Pharma: facility integrity records under GMP scrutiny

In most industries the integrity record is read by integrity engineers and, occasionally, by a jurisdictional inspector. In a pharmaceutical facility it is read by the quality unit, by corporate auditors, and by regulators whose concern is the product, and who bring the standards of GMP data integrity to everything they see. A perfectly good UT survey of a jacketed vessel can fail an audit because the record does not show who took the readings, whether it was changed afterward, or which version of the form was in use. This paper is about what pharmaceutical facility inspection software has to do to stand up to that scrutiny.

What does 21 CFR Part 11 ask of an electronic inspection record?

Part 11 sets the conditions under which FDA accepts electronic records and electronic signatures as equivalent to paper and handwritten signatures. It applies wherever a predicate rule (the GMP regulations) requires a record to be kept, and facility integrity records for product-contact equipment and clean utilities fall inside that boundary in most quality systems.

The requirements that shape the software:

• Audit trails that are secure, computer-generated, and time-stamped, that record the creation, modification, and deletion of records, and that do not obscure previously recorded information.
• Limited system access with unique user identities, so every entry is attributable to a person.
• Electronic signatures that are unique to the individual, linked to their record so they cannot be moved, and that display the printed name, the date and time, and the meaning of the signature.
• Record retention and copies, with the ability to produce accurate and complete copies in human-readable and electronic form for inspection.
• Validation of the system to ensure accuracy, reliability, and consistent intended performance.

The last item is the operator's obligation, not the vendor's. A vendor can supply the mechanisms; it cannot supply a validated state for a specific facility's intended use. Any claim otherwise should be treated with suspicion.

intelliSPEC supplies the mechanisms as follows. Every create, read, update, delete, login, permission denied, data export and import, and system change is recorded with actor, tenant, request id, IP, and user agent, and events are chained per tenant with SHA-256 hashes (previous hash plus event hash). A verify routine recomputes the chain so an auditor can confirm nothing was removed, and audit events are never auto-deleted. Identity is individual: SSO via OpenID Connect (Microsoft Entra, Entra B2C, Okta, and generic OIDC), with TOTP MFA and recovery codes. The signature widget records per-signer identity on a shared device, and the workflow includes owner sign-off as a distinct transition.

How should attribution and signatures work on the shop floor?

Facility inspection in a GMP plant happens in gowned areas, on shared tablets, often by contract technicians. The Part 11 problem is that a shared device defaults to a shared identity, and a shared identity voids attribution.

The behaviors to require:

• Each user authenticates individually, and the record shows who was signed in for each entry.
• A signature is captured by the individual signer, with the signature record carrying their identity, the timestamp, and the meaning of the signature.
• Once signed, the record is locked against unattributed change, and any amendment creates a new audit entry that preserves the original.
• Reviews and approvals are distinct signatures from performance, so "performed by" and "reviewed by" are separately attributable.

intelliSPEC provides 13 workflow transitions, including submit, approve, reject, hold, resume, reopen, and owner sign-off, so the performance, review, and approval steps are separate, attributable events. Permission changes invalidate stale tokens, so a user whose role changes cannot continue under the old authority. Seven default roles per tenant, custom roles, and role templates let the quality unit define who may perform and who may approve, and there are two segregation-of-duties rules today: no self-elevation to tenant admin, and a calculator author cannot approve their own calculator.

What does ASME BPE ask the equipment to keep in service?

ASME BPE is the standard for bioprocessing equipment, and it defines the hygienic condition the equipment was built to: materials and their certification, surface finish (with Ra limits for product-contact surfaces), orbital welding with defined acceptance criteria, drainability and slope, dead leg limits, and passivation. In service, the integrity question is whether the equipment still meets that condition, and the inspection record has to cover more than wall thickness:

• Surface finish verification and any degradation or mechanical damage to product-contact surfaces.
• Weld condition on product-contact welds, including any rework.
• Rouge classification and derouging or repassivation history on high-purity water and clean steam systems.
• Gasket and seal condition and material traceability at hygienic connections.
• Drainability and dead leg checks after modifications.

