Recent signals from the Therapeutic Goods Administration (TGA) indicate a clear shift toward deeper inspection of data integrity controls and the effectiveness of computer system validation (CSV) across both pharmaceutical and medical device sectors.

This is not a change in regulations, but a change in how rigorously existing expectations are being assessed during inspections.

Key focus areas observed:

• Data Integrity: Inspectors are placing greater emphasis on ALCOA+ principles. This includes verification that data is attributable, legible, contemporaneous, original, and accurate, as well as complete, consistent, enduring, and available. Particular attention is being given to audit trail review practices, including whether audit trails are routinely reviewed, by whom, and how discrepancies are investigated.
• Computer System Validation (CSV): There is increasing scrutiny on whether systems are validated based on actual use and risk, rather than relying on generic or templated documentation. Inspectors are challenging whether User Requirements Specifications (URS), Functional Specifications (FS), and test scripts truly reflect system functionality and GxP impact.
• Access Control and User Management: Deficiencies are being identified in user access provisioning, shared accounts, and lack of role-based access controls. Evidence of periodic access review is often requested but not always adequately demonstrated.
• Use of Excel and Standalone Tools: Uncontrolled spreadsheets continue to be a recurring issue. Lack of version control, absence of audit trails, and no formal validation approach for critical spreadsheets are common inspection findings.
• Validation Lifecycle and Change Control: TGA is expecting clear traceability from requirements through to testing and ongoing maintenance. Change control processes are being reviewed to confirm that system changes are assessed for validation impact and appropriately documented.

The direction of TGA inspections is increasingly aligned with expectations from the U.S. Food and Drug Administration and the European Medicines Agency, particularly in relation to data governance and lifecycle management.

Recommended actions:

• Conduct targeted data integrity assessments across GxP systems
• Review audit trail configurations and define a formal review process
• Reassess CSV documentation to ensure it reflects actual system use and risk classification
• Implement governance for critical spreadsheets, including validation and version control
• Strengthen access control procedures and periodic review mechanisms

Organisations that continue to rely on documentation-only compliance without operational evidence are likely to face increased inspection findings under this approach.

This shift reinforces a broader expectation: compliance must be demonstrable, consistent, and embedded in day-to-day operations, not prepared solely for inspection.