# Data Sharing Compliance Documentation Audit: Step-by-Step Guide By the end of this guide you will be able to plan, execute, and score a data sharing compliance documentation audit for a research group, department, or journal submission portfolio. You will know how to set audit criteria, collect evidence, verify that deposited datasets actually resolve and match their documentation, calculate compliance rates with a short script, and preserve an audit trail that stands up to a funder or regulator inquiry. You need three things on hand before you begin: 1. Copies of the policies that apply to your work (a funder data policy, a journal data availability policy, and any institutional data governance policy) 2. A spreadsheet program or a plain-text CSV file for the audit instrument 3. A computer with a terminal that has `curl` and `sha256sum` installed, plus Python 3 with the pandas library for scoring No specialized audit software is required. Everything in the walkthrough below uses standard command-line tools and a CSV file. ## What a Data Sharing Compliance Documentation Audit Is Research data sharing means making the data underlying a study available to others, either openly or through controlled access. Compliance documentation is the paper and metadata trail that proves the sharing happened as required. In a life science setting that trail usually includes: - A [data management](/blog/guides/data-management-basics-principles-processes-and-best-practices) and sharing plan (DMSP), the document submitted to a funder describing what data will be produced, where it will be deposited, and under what terms - Data availability statements in publications, which state where the data can be found - Deposited datasets in a repository, with [persistent identifiers](/knowledge/bioinformatics/persistent-identifiers-in-bioinformatics-selection-criteria-and-implementation-workflow) such as DOIs (Digital Object Identifiers, permanent links that redirect to the current location of a resource) - Metadata records describing the data, often using a standard schema - Access control documents, such as data transfer and use agreements (DTUAs) for human or otherwise sensitive data - Internal records showing who reviewed and approved each release An audit is a systematic comparison of that documented practice against predefined criteria. The audit itself must leave evidence. A compliance process is only efficient if it can show explicit verification of the applicable requirements, which is why audit frameworks in regulated data sharing emphasize capturing evidence of each check, not just performing it [1]. An audit trail is the record of that evidence: who checked what, when, against which criterion, with identifiers pointing back to the underlying documents. Governance research on compliance documentation stresses exactly this pairing, current narrative documents plus an auditable trail with identifiers to sources and supporting data, so that organizations can answer regulatory inquiries with less effort [2]. ## Why Life Science Teams Run These Audits Three distinct policy drivers create the demand for this kind of audit, and each produces documentation you can audit against. **Funder policy.** In the United States, the NIH Data Management and Sharing Policy, which took effect in 2023, requires funded researchers to plan for and execute data sharing. Institutional responses to that policy show what compliant infrastructure looks like. Washington University School of Medicine in St. Louis launched Digital Commons Data@Becker, a generalist institutional data repository that supports both open and restricted access, with a mediated curation workflow that walks researchers through consultation, metadata capture, documentation, and quality control [3]. **Journal policy.** The International Committee of Medical Journal Editors (ICMJE) requires that clinical trials registered in trial registries include a statement about sharing individual participant data. Published audits have examined whether registered trials actually carry these statements, which is itself a data sharing compliance documentation audit in miniature: a defined population, predefined criteria, and a scored result [4]. **Institutional policy.** When the Montreal Neurological Institute-Hospital committed to becoming an open science institute, the first of its kind in Canada, researchers audited data sharing practices across the institute's 2019 publications and surveyed researchers about barriers and facilitators. Of 313 unique publications examined, 66.5 percent (n=208) included a data sharing statement, and 74.5 percent (n=155) of articles had data that was publicly available. A parallel survey of researchers drew 124 responses out of 553 invited, a response rate of 22.42 percent [5]. This pair of studies, one auditing documents and one surveying people, is a useful template. The audit tells you what is happening. The survey tells you why. ## Before You Start: Preparation ### Define the audit question Write it as one sentence. Examples: - Do all publications from our lab between 2024 and 2026 contain a data availability statement that points to a