Warning Letter: Failure to exercise appropriate controls (ucm279058)

Your firm has failed to exercise appropriate controls over computer or related systems to assure that changes in master production and control records, or other records, are instituted only by authorized personnel [21 CFR 211.68(b)]. For example: a. Your firm did not put in place requirements for appropriate usernames and passwords to allow appropriate control over data collected by your firm’s computerized systems including UV, IR, HPLC, and GC instruments. All employees in your firm used the same usemame and password. In addition, you did not document the changes made to the software or data stored by the instrument systems. Without proper documentation, you have no assurance of the integrity of the data or the functionality of the software used to determine test results. b. Your firm had no system in place to ensure appropriate backup of electronic raw data and no standard procedure for naming and saving data for retrieval at a later date. In your response, you state that you will maintain backup of electronic raw data and all technicians will have their own user identification (ID) and password.

View the original warning letter.