Data integrity is a fundamental component of FDA compliance across pharmaceutical, biotech, medical device, and clinical research operations. As companies increasingly rely on Contract Research Organizations (CROs), contract laboratories, technology providers, consultants, manufacturers, and other third-party vendors, the responsibility for ensuring reliable and trustworthy data does not disappear when an activity is outsourced. An effective vendor audit program must therefore evaluate not only whether a supplier follows written procedures, but also whether the underlying systems, people, records, and controls consistently protect data throughout its lifecycle.

FDA defines data integrity in the context of drug CGMP as the completeness, consistency, and accuracy of data, with expectations that data be attributable, legible, contemporaneously recorded, original or a true copy, and accurate. FDA’s Data Integrity and Compliance With Drug CGMP guidance emphasizes risk-based strategies for preventing and detecting data integrity problems. For organizations using CROs or contract laboratories, this means vendor qualification and ongoing oversight should specifically address how regulated data are generated, modified, reviewed, transferred, retained, and ultimately used to support regulatory decisions. A strong CRO audit should begin before the vendor performs regulated work. Initial qualification should examine the vendor’s quality management system, relevant regulatory history, organizational structure, employee training, computerized systems, data governance procedures, deviation and CAPA processes, document controls, and experience with comparable projects. Companies should also determine whether the CRO uses subcontractors and, if so, understand who actually performs critical activities. Outsourcing work without adequate visibility into subcontracting arrangements can create significant compliance and data traceability risks.

The audit should then move into data integrity controls. Auditors should determine whether individual users have unique accounts, whether access rights are appropriately restricted, and whether privileged access is controlled. Shared credentials, uncontrolled administrative access, inappropriate spreadsheet manipulation, deleted records, undocumented changes, and inadequate audit-trail review can all undermine confidence in regulated information. For electronic systems, the auditor should assess validation status, security controls, audit trails, backup and recovery processes, change control, and the ability to retrieve complete records when required. Audit trails deserve particular attention during a vendor compliance audit. FDA expects electronic systems used in regulated activities to provide appropriate controls for reconstructing the history of electronic records. Auditors should verify that audit trails capture relevant creation, modification, and deletion activities; that users cannot improperly alter audit-trail information; and that audit-trail review is performed according to documented procedures. For clinical investigations, FDA also emphasizes maintaining source information and ensuring that electronic records remain reliable, traceable, and capable of supporting reconstruction of the study.

The scope of an audit should also reflect the type of vendor and regulated activity involved. A CRO managing clinical data may require detailed assessment of electronic data capture systems, source-data processes, database access, statistical programming, query management, and data transfers. A contract testing laboratory may require deeper review of laboratory instruments, chromatographic data, sample management, raw data, calculations, electronic worksheets, laboratory information management systems, and analytical records. A contract manufacturer may require evaluation of batch records, laboratory controls, equipment records, deviations, CAPA, change control, and production data. A medical device organization outsourcing design, software, testing, or manufacturing activities should similarly evaluate controls based on the risks associated with those activities. Quality agreements and contracts are another critical element of vendor oversight. Responsibilities should be clearly assigned for data generation, review, retention, deviations, investigations, change notification, regulatory inspections, record access, and audit rights. FDA’s expectations for outsourced activities make it important for sponsors and product owners to maintain sufficient oversight of contracted operations rather than treating the vendor as a separate compliance environment. The agreement should also address subcontracting, ownership and access to records, notification timelines, and expectations for regulatory authorities’ access to relevant information.

Recent FDA activity reinforces why this approach matters. FDA warning letters issued in 2025 and 2026 continue to identify inadequate data reliability and data integrity controls as significant compliance concerns. Recent enforcement responses have emphasized the need for comprehensive investigations into the scope and root causes of inaccurate or incomplete data, rather than treating individual discrepancies as isolated incidents. This demonstrates an important practical lesson: a vendor audit should look beyond individual findings and evaluate whether weaknesses indicate broader systemic failures. An effective vendor qualification program should therefore use a risk-based approach. Critical vendors handling GxP data, laboratory testing, clinical trial information, manufacturing records, or regulatory submissions generally warrant greater scrutiny than lower-risk service providers. Audit frequency should consider regulatory history, criticality of the outsourced activity, complexity of computerized systems, previous findings, organizational changes, performance trends, and the vendor’s CAPA effectiveness. Remote assessments may be useful for certain activities, but higher-risk operations may require appropriately comprehensive on-site or equivalent assessments.

When deficiencies are identified, the objective should not simply be to issue observations and close the audit. Companies should evaluate the potential impact on previously generated data, determine whether additional investigation is necessary, assess affected products or studies, and establish scientifically and procedurally justified corrective and preventive actions. Vendor performance should then be monitored through quality metrics, recurring reviews, deviation trends, audit findings, complaint or investigation data, and other indicators relevant to the outsourced activity. For organizations operating in regulated environments, the central principle is straightforward: outsourcing an activity does not mean outsourcing accountability for the quality and reliability of the information generated. A well-designed CRO audit checklist, supported by risk-based vendor qualification, robust computerized-system controls, effective quality agreements, and ongoing oversight, can significantly reduce the possibility that data integrity weaknesses at a third party will become a regulatory problem for the sponsor or product owner.