This is a ready-to-use prioritization tool for sequencing the findings a data integrity gap assessment produces into a remediation order an organization can actually resource. A real assessment generates more findings than any organization can fix at once; this matrix scores each one against four criteria and plots it on an impact-versus-effort grid so the sequencing decision is traceable rather than whoever-shouts-loudest. It is the working tool that feeds the remediation roadmap section of the Report: Data Integrity Program Gap Assessment and, for a crisis-driven remediation, the governance layer in the Data Integrity Remediation Program Plan; this document is the scoring mechanics behind either output, reusable regardless of which one consumes it. Replace every <<FILL: ...>> placeholder with your own specifics. A worked filled specimen follows. This is educational structure to adapt, not legal or regulatory advice.
Document control header
| Field | Entry |
|---|---|
| Document title | Data Integrity Gap Assessment Remediation Prioritization Matrix |
| Document number | <<FILL: reference, e.g. DI-PRIOR-2026-01>> |
| Assessment date | <<FILL>> |
| Prepared by | <<FILL>> |
| Parent charter / report reference | <<FILL>> |
1. Purpose
This matrix scores every finding from a data integrity gap assessment against patient safety impact, regulatory risk, scope, and remediation effort, derives a priority tier, and sequences the full gap register into a risk-ordered remediation plan with interim controls for anything that cannot close immediately.
2. Scoring criteria
| Criterion | Question it answers | Scale |
|---|---|---|
| Patient safety impact | What happens if this gap lets a quality decision be made on corrupted data? | High / Medium / Low |
| Regulatory risk | How likely is this gap to become an inspection observation if seen during an inspection? | High / Medium / Low |
| Scope | Does the gap affect one system, or does it multiply across many (a platform-level access or configuration weakness)? | Single system / Multiple systems / Platform-wide |
| Effort | How long does the fix realistically take, a configuration change and revalidation, or a multi-month program? | Low (days) / Medium (weeks) / High (months) |
3. Priority tier derivation
Combine patient safety impact and regulatory risk into an overall impact rating, then cross it with effort on the grid below. Scope is not folded into the grid directly; use it to break ties and to flag findings that belong in a systemic theme (see section 5) rather than being sequenced as an isolated item.
| Impact \ Effort | Low effort | Medium effort | High effort |
|---|---|---|---|
| High impact | Priority 1, this week | Priority 1, this month | Priority 2, planned program, staged |
| Medium impact | Priority 2, this month | Priority 3, this quarter | Priority 3, planned program |
| Low impact | Priority 3, batch with similar fixes | Priority 4 | Priority 4, defer to routine maintenance |
4. Prioritization worksheet
One row per finding, drawn from the finding scoring worksheet or the assessment report’s gap register.
| Ref | Finding | Patient safety impact | Regulatory risk | Scope | Effort | Priority tier | Sequencing |
|---|---|---|---|---|---|---|---|
<<FILL: F01>> | <<FILL>> | <<FILL: High/Medium/Low>> | <<FILL: High/Medium/Low>> | <<FILL: Single/Multiple/Platform-wide>> | <<FILL: Low/Medium/High>> | <<FILL: 1-4>> | <<FILL>> |
5. Systemic themes affecting sequencing
A finding scoped as “multiple” or “platform-wide” often shares a root cause with other findings. Group them and sequence the root cause ahead of treating each occurrence as an isolated Priority 3 or 4 item.
| Theme | Findings it groups | Recommended sequencing action |
|---|---|---|
<<FILL>> | <<FILL: refs>> | <<FILL: e.g. fix the root cause once, close all grouped findings against it, rather than sequencing each individually>> |
6. Interim controls for open findings
Every Priority 1 or 2 item that cannot close immediately needs a stated interim control, so an open finding is managed risk, not unmanaged risk, while the fix is in progress.
| Ref | Interim control while open | Owner of the interim control |
|---|---|---|
<<FILL>> | <<FILL>> | <<FILL>> |
7. Acceptance criteria
- Every finding in the gap register has a row in section 4 with all four criteria scored and a derived priority tier.
