Audit readiness check

Ten questions, about three minutes. See how ready your computerised systems are for an audit or inspection, and what to fix first.

Each question comes from a clause in the regulations or regulator guidance used by pharma and life sciences companies, such as EU GMP Annex 11, 21 CFR Part 11 and 21 CFR Part 211 (the US rules on electronic records and on drug manufacturing), and the data integrity guidance from the UK MHRA and from PIC/S. The source is shown under every question.

This check looks at your controls. If you need to plan back from a known audit date, use the GxP Readiness Planner instead. It is a different tool, and you can use both.

What we keep

Your answers are used to work out your score and are not saved. If you give an email address, we keep only that address, your overall score and your area scores, for 12 months. We do not keep your answers, your gap list or any company or system names. Joining the newsletter is a separate choice and is off unless you tick it.

Members get the full version: 48 questions answered for each of your systems and suppliers, with a map of where the gaps are. See membership.

The ten questions

For a question about systems or suppliers, think of the critical ones you rely on. Choose "All", "Some" or "None" for how many of them it is true for. Choose "Not applicable" if it does not apply to you.

0 of 10 answered

1. Do you hold an up to date list of all computerised systems used in GMP activities, with each system's GMP function?

This applies to your organisation as a whole.

Source: Annex 11 (2011) cl. 4.3

2. Does the list include stand-alone laboratory instruments and their attached PCs, and spreadsheets used for GMP calculations?

This applies to your organisation as a whole.

Source: MHRA s.4.3; FDA Data Integrity Q&A 1.c

3. Is there a documented risk assessment for each system, covering patient safety, data integrity and product quality?

Think of your critical computerised systems.

Source: Annex 11 (2011) cl. 1

4. Does the risk ranking actually set the depth of validation and the controls applied?

This applies to your organisation as a whole.

Source: Annex 11 (2011) cl. 1, 4.1

5. Does every user have an individual login, and does the system record who entered, changed, confirmed or deleted data, with date and time?

Think of your critical computerised systems.

Source: Annex 11 (2011) cl. 12.4

6. Are administrator rights held by people independent of the records' content, and are access privileges documented for each system?

Think of your critical computerised systems.

Source: FDA Data Integrity Q&A (see 21 CFR 211.68(b))

7. Where your risk assessment calls for it, do systems record GMP-relevant changes and deletions in an audit trail?

Think of your critical computerised systems.

Source: Annex 11 (2011) cl. 9; 21 CFR 11.10(e)

8. Is there a procedure saying who reviews audit trails, what is reviewed and how often, with the frequency set from risk?

This applies to your organisation as a whole.

Source: Annex 11 (2011) cl. 9; FDA Data Integrity Q&A, question 7

9. Have you tested restoring from backup, during validation and periodically since?

Think of your critical computerised systems.

Source: Annex 11 (2011) cl. 7.2

10. Are all changes, including configuration changes, made under a defined procedure?

This applies to your organisation as a whole.

Source: Annex 11 (2011) cl. 10; 21 CFR 11.10(k)(2)

This is a self-assessment against the listed sources. It is not an assurance. Question bank version 1.0, 10 November 2026.