Review design
Define purpose, risk, scope, protocol context, data sources, event categories, and review criteria.
Audit trail review
See the sequence, context, and evidence together.
High-volume audit trail data becomes meaningful only when events are interpreted in relation to protocol context, sequence, timing, user role, and associated activity.
Perspective
QA4Tech combines structured data preparation, assisted analysis, and qualified expert review. AI helps surface patterns and organize evidence; it does not independently decide what an event means or reach the final conclusion. Engagements can begin as a bounded pilot or proof of concept to evaluate data readiness, review logic, and fit before broader use.
Accountability model
AI assists. Experts conclude.
Qualified experts remain responsible for interpretation and conclusions. Source evidence is preserved, and any normalization or consolidation must remain traceable to the originating records.
Capabilities
Specialist support, connected to the whole system.
Scope is tailored to the engagement; these are the core areas in which QA4Tech can contribute.
Data normalization
Normalize heterogeneous audit trail data into a canonical event model so related technical records can be consolidated into meaningful events.
Evidence consolidation
Preserve source evidence, lineage, and traceability as related records are connected for review.
AI-assisted analysis
Use assisted methods to organize events, identify relationships, and direct expert attention.
Expert interpretation
Qualified reviewers assess significance in context and remain responsible for conclusions.
Pilot engagements
Evaluate feasibility, data readiness, review logic, and value through a bounded pilot or proof of concept before broader use.
Signals
What the review is actually looking for.
An audit trail rarely contains a single incriminating entry. It contains patterns — in timing, sequence, identity, and repetition — that only mean something once the protocol and process context is attached to them.
Retrospective entry
Records created or completed long after the event they describe, particularly where the delay clusters around a visit, a lock, or an inspection date.
Modification without reason
Changes to critical data where the reason-for-change is absent, generic, or copied — and changes where the reason does not match what was altered.
Sequence anomalies
Events in an order the process does not permit: results before samples, approvals before review, corrections before the original entry.
Identity and role
Activity under shared accounts, activity outside a user’s role or study assignment, and privileged access used for routine data entry.
Timing patterns
Clustering outside working patterns, implausible entry speed, or bulk activity that suggests transcription rather than observation.
Configuration and control change
Edit checks, validation rules, ranges, or permissions altered mid-study, and whether the change was assessed before it took effect.
Deletion and disablement
Records removed, subjects or visits disabled, and audit trail functionality itself switched off, reconfigured, or gapped.
Silence
Periods, systems, or record types with no audit trail at all — usually the most significant finding, and the easiest one to miss.
Why it is hard
Audit trail data resists review by default.
The obstacles are practical and consistent across systems. Naming them at the start is what separates a review that concludes something from one that produces a very large spreadsheet.
- Every system exports a different structure, vocabulary, and level of granularity
- One business event fragments into many technical records that must be reassembled
- Volume defeats manual review long before the interesting events surface
- Technical noise — session, sync, and system entries — buries the human activity
- Protocol, visit, and process context lives outside the audit trail entirely
- Time zones, clock sources, and local versus server timestamps disagree
- Exports are frequently incomplete, filtered, or truncated without saying so
Engagement shapes
Start small, then scale what works.
Data readiness varies enormously between organizations and systems. A bounded first engagement establishes what is actually reviewable before anyone commits to a programme.
One system, one bounded dataset. Establishes export completeness, normalization feasibility, and whether the review logic finds anything worth acting on.
A defined question — a study, a site, a system, a period, or an allegation — reviewed end to end with documented conclusions.
Periodic review at an agreed scope and cadence, with the method, criteria, and evidence handling documented for repeat execution.
Approach
Context first. Evidence throughout.
A clear sequence keeps the work rigorous while avoiding unnecessary process.
- 01
Prepare
Confirm questions, protocol context, systems, source formats, access, and preservation requirements.
- 02
Normalize
Translate and, where appropriate, consolidate related source records into consistent canonical events without losing their evidentiary relationship.
- 03
Relate
Examine sequence, timing, identity, role, linked records, and surrounding activity.
- 04
Interpret
Apply qualified human judgment, document rationale, and reach traceable conclusions.
Deliverables
What the engagement produces.
Output built to be defended: every conclusion traceable to the source record it rests on, and a method somebody else could repeat.
- A review protocol stating purpose, scope, data sources, criteria, and limitations
- A normalized event dataset with lineage back to the originating records
- A findings register with significance, context, and supporting evidence per item
- An evidence pack suitable for a quality investigation or an inspection response
- A written report separating observation, interpretation, and reviewer judgment
- Documented method and criteria, so the review can be repeated or extended
Reference frameworks
The expectations behind the review.
Review criteria are drawn from the regulations that apply to the records being examined, and stated in the review protocol before any analysis begins. Those below are the usual starting points.
- 21 CFR Part 11
- Secure, computer-generated, time-stamped audit trails, and the record and signature controls they are meant to evidence.
- EU Annex 11
- Audit trail expectations for computerized systems, including the requirement that they are regularly reviewed.
- EMA guideline on computerised systems and electronic data in clinical trials
- European expectations for audit trail content, review, and the electronic data lifecycle in clinical trials.
- PIC/S PI 041
- Data management and integrity expectations, including review of audit trails proportionate to data criticality.
- ICH E6(R3)
- Data governance across the clinical data lifecycle, and sponsor oversight of the systems that hold it.
- ALCOA++ principles
- Applied as the assessment frame: attributable, legible, contemporaneous, original, accurate, and the completeness, consistency, endurance, availability, and traceability that follow.
These are examples, not a complete list. The frameworks and criteria that apply to a particular engagement are identified and agreed as part of defining its scope.
Typical applications
Where this work can apply.
- Clinical trial audit trail review, routine or targeted
- Data-integrity investigations and allegation follow-up
- Inspection preparation and inspection response
- Periodic review obligations that are not currently being met
- Method feasibility and data-readiness assessment
- Pilot and proof-of-concept engagements
Start a conversation
Bring the right level of assurance to the next decision.
Begin with a focused discussion about context, risk, evidence, and the outcome you need.