This is a ready-to-use report template for an independent third party verifying a data integrity (DI) remediation. Its value comes entirely from independence: it must report findings without editing by the firm, or it becomes a paid endorsement rather than a check. Replace every <<FILL: ...>> placeholder with the verifier’s own specifics. A worked filled specimen follows. Verify each cited regulation against the current source before you rely on it.
Document control header
| Field | Entry |
|---|---|
| Report title | Independent Third-Party DI Remediation Verification, <<FILL: SITE>> |
| Document number | <<FILL: RPT-ID, e.g. TPV-2026-003>> |
| Version | <<FILL: version>> |
| Report date | <<FILL: date>> |
| Verifying firm | <<FILL: firm name>> |
| Lead verifier and qualifications | <<FILL: name, DI remediation experience>> |
| Engagement reference | <<FILL: engagement letter / scope agreement ref>> |
1. Independence statement
<<FILL: VERIFYING FIRM>> was engaged by <<FILL: SITE>> to provide an independent assessment of the DI remediation. The firm confirms it has no financial or organizational interest that would compromise objectivity beyond this engagement, and that it reports findings directly, without editing by the site. The scope was fixed in the engagement letter and the firm had unrestricted access to the records, systems, and personnel needed.
2. Scope and objective
Assess whether the remediation of <<FILL: regulatory instrument reference>> at <<FILL: SITE>> is complete and durable: whether root causes were fixed rather than symptoms, whether the new controls are actually in use, whether the retrospective review was sound and its findings disclosed, and whether the changes will hold once the program team disbands. Scope covers <<FILL: systems, procedures, workstreams, and period assessed>>.
3. Methodology
- Reviewed the remediation program plan, the responses, the commitment register, and the retrospective review protocol and report.
- Sampled objective evidence per workstream: audit trail review records, access reviews, change control records, validation records, training and effectiveness evidence.
- Interviewed personnel across levels to assess whether the culture and daily operating environment changed, not only the paperwork.
- Independently re-performed selected reconciliations from the retrospective review to test its methodology.
- Assessed each closed commitment against its objective evidence.
4. Findings by workstream
| Workstream | Verified state | Objective evidence sampled | Residual gap / observation |
|---|---|---|---|
| Immediate containment | <<FILL>> | <<FILL>> | <<FILL>> |
| Technical remediation | <<FILL>> | <<FILL>> | <<FILL>> |
| Procedural remediation | <<FILL>> | <<FILL>> | <<FILL>> |
| Training | <<FILL>> | <<FILL>> | <<FILL>> |
| Culture and leadership | <<FILL>> | <<FILL>> | <<FILL>> |
| Retrospective data review | <<FILL>> | <<FILL>> | <<FILL>> |
5. Results versus acceptance
| Acceptance question | Result | Basis |
|---|---|---|
| Root causes fixed, not symptoms? | <<FILL: yes/partial/no>> | <<FILL>> |
| New controls actually in use (records show it)? | <<FILL>> | <<FILL>> |
| Retrospective review complete and disclosed? | <<FILL>> | <<FILL>> |
| Commitments met on their dates? | <<FILL>> | <<FILL>> |
| Culture change observable? | <<FILL>> | <<FILL>> |
| Controls embedded in the routine QMS? | <<FILL>> | <<FILL>> |
6. Residual gaps and recommendations
| # | Gap | Risk | Recommendation | Firm’s suggested priority |
|---|---|---|---|---|
<<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
7. Attestation and conclusion
Based on the evidence sampled and the work described, <<FILL: VERIFYING FIRM>> concludes that the remediation is <<FILL: complete and durable / substantially complete with the residual gaps above / not yet adequate>>. This attestation covers the scope and period stated and the evidence sampled; it is not a guarantee of future conduct. <<FILL: number>> residual gaps are recorded above for the site to close.
8. Limitations
This assessment is based on the records, systems, and interviews available during <<FILL: dates>> and on the sample selected. It does not constitute regulatory, legal, or compliance advice. The firm’s independence is stated in section 1; any limitation on access is recorded here: <<FILL: none, or describe>>.
9. References
FDA, Data Integrity and Compliance With Drug CGMP: Questions and Answers (2018). MHRA GxP Data Integrity Guidance (2018); PIC/S PI 041 (2021); WHO Guideline on Data Integrity (2021) (reference by title; describe, do not paste). ICH Q10, Pharmaceutical Quality System, for the sustainable-state expectation. 21 CFR Part 211 and 21 CFR Part 11.
Confirm the current version and clause numbers of each reference before issue.
10. Approvals
| Role | Name | Signature | Date |
|---|---|---|---|
| Lead verifier | <<FILL>> | ||
| Verifying firm quality reviewer | <<FILL>> |
Filled specimen
The following shows the results-versus-acceptance section completed for an illustrative verification. Details are illustrative.
| Acceptance question | Result | Basis |
|---|---|---|
| Root causes fixed, not symptoms? | Yes | Change control now blocks audit-trail disabling across all CDS; verified on 3 systems |
| New controls actually in use? | Yes | 26 weeks of completed audit trail review records with real exceptions raised |
| Retrospective review complete and disclosed? | Partial | Review sound and disclosed, but boundary for one legacy system extended only after challenge |
| Commitments met on their dates? | Yes | Commitment register: 41 of 41 commitments met or renegotiated in advance |
| Culture change observable? | Yes | Analysts described reporting failing results without fear; managers ask about data before throughput |
| Controls embedded in the routine QMS? | Yes | Audit trail review and DI metrics now in quarterly management review |
Conclusion in this specimen: substantially complete, with one residual gap on the legacy-system retrospective boundary recommended for closure before the follow-up inspection. The value of the report is that it names that gap plainly rather than smoothing it over, which is exactly what makes an independent verification credible to the agency.
Common inspection findings this report prevents
- A third-party review perceived as a paid endorsement because the firm’s independence was never stated or the firm was allowed to edit findings.
- A remediation declared complete with residual gaps quietly omitted.
- Verification based only on document review, with no interviews or re-performed reconciliations to test whether controls are truly in use.
- Culture change asserted with no observational basis.
- A scope or access limitation hidden rather than recorded.
How to adapt this report
- State independence and unrestricted access up front; if access was limited, record it.
- Sample objective evidence per workstream and re-perform selected reconciliations, do not rely on document review alone.
- Interview across levels to test culture, not only paperwork.
- Record residual gaps plainly and let the firm report without editing.
- Frame the conclusion as an attestation over the scope and period, not a guarantee of future conduct.