Data integrity citations on FDA Form 483s: the sections FDA cites and how often, 2025 to 2026

A data integrity citation is a Form 483 observation that FDA writes when a drug manufacturer's records are not complete, consistent and accurate, most often under 21 CFR 211.68(b) for computer controls or 211.194(a) for complete laboratory data. In 779 human drug Form 483s citing Part 211 from January 2025 to July 2026, 24.6% cited one of those two sections.

That sample comes from the Atlas Form 483 directory (release of August 15, 2026, pulled October 22, 2026). We read the structured CFR citations on every human drug 483 issued in 2025 and in January to July 2026, 1,059 forms with citation detail, then narrowed to the 779 that cite 21 CFR Part 211, the drug CGMP rule.

• 21 CFR 211.68(b) appeared on 129 of 779 Part 211 drug 483s (16.6%), more than any other data integrity section.
• 21 CFR 211.194(a), complete laboratory records, appeared on 82 of 779 (10.5%), and rose from 9.0% in 2025 to 14.9% in January to July 2026.
• Foreign facilities had a higher rate than US facilities: 28.6% (48 of 168) against 23.6% (144 of 611) cited 211.68(b) or 211.194(a).
• Form 483s with a data integrity section averaged 5.7 observations, against 3.2 for forms without one.
• None of the structured CFR citations in the 1,059 forms cited 21 CFR Part 11; FDA wrote the findings under the Part 211 and Part 212 predicate rules.
• FDA's December 2018 guidance defines data integrity as "the completeness, consistency, and accuracy of data" and lists five ALCOA attributes, not ALCOA+.

What counts as a data integrity citation on a Form 483?

A data integrity citation on a Form 483 is any observation where the investigator found that CGMP records could not be trusted to show what actually happened: data that was missing, changed without a trace, not attributable to a person, or not recorded at the time of the work. FDA has no separate "data integrity" box on the form. The finding is written against the record-keeping section that was broken.

In practice the observation text describes conditions such as audit trails switched off on a chromatography system, analysts sharing one login, failing injections deleted or reprocessed until a result passed, or batch records filled in after the fact. The CFR line tells you which rule FDA used. Our directory shows each observation with its citation and FDA's standard short title, so you can search the FDA Form 483 database by section to see the wording investigators use.

FDA's guidance on this topic is Data Integrity and Compliance With Drug CGMP: Questions and Answers, issued in December 2018 by CDER, CBER and CVM. It answers 18 questions, from audit trail review to shared logins, and every answer points back to a specific section of Parts 211 and 212. The guidance is nonbinding; the sections it cites are not.

Which CFR sections does FDA cite for data integrity?

FDA cites data integrity mainly under 21 CFR 211.68(b), 211.194(a), 211.188, 211.180, 211.100(b) and, for PET drugs, 212.110(b) and 212.60(g). The 2018 guidance lists these as the Part 211 and 212 requirements "with respect to data integrity". The table pairs each with what it requires and how often it appeared in the Atlas sample.

The attribute column follows footnote 5 of the guidance, which maps each ALCOA letter to its regulations. 211.68(b) dominates for a simple reason: its text covers access control, change control over master records, input and output checks and backups in one paragraph. Of the 211.68(b) observations in the sample, 108 carry FDA's short title "Computer control of master formula records", 11 "input/output verification" and 10 relate to backup data or backup files. You can read the regulation itself on eCFR.

211.180(e) is on the list because the guidance cites it for legibility. Most 211.180(e) observations in the sample are about annual product review content, not data integrity in the narrow sense, so we exclude it from the headline rate.

What is ALCOA+?

ALCOA+ is a data integrity framework that extends FDA's five ALCOA attributes (attributable, legible, contemporaneously recorded, original or a true copy, accurate) with four more: complete, consistent, enduring and available. FDA's 2018 guidance uses ALCOA only. The "plus" attributes come from European and WHO data integrity guidance, though FDA's definition already requires data to be complete and consistent.

The section mapping for the five ALCOA rows follows FDA's footnote; the ALCOA+ rows are our mapping. The guidance also defines an audit trail as "a secure, computer-generated, time-stamped electronic record" that lets a reviewer reconstruct the creation, modification or deletion of a record. For an HPLC run, FDA expects the user name, run date and time, integration parameters and any reprocessing to be captured. Our guide to OQ audit trail tests for computerized system validation shows how to prove those controls work before an investigator checks them.