working repository deposit? - Does every restricted human dataset in our portfolio have a current DTUA on file and documented access review? A vague question such as "are we compliant with data sharing rules" produces an unscorable audit. Pick the population, the time window, and the criterion set before touching any files. ### Assemble the criterion set Each criterion must be binary or measurable. Weak criterion: "data is shared appropriately." Strong criterion: "publication contains a data availability statement naming a repository AND the stated DOI resolves AND the deposited file count matches the statement." ### Decide on a census or a sample An audit can cover every item in the population (a census) or a random sample. The Montreal audit examined all 313 eligible publications, a full census of one publication year [5]. For large populations, a random sample is acceptable and standard audit practice, but the sampling method must be written down before data collection starts, not chosen afterward. ## Step-by-Step Walkthrough ![Seven-step flow of the documentation audit, from fixing criteria through scoring to archiving the audit trail.](/article-images/illustrations/data-sharing-compliance-documentation-audit-audit-walkthrough.webp) The following eight steps assume a mid-sized audit, for example 30 to 300 research outputs, one auditor, and two to four weeks of part-time work. ### Step 1. Fix the criteria and weights Create a criteria table. For a typical life science lab auditing its publication-linked data sharing, a reasonable starter set is: | # | Criterion | Evidence required | Pass condition | |--|------|----------|--------| | 1 | Data availability statement present | Publication text | Statement exists | | 2 | Statement names a specific repository | Statement text | Repository named, not "available on request" | | 3 | Persistent identifier resolves | DOI or accession ID | HTTP request returns a redirect to the deposit | | 4 | Metadata record complete | Repository page | Title, creators with ORCID iDs, date, license present | | 5 | File inventory matches statement | Deposit file list | File count and formats match the statement | | 6 | Restricted data has access documentation | DTUA or equivalent agreement | Signed agreement on file, access route described | | 7 | DMSP consistent with actual deposit | DMSP text vs. deposit | Deposit location matches the plan | Criterion 4 reflects current repository practice. Modern institutional repositories capture persistent identifiers such as ORCID iDs (Open Researcher and Contributor IDs, unique identifiers for researchers), ROR IDs (Research Organization Registry IDs, unique identifiers for institutions), and DOIs, along with the DataCite metadata schema and custom fields [3]. Auditing for those fields is auditing to the standard the infrastructure already supports. ### Step 2. Build the population list List every auditable item with a stable identifier. For a publication audit, that means DOI, first author, journal, and publication year. Store this as a CSV file: ```csv pub_id,doi,lead_author,year,journal P001,10.1234/abcd.1001,Chen,2025,J Neurosci Methods P002,10.1234/abcd.1002,Okafor,2025,eLife P003,10.1234/abcd.1003,Silva,2024,J Neurosci Methods ``` If you plan to sample rather than census, generate the sample now with a documented random method. In Python: ```python import pandas as pd frame = pd.read_csv("population.csv") sample = frame.sample(n=30, random_state=42) sample.to_csv("audit_sample.csv", index=False) print(len(sample), "items sampled from", len(frame)) ``` Expected output: ``` 30 items sampled from 313 ``` The `random_state` value makes the sample reproducible, which matters when a reviewer later asks exactly how items were selected. ### Step 3. Collect the evidence For each item, record what the document says and where the proof lives. Do not summarize. Quote the relevant sentence from the data availability statement and paste the DOI into the audit sheet. A common audit failure mode is recording a judgment ("statement present, looks fine") without the underlying evidence, which makes the audit impossible to re-check later. Governance literature makes the same point at scale: an auditable trail of compliance-related activities, with identifiers to sources and supporting data, is what lets an organization respond to inquiries efficiently [2]. ### Step 4. Verify file integrity with checksums When you download a deposited dataset to confirm it matches its documentation, record a checksum. A checksum is a fixed-length fingerprint computed from a file's bytes. If one byte changes, the fingerprint changes. The standard tool is SHA-256: ```bash sha256sum raw_counts_v2.csv ``` Expected output: ``` e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 raw_counts_v2.csv ``` Paste that hash string into your audit record. If anyone later disputes which version of the file you audited, the hash settles it. Audit frameworks in other regulated industries use the same technique, combining event-driven provenance tracking, cryptographic hashing, and immutable logging to link each document to its originating process [6], and maritime regulatory