International Society of Automation–95 (ISA-95), Network Time Protocol (NTP), and Audit Trails: Three Architecture Questions Every GMP Site Must Answer Before the Next Inspection

In a pharmaceutical plant control room in Southeast Asia, an auditor asked a question that stopped the room: "Can you show me the original timestamp for this excursion event—not the one in the report, the one in the system?" The room went quiet. The engineer opened three separate applications, clicked through four export screens, and eventually produced a CSV file that could be opened and edited in Excel. The auditor proceeded to write the observation before the engineer finished explaining.

The data was accurate. The architecture was not audit-ready.

What failed was not the instrument, the standard operating procedure (SOP), or the training. What failed was a decision made during system design—where should the original record live?, no one had ever considered that question.

Drawing on 10 years of GMP computerized systems work across Southeast Asian pharmaceutical facilities—from greenfield builds to legacy remediation—a consistent pattern emerges: audit readiness is rarely a training problem or a documentation problem. It is almost always an architecture problem. And that architecture problem can usually be surfaced with three questions that any quality assurance (QA) lead, engineering manager, or information technology (IT) director can ask right now, without waiting for the next inspection.

Why Architecture Determines Audit Outcome

Regulatory frameworks—EU GMP Annex 11, FDA 21 CFR Part 11, ALCOA+—do not prescribe which software platforms a plant must use. They prescribe outcomes: electronic records must be attributable, legible, contemporaneous, original, and accurate. They must be protected from unauthorized alteration. Audit trails must be secure, computer-generated, and time-stamped. Records must be available for agency review.

Whether a plant meets those outcomes depends almost entirely on how its systems are connected, where original records live, and whether context is preserved as data moves from sensor to release decision.

ISA-95, the standard that forms the basis for International Electrotechnical Commission 62264 (IEC 62264) provides the layered model that makes this visible:

• Level 0–1 for field devices
• Level 2 for monitoring and control (supervisory control and data acquisition (SCADA), distributed control system (DCS), building management system (BMS), environmental monitoring system (EMS)),
• Level 3 for manufacturing execution systems (MES), electronic batch records (eBR), laboratory information management systems (LIMS)
• Level 4 for enterprise resource planning (ERP)

IEC 62443 defines the zone and conduit boundaries that protect the operational technology (OT) network from IT-side vulnerabilities. A problem that appears repeatedly is not that plants lack these systems. It is that the systems are installed without a clear answer to three foundational questions. Those unanswered questions become the source of observations.

Question 1: Where Does the Original Record Live—and Can It Be Proven?

Why auditors ask this: EU GMP Annex 11 Clause 7 requires that electronic records be protected from unauthorized modification. 21 CFR Part 11 §11.10(c) requires that records be retrievable throughout their retention period. Neither requirement is satisfiable if the plant cannot identify which system holds the authoritative copy of a given data type.

The failure sign: The same data value appears in three places—for example, a cleanroom temperature reading shows on the BMS dashboard, the EMS historian, and the eBR batch record—but no document designates which version is the original record and which are derived copies. When a deviation occurs, the investigation becomes a dispute between Engineering and QA over which number to use.

This is not a hypothetical. This exact scenario can delay batch release decisions by days because the investigation has to include a sub-investigation to establish which system is the source of truth.

The architectural fix: Define a system-of-record matrix before the user requirements specification (URS) is written. Process sensor data belongs in the Historian (not replicated to ERP). Batch execution steps belong in MES or eBR. Quality control (QC) results belong in LIMS. Environmental monitoring data belongs in the EMS database—and when that data is referenced in a batch record, the eBR should link back to the Historian record, not store a standalone copy. Every interface that moves data across systems must carry the source system identifier, original timestamp, tag ID, unit, and quality flag. If an interface only transmits the numeric value, it is not GMP-compliant for critical data regardless of how accurate the sensor is.

Question 2: Is Every GMP-Critical Timestamp Synchronized and Protected?

