What FDA’s Curia Warning Letter Means for Data Integrity Remediation

The Scope Is Bigger Than the Finding

Curia’s own review of credential sharing covered 12 stand-alone instruments over one year. FDA wanted every login-protected system at all facilities, an independent assessment covering three years, and a written justification for anything left out.

For any manufacturer, the first deliverable is an inventory QA can defend. List every system that creates, changes, reviews, or keeps regulated records: CDS, LIMS, stand-alone instruments, electronic batch records, MES. A QMS like Veeva Vault QMS, MasterControl, or TrackWise will track the deviations and CAPAs, but the evidence usually lives somewhere else.

For each workflow, trace an original result through any reprocessing to the decision it supported. Watch for paper copies and exports that drop the electronic history. At Curia, reviewers checked photocopies of notebook pages, then signed off on the originals. FDA’s data integrity guidance is clear that a static printout of a dynamic record may not be enough to reconstruct what happened.

Fixing Access Doesn’t Explain the Past

Curia stopped trial injections and pulled the Developer role. FDA acknowledged both and still found the response inadequate, because the company hadn’t investigated all of the earlier injections or explained why analysts used that role.

Those are two different jobs. A historical investigation works out what happened and whether past product decisions still hold up. It needs an approved protocol, a defined lookback period, preserved source data, lab SMEs who can read chromatograms, and QA to make the product-impact call. Control repair changes the conditions that allowed the problem: shared accounts, elevated privileges, disabled audit trails. Some of those changes should wait until the electronic evidence is captured.

Training won’t substitute for an access restriction the software can enforce, and a new SOP won’t recreate records that were never kept.

Every Fix Creates Validation Work

Remove elevated access from analyst accounts and you’ve changed a validated system. The validation work has to confirm analysts can still run approved tests, can’t make unauthorized changes, and that authorized changes land in an audit trail someone actually reviews. FDA’s guidance ties validation to the workflow, with testing scaled to risk.

A platform administrator can show that a setting changed. A process owner has to show the regulated activity still works. Effectiveness checks belong to the permanent team, since contractors leave when the project does.

Who Does the Work

Break the remediation into packages before writing requisitions. These skills rarely sit in one person:

• Quality investigation lead. Owns scope, deviation and CAPA decisions, and product risk. Usually senior Quality, or an independent investigator where FDA asked for a third party.
• Data integrity or CSV specialist. Designs audit-trail and access controls, writes risk-based test protocols, assembles the evidence. Hands-on experience with the regulated workflow beats familiarity with a template.
• CDS or LIMS administrator. Pulls native records, maps privileges, implements approved changes.
• Laboratory SME. Separates legitimate testing from unexplained events.
• Project coordinator or records analyst. Runs the evidence register so QA and validation staff aren’t chasing files.

The hardest seat to fill is someone who can work with native electronic records and explain their GMP significance. An administrator can export an audit trail without knowing which events need investigating. A QA reviewer knows the risk but may need help extracting the history.

The Curia letter asks for both short-term and permanent help. FDA recommended qualified third parties for the employee interviews and the retrospective review. It also asked Curia to confirm it would hire a data integrity compliance officer with authority to receive anonymous reports and trigger independent investigations.

Timelines vary with scope. A contained gap with accessible records can be scoped and corrected in a few weeks. A multi-site retrospective with older archives takes months, and validation and CAPA effectiveness checks run on after that.

Staffing a Data Integrity Remediation With HealthTECH

HealthTECH’s Pharma & Life Sciences IT staffing team recruits for each of the roles above, from contract CSV specialists and CDS administrators for a defined remediation to permanent data integrity hires when the project uncovers a standing gap. We work on contract, contract-to-hire, or direct hire.

Send us your scope below, and we’ll come back with a role-by-role breakdown and sample rates, so you can see how the work would be staffed before you commit to anything.