Data integrity in the microbiology lab: practical controls

Microbiology has unusual data integrity risks. Many results are visual, the raw data (a plate) is destroyed after reading, and much of the work still happens on paper. A chemist's HPLC chromatogram sits in a validated system with an audit trail. A microbiologist's colony count lives on a worksheet, written by one person, about a plate that went into the autoclave an hour later.

Auditors know this, and they look closely. Microbiology data integrity findings appear in USFDA warning letters to Indian sites every year. This article explains what good practice looks like in a micro lab, control by control.

ALCOA+ in plain words

Principle	In the micro lab
Attributable	Who sampled, who incubated, who read the plate, who counted, who checked
Legible	Readable entries, no overwriting, single-line corrections with reason, date and sign
Contemporaneous	Record counts at the time of reading, not later from memory or rough notes
Original	The first record (worksheet, logbook, instrument file) is kept, not a fair copy
Accurate	Counts, dilutions and calculations are right and checked
Complete	Every sample, every plate, every repeat is recorded, including invalid runs
Consistent	Same practice every time; dates and times in a logical sequence
Enduring	Records last for the retention period; no thermal paper that fades
Available	Records can be retrieved for review or inspection when needed

Where micro data goes wrong

Real findings from inspections tend to fall into a few patterns:

• Plates not read when recorded. The worksheet says the plate was read on day 3 at 10:00, but the incubator door log or the analyst's attendance shows otherwise.
• Counts that look too good. Months of zero counts in a Grade B area where other sites routinely see low single-digit counts. Auditors ask to see the plates.
• Missing samples. EM plates exposed in the field but never logged as received in the lab, or plates "lost" before reading.
• Results rewritten. Fair copies of rough notes, with the originals thrown away.
• Instruments with no audit trail. Endotoxin readers, identification systems or particle counters with shared logins and the audit trail switched off.
• Repeat testing to get a pass. An OOS result followed by unrecorded retesting until a passing result appears.

Each of these breaks the trust that the record tells the truth. That is the whole point of data integrity.

Controls that make a difference

Plate reading and counting

• Second-person verification of colony counts for critical tests, ideally before the plate is discarded. Both names, both signatures, same time.
• Plate photographs for Grade A and B recoveries, sterility tests, media fills, and any count near an alert or action level. Store photos in a controlled location, not on a personal phone.
• Count at the stated time. If incubation is 72 hours, define the allowed window (for example 72–76 hours) in the SOP and record the actual time.
• Record "no growth" positively, for example "0 CFU" rather than a dash or a blank cell.

Paper records

• Issued, numbered worksheets. QA issues worksheets with a unique number; the lab reconciles every issued sheet, including spoiled ones.
• Bound logbooks with numbered pages for instruments and media.
• Single-line corrections with reason, date and sign. No correction fluid, no overwriting, no pencil.
• No rough notes. If you need to note a count quickly, the worksheet is the place.

Samples and plates

• Sample reconciliation. Every plate sent out for EM comes back and is read, including those dropped or damaged. Damaged plates are recorded as such, not quietly replaced.
• Labelling at the point of use. Plates are labelled before exposure, with location, date and session.
• Chain of custody for samples that move between areas, such as water samples from a distant loop.

Incubators and equipment

• Continuous temperature monitoring with alarms, linked to the samples inside.
• Incubator load records showing which samples went in and came out, and when.
• Calibration and qualification status visible on each instrument.

Computerised systems

Endotoxin readers, identification systems, particle counters, LIMS and building management systems all need:

• Unique user IDs and passwords, no shared logins
• Role-based access, so analysts cannot delete data or change methods
• Audit trails that are switched on and reviewed regularly, not only before an audit
• Regular backups, and a tested restore procedure
• Time and date synchronisation, so records from different systems line up

Reviewing data properly

Data review is the last control before a result is used. A good reviewer:

1. Checks that the sample, method, media lots and incubation conditions match the specification.
2. Confirms times and dates make sense: incubation started after sampling, read after the minimum period.
3. Checks calculations and dilution factors.
4. Looks at related records: incubator temperature, media GPT, negative controls.
5. For computerised data, reviews the relevant audit trail entries for changes, deletions or reprocessing.
6. Signs only when all of this is done.

Write these steps into a review checklist. It makes reviews consistent and shows auditors what you actually check.

Audit trail review in practice

Audit trail review does not mean reading every line. Focus on events that matter:

• Deleted or modified results
• Changes to methods, limits or calibration curves
• Failed login attempts or out-of-hours access
• Re-runs of samples on the same day
• Changes to the system date or time

Define the frequency (each batch for release tests, monthly for supporting systems) and record that the review was done and what was found.

Culture matters as much as controls

People falsify data when they are afraid of results. Encourage reporting of excursions, make investigations about learning rather than blame, and make sure workload allows reading plates on time.

If an analyst knows that an action-level count will lead to a fair, factual investigation, they will record it. If they believe it will lead to blame, extra work and a bad appraisal, some will be tempted not to. Leadership sets that tone. Every QC head should be able to say, honestly, that a high count has never been punished.

A quick self-audit for your lab

• Can you trace one EM plate from sampling to disposal with records at every step?
• Can every analyst log in to every instrument with their own ID?
• When was each instrument audit trail last reviewed, and by whom?
• How many worksheets were issued last month, and are all accounted for?
• Do your Grade A and B plate photos match the counts in the worksheets?

If any answer is "I'm not sure", start there.