298 FDA drug CGMP warning letters from 2023-11-06 to 2026-10-27: 40 of them (13%) cite problems in this area: audit trails, shared logins, back-dated entries, deleted or re-integrated lab data, the same person doing and checking. Below, each problem FDA cites, how often, where the records that show it live, and how a plant can find it in its own records.
What FDA cites
| Problem | Records in | Letters |
|---|---|---|
| Lab data deleted, trial-injected or re-integrated to pass How to find it: In the chromatography and LIMS audit trails, flag deleted or aborted runs, injections not part of a reported sequence, and results manually re-integrated before reporting, per sample. FDA wrote, for example: “Incomplete lab records; TNTC and compromised plate results omitted or discarded without review.” | LIMS / CDS | 22 · 7.4% |
| Audit trails off, not reviewed or with gaps How to find it: Find records changed with no audit trail entry, periods with the audit trail switched off, and audit trail reviews missing before batch release. FDA wrote, for example: “Electronic records had shared passwords, auto-deleted data and no audit trails.” | MES / eBMR, LIMS / CDS, QMS, eLogbooks / CMMS | 13 · 4.4% |
| Users with administrator rights who also do GMP work How to find it: List users who can change configuration, delete data or switch off the audit trail, and who also sign batch or lab records. FDA wrote, for example: “Electronic records had shared passwords, auto-deleted data and no audit trails.” | MES / eBMR, LIMS / CDS, QMS, eLogbooks / CMMS | 13 · 4.4% |
| Entries made after the fact (back-dated or written up later) How to find it: Compare when each step or reading was entered with when it says it happened; flag entries recorded more than the plant's limit (say 30 minutes) after the activity, and batches whose entries were all saved together at the end of the shift. FDA wrote, for example: “EM data not recorded contemporaneously.” | MES / eBMR, eLogbooks / CMMS, LIMS / CDS | 7 · 2.3% |
| Shared or generic logins sign GMP records How to find it: List every user ID that signed or changed a GMP record; flag IDs that aren't one named person (admin, operator, qc, lab1, shift…) and IDs used by more than one person at the same time on different stations. FDA wrote, for example: “Electronic records had shared passwords, auto-deleted data and no audit trails.” | MES / eBMR, LIMS / CDS, QMS, eLogbooks / CMMS | 3 · 1.0% |
| The same person does and checks (no second person) How to find it: For every step that needs a doer and a checker, flag those signed by the same user ID, or by two IDs of the same person. | MES / eBMR, eLogbooks / CMMS, LIMS / CDS | 0 · 0.0% |
| Records signed by people who had left or were disabled Cross-system How to find it: Match every signature to the user list and the HR/training record: flag signatures after the person's leaving date or after the account was disabled. | MES / eBMR, LIMS / CDS, QMS, Training (TMS / LMS) | 0 · 0.0% |
Read the warning letters, one by one · All the figures
Other areas
How these figures are made: Siddhi LLC reads FDA's public drug CGMP warning letters (on fda.gov, 2023-11-06 to 2026-10-27: 298 letters, 1315 findings) and groups each finding by the problem it describes, from the CFR section FDA cites and FDA's wording. A letter counts once in an area, and can count in several areas. These are our grouping of FDA's letters, not FDA's own statistics. The systems are where a plant keeps the records that show each problem: FDA cites the regulation, not a system. Updated with each new release of the Atto Audit Library.
Find these problems in your own records before an inspector does
The Atto Auditor compares the exports of your MES, QMS, LIMS, training, documents, logbooks and ERP, whichever vendors made them, and gives your plant's Audit fit summary: each problem FDA cites, with the records that show it.