The Data
Integrity Gap
It is easier than ever to backdate or edit evidence. Being able to independently prove authenticity is a competitive advantage
In brief
Five things this paper argues
- Regulators have stopped taking records on trust; US financial regulators alone have collected over $3 billion since 2021 for recordkeeping failures.
- The records that fail are not wrong, they are unprovable.
- AI has collapsed the cost of fabricating convincing records to near zero.
- Your exposure does not end at your own records; every supplier document is one they marked their own homework on.
- A record anchored to a public blockchain at creation is verifiable by anyone, in seconds, without trusting its producer.
The law does not ask whether you have records. It asks whether you can prove when they existed.
See it in action
The problem, and how immut closes it
A short walkthrough: a worked example of how a record fails, and how anchoring it to a public ledger lets anyone verify it in seconds.
Watch on YouTube: youtu.be/aC4U6utEZfo
The enforcement wave
Data integrity is now the first question
For decades, a record was evidence. Today, a record is a claim, and the regulator’s first question is whether the claim can be proved. The numbers describe a wave that crosses every regulated industry.
in fines for failure to keep required records of business communications, since December 2021. No client losses were required.
sec.gov ↗of audit engagements inspected in 2023 lacked sufficient appropriate audit evidence. The profession whose product is assurance could not evidence its own work.
pcaobus.org ↗of the FDA’s drug GMP warning letters carried data integrity citations at the peak of the enforcement wave.
Unger Consulting ↗fine over gas risers in 769 high-rise buildings. No one was hurt and no defect was found. The company could not produce records of inspection.
energylivenews.com ↗Four regulators. Four industries. One converging question: can you prove it, contemporaneously, to a party that does not trust you?
The scale of this problem
What the FDA’s paper trail shows
The FDA publishes more enforcement detail than any other regulator, which makes pharmaceuticals the clearest window into where every regulated industry is heading.
FDA regulation 21 CFR Part 11 sets the criteria under which electronic records are considered “trustworthy, reliable, and generally equivalent to paper records.” The operating principle, shared with the UK’s MHRA, is ALCOA+. The load-bearing word is contemporaneous. Recorded at the time of the activity. Not approximately. Not later.
The enforcement record shows what happens when that word cannot be proved. The FDA is not mainly catching fraud. It is mainly catching records that cannot defend themselves: quality records in editable spreadsheets, audit trails that do not establish when an entry was made, documentation that asserts a date rather than proving one.
Every regulator is converging on the same standard the FDA wrote down in 2018. ISO auditors now require immutable logging of security events. HMRC requires contemporaneous technical evidence for R&D claims. The ICO and HSE treat the inability to produce records as itself sanctionable.
Records must be Attributable, Legible, Contemporaneous, Original and Accurate, plus Complete, Consistent, Enduring and Available.
Fabricated and falsified clinical data, stability data and manufacturing records submitted to the FDA. Pleaded guilty to seven federal criminal counts, at the time the largest drug-safety settlement against a generic manufacturer.
oig.hhs.gov ↗FDA investigators documented an analyst pouring acetic acid over CGMP records, and found a truck of shredded, acid-soaked quality documents. The fabrication was caught because an inspector physically witnessed it. The documents alone would never have revealed it.
fda.gov ↗Why this keeps happening
The self-asserted date
The records failing these inspections run on the same tools every regulated business uses, and those tools share one property: the date on a record is whatever the system, or anyone with sufficient access, says it is.
Word and Excel. File metadata, including creation and last-modified dates, can be overwritten with free tools such as ExifTool in seconds. Contents are trivially editable with no visible forensic trace.
Email. Headers record sending time only on the sending server. Body text and attachments can be modified by anyone with mailbox access. Export-to-PDF workflows strip the original headers entirely.
Slack and Teams. Editing is a designed feature. Administrative accounts can alter message history. Channel exports carry no cryptographic integrity guarantees.
