Appropriate controls are not exercised over computers or related systems to assure that changes in analytical methods or other control records are instituted only by authorized personnel [21 CFR § 211.68(b)]. Specifically:
a) Laboratory managers (QC and R&D) gained access to the [redacted] computer system through a common password. Analysts were not required to use individual passwords; they operated the system following the login by the laboratory managers.
b) Due to the common password and lack of varying security levels, any analyst or manager has access to, and can modify any HPLC analytical method or record. Furthermore, review of audit trails is not required.
View the original warning letter.