[ WHITE PAPER ]

Empower Software Audit Trails and Logs:

A guide to the different locations of audit trails
in Empower and what information they provide to reviewers

INTRODUCTION WHAT IS AN AUDIT TRAIL?

Audit trails are considered the key to the security of a system 21 CFR Part 11 and other electronic record regulations require
since they track changes to data and metadata. In this way, electronic audit trails for all data created, reviewed, modified,
an incomplete or absent audit trail can impact data integrity deleted, and archived. From Part 11, audit trails must be:
or even product quality. The absence of an audit trail is ■■ Operator independent – no operator or administrator may
considered to be, “highly significant when there are data change or modify in any way.
discrepancies” according to the FDA.1
■■ Computer generated (automatically).
The use of computer generated, time-stamped audit trails
■■ Date and time stamped when the individual created,
are a significant part of the Controls for Closed Systems.
modified, reviewed, approved or deleted an electronic
(§11.10(e)) for 21 CFR Part 111 as well as regulations and
record in an unambiguous format.
guidances from across the globe, covering GMP, GLP,
and GCP data. ■■ Secure – adequate security to prevent tampering.

As stated in the April 2016 OECD Guidance Number 17 for Additionally, any change actions need to be documented
Applications of GLP Principles to Computerized Systems : 2 automatically in the audit trail and the recorded changes
“An audit trail provides documentary evidence of activities must not obscure previously recorded information
that have affected the content or meaning of a record at a (i.e. record the “before” and “after” values).
specific time point.” Finally, the users are required to also record a scientific
Additionally it has become clear that while audit trail justification of “why” the changes are being made. This is
capabilities exist on most laboratory applications, they normally documented in a comment or reason field.
are often not enabled, configured correctly, or part of the ■■ Empower™ Software has the ability to discern invalid
data review or periodic review cycle in many laboratories. or altered records using entries in the project audit trail.
Regulators are keen to see that this technical control, which Changes to methods and results automatically creates
enables detection of non-desirable activity by users, and new and discrete versions of those records. This not
provides a management tool to modify users’ behavior (based only preserves the original but allows for comparison
on the degree of review of audit trails), is being utilized to by highlighting differences.
ensure data integrity in regulated companies. Moreover, they
■■ In addition, Empower provides checksum
themselves are using audit trails to review the honesty and
and cyclic redundancy check (CRC) verification for
trustworthiness of data that is being presented to them.
all human-readable and machine-readable data to
protect against data being altered by external
access to the system.

1
[ WHITE PAPER ]

As highlighted in a number of the recent guidances, audit computerized or paper based systems. It is therefore
trails consist of more than simply the table you might find important for settings to be adjusted to reflect the intended
in an application, which is labeled “Audit Trail”. use and acceptable risk of any laboratory.

For example, in the recently updated WHO TRS 996 Annex

05 3 it states “Computer-generated audit trails may include
discrete event logs, history files, database queries or reports
or other mechanisms that display events related to the
computerized system, specific electronic records or
specific data contained within the record.”

Conversely, certain kinds of logs, which record content

unrelated to a user’s creation, modification or deletion of
data and may not meet the exact requirements of an official
audit trail, may be misidentified as an audit trail. For instance,
error logs, while useful in a troubleshooting scenario, may be
simply a record of errors without the required date/time, and
user details of change and justification reasons that make
perfect sense in a true audit trail.

One final note – only in very critical clinical applications might

you find that a user viewing a record or opening
a window for read only access is actually audit trailed.
In these cases no data is created, modified or deleted.

AUDIT TRAIL CONFIGURATION

Audit trails should be enabled prior to any regulated data
being collected in an application. While this could be set
by default, it might be configured by the vendor upon
installation or it may be configured by the administrators
at the regulated company.

Software applications may allow both regulated and

non-regulated users to work in the same application but
with different audit trail settings for their specific projects.
In this kind of configuration, care should be taken to ensure
that these working practices are segregated and managed
such that regulatory data cannot be created, modified, or
deleted in non-regulated/non-audit trailed areas.

OECD Guidance Number 17 2 states quite clearly

that “The ability to make modifications to the audit trail
Figure 1 and 2. The New Project and System Audit Trail Policies for
settings should be restricted to authorized personnel.” Empower can be set by privileged users according to the intended
Additionally audit trail configuration changes should use and acceptable risk of the laboratory.

themselves be fully audit trailed.