compliance research identifies immutable audit trails as a principal mechanism for strengthening document integrity and traceability [7]. The technique transfers directly to research data. ### Step 5. Verify that deposits resolve A statement pointing at a dead link fails the audit even if the statement itself is beautifully written. Check each identifier: ```bash curl -sI https://doi.org/10.1234/abcd.1002 ``` Expected output for a working DOI: ``` HTTP/2 302 location: https://example-repository.org/articles/1002 ``` A `302` means the DOI handle redirects to the deposit location, which is normal. `404` or a redirect to the publisher's home page means the identifier does not lead to the dataset, and the item fails criterion 3. For metadata completeness, open the repository page and check each required field against your criteria table. If your institution runs its own repository, ask the repository manager for the metadata export. The Washington University repository, for example, issues draft DOIs once the access type is determined and publishes the final DOI only after curation and quality control, which means a resolved final DOI is itself evidence that a curation review occurred [3]. ### Step 6. Score the audit Enter one row per item in a CSV, with one column per criterion scored as 1 (pass) or 0 (fail): ```csv pub_id,crit1,crit2,crit3,crit4,crit5,crit6,crit7 P001,1,1,1,1,1,0,1 P002,1,1,0,0,1,0,1 P003,1,0,1,1,0,0,0 ``` Compute compliance rates with pandas: ```python import pandas as pd df = pd.read_csv("audit_results.csv") criteria = ["crit1","crit2","crit3","crit4","crit5","crit6","crit7"] rates = df[criteria].mean() * 100 overall = df[criteria].mean().mean() * 100 print(rates.round(1)) print("Overall compliance:", round(overall, 1), "percent") ``` Expected output: ``` crit1 100.0 crit2 66.7 crit3 66.7 crit4 66.7 crit5 66.7 crit6 0.0 crit7 66.7 dtype: float64 Overall compliance: 61.9 percent ``` The compliance rate is simply compliant items divided by audited items, multiplied by 100. The per-criterion breakdown matters more than the single overall number, because it tells you what to fix. In this worked example, criterion 6 (restricted data access documentation) failed completely, which is a different problem from a few missing statements. For context when interpreting your results, published institutional audits have found substantial gaps. In the Montreal audit, roughly a quarter of publications in an openly committed institute still had no publicly available data [5]. A compliance rate in the 60 to 75 percent range is therefore a realistic starting point for a first audit, not a sign that your team is uniquely failing. ### Step 7. Report, intervene, and re-audit A single audit with no follow-up is a snapshot, not a quality improvement process. The standard structure, used throughout clinical and laboratory auditing, is the audit cycle: measure, act, measure again. Interventions that published audits have used include targeted education for the people producing the documentation and adding structured prompts to the templates they already work in, so that the required fields appear in front of them at the moment of writing. If your audit found that statements exist but deposits do not, the intervention is different. It belongs at the submission workflow stage, not the writing stage. If metadata fields were incomplete, the intervention belongs with the repository curation team, which is precisely the function a mediated curation workflow serves, guiding researchers through metadata capture and quality control before publication [3]. Pair the numbers with a short survey of your own researchers if you have the resources. The Montreal group ran the audit and a researcher survey in parallel, explicitly to capture perceived barriers and facilitators to data sharing, because a compliance gap with an unknown cause cannot be fixed reliably [5]. ### Step 8. Preserve the audit trail Archive the audit itself. That means the criteria table, the population list, the sampling code, the raw audit CSV, the checksums, the DOI verification dates, and the final report, all in one versioned folder with a README naming the auditor and the dates. Cloud-based storage supports this directly. Case study research on audit practice found that cloud use speeds the audit process through easy data sharing, electronic data archives, and teamwork monitoring, with the added benefit of scalability for small teams [8]. The goal is a trail in which every finding traces back, through identifiers, to the source document it came from [2]. ## Choosing Where Data Should Live: A Data Repository Comparison ![Decision path checking a deposit for a resolvable identifier, complete metadata and restricted access documentation.](/article-images/illustrations/data-sharing-compliance-documentation-audit-deposit-location.webp) The audit often fails not because researchers avoided sharing but because the data was placed somewhere that cannot support the required documentation. The deposit location decision, made at DMSP writing time, determines what your later audit can check. This is the core of any data repository comparison. | Option | Access control | Curation and metadata | Best suited for | Audit evidence produced | |----|--------|-----------|---------|-------------| | Generalist institutional repository with mediated curation | Open and restricted access tiers, restricted deposits reviewed by the human research protection office and governed by DTUAs | Fully mediated workflow, consultation, metadata capture, quality control, DataCite schema, DOIs, ORCID and ROR identifiers | Institutional compliance with funder data sharing policies, mixed data types, sensitive human data | Resolved DOI, curation record, access request log, agreement records | | Subject-specific community repository | Varies, often open with optional controlled access | Domain-standard metadata and community curation norms | Data types with established community standards, for example sequencing or imaging | Resolved accession ID, community-standard metadata | | Journal supplementary material | Open, tied to the article | Minimal, limited metadata | Small files directly tied to one paper | Article URL, limited metadata | The institutional generalist model is the most instructive to study because it was designed around a compliance requirement. The Washington University repository handles restricted datasets through Human Research Protection Office review and DTUAs before access is granted, and it tracks the full usage record. Since its 2023 launch it published 30 datasets spanning biomedical imaging, sequencing, quantitative assays, flow cytometry, and [qualitative survey](/blog/guides/designing-effective-qualitative-surveys-question-types-and-examples) data, with 4,409 views and 4,120 file downloads, and restricted datasets generated 13 access requests, three of which were granted through DTUAs [3]. Those access request logs are exactly the evidence a data sharing compliance documentation audit needs for restricted data, and a journal supplement or a personal lab webpage produces nothing comparable. The practical rule for your audit: a deposit location passes only if it produces a resolvable persistent identifier, a complete metadata record, and, for restricted data, a documented access pathway. ## Automating the Audit Manual auditing does not scale, and the published experience on automation is encouraging. At KK Women's and Children's Hospital, quarterly clinical documentation audits were re-engineered around an automated application, which expanded audit coverage, reduced human dependency and errors, and saved significant time compared with manual retrieval and cross-referencing [9]. The lesson transfers: identify the mechanical parts of your audit, such as checking whether each DOI in a batch resolves, or whether each metadata record contains the required fields, and script them. The `curl` loop in Step 5 is a small version of this. Generative AI can help with the narrative side. Large language models are well suited to generating compliance narrative artifacts such as draft policies, impact assessments, and response documents, and to assembling audit trails with identifiers to sources, which addresses a real bottleneck in which teams have abundant technology but struggle to keep compliance documentation current [2]. The same literature carries a hard warning that belongs in every audit plan: these models are prone to factual inaccuracies and do not understand the content they produce, so any AI-drafted compliance document requires human verification against the actual evidence before it enters the record [2]. In an audit context, an unverified AI-drafted statement is not documentation. It is a liability. More advanced automation directions combine provenance tracking, hashing, and continuous rather than periodic checking, drawing on frameworks developed for regulated manufacturing supply chains [6]. For most life science labs, the practical entry point is periodic scripted checks plus disciplined evidence capture, not a blockchain ledger. ## Common Mistakes and Limitations **Auditing the statement instead of the data.** A data availability statement is a claim, not evidence. Verify that the identifier resolves and the deposit exists before scoring the item as compliant. **Counting "available on request" as compliance.** If your criteria require a repository deposit, a promise to share on request fails the criterion. Decide this before the audit and apply it consistently. **Starting data collection before fixing the criteria.** Criteria written after you see the data tend to bend around the results. Write them first, freeze them, and record any later change as an amendment with a date. **Ignoring restricted-use documentation.** Open data gets all the attention, but the failure point in most life science portfolios is the controlled-access tier. Check for signed agreements, documented access review, and an access request log. The institutional repository model makes these artifacts explicit, with HRPO review and DTUA requirements for restricted deposits [3]. **Accepting AI-drafted compliance text without verification.** Generative tools produce fluent, confident text that can be factually wrong [2]. Verify every claim in an AI-drafted document against the underlying evidence before filing it. **No evidence identifiers in the audit record.