Can you assess one process or one utility system?

Yes. We define the process boundaries and map the associated data and controls. Interfaces with other systems remain visible so relevant handoff risks are considered.

How is the RPN calculated?

RPN equals severity multiplied by probability multiplied by detectability, using your approved scoring definitions. Existing controls inform probability and detectability. We document the rationale and classify each risk using the applicable thresholds.

What happens when a risk is high?

High risks require action. We recommend controls to reduce the risk, identify interim measures where needed, and define CAPA recommendations through your quality process. Your quality team approves the actions and acceptance decisions.

Do medium and low risks always require CAPA?

Medium risks require a documented acceptance decision; unacceptable risks need action through the applicable CAPA process. Low risks are generally acceptable without further action, although improvement recommendations may still be useful.

What is covered by a data integrity lifecycle assessment?

The assessment follows data from creation through use, review, transfer, retention, and retrieval within the agreed scope. Keeping it current also requires review when relevant changes, quality events, or scheduled reviews occur.

How often should we update the assessment?

Use the interval defined by your quality procedures and the process risk. Review it sooner when changes or quality events could affect the data flow, existing controls, or risk conclusions.

Does a lower proposed RPN mean the risk is closed?

No. A proposed score describes anticipated residual risk. Closure requires evidence that actions were implemented and their effectiveness evaluated, followed by the required site approval.

Will you review every record or replace system validation?

Record review follows an agreed sampling scope unless a complete review is specified. A data integrity assessment does not replace computerized system validation; findings may identify additional validation work.

What do you need from our team?

We need process and system owners, relevant procedures, available maps, representative records, and controlled access to evidence of system settings and working practices. We agree on access and scheduling before work begins.

DATA INTEGRITY / PROCESS TO CONTROLS

Data Integrity Assessment & Remediation

Know where your process puts data at risk and which controls need to improve.

SOLVE provides data integrity assessment services for manufacturing, utility equipment, and laboratory processes. We map the process and its data, assess technical, procedural, and behavioral controls, and score each identified risk using a Risk Priority Number (RPN).

Control Assessment

Data risks · Controls

Process-led assessment

Risks located at the steps where they arise

Three control perspectives

Technical, procedural and behavioral

Documented decisions

Risk acceptance, actions and review needs

01/ Assessment scope

02 / When to access

03 / Our process

04/ Deliverables

05/ Pricing & Quote

06/ FAQs

01 ASSESSMENT SCOPE

What can we assess?

A GMP data integrity assessment follows the data through the selected process, from its source and recording to review, transfer, storage, and retrieval.

01/ ASSESSMENT AREA

Process and data flo

Process steps, data sources, inputs, outputs, owners, and handoffs between paper records and electronic systems.

03/ ASSESSMENT AREA

Procedural control

Training, demonstrated understanding, actual recording practices, and whether personnel follow the controls during routine work

05/ ASSESSMENT AREA

Risk and acceptance

Severity, probability, detectability, RPN, risk classification, acceptance rationale, and the actions required for each identified risk

02/ ASSESSMENT AREA

Technical controls

Individual accounts, access permissions, system settings, audit trails, data transfer checks, and backup or retrieval controls.

04/ ASSESSMENT AREA

Behavioral controls

Training, demonstrated understanding, actual recording practices, and whether personnel follow the controls during routine work

AGREED IN YOUR PROTOCOL

Focused gap assessment

Need a focused data integrity gap assessment? Share the process or equipment you want reviewed, existing concerns, and available procedures.

ALCOA+ principles applied to each process

An ALCOA+ data integrity assessment evaluates whether records are attributable, legible, contemporaneous, original, and accurate, as well as complete, consistent, enduring, and available.

We connect these principles to the actual process steps and controls. Your assessment shows where a weakness occurs, which data it affects, and how the risk should be addressed.

02 STUDY THE FULL SPACE

Why map the process before scoring risk?

A missing entry or shared account is part of a wider workflow. Process mapping shows where data originates, how it changes hands, and which controls protect the decisions made from it.

Locate risks at the process steps where they arise

Distinguish controls that exist on paper from controls used in practice

Give QA and process owners a documented basis for action and acceptance

When do you need temperature mapping?

Start with a baseline assessment for an unassessed process. Keep the assessment current through defined review intervals and event-based review under your quality procedures.

New equipment and validation

Assess data flows and controls when introducing equipment or systems, or as part of relevant qualification and validation activities.

Changes to the process or its controls

Review the assessment when software, interfaces, data flows, permissions, procedures, responsibilities, or retention arrangements change.

