FDA Warning Letters: What They Reveal About Computerized Systems

FDA warning letters can be useful learning material because they show where a real inspection found gaps in a firm’s controls. They should not be treated as a checklist of every requirement, but recurring themes can help quality and IT teams identify questions worth asking before an inspection.

Theme 1: Can the organization control who changes regulated records?

FDA warning letters have repeatedly cited inadequate controls over computerized systems, including insufficient restriction of access and inadequate controls over who can institute changes to regulated records. In one 2024 warning letter concerning laboratory computerized systems, FDA described concerns about user access levels, authorization, and controls supporting data integrity. Source

The practical question is not simply whether accounts exist. It is whether privileges are appropriate, reviewed, traceable, and aligned with the user’s role.

Theme 2: Are audit trails meaningful and usable?

An audit trail is valuable when it helps an organization understand what happened to an electronic record, who performed an action, and when the action occurred. FDA Part 11 guidance recommends considering audit trails and other controls based on applicable requirements, risk, and the impact on record integrity. Source

The implementation question is therefore broader than "Is the audit trail turned on?" Teams should also ask whether it is reviewable, protected, retained, and connected to an effective investigation process.

Theme 3: Is electronic data actually preserved and reliable?

FDA inspection observations have included cases where electronic records were not adequately retained, protected, or controlled, creating uncertainty about the reliability and completeness of laboratory or manufacturing data. FDA has also emphasized that incomplete or unreliable data can undermine quality decisions. Source

A resilient program therefore needs controls for data creation, modification, retention, backup, restoration, review, and investigation.

Theme 4: Is software validation tied to intended use?

FDA's software-validation guidance describes validation as a way to provide evidence that software consistently performs its intended use. The depth and rigor can vary by context, but the organization still needs a defensible basis for the chosen approach. Source

A pre-inspection self-check

A regulated team can use five questions:

1. 1Can we show the intended use and critical functions for each regulated application?
2. 2Can we demonstrate that access is restricted to authorized users?
3. 3Can we reconstruct significant changes to regulated records?
4. 4Can we demonstrate that important electronic data are complete, accurate, available, and protected?
5. 5Can we show why our testing and validation evidence is proportionate to risk?

What warning letters cannot tell you

A warning letter describes findings for a particular firm and context. It does not automatically establish that every company must implement the same control in the same way. Use warning letters as evidence of regulatory concern and as prompts for internal risk assessment — not as a substitute for reading the applicable regulation and guidance.