Empower audit trail settings can never be modified once

a project is created. The Empower policies only affect the
options available for new projects. While vendors may make
suggestions about settings such as audit trail configuration,
an individual regulated company may be using the application
in a unique way, either alone or in conjunction with other

Empower Software Audit Trails and Logs 2

[ WHITE PAPER ]

AUDIT TRAIL TIME STAMPS

Time stamps for record creation as well as audit trails need to
be standardized and consistent. It is critical that time sources
are synchronized and protected from alteration by users,
managers and even administrators. It is common that time
stamps are taken from the time of the operating system and, Figure 4. An Empower project audit trail showing the time zone included in
particularly in standalone systems (single computer PC’s), the time stamp.
this level of protection may be difficult to control. However, in
network deployments, it is much easier to synchronize and
AUDIT TRAIL REASONS FOR CHANGE
One critical aspect of audit trails is the documentation of the
control access to time sources.
reason “why” an action was performed. This level of detail
For standalone or site-wide solutions, local time may be is almost never possible to be populated by the software
preferred. When wider, cross time zone installations are application automatically as it requires the input of the user
deployed, consideration of UTC or a fixed timezone may be performing that action. Free form reasons allow the user to
needed, if managing users and instruments in multiple time truly express why an action was performed, while pre-defined
zones is unobtainable. reasons are available for noting common reasons.
■■ Empower Enterprise solutions allow specific time zones ■■ Empower offers users silent, pre-defined or free form
to be specified for acquisition clients, processing clients, use of reasons to document why an action has
Citrix clients and servers. been performed.
■■ View Filters in Audit Trails allow reviewers to search
for specific data, specific actions, or specific reasons
for actions.

Figure 3. During creation of a Node connection in Empower, the Node time Figure 5. View Filters on Audit Trails can be created to search for specific
zone and Node location can be set. data; specific users, specific actions, or specific reasons for actions.

A good understanding about how any specific application

leverages time stamps (and additional controls put in place
in the IT infrastructure), help with confidence in the correct
sequencing of actions noted in the audit trails, referred to as
“operational system checks to enforce permitted sequencing
of steps and events” as stated in §11.10(f) for 21 CFR Part 11.1

Empower Software Audit Trails and Logs 3

[ WHITE PAPER ]

ENSURING THE AVAILABILITY OF AUDIT TRAILS

The audit trail documentation must be retained for the same
period as the electronic record. Accurate and complete copies
must be made available to the auditor (whether internal or
external) for review and copying, and must be both human-
readable and machine-readable.

■■ All records, histories, and audit trails are automatically

backed up during security back up routines of Empower.
■■ Empower Audit Trails at the project level and below are
always archived and restored when the project is archived
or restored, ensuring that any metadata relating to a
specific analytical result cannot be lost during the
record lifecycle.
Figure 6. Readable view of the Empower System Audit Trail which can be
■■ System Audit Trails may be archived to a secure format, filtered and sorted to find and print relevant records.
readable only in the Empower application, or exported in
a converted, non-secure format. EMPOWER PROJECT AUDIT TRAIL
■■ Archiving the System Audit Trail, like other archiving
■■ The Empower Project Audit Trail is an overview of every

activities, may be a manual process, or with the use of activity performed by users, as well as data, metadata,

NuGenesis LMS, this task may be automated. and methods inside that project.
■■ The Project Audit Trail captures information that affects
EMPOWER SYSTEM AUDIT TRAIL the data within a project (sample set information,
■■ Empower 3 Software System Audit Trail provides a history calibration curves, method changes, processing data)
of actions that affects the overall system configuration and other information captured in the Empower database
(such as denied login, project archival, changes to system (who, when, what, and why) including any data creation,
policies etc.). modifications to metadata, record copying, deletions,
■■ ‘System’ here refers to the overall Empower application and signature actions.
and should not be confused with an analytical instrument ■■ Further details can be found in individual item histories
system or HPLC system audit trail. such as Acquisition or Injection Logs, Method Audit Trails,
■■ Changes to user privileges are tracked. Sample or Sample Set Histories.

■■ All system-level actions in Empower, even those

performed by administrators, are recorded.
Sample Sets
Standards Used
■■ Audit trails are generated automatically and cannot for Calibration
be modified. Original
Processing Calibration
Method Curves

Original
Instrument
Method Unchanged Raw Data File
eCord Information
Traceable Chain
of Custody
LC/GC
System
Used
Product Code/
Stage Reagent
Sample History LIMS ID

Figure 7. The Oracle database underlying Empower, creates permanent

linking relations between methods, dynamic electronic data, and metadata
which cannot be broken, permitting easy query and review of related data.

