Paper or digital LOTO: what changes for a GMP audit

LOTO as a quality record

In pharmaceutical sites, every maintenance operation on qualified equipment generates records. The LOTO register is one of them: it documents that the plant was correctly isolated before the operation and that the isolation state was managed in a traced way through to restoration.

In a GMP audit — whether FDA, EMA or AIFA — LOTO is almost never inspected first. It becomes relevant when the chain is followed: a production deviation → the related maintenance operation → the LOTO procedure performed → the record that demonstrates it. It is at that point that the quality of the evidence makes the difference.

What an inspector looks at

The inspector does not assess whether the procedure is "well written". They assess whether the record is reliable. The typical questions, explicit or implicit:

Is the record contemporaneous with the event? A signature applied at the end of the shift for operations distributed over the day is formally completed but substantially reconstructed. It is the first element that draws attention.

Is the person who performed the action uniquely identifiable? An illegible signature on a paper form identifies no one. An electronic signature associated with a personal account does.

Is the integrity of the record guaranteed? A paper sheet can be modified without a trace. A compliant digital register must prevent untraced changes and retain the history of the variations.

Is there linkage with the other records? Does the LOTO performed link to the change control that authorized the operation, to the work order, to the closure report? If the systems are disconnected, the picture is fragmentary.

These questions are the operational translation of the ALCOA+ principles: attributable, legible, contemporaneous, original, accurate — plus complete, consistent, enduring, available.

The four recurring shortcomings of paper

Paper, in the sites where we have worked, repeatedly shows the same weaknesses in audit. Not because it does not work in principle, but because the discipline it requires does not hold up over time at zero cost.

Filling in afterwards. The operations are noted at the end, not at the moment they happen. All the day's signatures have the same time and the same pen stroke. For an inspector it is an immediate signal.

Approximate identification. Initials, abbreviations, indecipherable signatures. When you try to trace the operator who applied the padlock on an operation six months earlier, the record does not allow it.

Tags detached from the registers. The physical tag on the valve and the line in the register live parallel lives. Transcription errors and misalignments accumulate.

Lack of linkage. The LOTO register is in one binder, the change control in another system, the work order in a third. Recomposing the chain takes time and introduces errors.

These are recurring, not insurmountable, shortcomings. They can be mitigated with discipline and controls, but the organizational cost grows with the number of operations and the complexity of the plant.

What a digital system guarantees (and what it does not)

A well-designed digital system solves the shortcomings of paper structurally: timestamps are automatic and cannot be manipulated, operators are identified by their account, changes to the record require a justification and remain in the history, and the linkage with other systems is coded.

To be acceptable in a GMP context, however, the system must be compliant with the requirements for computerized systems:

• compliance with the EU GMP Annex 11 (computerized systems in a regulated environment)
• compliance with 21 CFR Part 11 if the site exports to the US market or produces for FDA-regulated customers
• system qualification according to GAMP5: URS, FS, DS, IQ, OQ, PQ depending on the software category
• account management with unique identification, password policy, revocation at the end of employment
• a complete audit trail, not disableable by the user, with retention for the period required by the site
• documented backup and disaster recovery

Without these requirements, a digital system is not "better than paper": it is one more non-conformity. Digitizing badly is worse than managing paper well.

What does NOT change when moving to digital

It is honest to say it: the system, on its own, does not solve the underlying problems of LOTO. The following remain entirely the site's responsibility:

• the risk assessment for each maintenance activity
• the choice of isolation process (RI, SI, N, SP) according to the 17975
• the written operating procedures describing the operation step by step
• the structured training of personnel (maintenance staff, supervisors, operators)
• the change control when a plant or a procedure is modified
• the cultural behavior that prevents shortcuts under pressure

A digital system makes the record better. It does not make the organization better. It is a point that those who sell digital solutions tend to skip and is instead the first that an experienced quality manager raises.

When the move to digital really pays off

From our experience in the sites where we operate, digital produces a substantial (not just formal) return when at least two of these conditions are met:

• the plant has dozens of isolation points and parent/child dependencies
• multiple teams work in parallel on connected areas
• the site is audit-ready (FDA, EMA, AIFA, MHRA) and every formal anomaly has a cost
• the change control is already digital and you want to link the maintenance records
• the operations are frequent (more than a few a week per area)

On simpler plants with low frequency, a well-managed paper system with periodic control remains a legitimate choice.

The Eurosystem experience

SmartLOTO was born inside regulated pharmaceutical sites, not in a laboratory. The design choices — an Annex 11-compliant audit trail, unique operator identification, a procedural constraint on the parent/child sequences, linkage with change control systems — answer questions posed by real inspectors, not imagined at a desk. We do not propose it as "the solution" to everything: it is the way we translated into hardware and software the requirements we see raised in GMP audits. Where a disciplined paper system is enough, we say so openly.