What FDA CSV Citations Reveal About Your Next GMP Inspection

If your organisation is preparing for a GMP inspection, reviewing computerised-systems and data- integrity observations can reveal more than a list of regulatory citations. It can show where inspectors look beyond the validation binder and ask how systems actually operate.

This article is a practical interpretation of recurring themes in FDA inspection observations and related GMP guidance. It is not an inspection prediction, legal advice, or a determination that a particular organisation or system is compliant. The applicable FDA communication, regulatory requirements, intended use, risk assessment, and quality system remain the controlling context.

The inspection question behind the citation

Organisations often read an observation as a question about one clause or one record. An experienced inspection response also asks what risk the observation exposes.

An observation about an incomplete batch record may prompt a broader question: can the organisation trust the information used to make quality decisions? An observation about electronic records may raise the question of whether GMP data can be changed without appropriate oversight. An observation about input and output verification may point to uncertainty about whether data moved through the process correctly.

These questions have a common theme: whether data remains accurate, complete, attributable, contemporaneous, and trustworthy throughout its lifecycle.

Why validation documentation is not enough

An approved Validation Plan, User Requirements Specification, test evidence, traceability matrix, validation report, and operating procedures are important evidence. They do not, by themselves, show that a system remains controlled after go-live.

Systems evolve. Users and permissions change. Suppliers release updates. Configurations and integrations change. Business processes change. Incidents reveal new information. Periodic review should connect those changes and findings to the system's current state of control.

The practical inspection question is therefore not only, “Was this system validated?” It is also, “How do you know this system remains fit for its intended GMP use today?”

The ongoing control beyond validation guide explores this lifecycle distinction in more detail.

What recurring weaknesses can reveal

1. Critical data is not clearly understood

Not all data carries the same process impact. Some records directly support product release decisions. Some influence process control, investigations, traceability, or reporting. Other data may be informative without driving a GMP decision.

If critical data has not been identified, it becomes difficult to apply proportionate controls, define appropriate review, or explain why a validation approach was sufficient. Start with the process and intended use, then identify which data and decisions matter most.

2. Audit trails exist but are not effectively used

An audit trail that nobody reviews provides limited assurance. The organisation should understand which changes matter for the process, who reviews them, how findings are assessed, and when a change requires investigation or escalation.

The question is not simply whether the system can generate an audit trail. It is whether the audit trail helps the organisation detect and explain changes that could affect quality or data integrity.

The evidence and traceability guide for GMP AI applies the same principle to AI-assisted work and its resulting decisions.

3. User access is weaker than expected

Common access-control questions include:

• Are privileges appropriate to the person's role?
• Are shared accounts prohibited or controlled?
• Are inactive users removed promptly?
• Are access reviews performed at a defined frequency?
• Are conflicting duties separated where the process requires it?
• Is privileged access documented and justified?

Access control is part of data integrity. It helps establish who could create, change, approve, or delete information and whether those actions can be attributed to the right person.

The SharePoint governance pathway provides related guidance for controlled information, permissions, and process structure in Microsoft 365.

4. Supplier reliance is not well understood

GMP operations increasingly depend on SaaS platforms, cloud hosting, managed services, and external configuration partners. Supplier evidence can support the assessment, but it does not remove the regulated organisation's responsibility for its intended use.

The organisation should understand supplier quality processes, security, service changes, incident handling, support boundaries, contractual controls, and the evidence available to justify reliance. It should also be able to explain what it controls itself.

A practical inspection-readiness check

Before an inspection, ask whether the team can answer these questions with current, retrievable evidence:

1. Do we have an up-to-date inventory of GMP-relevant computerised systems?
2. Can we identify the critical functionality and data for each system?
3. Can we explain the intended use and process impact?
4. Are audit trails enabled, reviewed, and escalated where appropriate?
5. Are user access reviews routinely performed and evidenced?
6. Can we demonstrate that backup restoration has been tested?
7. Are interfaces and data transfers understood, verified, and controlled?
8. Can we explain why validation and assurance effort was proportionate to risk?
9. Can we demonstrate effective oversight of critical suppliers?
10. Can we show how the system remains in a validated state today?

These questions are often more revealing than asking whether a protocol was approved several years ago.

The most useful question in CSV

Many validation projects begin with, “What documents do we need?” A stronger question is:

What could go wrong, and how do we know it is controlled?

That question shifts the conversation towards process understanding, intended use, criticality, data integrity, risk controls, and assurance activities. Documentation then becomes evidence of those decisions rather than the objective by itself.

The purpose of validation is to provide justified confidence that the system performs consistently and reliably for its intended GMP use and protects critical information. The right evidence depends on the system, process, risks, and lifecycle stage.

Developing better CSV thinking

Validation practitioners need more than the ability to write a requirement, execute a test script, complete a traceability matrix, or issue a report. They also need to make sound decisions about:

• intended use and process impact;
• product quality and patient-safety relevance;
• data-integrity risk;
• supplier reliance;
• appropriate testing and assurance;
• system governance and operational controls;
• ongoing review and change management.

These judgement skills matter as cloud platforms, software-as-a-service, automation, and artificial intelligence become more common in GMP operations. The Regulatory compliance pathway connects these questions to practical quality-system work.

For AI-assisted processes, the Practical, Governed AI for GMP Quality Operations hub adds questions about output boundaries, human oversight, evaluation, traceability, and controlled change. The technology may differ, but the underlying inspection question remains familiar: can the organisation explain what happened and demonstrate that the process remains under control?

Final thought

Reviewing FDA CSV citations is most valuable when it changes the question from “How do we produce a larger validation binder?” to “How do we demonstrate confidence?”

Confidence that systems are fit for intended use. Confidence that data can be trusted. Confidence that quality decisions are based on reliable information. And confidence that, when an inspector asks how the organisation knows a system is controlled, the answer is clear, current, and supported by evidence.

Discuss your GMP quality-system pathway.