Empower Software Audit Trails and Logs 4

[ WHITE PAPER ]

ACQUISITION AND INJECTION LOGS COMPARE METHODS

Integrity of data during a chromatographic run may also While audit trails provide a history of modifications made to
be important. Although there is a record of the instrument a method, often it may be required to compare two different
parameters, could there be a way for an analyst to make methods or two versions of the same method to view the
“alterations on the fly” or influence the run in other ways, details of the change, including the ‘before and after’ values.
before the data is securely saved? This could be useful to determine if all changes adhere to
any standard operating procedure (SOP)-mandated
Most chromatography data system (CDS) solutions and
allowable changes.
instruments have a number of technical controls to prevent
altering data, such as locking front panels or recording ■■ Empower’s Compare Methods feature may be used
interactive changes. to compare two methods with different names or two
versions (either historical or current) of the same method.
■■ Empower permanently stores the exact instrument method
that was used to collect the data with any chromatogram. ■■ Compare Methods feature can be used for instrument
methods, sample set methods, sample set method
■■ If a system allows interactive changes (through either
templates, method sets, processing methods, report
an unlocked front panel, separate controller, or console
methods and export methods.
software) and users have permissions to perform
interactive changes during a run, those changes are ■■ Method comparison tables may be searched to look for
recorded in an Acquisition Log which is permanently key parameter alterations.
linked to the raw data. ■■ Documenting and reviewing method ID’s, limiting
■■ For some specific Empower-controlled instruments there permissions to change methods, or locking methods may
may additionally be a Post Run Report to verify the actual negate the need to examine method histories in detail,
acquisition settings or experimental conditions for e.g. as method changes would be easily observed, restricted
MS data acquisition and Waters™ ACQUITY™ UPLC™ or prohibited.
Systems.
■■ The Acquisition and Injection Logs are viewable in older
Empower versions though a special report group in
Report Publisher.
■■ Since Empower 3 FR2, Acquisition Logs are displayed with
other audit trails in the Result History tab within the Result
Audit Viewer.

METHOD HISTORIES
■■ All methods in Empower are never overwritten and are
automatically versioned.
■■ Methods are assigned unique ID’s (within the project)
Figure 8. Difference between methods and method versions, as used in
upon creation, with all previous versions available for Empower can easily be shown and differences highlighted.
review, and permanently linked to any results that were
generated using them.
■■ Methods can be locked, assuring that modifications can
never be made.
■■ While an indication of changes to any Empower method
exists in the project audit trail, more details of the change
are additionally stored in each method properties.
■■ Method properties shows the history and all versions of
the method, including the reason for change.
■■ Older versions of methods can be “made current” allowing
users, if permitted, to restore an earlier version into use.

Empower Software Audit Trails and Logs 5

[ WHITE PAPER ]

SAMPLE AND SAMPLE SET HISTORIES Most regulated companies treat audit trails relating directly to
Changes to sample metadata are often required. Metadata data and results as an integral part of the metadata needing
may be as simple as a sample name or text field but may also to be reviewed based on a risk-based approach before batch
be a critical value that is required to calculate the final results. or study release. This may follow a “review by exception”
Modification of metadata may be needed, either pre or post- approach, as is typically performed for other metadata.
run, to complete missing metadata or to correct incorrectly ■■ Empower can assist in meeting this expectation by
entered metadata. providing easy access to method, data, results, and
Metadata changes will often be simple corrections or may metadata audit trails from the Review screen. This
indicate an attempt to influence the final results. capability is available in all versions of Empower Software.

Changes to sample metadata should therefore be audit ■■ A new tool introduced in Empower 3 FR2, called the Result
trailed, with the ‘before’ and ‘after’ values recorded Audit Viewer, brings together audit records from the
automatically so that previous values are not obscured Project Audit Trail, Acquisition Log, Method, and Sample
and are associated with an acceptable justification. Histories into a single window, and also permits easy
comparison of methods and results.
Records where metadata has been altered should be
flagged, indicating that a deeper review is needed as
part of a risk-based quality management system.

