Corrected, not rewritten

A regulatory record that can be silently rewritten is not a record; it is a claim with no history behind it. That is why 21 CFR 11.10(e) requires an audit trail on electronic records under its scope — one that independently timestamps who created, modified, or deleted an entry, and one where “record changes shall not obscure previously recorded information.” The rule does not ask a company to get everything right the first time. It asks that when something changes, the earlier version stays legible next to the new one, not replaced by it.

What FDA Radar built to the same shape

Every recommended action in this product carries a human name, by database constraint — see our editorial standards. When one of those calls turns out to be wrong, the fix is not an edit to the original row. It is a new row in a separate corrections table: a note, a timestamp, and the name of the person who wrote it, linked to the item it corrects. The schema gives a correction nowhere to record a revision to itself — no updated_at, no version number — because a correction is not meant to be corrected in place either. It is meant to sit there, dated, next to what it corrects.

Nothing in the shipped code ever runs an update or a delete against that table. The only write path a reviewer has is insert. That is a narrower claim than “the database forbids it” — nothing stops a future migration from adding an edit screen — but it is the honest claim for what exists today, and it is why the item permalink can render every correction a record has ever received, oldest first, rather than a single “last updated” line that erases how many times something changed before it got there.

The correction rides along, not just the archive

A correction that only lived on a permalink nobody revisits would satisfy the letter of “never disappeared” while missing the point of it. FDA Radar’s digest renderer checks every approved item for a correction note before sending it, in the emailed digest and the plain-text version alike, and prints it under the original entry with its own labeled block. A subscriber who read the wrong call once does not have to go looking for whether it was ever fixed — the next digest that includes that item carries the fix forward with it.

The old recommendation does not get quieter as time passes. It gets a dated line next to it saying what changed, and both stay visible.

The practice

The same question is worth asking of any regulatory record system, including a company’s own DHF or CAPA log: when a past entry turns out to be wrong, does the system produce a new, dated, attributable statement of what changed — or does it quietly become correct, with no trace that it was ever anything else? The first is auditable. The second is only as trustworthy as everyone’s memory of what the record used to say. This is regulatory intelligence about how one product’s correction trail is built, never advice about what a specific correction should say about a specific device — that judgment belongs to the regulatory professional who writes it.