- Priority 1 findings are sequenced this week or this month, never deferred behind lower-tier items on the basis of ease alone.
- Every finding scoped as multiple or platform-wide is checked against section 5 for a shared root cause before being sequenced as an isolated item.
- Every open Priority 1 or 2 finding has a named interim control and owner in section 6.
- The sequencing in this matrix, not the order findings happened to be discovered, is what feeds the remediation roadmap.
8. References
ICH Q9(R1), Quality Risk Management, for the risk-based sequencing logic. ICH Q10, Pharmaceutical Quality System, for management review as the resourcing decision point. FDA, Data Integrity and Compliance With Drug CGMP: Questions and Answers (final, December 2018).
Confirm the current version of each reference before issue.
9. Revision history
| Version | Date | Author | Summary of change |
|---|---|---|---|
<<FILL: 1.0>> | <<FILL: date>> | <<FILL: author>> | Initial issue. |
10. Approvals
| Role | Name | Signature | Date |
|---|---|---|---|
| Author (Lead Assessor) | <<FILL>> | ||
| Approver (Assessment Sponsor) | <<FILL>> |
Filled specimen
The following shows the matrix completed for five findings from the same site assessment used in the finding scoring worksheet, so you can see how the two tools connect. The company and findings are illustrative; replace them with your own.
Prioritization worksheet:
| Ref | Finding | Patient safety impact | Regulatory risk | Scope | Effort | Priority tier | Sequencing |
|---|---|---|---|---|---|---|---|
| F01 | Audit trail off for method changes on a release-testing CDS | High | High | Single system (but release-critical) | Low, configuration change plus revalidation | 1 | Contain now, fix this week |
| F02 | Three users hold unneeded admin rights on the LIMS | High | High | Single system | Low, remove rights | 1 | This week |
| F03 | No audit trail review procedure exists for a Tier 2 system | Medium | Medium | Platform-wide, no review procedure exists for any Tier 2 system, not just this one | Medium, write, train, start | 2 | This month, treat as the systemic theme in section 5 |
| F04 | Password expiration disabled on a label-printing workstation | Low | Low | Single system | Low | 4 | Batch with other configuration fixes at next maintenance window |
| F05 | Audit trail review procedure not updated after a configuration change | Low | Medium | Single system | Low | 3 | This quarter |
Systemic themes: F03’s true scope is platform-wide once the assessor confirmed no Tier 2 system anywhere in the inventory has a defined audit trail review procedure; the recommended action is a single program-level procedure write covering all Tier 2 systems, rather than five separate Priority 2 tickets appearing one at a time as each system is individually assessed in future cycles.
Interim controls: F01, until the configuration change and revalidation complete, second-person manual review of all method changes on the affected CDS is added immediately, owned by the QC supervisor. F02, until admin rights are removed, the three accounts are restricted to read-only pending the change, owned by the IT system administrator.
Common inspection findings this matrix prevents
- Remediation sequenced by ease of fix rather than risk, so a low-effort, low-impact item closes before a high-impact item still sits open.
- A finding scoped as affecting one system when it actually reflects a platform-wide gap, so the same root cause reappears at the next assessment as a “new” finding.
- An open Critical or Major finding with no interim control, so the gap sits as unmanaged risk for the weeks or months the fix takes.
- A remediation plan with no visible scoring behind the sequence, so a reviewer cannot tell why one item moved ahead of another.
How to adapt this matrix
- Set your document number and link it to the parent assessment charter or report.
- Pull findings directly from your finding scoring worksheet or gap register rather than re-describing them here.
- Watch the scope column for anything marked multiple or platform-wide, and check section 5 before sequencing it as an isolated item.
- Feed every Priority 1 and 2 interim control into your real deviation or change control system in addition to tracking it here.
- Confirm every regulation in section 8 against the current published version before issue.