# An audit trail a monitor can verify offline

A monitor recomputes the export's hash chain on their own computer and compares it with fingerprints written down at earlier visits.

Canonical: https://signalment.app/guides/an-audit-trail-a-monitor-can-verify-offline/
Updated: 2026-11-02

A monitor can check study records without trusting the software vendor when the export carries its own proof. Every record and every audit entry gets a hash, a short fingerprint of its contents, and each hash covers the entry before it, so the entries form a chain. With the export and a written description of the method, the monitor recomputes every hash on their own computer, with no account and no network. If a value, a name, a time or a reason changed after the fact, the hashes stop matching. Because a chain cannot show by itself that nobody rebuilt it, the monitor also writes the latest fingerprint into each visit report and checks that the next export still passes through it.

## What the rules ask of an audit trail

21 CFR Part 11 applies to electronic records kept under any FDA records requirement and to electronic records submitted to FDA (11.1(b)). Section 11.10(e) asks for "secure, computer-generated, time-stamped audit trails" and says "record changes shall not obscure previously recorded information"; the trail is kept at least as long as the records and is available for FDA to review and copy. Section 11.10(b) asks for accurate and complete copies in human-readable and electronic form, suitable for inspection. Section 11.50 says a signed record shows the signer's printed name, the date and time, and the meaning of the signature, and 11.70 links each signature to its record so it "cannot be excised, copied, or otherwise transferred" to falsify another.

FDA's October 2024 questions-and-answers guidance on electronic systems in clinical investigations, co-issued by CVM and covering new animal drugs, fills in the fields. Under Q12 an audit trail must hold the date and time of each entry or change, who made it (for example user ID and role) and the old and new value; it should hold the reason and "should be protected from modification and from being disabled", and FDA recommends keeping it searchable and sortable. Q14 asks for the time zone of the time stamps when a study spans zones. Q5 says FDA may ask for all records needed to reconstruct a study, audit trails included, and that when a hosted system's contract ends the sponsor should keep the metadata linked to each data element.

For veterinary studies meant for FDA, Guidance #85 (VICH GL9) section 8.3.6 says data entered directly into a computer are the raw data, each entry and change is made under the electronic signature of the person entering it, and changes are kept in an audit trail. Guidance #287 (June 2025) asks for the audit trail to be submitted with raw data collected by an EDC system, in an acceptable eSubmitter file format, and says CVM "will verify the study conduct by evaluating the raw data" (sections III and IV).

## Why the vendor's own screen is not enough

GL9 section 5 makes verifying the data the monitor's job: ensure all data are correctly and completely recorded (5.2.9), ensure corrections are fully explained (5.2.10), and review the raw data against the protocol and the investigator's records (5.2.12). Section 3.1.5 keeps monitor and investigator separate people. The 2024 guidance, section III.C, says regulated entities using an IT service provider "are responsible for ensuring that electronic records meet applicable part 11 requirements", and FDA neither pre-evaluates EDC systems (Q16) nor certifies signature methods (Q28). An audit trail shown by the system that keeps it is that system's account of itself. An export the monitor can recompute stands apart from it.

## How the offline check works

Change one character in a record and its hash changes. Because each audit entry's hash includes the previous one, an edit, a deletion or a reordering anywhere breaks every hash after it. A database lock adds one fingerprint over the whole locked dataset.

The monitor needs two things from the vendor: the export, and a written description of how each hash is computed, precise enough that someone at the CRO could write their own checker. A checker the monitor cannot read is one more thing to trust.

A chain that verifies proves the export agrees with itself, not that it is the export the site saw last month: whoever controls a database could, in principle, rewrite a record and recompute every hash after it. The anchor closes that gap. A fingerprint written into the monitor's signed visit report, or into the sponsor's file at lock, is held outside the vendor. If the next export does not pass through it, something before it changed.

## What to ask for and what to check

1. Before enrollment, ask the sponsor which electronic systems the study uses and for the written agreement with the provider; the 2024 guidance expects the systems documented (Q8) and an agreement with a plan for access to the data through the retention period (Q17).
2. Ask for a test export. Confirm it holds every record and version, every audit entry with time and time zone, user and role, old value, new value and reason, and every signature with name, time and meaning.
3. Ask for the hash method in writing and run your own check on the test export.
4. At each visit, take a fresh export, recompute it, and write the latest audit fingerprint into your signed visit report.
5. At the next visit, confirm the new chain passes through that fingerprint and that each change since carries a reason.
6. At lock, record the lock fingerprint in the sponsor's file and recompute it from the final export.
7. Keep doing what a hash cannot: compare records with the clinic's source, read the corrections, and confirm consent was recorded before each animal took part (GL9 5.2.8).

## How the study design changes the answer

| Design | Which rules reach the records | What the offline check adds |
|---|---|---|
| Observational, nothing assigned | Usually none: Part 11 needs an FDA records requirement (11.1(b)); GL9 excludes studies not meant for regulatory support (2.6) | Records that can be relied on later; Q12 calls audit trails important even where no predicate rule asks for one |
| Approved product used on its label | Part 11 and GL9 if the data go to FDA (11.1(b) reaches records submitted to FDA) | The audit trail Guidance #287 asks for, already checked |
| Unapproved product under an INAD | 21 CFR 511.1: complete records kept two years after the study ends or the drug is approved ((b)(7)(ii), (b)(8)(i)) and "current monitoring" by a qualified person ((b)(8)(ii)); Part 11 applies (2024 guidance, Q2) | A check the monitor can rerun at an inspection years later |

## Signalment's export

Signalment keeps an append-only, hash-chained audit trail and exports it with the fingerprints, so a monitor verifies it offline. The JSON bundle carries the full audit trail; signatures re-check the signer's password and bind to the hash of what was signed; the lock has its own fingerprint; CSV exports per form and a data dictionary come with it. Owner identities are held apart from study data and never appear in a pseudonymous export. There is no SAS or SEND export yet, so ask CVM which formats your submission needs. Offline means the check, not the data entry: offline capture is not built. More for sponsors and CROs: [signalment.app/sponsors](https://signalment.app/sponsors/).

## What stays with the sponsor and the investigator

Signalment is a data system. The protocol and monitoring plan, the choice of monitor, the ethics review, the content of the owner's consent, the INAD file, adverse event reporting and any submission to FDA stay the sponsor's and the investigator's work, as do the letter certifying to FDA that the organization's electronic signatures are the legally binding equivalent of handwritten ones (2024 guidance, Q29) and the agreement with any IT service provider. An offline check shows records were not altered after they were written. It does not show they were right when written; that is still source verification, done by a person. For closing the database, see [How to lock a study database](/guides/how-to-lock-a-study-database/).

## Sources

- 21 CFR Part 11, electronic records and electronic signatures: https://www.ecfr.gov/current/title-21/part-11
- 21 CFR 511.1, new animal drugs for investigational use: https://www.ecfr.gov/current/title-21/section-511.1
- FDA, Electronic Systems, Electronic Records, and Electronic Signatures in Clinical Investigations: Questions and Answers (October 2024): https://www.fda.gov/media/166215/download
- FDA Guidance #85, VICH GL9, Good Clinical Practice: https://www.fda.gov/media/70333/download
- FDA Guidance #287, Raw Data for Safety and Effectiveness Studies (June 2025): https://www.fda.gov/media/177901/download