■■ Changes to sample metadata are performed using the

Run Samples window or the Alter Sample tool.
■■ Raw data and records, where the sample metadata has
been altered, are permanently flagged.
■■ Existing results, generated with the original data, remain
unchanged and data must be processed using the new
values, creating new and distinct results.
■■ Sample metadata changes are audit trailed in Empower
through both the Project Audit Trail and Sample and
Figure 9. The Review window and the new Result Audit Viewer facilitate
Sample Set Histories. a reviewer to interrogate the data, methods, peak results, calibration
curves, and audit records, and then take the results directly to
■■ Sample and Sample Set Histories are traditionally viewed Preview for electronic sign-off.
from the Altered Sample tool, but may also be seen in the
new Result Audit Viewer. Sample and Sample Set Histories
display the original and new values as well as the user, Managing and reviewing the System Audit Trail is typically
time and reason for change. performed as part of a regulated company’s periodic
review process, which many local regulators require for
■■ Sample and Sample Set histories may be included in
computerized laboratory systems e.g. PIC/S GMP Annex 11:
Reports. However, the level of required detail could fill
dozens of pages for a single run, and therefore a review ■■ Empower System Audit Trail provides View Filters to
is more typically performed on the original electronic search for specific events which may indicate improper
record using the Empower application, under a risk-based use of the system at the administration level.
approach based on the altered flag and other indicators. ■■ Specific views can be created to display only the
information needed for review. Additionally, ad hoc views
REVIEWING AUDIT TRAILS
may be created to, for example, search for all actions by
New requirements of European regulations (GMP Annex 11)
a specific user.
to regularly review audit trails are also being expected by
FDA investigators. Even though there is no formal mention
of this in Part 11, companies that fail to have a formal process
to review audit trails have had this omission cited in official
observations or warning letters.

Empower Software Audit Trails and Logs 6

[ WHITE PAPER ]

INCLUDING AUDIT RECORDS, LOGS, While many laboratories still continue to create paper copies
AND HISTORIES IN REPORTS of electronic records in the form of reports and rely on these
In a hybrid laboratory that has yet to fully embrace electronic to review them, the task of now creating giant reports,
data review and still largely relies on paper records, the including audit trails, and the risk that critical notifications
requirement to now include audit trail review can present may be lost in the sea of printed data, pose a significant risk
a major obstacle. Many of the new guidances clearly define to product quality and data integrity. This specific risk is also
reports as “static” records that do not preserve the “dynamic” mentioned in the WHO Guidance.3
nature of the original electronic record which permits a more
forensic review of laboratory (e.g. integration baselines.) DOCUMENTING DATA REVIEW INCLUDING
AUDIT TRAIL REVIEW
Additionally, while regulators are requiring review of
Documentation of audit trail review should be performed
significantly more metadata, such that a review must
in a similar way to documentation of any review process.
include the “complete” data, the challenge of presenting
Typically this is done by signing the results as ‘reviewed’
all the available dynamic electronic data on a static paper
or ’approved’, following a data review SOP which outlines
or PDF report becomes insurmountable.
how the review process should be performed, and will
As well as audit trails, regulators may include in their include how and when to review audit trails.
definition of “complete data” every chromatographic run
The WHO Guidance 3 , notes that under the section for
of a specific sample, (even those rejected because of a
documentation of data review on paper records, a signature
failed system, injection, column or solvents), every version
is added to the actual records reviewed, while, in the
of a result, (potentially even those rejected because of poor
“expectations for electronic records” you follow a clear
or inaccurate integration or incorrect metadata), and all
procedure and then electronically sign the electronic data
versions of sample sets and methods.
set as having been reviewed and approved.
The FDA themselves do not believe that, for anything more
Thus it would seem unreasonable to require specific
complicated than a simple balance or pH meter, any static
‘evidence’ of exactly which records and metadata were
report can be defined as a true and complete copy of the
looked at or opened. This might be considered an audit trail
original electronic record. Review of the original and complete
of the review process, or an audit trail of the audit trail review
electronic record is expected.6
process. Perhaps keystroke tracking or video recordings may
■■ “The printed chromatograms used in drug manufacturing be the only way to achieve this electronically.
and testing do not satisfy the predicate rule requirements
in 21 CFR Part 211.” 7 Other non-audit trail logs
In addition to the audit records detailed above, there are
■■ “The electronic record must be maintained and readily
other logs and messages regarding the Empower application,
available for review by, for example, QC/QA personnel or
instrument drivers, and the host operating system available
the FDA investigator.”
to the user which do not meet the definition of an audit trail.
The WHO Guidance,3 however, does propose a way to create
These include, but are not limited to the Windows Event
and leverage paper or PDF summary reports for further
Viewer, Empower Message Center, and pop-up messages
decision making:
from Empower or any other application. Like most kinds
■■ “Paper printouts of original electronic records from or error logs or histories, these logs may not always be
computerized systems may be useful as summary reports permanently retained, as their usefulness is time dependent.
… verify that the printed summary is representative of all
The Empower Message Center is an interface that brings
(electronic) results.”
together pertinent informational, warning, and error
—— Note that this can only be done after verification that messages generated by Empower applications, which might
the summary is trustworthy and all-inclusive. otherwise only display in a pop up message. These messages
■■ “Data integrity risks may occur when persons choose may be from Waters or third party instruments and drivers,

to rely solely on paper printouts or PDF reports.” third party applications via the API toolkit, as well as from
pieces of Empower code.
■■ “If the reviewer only reviews the subset of data provided
as a printout or PDF, these risks may go undetected.”