How common are data integrity findings in 2025 and 2026?

Data integrity findings appeared on about one in four CGMP drug Form 483s in 2025 and 2026. In the Atlas Form 483 directory (release of August 15, 2026), 192 of 779 human drug 483s citing Part 211 from January 2025 to July 2026 (24.6%) cited 21 CFR 211.68(b) or 211.194(a). Across all 1,059 human drug 483s, including clinical investigator and PET forms, the rate is 18.1%.

Three readings hold up. First, 211.68(b) is steady at about one form in six in both years, while 211.194(a) climbed in 2026; incomplete laboratory data is now cited almost as often as computer controls. Second, foreign facilities draw 211.68(b) more often (21.4% against 15.2% in the US). Third, data integrity forms are larger: an average of 5.7 observations and a median of 5, against 3.2 and 3 for the rest, because a broken record system tends to show up in the lab, in production and in the quality unit at once.

India is in line with the overall rate: 17 of 74 Indian Part 211 forms (23.0%). The China sample is too small to compare, 3 of 11 forms. For how foreign inspections are scheduled and announced, see our piece on FDA foreign inspections.

As a cross-check, our earlier sample of 90 late-2025 human drug 483s found 211.68 on 17%. In the full July to December 2025 set, 211.68 in any paragraph appears on 57 of 361 human drug forms (15.8%), close to that figure.

Atlas

See what the FDA knows about your next investigator.

30 minutes with the founder. No pitch deck.

See it live

Which recent Form 483s cite data integrity sections?

These Form 483s from 2025 and 2026 carry data integrity citations in their public observation detail. We hold the structured citations; the verbatim observation text sits in the source PDF.

Pace Analytical is the cleanest case: a two-observation form where both observations are data integrity sections, at a contract testing laboratory. Janssen Ortho and Silgan Unicep show the most common pairing in the sample, computer controls plus a laboratory record finding; 19 forms cited both 211.68(b) and 211.194(a). At Eugia and Apotex the data integrity citation sits inside a larger sterile manufacturing form, which matches the higher observation counts above. For a longer view of how repeat citations build up at one Indian manufacturer, see our Hetero Labs inspection history.

Why does FDA cite 211.68(b) and not Part 11?

FDA cites 211.68(b) rather than 21 CFR Part 11 because Part 11 governs how electronic records and signatures are created and controlled, while the duty to keep complete, accurate, secure CGMP records comes from the predicate rules in Parts 211 and 212. The 2018 guidance makes the same split: it refers readers to FDA's separate Part 11 scope guidance and grounds its answers in Parts 211 and 212.

The sample bears this out. None of the structured citations on 1,059 human drug 483s from January 2025 to July 2026 named Part 11. If your remediation plan is organized around Part 11 clauses, map it back to 211.68(b), 211.188 and 211.194(a), because those are the lines a 483 response has to answer. Our comparison of CSA vs CSV covers how much validation evidence each computerized system needs under a risk-based approach.

What should a quality team check before the next inspection?

A quality team can test its exposure to a data integrity citation with seven checks drawn from the questions in FDA's 2018 guidance:

1. Every user on a CGMP computer system has a unique login; shared accounts are read-only (guidance question 5).
2. The system administrator role sits with someone independent of the people who generate the data (question 4).
3. Audit trails are on, and reviewed at the same frequency as the data they cover, for example before batch release (questions 7 and 8).
4. Reprocessed chromatography keeps every result, not only the final one, under a written procedure (question 14).
5. No actual samples are used in system suitability, test or equilibration runs as a way to test into compliance (question 13).
6. Blank forms and notebooks are issued and reconciled by document control (question 6).
7. Backups are true copies, secure from alteration and retained for the full record period (question 1e).

Documentation gaps outside the computer system matter too. Our review of documentation failures FDA flagged in 2024 and 2025 covers batch records, logbooks and SOPs.

Atlas

FDA Inspection Intelligence Digest

We track every 483, EIR, and warning letter the moment it happens. Get the signals before they hit the FDA website.

Subscribe