CAPA and quality events

Revisit affected risks after discrepancies, deviations, audit findings, or CAPA. Periodic review should also consider whether existing controls remain effective.

Prepare for the assessment

Bring the people and evidence needed to understand both the documented process and routine practice.

Process and system owners, with agreed assessment boundaries

Available process maps, procedures and representative records

Controlled access to relevant settings and working practices

Your approved scoring matrix and risk acceptance criteria

Existing findings, changes, deviations or CAPA relevant to the scope

03 MAP, ASSESS & FOLLOW THROUGH

How SOLVE performs the work?

01

Define and map the process

Agree on scope, boundaries, records, and stakeholders. Map process steps, data sources, inputs, outputs, transfers, and ownership with your team.

02

Identify risks and existing controls

Assign risks to the relevant steps. Review technical, procedural, and behavioral controls against procedures, demonstrations, observations, and selected records.

03

Calculate and classify current risk

Perform a data integrity risk assessment using your approved scoring matrix. Document severity, probability, detectability, RPN, classification, and rating rationale for each risk.

04

Determine acceptance and actions

Document the acceptance decision. Define risk reduction or CAPA recommendations for unacceptable risks, including interim controls where needed, proposed owners, and closure evidence.

05

Document residual risk and review needs

Estimate risk after the proposed controls and define follow-up checks. Confirm achieved risk reduction through implementation evidence and effectiveness review within the agreed scope.

SOLVE

Map & Assess

Link risks to process steps and evidence. Document control coverage, scoring rationale and recommended actions.

YOUR QUALITY TEAM

Approve Decisions

Approve risk acceptance, CAPA and closure through your site’s quality procedures.

AGREED FOLLOW-UP

Verify Improvements

Assess implementation evidence and effectiveness within the agreed scope before confirming achieved risk reduction.

A proposed lower RPN is not closure. Anticipated residual risk must be distinguished from achieved risk reduction supported by implementation evidence, effectiveness review and site approval.

04 A DOCUMENTED BASIS FOR ACTION

What you recieve?

Your team receives a documented risk classification, an acceptance rationale, and specific recommendations for risk reduction or CAPA where needed.

A process and data map showing the assessed steps, records, transfers, and owners

A risk and control register linking each risk to technical, procedural, and behavioral controls

An RPN assessment with scoring rationale, risk classifications, and acceptance decisions

An action plan with recommendations, proposed responsibilities, interim measures where needed, and anticipated residual risk

An assessment report and review documenting conclusions, limitations, and future review needs

The assessment reflects the agreed scope and available evidence. Your process owner and quality team approve risk acceptance, CAPA, and closure decisions.

FROM PROCESS STEP TO FOLLOW-UP

FOR DEMONSTRATION PURPOSE ONLY

How your findings can be organized

Traceable assessment

Connect each risk to a process step, affected data, existing controls and supporting evidence.

Visible action status

Separate recommendations, anticipated residual risk and verified closure.

This outline contains no actual findings, scores, risk classifications or acceptance decisions. Your approved matrix, available evidence and agreed scope govern the assessment.

YOUR APPLICATION

Assessment for your operation

Manufacturing and utility equipment

A manufacturing data integrity assessment can cover weighing, preparation, process readings, equipment logs, transfers, and cleaning records. Utility assessments follow operating, monitoring, and maintenance data through the relevant equipment process.

Laboratory workflows

A laboratory data integrity assessment maps sample identification, instrument output, calculations, result reporting, and review, including links between original data and reported results.

Remediation and inspection support

Our data integrity remediation services can support procedure revisions, control improvements, and effectiveness checks. Data integrity audit services and data integrity inspection readiness support can focus on assessment evidence, unresolved risks, and action status. Implementation and follow-up are defined in your quotation.

Data integrity support in California

SOLVE provides pharmaceutical data integrity consulting in California, including GMP data integrity assessment support in the San Francisco Bay Area. Work with a data integrity consultant in California to define the onsite and remote activities your process requires.

05 SCOPE-BASED PRICING

What does a data integrity assessment cost?

Cost depends on process complexity, equipment and systems, data interfaces, available documentation, site access, and follow-up requirements. Your quote defines the assessment boundaries, review coverage, deliverables, and remediation support included.

Start with the process you need assessed

Send your site location, process or equipment list, reason for assessment, available maps and procedures, and target date. Include existing findings or CAPA where relevant.

CAT Frequently asked questions

Ready to assess your process?

Tell us which process or equipment you want assessed and what is driving the review. We will define the mapping, control review, risk scoring, and deliverables for your project.