The record therefore needs configurable inspection forms, because BPE inspections do not fit the CML template. intelliSPEC is metadata-driven: forms and workflows are configured by the tenant through the form designer, not through code. Photo capture binds images to the component at capture time, and PDF and drawing annotation lets a weld map or isometric be marked with the inspected joints. The asset hierarchy is a graph with roles down to the weld, so product-contact welds can be records with their own history.

Where does conventional pressure equipment integrity fit?

A pharmaceutical facility also has conventional pressure equipment: jacketed reactors and bioreactors under ASME VIII Div 1, autoclaves, clean steam generators, air receivers, and utility piping. These carry the same thickness monitoring and interval obligations as any plant, and the jurisdiction may require inspections in addition to the quality unit's.

For that equipment intelliSPEC's intelliINTEGRITY module computes tMin by routing to ASME VIII Div 1 for vessels and ASME B31.3 for piping and returns the design code and formula with the number. CML points carry 64 fields including tMin and its method, design pressure, material, allowable stress, joint efficiency, and three corrosion rates. Intervals are capped at half the remaining life. Instrument profiles for supported UT gauges bring readings in without retyping, which removes a transcription step the auditor would otherwise want to see controlled. NDE records run through intelliNDT and visual inspections through intelliINSPECT.

How does configuration change control work?

Here is the failure mode that makes quality auditors nervous about configurable software: if the form can be changed, how do you know what the record looked like when it was signed? A change to a dropdown option or a field label after the fact can alter the meaning of a completed record.

Two things have to be true:

1. Changes to forms and workflows are controlled events, attributable in the audit trail, so the quality unit can treat them as change control.
2. Completed records keep the exact form they were executed with, so the change has no effect on what has already been signed.

In intelliSPEC, system change events are recorded in the audit trail with the actor, and completed records pin their field configuration, locale, and reference options and render forever as executed. Together these mean the quality unit can approve a form revision, see who made it and when, and rely on every previously signed record remaining unchanged in appearance and meaning. Per-locale date formats and localization in English, Spanish, French, and Arabic also matter in global manufacturing networks where the same form is used at several sites.

What does the IT and quality reviewer need to see?

A pharma software review is run jointly by IT, security, and the quality unit, and the questions cross the boundaries between them:

• How is tenant data isolated? intelliSPEC enforces isolation at the repository chokepoint: writes with a mismatched tenant are rejected and logged, requests are scoped to the tenant, and audit chains are per tenant.
• How is data protected? AES-256 at rest for the database and object storage, TLS 1.2 or higher in transit, application-layer AES-256-GCM for MFA secrets, and encryption of offline columns on the device.
• What is the compliance posture? Controls are mapped to SOC 2 Trust Services Criteria and described at the Trust Center. No certification is claimed.
• How do we get our records out? Bulk export, workbook export, PDF generation from report definitions, and an OpenAPI 3.0 specification with 514 documented endpoints, with tenant self-service API keys.
• Can we handle data subject requests? Data-subject request handling is part of the reporting layer.

Records produced for the quality unit and for regulators come from report definitions with datasets and layouts, rendered as PDFs with cover, header, and footer, with tenant report branding and scheduled delivery. intelliCOMPLY is the module oriented to compliance programs and their evidence.

How intelliSPEC handles it

For a pharmaceutical facility integrity and quality team, the facts that bear on GMP scrutiny:

• A hash-chained audit trail per tenant records every event with actor, request id, IP, and user agent; a verify routine recomputes the chain; audit events are never auto-deleted.
• Individual identity through OIDC SSO and TOTP MFA; per-signer signatures on shared devices; performance, review, and approval as separate workflow transitions; permission changes invalidate stale tokens.
• Two segregation-of-duties rules, seven default roles, custom roles, and role templates.
• Metadata-driven forms configured by the tenant, with completed records pinned to the configuration they were executed with and system changes logged.
• tMin routed to ASME VIII Div 1 and ASME B31.3 with the code and formula returned; CML points carry the full basis; intervals capped at half the remaining life.
• AES-256 at rest, TLS 1.2 or higher in transit, device-side encryption offline, tenant isolation at the repository chokepoint.
• Controls mapped to SOC 2 criteria, described at the Trust Center; no certification is claimed, and validation for intended use remains the operator's responsibility.

The pharma solutions page describes the module mix for a manufacturing site. The right evaluation is to bring the quality unit to it and ask them to audit a completed record.