FDA's 2026 computer-system findings cluster into six recurring themes under 21 CFR 211.68 — shared logins, missing audit trails, unvalidated systems, backdated records, deletable data, and AI used without controls. This assessment tells you exactly where your systems sit against all six, what to fix first, and what it will take — before an inspector tells you instead.
Six themes. Every system you nominate is scored against each one, with the evidence behind the score.
| Theme | The question answered | |
|---|---|---|
| 01 | Access & attribution | Can every GxP action be traced to a unique person — or do shared logins exist? |
| 02 | Audit trails | Are they on, complete, reviewed, and reconstructable? |
| 03 | Validation state | Which systems are making GxP decisions without defensible validation? |
| 04 | Record integrity | Can records be altered or backdated without a trace? |
| 05 | Backup & retention | Can data be deleted or overwritten without detection? |
| 06 | AI governance | Where is AI influencing GxP decisions — and is it controlled? |
Four artifacts. Yours to keep and act on, whether or not you ever use our platform.
Every system scored red / amber / green against the six themes, with the evidence behind each score.
Each gap rated by inspection risk and effort to close, so the sequence is obvious rather than debated.
What to fix first, who owns it, and what "done" looks like for each item.
A deck your leadership can act on — written so you don't have to translate it first.
Fixed scope, fixed fee, fixed end date.
Kickoff, evidence review and interviews, then the readout. Roughly 4–6 hours of your team's time in total.
Fixed fee. No hourly billing, no scope creep, no $400/hr surprise at the end of the month.
20+ years across big and mid pharma. 10,000+ professionals trained in modern CSA. Not a junior on a rate card.
Three steps, and each one credits toward the next — so nothing is paid for twice.
One system, one problem, worked live with your team. You get a one-page findings memo and the three actions worth taking first.
The full six-theme review: scorecard, gap register, 90-day plan, and an executive readout — closing with a working session where the first three actions get agreed in the room.
For teams whose remediation plan is bigger than their capacity. I own the plan with you — reviews, risk calls, inspection prep — without adding headcount.
You get the scorecard and the plan whether or not you ever use our platform. If the remediation turns out to be bigger than your team's capacity, we can run it with you — but that's a separate conversation, held after you have the findings in hand.