Who Cut Down the Cherry Tree?

I feel like George Washington deciding if I should admit to cutting down the cherry tree or not. We were just notified of a regulatory audit of our vaccine stability program scheduled in five days. We’re in a conundrum of whether to proactively bring the auditors attention to a systemic failure of our environmental monitoring system where the system crashed two weeks ago and stopped collecting data for nearly 18 hours with no alarms and no backup recorders at the time.

We’ve had numerous meetings and spent many hours investigating but are not satisfied with IT’s and HVAC maintenance group’s explanation of the event. We don’t believe we have enough information to implement a true corrective action. IT says it was a one off, extremely rare occurrence that will never happen again. The HVAC group says that there are no issues since the air handlers functioned as designed during the deviation period and there is no evidence that any actual environmental outage occurred. To top it all off, the event highlights significant shortcomings in our program.

Since it’s still an open investigation should we hope for the best—that the auditors will not discover the outage? Or should we notify them in the opening meeting or soon after that we have an unresolved outage and disclose our findings so far?

You should definitely “hope for the best.” Our practice is that when inspectors pre-request investigations and deviations for their audit we only include closed investigations. In my experience, auditors rarely get into such depth of scrutiny that they would directly observe the 18-hour data gap on their own, so the risk of detection is much more appealing than the possible 483 resulting from your voluntary disclosure.