Empower Software Audit Trails and Logs 7

[ WHITE PAPER ]

Figure 11. Additional Logs may exist in specific instrument console pages.
Figure 10. The Empower Message Center displays error messages
from instruments, third party applications, and Empower Software
for troubleshooting purposes. The Message Center and other available logs and messages
are intended to aid in user level monitoring and/or
For quick reference, the Message Center typically displays troubleshooting in the laboratory; either independently or
only the messages relating to the currently logged in user. with the assistance of Waters’ or third party technical support.
Error messages relating to all users in the system will be
displayed if the current user has appropriate privileges.
The Message Center introduced in SR3 is searchable with SUMMARY
View Filters. Empower Software provides tools to capture users actions
as they relate to data creation, modification, and deletion.
The Message Center is not intended as a replacement for,
The unique way Empower utilizes the Oracle database
or a component of, the audit trail. Any critical messages
ensures that the links between various records can never
related to the users’ creation, modification, or deletion of
be broken, including the links between audit trails and
data are always permanently saved into the associated audit
results or methods.
trail or acquisition log along with the users’ justification
when appropriate. Message Center messages more often Reviewing audit trails makes the most sense as an integrated
than not describe some requested action which could not part of the data review process, so it is essential that the
be completed. reviewers have a good knowledge of how Empower Audit
Trails are designed and work together with the data.
Due to the high volume of messages collected in the message
The extent of audit trail review should be considered,
center in large deployments of Empower, the Message
along with the extent of any other critical metadata which
Center was originally designed with functionality to remove
should be included in peer review and approval review.
messages. Either a manually instigated or a time-based auto-
A clear SOP to identify the frequency, roles, responsibilities,
purge (where the user specifies the time) may be utilized.
and approach to a risk-based review of data and metadata
Traditionally laboratories may have had a desire to export and including audit trails (as well as documentation that this
retain copies of these messages in external files or systems for is adhered to) should be developed and followed.
troubleshooting purposes. However, the new Message Center Periodic review processes should investigate the
introduced with SR3 is designed to eliminate the need to purge effectiveness of the data review SOP.
or export messages. All historical messages can be available
and searched “near line” for troubleshooting purposes.

Within the overall Empower application, instrument control

consoles may also include their own cache of error logs.
For instance, the ACQUITY UPLC PDA Detector has its own
log tab in its console.

Empower Software Audit Trails and Logs 8

[ WHITE PAPER ]

References
1. FDA Title 21 chapter 1 Subchapter A Part 11 (21 CFR Part 11)
Electronic Records; Electronic Signatures from www.ecfr.gov.
2. ENV/JM/MONO(2016)13..... OECD Series Number 17: Application
of GLP Principles to Computerized Systems 22-APR-2016
available on http://www.oecd.org.
3. WHO_TRS_996 Annex05 http://www.who.int/medicines/
publications/pharmprep/WHO_TRS_996_annex05.pdf.
4. EudraLex Volume 4 GMP Medicinal Products for Human and
Veterinary Use; EU GMP Annex 11 Available from: http://
ec.europa.eu/health//sites/health/files/files/eudralex/vol-4/
annex11_01-2011_en.pdf.
5. PIC/s GMP Guide (PE 009-13 (Annexes) Annex 11: Computerized
Systems Available from https://www.picscheme.org.
6. Questions and Answers on Current Good Manufacturing
Practices, Good Guidance Practices, Level 2 Guidance – Records
and Reports; Available from: http://www.fda.gov/Drugs/
GuidanceComplianceRegulatoryInformation/Guidances/
ucm124787.htm.
7. FDA Title 21 chapter 1 Subchapter A Part 211 (21 CFR Part 211)
GMP for Finished Pharmaceuticals from www.ecfr.gov.

Waters Corporation
34 Maple Street
Milford, MA 01757 U.S.A.
Waters, The Science of What’s Possible, ACQUITY, and Empower are trademarks of Waters Corporation.
All other trademarks are the property of their respective owners.
T: 1 508 478 2000
F: 1 508 872 1990
©2018 Waters Corporation. Produced in the U.S.A. October 2018 720005904EN LM-PDF www.waters.com