Take the tour Book a demo

MHRA data integrityUK · GxP guidance

MHRA data integrity, designed into the record.

MHRA data integrity expectations apply to every GxP record, paper or electronic. Swat iQua Suite supports them with attributable, reviewed and protected data — on a platform UK QC laboratories have run since 2016.

  • Attributable actions with a reason for every change
  • Risk-based periodic audit trail review
  • Original files kept unaltered as raw data
  • Controlled paper copies for hybrid records
Book a free demo ALCOA+ principles
Scientist pipetting a sample in a QC laboratory

Real product footage

Watch an audit-trail review turn a finding into a CAPA.

The guidance

What the MHRA GxP data integrity guidance expects.

The MHRA published its “GXP” Data Integrity Guidance and Definitions (revision 1) in March 2018. It applies across GMP, GCP, GLP, GDP and pharmacovigilance, and it is the reference point for data integrity during UK GMP inspections.

The guidance describes data integrity as the degree to which data are complete, consistent, accurate, trustworthy and reliable throughout the data lifecycle. It does not prescribe technology. Instead it asks organisations to understand their data, assess its criticality and risk, and put proportionate controls in place — organisational as well as technical. The arrangements that make this work are called data governance.

Key expectations

  • Data governance — the sum of arrangements, including culture, that ensure data are recorded, processed, retained and used to give a complete, consistent and accurate record throughout the data lifecycle.
  • Data criticality and risk — controls proportionate to how much the data matters to product quality and patient safety, and how vulnerable it is to unauthorised change.
  • ALCOA+ — data that are attributable, legible, contemporaneous, original and accurate, and also complete, consistent, enduring and available.
  • Original records and true copies — the first capture of data, or a verified copy that keeps its content, meaning and metadata.
  • Audit trails and their review — audit trails for GxP-relevant changes, reviewed as part of routine data review, with a risk-based approach to frequency.
  • Access and system administration — individual user accounts, access appropriate to the role, and system administrator rights restricted and, where possible, independent of the people who generate the data.
  • Data review and approval — a documented process for reviewing data, including relevant metadata, before it is used to make decisions.
  • Hybrid systems, data transfer and archiving — controls where paper and electronic records combine, where data moves between systems, and where it is retained for the long term.

What an MHRA inspector looks for

In practice, UK GMP inspectors follow the data. They pick a result or a batch, ask to see the raw data and its metadata, check who did what and when, look at audit trails around key decisions, test whether shared logins or uncontrolled spreadsheets exist, and ask how your QA team reviews audit trails. Data integrity observations often arise when a system allows changes without a reason, lets the person who produced a result approve it, or keeps the original data somewhere nobody reviews.

Requirement → control

How Swat iQua Suite supports MHRA data integrity expectations.

  • Audit trail with a reason

    Every write and its audit-trail entry commit together — old and new value, user, site, time and a mandatory reason. A cross-module report shows the record and related records up to two levels deep.

  • Risk-based audit trail review

    Review plans with scope and cadence; automatic signals for deletions, privileged and configuration changes, after-hours activity and changes after approval.

  • Independent review

    Second-person raw data review where the reviewer cannot be the analyst — no administrator bypass. A finding raises a deviation.

  • Original data preserved

    Instrument and spreadsheet files enter through approved import profiles; the original is stored unaltered with a SHA-256 hash and downloaded only under control.

  • Individual, role-based access

    Named accounts, a permission matrix per site, MFA, lockout and logged permission changes. Only internal users can perform GMP actions.

  • True copies & retention

    Controlled PDF prints with historical signature blocks, logged Excel exports protected against formula injection, scheduled backups and automatic log archiving.

Hybrid systems

Paper copies that stay under control.

The MHRA guidance gives specific attention to hybrid systems, where paper and electronic records combine. Swat iQua Suite controls the paper copies of a batch record rather than ignoring them.

  • Controlled-copy number — on every issued copy.
  • One-shot print — a SHA-256 checksum is frozen at print; a re-print is refused and a fresh copy must be issued.
  • Reconciliation — each returned copy is checked and reconciled against the electronic record, with a note.
  • Close gate — the batch cannot close until its copy is reconciled or archived, and the QA archive is e-signed.
Hybrid batch records
Electronic batch record with a reconciled controlled paper copy

Customer stories

UK laboratories, inspection after inspection.

“Ten years on, we would choose it again.”

We moved our QC LIMS onto SwatTech in 2016 and have never looked back. Every specification, result and calibration is one search away, and every change explains itself. When inspectors arrive, we don’t prepare — we simply open the system.

ARC Pharma UK LimitedUnited Kingdom · QC laboratory, since 2016

“Audits are something we welcome now.”

In contract testing, our reputation rides on every result we sign. A second-person review on every result, a complete audit trail and a client portal that delivers reports and CoAs on time have turned audits from something we braced for into something we welcome.

Lunar Labs LimitedUnited Kingdom · QC laboratory

“Any batch, traced in one click.”

In API manufacturing, traceability is everything. Today we follow any batch back to its raw-material lots and forward to every shipment in seconds. Revised Schedule M no longer feels like a deadline — it feels like the way we already work.

Norvium Healthcare Pvt. Ltd.India · API manufacturing

Shared responsibility

Data governance is yours to lead.

The MHRA is clear that data integrity is a management responsibility. Swat iQua Suite gives you controls that make good practice the default; your organisation builds the culture and procedures around them.

  • Data criticality and risk assessment — deciding which data and audit trails matter most, and how often they are reviewed.
  • Procedures — data review, audit trail review, true-copy verification, archiving and the handling of paper records.
  • System administration — assigning administrator rights to people independent of data generation, wherever your organisation’s size allows.
  • Culture and training — an open, no-blame reporting culture and staff who understand why the controls exist.
  • Validation and periodic review — validating your installation and reviewing it over time. We support you with requirements traceability and our team.

Swat iQua Suite is designed to comply with EU GMP Annex 11 and 21 CFR Part 11 and follows ALCOA+ data-integrity principles — the same controls support the MHRA guidance.

Keep exploring

Related regulations

FAQ

Frequently asked questions

Can’t find your answer? Talk to our team — we reply within one business day.

Does Swat iQua Suite meet the MHRA data integrity guidance?

Swat iQua Suite is designed to support the MHRA GxP data integrity guidance: attributable changes with reasons, risk-based audit trail review, independent second-person review, preserved original data and controlled hybrid records. Meeting the guidance also depends on your data governance, procedures and culture.

Which UK customers use Swat iQua Suite?

ARC Pharma UK Limited has run its QC laboratory on Swat iQua Suite since 2016, and Lunar Labs Limited runs its contract testing laboratory on it. Both are UK QC laboratories.

How often should audit trails be reviewed?

The guidance expects a risk-based approach, with audit trail review as part of routine data review for critical data. Swat iQua Suite lets you set review plans by scope and cadence, and highlights the highest-risk signals automatically.

Can analysts delete or overwrite results?

Results lock once submitted. Corrections never overwrite: the original is kept, and the correction needs a reason and, where configured, an e-signature. Deletions and voids are flagged as a risk signal in audit trail review.

How are instrument results handled without interfacing?

Results enter through approved Excel/CSV import profiles or the REST API. Each import is previewed, committed with a reason, the original file is stored unaltered as raw data, and every value is reviewed before it counts.

Ready to see Swat iQua Suite in action?

Book a free, personalised demo and see how Swat iQua Suite takes your plants, labs and quality teams from paper to inspection-ready.

Download the brochure →