Invalidating an out-of-specification result: the highest-stakes signature in the laboratory
Every data integrity enforcement action of the last decade passes through the same door. Not falsified data — that is rarer than the headlines suggest. The door is the invalidated result: a failing test set aside on the grounds of assignable laboratory error, recorded by the laboratory that set it aside.
What is the highest-stakes signature in a laboratory?
Invalidating an out-of-specification result. It converts a failing result into one that never counted, and it is the single decision most likely to be examined in an inspection or a consent decree. The record is typically a workflow status and a free-text justification.
- Invalidation is the single most scrutinised behaviour in pharmaceutical quality control, and its record is the least evidential artefact in the laboratory.
- An invalidation-drift control chart — invalidations per 1,000 tests, by analyst and by method — is computable from data every LIMS already holds.
- A dual-signed invalidation receipt binds two independent humans to the result hash, the assignable cause classification and the rationale.
Part of Pharma and GxP identity
Why this one decision carries the weight
An out-of-specification result is not, by itself, a problem. Analytical methods produce outliers, instruments drift, and genuine laboratory error is a documented and expected phenomenon. Investigating an OOS and finding an assignable cause is normal science.
The problem is structural. The party that investigates the failing result is the party inconvenienced by it. The determination that an error was assignable is made by people under schedule pressure, on a batch that may already be allocated. And the record of that determination is a status change in a system the laboratory controls.
FDA guidance on investigating OOS results is detailed and good. It describes a phased investigation, requires laboratory error to be demonstrated rather than assumed, and prohibits retesting into compliance. What it cannot do is change who holds the evidence.
What the record contains, field by field
| Field | Typical content | Evidentiary weakness |
|---|---|---|
| Status | Valid → Invalidated | A workflow state transition, alterable with database access |
| Reason code | Selected from a picklist | Coarse; the picklist was designed for reporting, not for evidence |
| Investigation reference | Link to a QMS record | Correct, but the QMS is the same custodian |
| Approver | User id, Part 11 signature | Knowledge factor; see the evidentiary ladder |
| Rationale | Free text | Unbounded, unhashed, and editable |
Read that table as an investigator would. Every field is an assertion by the accused, and the most important one — the rationale — is the least constrained.
The chart that changes the conversation
Before discussing controls, build the baseline. Invalidation rate is a process metric and should be charted like one. The data is already in your LIMS.
- Export 24 months of tests: test id, method, analyst, result disposition, date.
- Compute invalidations per 1,000 tests, monthly, overall.
- Stratify by method and by analyst. Report the interquartile range, not the mean.
- Flag any analyst-method pair more than two standard deviations above the site median for that method.
- Plot the series with control limits. Look for step changes rather than points.
This is not a fishing expedition against analysts, and it should not be framed that way internally. A high rate for one method across all analysts is a method problem. A step change following an instrument change is an instrument problem. Only a persistent analyst-specific divergence across methods raises a personnel question, and even then the first hypothesis should be training.
The OOS Invalidation Receipt
Two signatures over one canonical statement. The analyst who performed the investigation and the QA approver each sign the identical object, from distinct credentials on distinct authenticators.
{
"type": "manav-stmt/1",
"action": "invalidate_oos_result",
"render": [
"Result: [test id] — [method] — [value] [unit] vs spec [range]",
"Instrument: [id] Column/lot: [id] Analyst: [name]",
"Assignable cause: [classification]",
"Basis: [rationale as written]",
"Investigation: [QMS reference, phase]"
],
"constraints": { "distinct_credential": true, "distinct_aaguid": true }
}Both parties sign the rationale as written, which means the rationale becomes immutable at the moment of signing. That single property removes the most common evidentiary criticism of an invalidation record, and it costs nothing operationally.
What the receipt does not do
It does not make the assignable cause determination correct. A laboratory can sign, with full cryptographic rigour, an invalidation that a reviewer would disagree with. Evidence of who decided is not evidence that the decision was sound.
What it does is separate two questions that are currently entangled. Today, an inspector who doubts an invalidation is simultaneously doubting whether the record is accurate and whether the judgement was right. With a signed receipt, the first question is settled and only the second remains — which is the scientific argument the laboratory should want to have.
Sequencing the work
- Build the invalidation-drift chart first. It costs nothing and it tells you whether you have a story to defend.
- Fix the reason-code taxonomy if it is coarse. A receipt over a bad classification scheme preserves a bad classification scheme.
- Add dual signing to the invalidation step only. Do not attempt to instrument every LIMS approval at once.
- Run one quarter in parallel and present both evidence packages at your next internal audit.
What an inspector reconstructs
| Question | Usual answer quality |
|---|---|
| Who decided? | An account in a LIMS |
| On what evidence? | Free text, sometimes templated |
| Was an assignable cause identified? | Recorded, quality varies |
| What did they review before deciding? | Not recorded |
| Has the pattern changed over time? | Computable, rarely computed |
The last row is worth doing before an inspector does it. An invalidation rate that drifts upward, or clusters around particular products or analysts, is a finding waiting to be made.
Objections and honest limits
“Our OOS procedure follows the guidance closely.” Procedure quality is the first thing checked and the easiest to demonstrate. What is harder is showing that a specific decision applied that procedure to that data.
“Invalidations are reviewed by quality.” By a second account, recorded the same way. A review that leaves the same artefact as the decision does not add evidence, only a second name.
Making an invalidation defensible
- Render the data being invalidated. The result, the specification, the investigation findings.
- Sign that rendering. Not a workflow transition.
- Require structured cause, not free text. Categories a trend can be computed over.
- Compute your invalidation rate quarterly. Before someone else does.
Terms used here
- Out-of-specification
- A result outside established acceptance criteria, triggering a defined investigation.
- Assignable cause
- An identified laboratory error justifying invalidation — the finding the whole decision turns on.
- Phase I investigation
- The initial laboratory review determining whether an assignable cause exists.
Frequently asked questions
Does this suggest laboratories routinely falsify results? No. The overwhelming majority of invalidations are legitimate and well investigated. The argument is that the record cannot currently demonstrate the difference, which disadvantages honest laboratories most.
Is a second signature not already required? QA approval is typically required, but both signatures are Part 11 knowledge-factor signatures applied through the same system, frequently from the same terminal. The distinctness constraints are what make the second signature independent.
What is a reasonable invalidation rate? There is no universal figure, and any article quoting one should be treated sceptically. The useful comparison is your own method-stratified rate over time, against your own history.
Would this survive an inspection challenge? The receipt is verifiable offline by the inspector against a published key, without access to your LIMS. That is a materially stronger position than a status change, though no artefact guarantees an inspection outcome.
Why is invalidation so heavily scrutinised? Because it converts a failing result into one that never counted, and a pattern of invalidations is a recognised inspection finding.
What is usually missing from the record? What the decider reviewed. The result and the justification are recorded; the data they were looking at is not.
What should a site compute itself? Its invalidation rate over time, by product and by analyst, before an inspector computes it.
Where this fits in Manav
Manav binds the signer to the exact record being certified, on a credential under their sole control, and produces a receipt an inspector can verify years later without access to the manufacturing system.
Sources and further reading
- FDA — Investigating Out-of-Specification Test Results guidance
- MHRA GxP Data Integrity Guidance and Definitions.
- EudraLex Volume 4 — EU GMP guidelines
- 21 CFR Part 11 — Electronic Records; Electronic Signatures
- FIDO Alliance specifications