Databases, ELNs, QMS platforms and cloud storage. Version history and audit logs sit on the same infrastructure as the records themselves. An administrator with sufficient privilege can alter both the record and the log that recorded it.
Compliance platforms. Evidence platforms disclaim the problem contractually:
“Customer, not Vanta, shall have sole responsibility for the accuracy, quality, integrity, legality, reliability” of customer data.
Vanta Master Subscription Agreement
This is not a flaw in one product. It is an architectural property of self-controlled storage: the party with the most to gain from a record is the same party that created it, stored it and dated it.
And the cost of exploiting that property has just collapsed.
Fabricating a convincing record once required skill, time and inside access. AI has removed all three constraints.
The pivot
Your suppliers mark their own homework too
Everything above describes your records. Now consider the records you rely on. Every regulated organisation sits at the centre of a web of evidence it did not produce, each one a digital record produced by the party it favours, on infrastructure that party controls, carrying a date that party asserted.
Today a buyer has three options, and all three are bad.
A 2022 ransomware attack on Advanced Computer Software, an NHS software supplier, disrupted services including the 111 line and exposed the records of 79,404 people. The ICO fined the supplier £3.07 million, and the penalty notice turned on what the company could demonstrate about its controls at the time of the attack. The NHS asks its thousands of suppliers to self-attest annually through the Data Security and Protection Toolkit, and no buyer, including the NHS, can independently verify a single one of those answers.
The cost of the status quo
You already pay for this problem. None of it fixes the cause.
Add up what the current system charges, on both sides of the contract. More rules and more checking raise the cost of compliance without changing the architecture that makes records unprovable in the first place.
The standard
What proof actually requires
Be precise about the standard. Evidence that satisfies a sceptical third party has four properties.
- Contemporaneous
- Created at the moment of the activity it describes, not assembled later. The FDA, the MHRA and HMRC all now name this property explicitly.
- Tamper-evident
- Any change to the record after creation is detectable by anyone, not only by a forensic examiner with privileged access.
- Independently verifiable
- Verifiable by a party that does not trust the organisation that created the record, the software it was created in, or any intermediary.
- Court-ready
- Meeting the evidentiary standard of the relevant jurisdiction, with precedent for acceptance.
A document on a company file server has none of the four. A supplier’s PDF attachment has none of them either. That symmetry is the point: the producer’s problem and the buyer’s problem are the same problem.
The fix
Anchor it once
There is a way to give any record all four properties in seconds, without changing the tools that produce it. The file itself never leaves the device and is never placed on any blockchain.
Your batch records, risk assessments, technical reports, audit logs and board minutes carry proof formed at the moment of creation. When the regulator asks when, the answer does not depend on your infrastructure, your administrators or your word.
This is the part the market has not priced in. Make anchored evidence a procurement requirement, and a supplier’s certificate arrives with a public-ledger anchor your team verifies in seconds, at no cost, without trusting anyone. One clause in a supplier contract replaces an audit programme’s worth of unverifiable paperwork. The buyers who require this first set the standard their competitors are later asked to meet.
Standing in court
Already accepted as evidence
A blockchain-anchored timestamp is not a novelty awaiting a test case. Courts across three legal traditions have accepted it.
- United States. In United States v. Sterlingov (2024), blockchain evidence survived a Daubert challenge in the US District Court for the District of Columbia.
- European Union. In AZ Factory v. Valeria Moda (Tribunal Judiciaire de Marseille, 20 March 2025), a blockchain timestamp was accepted as standalone proof of authorship, recognised across all 27 EU member states under eIDAS Article 41(2).
- China. Internet Courts have accepted blockchain-anchored evidence since 2018, formalised by the Supreme People’s Court in September 2018.
An immut certificate is recognised across 88 countries and 171 jurisdictions.
Public proof. Private work. Your file never goes on the blockchain. Only a one-way code of it does.
The method, in one line
Before the question is asked
How confident are you that your suppliers and employees are providing compliant evidence?