Why auditors ask this: ALCOA+ requires that records be contemporaneous — captured at the time the event occurs. 21 CFR Part 11 §11.10(e) requires audit trails to be computer-generated and time-stamped. If the clocks across a plant's control and monitoring systems are not synchronized to a single authoritative time source, the audit trail is unreliable even when every individual entry is accurate.

The failure sign: Plant network clocks are set manually or synchronize infrequently, so a programmable logic controller (PLC) timestamp and the Historian timestamp for the same event differ by seconds — or minutes. Alarm acknowledgment entries arrive in the audit trail out of chronological order. A store-and-forward gap event shows a reconciliation timestamp from when the connection restored, not the original event time.

The architectural fix: Every device from Level 1 field modules to Level 3 Historian servers must synchronize to a single NTP server. This is not optional infrastructure—it is a precondition for the entire audit trail to be defensible. Beyond NTP, the EMS and SCADA layer must implement store-and-forward: when a network interruption occurs, the field device buffers data locally and resynchronizes with original timestamps when connectivity is restored. Without this, every server restart or network hiccup creates a data gap in regulatory records. Testing store-and-forward behavior—physically disconnecting a network cable during a logging session and verifying continuity in the Historian afterward—should be a mandatory test case in every operational qualification (OQ) for Level 2 and Level 3 systems. Pass criterion: the Historian record shows zero-gap continuous data with original timestamps, and the field device event log shows buffered entries with the original capture time, not the reconnection time.

The network itself must be segmented per IEC 62443 principles: a plant OT network (sensors, SCADA, EMS), an industrial DMZ (EMS server, Historian), and a corporate IT network (ERP, office systems). These zones must not be directly interconnected. A flat network architecture—where the same IP range covers both a SCADA workstation and the accounting department—means a ransomware event or a misconfigured patch can destroy GMP records without any direct attack on the GMP system itself.

Question 3: Can QA Trace Every GMP Decision Back to Its Evidence Owner?

Why auditors ask this: Data integrity is not only about protecting data from tampering. It is about ensuring that the chain of evidence for every quality decision is complete, traceable, and has a responsible owner. EU GMP Annex 11 requires that audit trails capture who did what and when. ISPE GAMP^® 5 Guide (Second Edition) reinforces risk-based validation scoped to the full data flow, not individual systems in isolation.

The failure sign: Audit trail entries exist in multiple systems—SCADA records setpoint changes, MES records batch step completions, LIMS records result approvals—but no one can answer: "If a contamination event occurred at 14:32 on a given day, which system owns the evidence, who is responsible for retrieving it, and what is the format required for agency review?" The answer "it depends" is itself a finding.

The architectural fix: Validation boundary mapping must follow the data flow, not the system boundary. If an EMS excursion event triggers an automated entry in an eBR, the validation scope must cover the EMS event, the interface mapping, the MES display, and the eBR audit trail as a single chain. Testing only the EMS or only the MES leaves the interface—typically the highest-risk point—outside the scope entirely. This gap is common because responsibility for the interface falls between two validation teams.

Beyond scope definition, access control must enforce segregation of duties per 21 CFR Part 11 §11.10(d): operators, QA reviewers, and IT administrators must have separate roles with separate permissions. The audit trail review itself must be a defined workflow with an identified owner and a documented frequency. The question is not "does an audit trail exist?" It is "who reviews it, how often, and what constitutes an actionable finding?"

The Decision Moment

Three questions. Before the next inspection, before the next system investment, before the next validation project launches:

1. Can a system-of-record matrix be produced—written, approved, current—that names which system holds the original record for each GMP-critical data type?
2. Can it be demonstrated, with a test record, that a network interruption during data collection does not create a gap in the Historian, and that every timestamp in your audit trail is traceable to a single synchronized time source?
3. Can the owner responsible for retrieving and presenting audit trail evidence for each GMP system be named—and can it be confirmed that the interface between those systems has been validated as a complete data flow, not as two separate scopes?

If any of these three answers is uncertain, the gap is not in the SOPs. It is in the architecture. Addressing it before an inspection is straightforward. Explaining it during one is not.