Part 01 · The Question→Part 02 · The Record→Part 03 · The File
← Part 01
Inspection Case File · CF07 · Part 02 of 03

The five fields the FDA investigator expects to find — and the one most files don't have.

A deviation closure with a signature is not the same as a deviation closure with a documented decision. The investigator can tell the difference in thirty seconds.

See the Complete File → Free to read. Buy decision is on the next page.
What separates a decision from a signature

A signature on a CAPA closure form proves that a person signed. It does not prove what they decided.

Under inspection, a signature is evidence of an event. It is not evidence of a decision. The investigator does not doubt the signature. She doubts that anything was decided.

An authorization record is structured to be evidence of a decision. It names the person, the moment, the evidence reviewed, the alternatives evaluated, and the basis on which the conclusion was reached. The investigator does not have to ask the QA Director what she was thinking. The record answers.

Investigator
"Who authorized the data integrity determination for this record, on what evidence, and how was the conclusion that the data was attributable, contemporaneous, and accurate justified at the moment of decision?"
This is the question that requires Field 03 of the authorization record to exist.
The Authorization Record · Required Structure

Five fields. Missing any one is the gap a 483 cites.

Every authorization record for a deviation root cause conclusion must contain the following five fields. The third field is the one that is almost always missing.

  1. 01
    The determination being authorized
    Stated as a decision, not a description. Not "no data integrity concern." Specifically: the conclusion that the audit trail anomalies on HPLC system in Lab 3 were caused exclusively by authorized administrative activities, on the basis of independent corroboration of each activity, review of data captured during access events for evidence of manipulation, and risk evaluation supporting acceptance of residual data integrity risk.
  2. 02
    The independently corroborated evidence
    Every piece of evidence external to the investigation itself: maintenance ticket logs from the IT system, vendor service reports, calibration certificate dates, badge access logs cross-referenced to the HPLC access. Each item identified, each item dated.
  3. 03
    Alternative explanations evaluated and rejectedMost Often Missing
    The candidate explanations considered before no-concern was concluded. Not "we considered alternatives." The actual alternatives — unauthorized access by named or unnamed individual, data manipulation post-acquisition, system clock manipulation — and the documented basis on which each was eliminated. This is the section a 483 cites when it is missing.
  4. 04
    The risk evaluation applied
    What was at stake if the no-concern conclusion was wrong. The integrity of every release decision based on data from this HPLC system over the affected period.
  5. 05
    The named decision owner and timestamp
    The individual whose authority basis is documented. Not the Lab QA Director signature. The person who reviewed the corroborating evidence, evaluated the alternative explanations, applied the risk standard, and authorized the determination.
Why Field 03 matters most

A deviation file almost never contains a documented alternative-causes evaluation. The investigator opens to it first.

Most deviation investigations conclude with a single root cause. They rarely document the alternatives that were evaluated and eliminated to arrive there. The investigator knows this. It is the field she opens to first.

If field 03 is empty, every other field is suspect. The evidence in field 02 may have been reviewed, but no alternative interpretations are on record. The conclusion in field 01 may be correct, but the reasoning is unreconstructable. The signature in field 05 attests to the conclusion, not to the analysis that produced it.

An authorization record without a documented alternative-causes evaluation is not an authorization record. It is a signature on a conclusion.

Why this matters now

The five-field structure is the same whether the inspection is this quarter or next year. The difference is whether you build the record now — when you have time, evidence, and the original decision-maker available — or under inspection pressure when none of those are guaranteed.

Reference Example

DDR-DI-001 — Amlodipine Besylate Tablets 10 mg — Data integrity investigation DI-2024-0042

The same scenario from Part 01, with the authorization record that should have existed in the file. Excerpt from the complete reference DDR.

Decision Defense Record · DDR-DI-001 · Excerpt
Data Integrity Decision Trail — DI-2024-0042
Decision Authorized
The conclusion that the audit trail anomalies on HPLC system in Lab 3 between January 8 and March 14, 2024 were caused exclusively by authorized administrative activities, on the basis of independent corroboration via IT maintenance tickets, vendor service reports, badge access cross-reference, and review of data captured during access events.
Authorizing Individual
Dr. Kevin Park, Director of Quality Assurance — Laboratory Operations
Authority Basis
DI-AUTH-001 §2.4 — designated authority for data integrity disposition authorization on laboratory systems
Evidence Reviewed
DI-2024-0042 · IT-MAINT-LOG-Q1-2024 · Vendor service reports SR-HPLC3-2024 · Badge access logs · Calibration certificates HPLC3-2024 · Audit trail review report ATR-HPLC3-2024 · Data manipulation review DMR-HPLC3-2024
Alternatives Eliminated
Unauthorized analyst access · Data manipulation post-acquisition · System clock manipulation · Compromised administrator credentials · Audit trail itself unreliable — each evaluated against independently corroborated evidence
Authorization Timestamp
March 28, 2024 — 13:15 EST
Regulatory Framework
21 CFR Part 11 · 21 CFR 211.68 · 21 CFR 211.194 · MHRA Data Integrity Guidance
— Continued in the complete file —
Inspection Exposure Snapshot

Want the 483 observation language for your records?

The exact citation language an investigator uses when this gap appears. Sent to your inbox. Useful as a reference. No follow-up sales sequence.

No spam · Unsubscribe anytime

Continued · Part 03 of 03

The structure is clear. The example is published. The record itself is in the complete file.

See the complete authorization record.

A completed reference DDR for the Vancomycin scenario. The blank template applied to your facility. The evidence checklist that closes the gap before inspection begins.

Show Me the Complete File →
✓ Free to read · Three commitment levels available

Used by Quality and Validation leaders preparing for FDA and EMA inspections. Built around 21 CFR 211.192 and ICH Q9.