easier to fix.
Hybrid. Where most findings actually originate. Two systems running alongside each other, data moving between them by hand, and a gap in the middle that neither system owns. Almost every organisation I work with is hybrid somewhere, whether or not they'd describe themselves that way.
Electronic. Access, attribution, audit trails, review. I look at these from a GxP position: does the record hold up, and is anyone actually looking at it. Whether the system itself is validated and fit for purpose is a separate discipline.
What the assessment covers
How records get created. Walkthroughs at the point of work. This is the part that finds things.
How data moves. Where it originates, where it's copied, transformed, reviewed and retained. I map the flow, and the map is usually the first time anyone has seen it laid out.
Which data actually matters. Not everything deserves the same level of control. Criticality drives where the effort should go.
Who owns what. Records and systems both. This question produces more silence than any other I ask.
What you receive
A findings report.
For each area: the regulatory clause that applies, where you sit against it, and the gap.
A criticality rating on every gap, so you can work through them by risk.
A data flow map with the exposure marked.
Where things repeat, where they're transcribed, and where integrity is at risk.
Short-term and long-term actions, kept separate.
A walkthrough with your team, including the people who create the records, not only QA.
Where this connects
If the wider system is the issue.
Data integrity problems often turn out to be quality system problems wearing a different coat.
If the people are the gap.
I deliver training on data governance and data integrity, tailored to your own procedures.
How you'd know it worked
Whether documentation findings repeat.
How many transcription steps you've removed.
Whether audit trail review is actually happening rather than being scheduled.
Whether records are being completed at the point of work.
The transcription one is the most useful, because you can count it.
Proof
eQMS effectiveness review — pharmaceutical CDMO
A pharmaceutical CDMO had implemented an eQMS quickly during the pandemic. Manual controls still ran alongside it, and the people who built it had left. I assessed the system against PIC/S data integrity guidance, mapped its processes, and delivered tailored QA training. The assessment exposed compliance and data integrity gaps before a regulator did. A short- and long-term plan helped the client prepare to replace the system and put remedial actions in place to hold the compliance position in the meantime.
- 1. A conversation.
- 2. The assessment.
- 3. Analysis.
- 4. Report and walkthrough.
- 5. Help afterwards, if you want it.
How an assessment runs
1. A conversation.
Thirty minutes to understand your environment. Paper, electronic, or the usual mixture of both.
How an assessment runs
2. The assessment.
Walkthroughs at the point of work, record and document review, data flow mapping. I'll need time with the people who create the records, not just with QA. That's what makes it an assessment rather than a desk review.
How an assessment runs
3. Analysis.
Exposure ranked by criticality and consequence, split into regulatory and operational.
How an assessment runs
4. Report and walkthrough.
Short-term and long-term actions, taken through with your team.
How an assessment runs
5. Help afterwards, if you want it.
Remediation support or staff training. Optional, and the assessment stands on its own.
Who you'd be dealing with
I'm Antiksha Joshi. I've spent 28 years in pharmaceutical and life sciences quality across three continents. I am Chair of Women in Pharma, ISPE Australasia Affiliate.
I also write and speak on quality systems for various knowledge sharing organisations and online publications.
I facilitate data governance and data integrity training for Life Sciences Australia, and I've assessed records in laboratory, manufacturing and clinical environments across paper, hybrid and fully electronic systems.
My background is in microbiology, which means I've spent time in the environments where most of these records actually get made.
Questions people ask
What does a data integrity assessment cover?
How your GxP records get created, moved, reviewed and retained, and whether they'd stand up to scrutiny. Paper and electronic both.
What is ALCOA+?
The framework for what a reliable record looks like: attributable, legible, contemporaneous, original, accurate, plus complete, consistent, enduring and available. Useful as a checklist. Less useful as a diagnosis, because failing it is a symptom rather than a cause.
What causes data integrity findings?
Usually workflow design. Recording that's difficult, transcription between systems, unclear ownership, or training that covered the rules but not the judgement. Deliberate falsification exists but it's rare.
Does this apply to us if we're mostly on paper?
Yes, and paper environments have their own failure modes. Most organisations are hybrid somewhere anyway.
Is this the same as validating our systems?
No. Validation asks whether a system works as intended. This asks whether the records it produces can be trusted. Related, but different questions.
Do you train our staff as part of it?
I can. I deliver tailored data governance and data integrity training, built around your own procedures.
How much of our team's time will it take?
Some, particularly from the people who create records. That's where the findings are.