See it against your own evidence
David Horne will hash a real file with you and walk through how the certificate maps to the framework you operate under, FDA, ISO, HMRC, HSE or other. Fifteen minutes. No slides.
Public proof. Private work.
immut.io · the proof layer for digital files
References
Sources
- US Securities and Exchange Commission, “SEC Announces Enforcement Results for Fiscal Year 2024,” press release 2024-186, November 2024. sec.gov. Cumulative figures corroborated by Kirkland & Ellis, “Off-Channel Communications,” January 2025.
- US Commodity Futures Trading Commission, press release 8762-23, August 2023. cftc.gov.
- PCAOB, “Spotlight: Staff Update on 2023 Inspection Activities,” August 2024. assets.pcaobus.org. The 2024 inspection cycle showed improvement on the 2023 peak.
- US FDA, “Data Integrity and Compliance With Drug CGMP: Questions and Answers, Guidance for Industry,” December 2018. fda.gov.
- Barbara Unger, Unger Consulting Inc., annual analyses of FDA drug GMP warning letters, Pharmaceutical Online: 79% in FY2016, 68% in 2017, 57% in FY2018 (compounding-pharmacy letters excluded). See also Park and Kwon, “Trends in FDA Data Integrity Enforcement Before and After the COVID-19 Pandemic,” Therapeutic Innovation and Regulatory Science, 2025.
- UK Health and Safety Executive prosecution of National Grid Gas plc, Liverpool Crown Court, 9 February 2021. Fine £4 million plus costs.
- 21 CFR 11.1(a), Electronic Records; Electronic Signatures. ecfr.gov.
- UK MHRA, “‘GXP’ Data Integrity Guidance and Definitions,” Revision 1, March 2018, §3.10. assets.publishing.service.gov.uk.
- US Department of Justice, “Generic Drug Manufacturer Ranbaxy Pleads Guilty and Agrees to Pay $500 Million,” 13 May 2013. oig.hhs.gov.
- US FDA, warning letter 662868 to Intas Pharmaceuticals Limited, 21 November 2023. fda.gov.
- QBench, “Inside 470 FDA Warning Letters from 2025: What Labs Need to Know,” 2026. qbench.com/resources. Vendor analysis of the public FDA warning letter database, January to December 2025.
- US FDA Office of Pharmaceutical Quality, “Report on the State of Pharmaceutical Quality,” FY2024. fda.gov.
- Meridian Discovery, “Date Forgery Analysis: Timestamp Resolution.” meridiandiscovery.com.
- Vanta Master Subscription Agreement, customer data clause, retrieved 2026.
- US FinCEN, Alert FIN-2024-Alert004, “Fraud Schemes Involving Deepfake Media Targeting Financial Institutions,” 13 November 2024. fincen.gov.
- Deloitte Center for Financial Services, “Deepfake Banking Fraud Risk on the Rise,” 2024. deloitte.com/us/en/insights.
- UKAS, “Counterfeit Certificates,” ukas.com/accreditation/counterfeit-certificates; IAF CertSearch, iafcertsearch.org.
- Rx-360 Joint Audit Program. rx-360.org/jointauditprogram.
- Verizon, 2025 Data Breach Investigations Report. verizon.com/about/news/2025-data-breach-investigations-report.
- UK Information Commissioner’s Office, penalty notice to Advanced Computer Software Group Ltd, 27 March 2025. ico.org.uk.
- EDRM Digital Forensics Pricing Survey, 2025.
- Thomson Reuters, Cost of Compliance Report, 2023.
- immut certificates recognised under the UNCITRAL Model Law on Electronic Transferable Records 2017, the UK Electronic Trade Documents Act 2023, and eIDAS Regulation (EU) 910/2014.
- China Supreme People’s Court, Provisions on Several Issues Concerning the Trial of Cases by Internet Courts, September 2018.
- United States v. Sterlingov, US District Court for the District of Columbia, 2024.
- Tribunal Judiciaire de Marseille, AZ Factory v. Valeria Moda, RG 23/00046, 20 March 2025.