Data integrity failures escalate faster than almost anything else, because they call into question the evidence for everything else on the site. Maturity here is mostly about design and culture rather than about technology.
Data integrity maturity is the degree to which the compliant route is also the easy route.
The process runs when something forces it to.
Shared logins are common, audit trails may be disabled or unreviewed, and results are recorded on paper and transcribed later.
Typical weakness. Records cannot be attributed to an individual.
Risk. Attributability and contemporaneity fail simultaneously, undermining every downstream record.
Procedures exist and are followed, mostly.
Individual accounts exist on major systems and audit trails are enabled, but nobody reviews them and the system inventory is incomplete.
Typical weakness. Spreadsheets and instrument software performing GMP calculations are not treated as systems.
Risk. An enabled but unreviewed audit trail provides no assurance and is trivially easy to test.
The process is designed, resourced and measured.
A complete system inventory exists, audit trail review has a named owner and frequency, and hybrid records have a defined raw-data position.
Typical weakness. Review is performed but its depth is not defined.
Risk. Review that confirms the trail exists rather than examining what it contains.
It connects to the rest of the quality system.
Access rights are reviewed periodically, leaver accounts are removed promptly, and data governance is assessed across the lifecycle rather than per system.
Typical weakness. Culture is not explicitly addressed — pressure to make data look acceptable is unmanaged.
Risk. Behavioural failures that no technical control prevents.
It improves itself, and the improvement holds.
Systems are designed so the compliant route is the easy route, and reporting a problem is demonstrably safe for the person reporting it.
Typical weakness. Sustaining this through management change.
Risk. A change of leadership tone reverses behavioural progress quickly.
PI 041 — Good Practices for Data Management and Integrity
MHRA GxP Data Integrity Guidance and Definitions
Annex 11; Part I, Chapter 4
These five levels are a GMPConsultant.nl framework for structuring a conversation about capability. They are not an official regulatory classification, no authority recognises or issues them, and a maturity level is not a statement of GMP compliance.
The GMP Health Index scores seven domains and maps each to a maturity level, in about ten minutes. It calculates in your browser and stores history on your device only.