How to Prepare for an FDA Computerized-System Inspection

An FDA inspection of a computerized system is rarely a request to see "the validation binder." It is usually a series of specific questions: who could change this record, what happened to it on a given date, and why a particular testing approach was considered sufficient.

What investigators typically ask for

• The system’s documented intended use and the regulated process it supports.
• Evidence of access controls: who has access, at what privilege level, and how that is reviewed.
• A reconstructable history of significant changes to the system and to specific records.
• The rationale for the depth of testing or assurance activity chosen for a given function.
• Evidence that electronic records remain complete, accurate, and available.

A practical readiness checklist

1. 1Confirm the documented intended use exists and matches how the system is actually used today.
2. 2Confirm access-control records are current and can show who can change regulated data.
3. 3Confirm audit trail or change-history records can be retrieved for a specific date range within minutes, not days.
4. 4Confirm the validation/assurance rationale for the system is written down, not only understood informally by one person.
5. 5Run a mock request: pick a real record and see how long it takes to produce its full change history.

The most common gap

The most common readiness gap is not missing evidence — it’s evidence that exists but cannot be located or explained quickly, because it is scattered across systems, people, or formats with no single point of retrieval.

Questions to ask before an inspection

• If asked right now, could we produce this system’s intended use statement within an hour?
• Could we show a complete, reviewed change history for a specific record from the last 12 months?
• Does more than one person know where this evidence lives?
• Have we actually rehearsed producing this evidence, or only assumed we could?