This is a ready-to-use self-assessment. Replace every <<FILL: ...>> placeholder with your own specifics, run it as a facilitated exercise rather than a solo tick-box, and require a piece of evidence for every rating so the score is defensible rather than aspirational. A worked filled specimen follows the template. This is an educational aid to adapt and verify against your own quality system, not a compliance guarantee.
How to use this assessment
- Rate each dimension against the four-stage ladder (Reactive, Compliant, Proactive, Generative), not on a feeling but on the observable evidence you can point to.
- Record the evidence in the evidence column. A rating with no evidence is the same empty claim as a culture slide deck, and it is the first thing an auditor will test.
- Do not average the scores for a headline number. Work the lowest rows, because the lowest dimension, not the average, is usually where the next failure comes from.
- Take the completed assessment, with actions for the weak rows, into management review on a defined cadence.
The maturity ladder (rating scale)
| Stage | What it looks like |
|---|---|
| Reactive | Data integrity work happens only after a finding; “we fixed what the inspector cited” |
| Compliant | Controls and procedures exist; reviews are scheduled but can be rubber-stamped |
| Proactive | Behavior is monitored, reporting is rewarded, rising self-reported concerns are seen as good |
| Generative | Integrity is assumed; people stop bad practices without being told and are thanked for it |
Assessment dimensions
Rate each dimension R / C / P / G and record the evidence.
| # | Dimension | Question that discriminates the stages | Rating | Evidence |
|---|---|---|---|---|
| 1 | Reporting and psychological safety | When did someone last bring leadership bad news before it became a crisis, and what happened to them? | <<FILL: R/C/P/G>> | <<FILL: evidence>> |
| 2 | Investigation depth | Does “retrain the analyst” still appear as the corrective action for deliberate acts? | <<FILL>> | <<FILL>> |
| 3 | Metric plausibility | Is the OOS rate plausible for the volume, is the deviation severity mix realistic, do results cluster just inside limits? | <<FILL>> | <<FILL>> |
| 4 | Leadership behavior under pressure | How did leadership behave the last time a borderline result met a shipment deadline? | <<FILL>> | <<FILL>> |
| 5 | Bench practice versus SOP | Is there a routine program that watches work at the point of performance, or only document review? | <<FILL>> | <<FILL>> |
| 6 | Just-culture consistency | Are honest reporters and deliberate falsifiers treated differently, by a documented method? | <<FILL>> | <<FILL>> |
| 7 | Confidential reporting pathway | Does a no-retaliation channel exist, is it used, and do reporters hear the outcome? | <<FILL>> | <<FILL>> |
| 8 | Audit trail review ownership | Is a single named person accountable for each audit trail review, and does the review produce real discussion items? | <<FILL>> | <<FILL>> |
| 9 | Incentive and metric design | Do any individual or team scorecards reward low deviation counts or fast release without a paired data-reliability measure? | <<FILL>> | <<FILL>> |
| 10 | Remediation follow-through | After the last finding, was the behavioral rebuild resourced, or only the technical hardening? | <<FILL>> | <<FILL>> |
Acceptance criteria
This assessment is complete and usable when all of the following are true:
- Every dimension carries a rating and a specific piece of evidence, not an assertion.
- No dimension rated Proactive or Generative rests on evidence that is only a policy statement or a training record.
- Every dimension rated Reactive or Compliant has a named owner and a dated action.
- The result is reviewed by quality leadership and recorded, and the weak dimensions carry into the next management review.
References
FDA guidance, Data Integrity and Compliance With Drug CGMP: Questions and Answers (December 2018), on management responsibility for a work environment that enables data integrity. MHRA GXP Data Integrity Guidance and Definitions (2018), on the behavioral dimension of data governance. PIC/S PI 041, Good Practices for Data Management and Integrity in Regulated GMP/GDP Environments, on data governance and management’s role. ICH Q10, Pharmaceutical Quality System, on management responsibility and continual improvement. WHO guidance on good data and record management practices, on a culture that supports integrity.
Confirm the current version of each reference before you rely on it.
Revision history
| Version | Date | Author | Summary of change |
|---|---|---|---|
<<FILL: 1.0>> | <<FILL: date>> | <<FILL: author>> | Initial issue. |
Approvals
| Role | Name | Signature | Date |
|---|---|---|---|
| Facilitator | <<FILL>> | ||
| Quality Head | <<FILL>> |
Filled specimen
The following shows the assessment completed for an illustrative site. The ratings and evidence are examples; replace them with your own.
| # | Dimension | Rating | Evidence |
|---|---|---|---|
| 1 | Reporting and psychological safety | Proactive | Self-reported DI concerns rose from 2 to 11 per quarter after the confidential channel launched; each was resolved with a recorded outcome |
| 2 | Investigation depth | Compliant | Investigations are thorough, but “retrain” appeared as the sole CAPA on 3 of 9 deliberate-act events last year |
| 3 | Metric plausibility | Proactive | OOS rate (about 1.8 percent) tracks volume; deviation mix included 4 majors last quarter; no clustering just inside the lower limit |
| 4 | Leadership behavior under pressure | Compliant | Leaders verbally support investigations, but the last borderline release before a clinical shipment was closed in the minimum time |
| 5 | Bench practice versus SOP | Reactive | No routine bench-observation program; last SOP-to-practice comparison was during the prior inspection |
| 6 | Just-culture consistency | Compliant | A just-culture procedure exists but was applied inconsistently in two recent events |
| 7 | Confidential reporting pathway | Proactive | Channel exists, received 11 reports last quarter, reporters received written follow-up |
| 8 | Audit trail review ownership | Compliant | Each review has one accountable name, but reviews rarely surface discussion items, suggesting review by rote |
| 9 | Incentive and metric design | Reactive | The lab scorecard still rewards a low deviation count per analyst |
| 10 | Remediation follow-through | Reactive | After the last finding, systems were hardened in six weeks; no behavioral or cultural action was resourced |
Reading this specimen the way a quality leader should: the average is somewhere around Compliant, but the story is in rows 5, 9, and 10. A scorecard that rewards low deviation counts (row 9) actively discourages the reporting that row 1 says is improving, and the absence of bench observation (row 5) means normalized deviance would be invisible. Those three rows, not the average, are the work.
Common inspection findings this assessment surfaces early
- Culture “addressed” with an annual training slide and no behavioral metrics.
- A confidential reporting channel that has never received a report, presented as proof of a clean site.
- Audit trail review that is signed but produces nothing, indicating review by rote.
- “Retrain the analyst” as the recurring corrective action for deliberate acts.
- A suspiciously low OOS or deviation-severity profile that no one has tested for plausibility.
- Remediation that closed technical gaps only, with the behavioral root cause left untouched, setting up a recurrence.
How to adapt this assessment
- Add or remove dimensions to match your operation; keep each dimension observable and evidence-backed.
- Set the cadence (annual is common, with an out-of-cycle run after a serious finding).
- Decide who facilitates. An assessment run only by the people being assessed tends to score high; a cross-functional or independent facilitator is more honest.
- Feed the weak rows into real actions with owners and dates, then re-assess those rows at the next cycle rather than re-scoring everything from scratch.
- Confirm each reference in the References section against its current published version before issue.