** If your audit sheet says "compliant" without a quoted statement, a DOI, and a checksum, the finding cannot be re-verified. Build the identifier habit into the instrument from step one. **One audit, no re-audit.** Compliance decays. Plan the second measurement when you plan the first. **Treating low compliance as a motivation problem.** The Montreal paired design showed the value of asking researchers why the gaps exist. A barrier survey alongside the document audit distinguishes "people did not know the policy" from "the repository workflow is too slow," and those two findings demand different fixes [5]. A final limitation applies to any documentation audit. Documents show what was recorded, not everything that happened, and a finding of poor documentation is not automatically a finding of poor practice. Individual cases, especially those involving human participants data, need review by your institution's [research ethics](/blog/guides/research-ethics-fundamentals-a-practical-guide-for-early-career-scientists) or data protection office rather than resolution inside the audit itself. ## Frequently Asked Questions ### What is a data sharing compliance documentation audit? It is a systematic check of whether the documentation required for research data sharing, such as data availability statements, repository deposits, metadata records, and access agreements, exists, is accurate, and matches predefined criteria, with evidence recorded for every finding. ### Who should run this kind of audit? Research group leaders, institutional library and research data management teams, quality managers, and journal editors all run versions of it, and any of them can use the same step-by-step structure with different populations. ### How often should a data sharing compliance documentation audit be repeated? Once per audit cycle is the minimum, meaning you re-audit after each round of corrective action, and for most groups an annual cycle is a realistic rhythm. ### What documents belong in the audit packet? The criteria table, the population or sample list, the raw audit CSV, checksums for downloaded files, DOI verification outputs, signed access agreements for restricted data, and the final scored report. ### What is the difference between open and restricted access deposit? Open access data is freely downloadable by anyone, while restricted access data requires a documented request and approval process, typically governed by a data transfer and use agreement and, for human subjects data, review by a human research protection office. ### Can generative AI tools write the compliance documentation for us? They can draft narrative artifacts such as policies, plans, and responses to data requests, but they are prone to factual inaccuracies and do not understand what they produce, so a human must verify every AI-drafted document against the actual evidence before it counts. ### What sample size do we need for a documentation audit? There is no fixed threshold, a full census is best for small populations, and for large populations any pre-registered random sample with a documented selection method is defensible, with larger samples giving more precise rates. ### What should we do when the audit shows low compliance? Report the per-criterion results, match each failing criterion to a specific intervention such as template prompts, targeted education, or repository workflow support, and schedule the re-audit before closing the first one. ## Sources 1. [An ontology-based compliance audit framework for medical data sharing across europe](https://doi.org/10.34028/iajit/18/2/4) 2. [GENERATIVE AI-ENABLED COMPLIANCE DOCUMENTATION AND AUDIT TRAIL AUTOMATION FOR GLOBAL DATA CENTER GOVERNANCE](https://doi.org/10.61841/turcomat.v15i3.15512) 3. [A generalist institutional data repository offering both open and restricted access to support NIH data sharing compliance](https://pubmed.ncbi.nlm.nih.gov/41982430/) 4. [Compliance with International Committee of Medical Journal Editors policy on individual participant data sharing in clinical trial registries: An audit](https://pubmed.ncbi.nlm.nih.gov/36337374/) 5. [A cross-sectional audit and survey of Open Science and Data Sharing practices at The Montreal Neurological Institute-Hospital](https://doi.org/10.12688/f1000research.138196.1) 6. [Digital Evidence Chains for PPAP Assurance: AR-Guided Data Capture, AI-Verified Documentation, and Continuous Audit Automation for Secure Multi-Tier Supplier Traceability in Industry 4.0 Manufacturing](https://doi.org/10.54660/ijmer.2026.7.1.43-55) 7. [Blockchain for Maritime Regulatory Compliance: A Systematic Review of Digital Documentation and Audit Trail Solutions](https://doi.org/10.36948/ijfmr.2026.v08i04.85119) 8. [Developing Audit Manual Design for Audit of Small and Medium-Sized Entities and Applying Data Sharing in Cloud to Increase Audit Efficiency](https://doi.org/10.4108/eai.27-7-2021.2316869) 9. [Re-Engineering Data Processing Workflow to Automate Abbreviations Audit of Clinical Documentation](https://pubmed.ncbi.nlm.nih.gov/38269721/)