What does MHRA look for in a data integrity inspection, and how do you prepare?
MHRA's 2021 GxP Data Integrity guidance applies ALCOA+ to all pharmaceutical and life sciences records in the UK. MHRA inspectors focus on the Contemporaneous criterion: records must prove they were created at the time of the activity, not reconstructed afterward. In inspections, MHRA consistently finds that audit trails are disabled, not reviewed, or contain deleted entries — and that organisations cannot demonstrate original data integrity independently of their own systems.
immut provides the independent proof layer MHRA requires: a blockchain-anchored timestamp that an inspector can verify on the public XRP Ledger, controlled by no party, without trusting the regulated organisation.
Six common MHRA data integrity inspection findings
These are the most frequently cited issues in MHRA data integrity inspections and regulatory correspondence. Each finding maps to an ALCOA+ criterion failure.
Computerised systems configured with audit trails disabled — commonly cited as a 'performance optimisation' by IT teams. MHRA treats this as a fundamental data integrity control failure regardless of the business reason.
Audit trails were enabled and retained but not reviewed as part of batch record review or quality oversight. MHRA requires that audit trail review be a defined activity in quality procedures, not an ad-hoc investigation tool.
Analysts deleted out-of-specification results and re-ran tests, retaining only passing results. The audit trail showed deletions but the batch record presented for review did not reference them. Original data was not retained.
Multiple analysts using shared login accounts. Audit trail entries were not attributable to individual operators. The Attributable criterion in ALCOA+ was not satisfied.
System clocks set incorrectly or manipulated to backdate records. Without an independent external timestamp, there is no way to verify when a record was actually created.
Records completed after the end of shifts from analyst memory rather than at the point of each activity. MHRA's guidance specifically warns against this practice as it fails the Contemporaneous criterion.
What does MHRA mean by 'original data' and why does it matter for inspections?
MHRA defines original data as the first-captured observation in any format. Any subsequent transfer, transcription, or recreation must be demonstrably equivalent to the original. The word “demonstrably” is critical: MHRA does not accept an organisation's assurance that a transferred record is equivalent to the original. Equivalence must be shown through an independent, tamper-evident mechanism. Where a laboratory transfers instrument raw data to a LIMS — and the instrument data could have been altered before transfer — MHRA inspectors require evidence that the transfer was verified against the original at the time of capture.
How does immut address the MHRA system clock manipulation finding?
System clock manipulation is cited when a laboratory's instrument computers or LIMS have clocks set incorrectly — accidentally or deliberately — invalidating internal timestamps. immut's timestamps are not derived from any client device clock. The XRP Ledger network timestamp is set by consensus across thousands of independent validator nodes worldwide. No single organisation, including immut, can manipulate the network time. When immut anchors a record to the XRP Ledger, the timestamp is the consensus time of the global validator network — immune to single-party manipulation.
Can immut prove contemporaneity for records created in a validated computerised system?
Yes. The validated computerised system (LIMS, EBR, EDMS) proves the system is fit for purpose and that access controls are in place. immut proves that a specific record — exported or accessed at a specific point in time — existed with a specific hash at that moment. For MHRA inspection purposes, you present both: the validated system's internal audit trail (showing the record was created and modified in sequence), and the immut certificate (proving the final approved record existed, unchanged, at the claimed approval time). The combination addresses both the system integrity question and the contemporaneity question.
MHRA data integrity reference documents
The primary MHRA guidance document. Defines ALCOA+, data governance, computerised systems requirements, and inspector expectations.
Applies across EU GMP regulated activities. Clause 9 covers audit trail requirements. Applicable in UK under MHRA's current GMP framework.
Requires management of knowledge throughout the product lifecycle, including temporal sequence of knowledge creation.
Related GxP evidence resources
Prove your first file in minutes.
Takes seconds. Works on any file type. No installation required.