ALCOA+ Data Integrity in Pharma: Complete Guide and Checklist

In short: Data integrity means that the data behind every GMP decision is complete, consistent, accurate and trustworthy for as long as it exists. The ALCOA+ attributes (attributable, legible, contemporaneous, original, accurate, complete, consistent, enduring, available) are the practical test for any record, paper or electronic. This guide takes QA, QC, production and IT staff and students through the attributes, audit trails, user access, hybrid systems, inspection themes and a self-audit checklist, with a fictional worked example.

What is data integrity, and why do inspectors care?

Every release decision rests on records: weighing slips, chromatograms, temperature charts, batch records. If those records cannot be trusted, the decision cannot be trusted either, and a patient may take the risk.

The MHRA GXP Data Integrity Guidance and Definitions (Revision 1, March 2018, §6.4) defines data integrity as the degree to which data are complete, consistent, accurate, trustworthy and reliable, with those characteristics maintained throughout the data life cycle. WHO’s Guideline on data integrity (TRS 1033, Annex 4, 2021) says data governance and related measures are part of the quality system and that data and records should meet ALCOA+. The PIC/S guidance PI 041-1 (1 July 2021) says the same for GMP and GDP.

Data integrity is not an IT topic only. It is a behaviour topic. Most failures are not clever fraud; they are shortcuts: a shared password, a “trial” injection, a number written on a scrap of paper and copied later. For an introduction, see what is data integrity in the pharmaceutical industry, and for a procedure written as an example SOP, the SOP on data integrity.

ALCOA and ALCOA+: the attributes

The MHRA guide (§3.10) notes that it uses the acronym ALCOA rather than ALCOA+, and that expectations are the same whichever is used. ALCOA was the original list; the ”+” attributes were added to emphasise data quality across the life cycle. WHO TRS 1033 Annex 4 (§1.2) and PI 041-1 (§7.4) list all nine.

The MHRA wording for the original five is that data should be attributable to the person generating it, legible and permanent, contemporaneous, an original record (or certified true copy) and accurate, and that data governance should also make sure it is complete, consistent, enduring and available. The US FDA guidance Data Integrity and Compliance With Drug CGMP: Questions and Answers (December 2018) discusses the same ideas in relation to 21 CFR Part 211. These are examples of where Part 211 sets these expectations, not FDA’s own table: contemporaneous recording, 21 CFR 211.100(b) and 211.160(a); backup or accurate copies of computer data, 211.68(b); retention of original records or true copies, 211.180; complete records, 211.188 and 211.194.

Data governance

PI 041-1 (§5.1.1) describes data governance as the sum of arrangements that assure data integrity: whatever the process, format or technology, the record must be attributable, legible, contemporaneous, original, accurate, complete, consistent, enduring and available through its life cycle. WHO TRS 1033 Annex 4 adds that senior management is responsible for an effective data governance system (§4.3), that governance should ensure ALCOA+ (§4.4), that data should be reviewed regularly for ALCOA+ consistency, including in audits and self-inspections (§4.11), and that effort should be proportionate to the risk (§4.12).

A workable programme has six parts:

1. Policy and culture. Staff can report errors and deviations openly and are not punished for honest mistakes; falsification is dealt with firmly.
2. Data flow map. For each critical process (weighing, in-process checks, QC testing, stability, batch release) draw where data is created, processed, reviewed and stored.
3. Risk assessment. Rank each step by impact on patient safety and by the chance of being altered or missed. Spend effort where both are high.
4. Controls. Technical (access, audit trails, locks), procedural (review, GDP) and behavioural (training, supervision).
5. Review. Independent review of data with its audit trail before decisions.
6. Monitoring and CAPA. Periodic self-audit, trending of findings and corrective action through the deviation and CAPA systems.

Paper records

Paper is not automatically safe. PI 041-1 (§8.1.2) expects paper records to meet ALCOA+ over their life. In practice:

• Controlled, numbered blank forms and logbooks, issued and reconciled by QA, so that nobody can recreate or discard a page unnoticed. MHRA §5.1 asks for access to blank proformas to be controlled.
• Indelible ink, no pencil, no correction fluid; WHO TRS 1033 Annex 4 (§10.2) asks for durable media and indelible ink, and warns against erasable or heat- or light-sensitive inks.
• One-line cross-out for corrections, with the original still legible, plus date, initials and reason.
• Thermal-paper printouts photocopied or attached as a certified true copy before they fade.
• No loose “rough” sheets, sticky notes or unrecorded notes.

These are the basic good documentation practices; the same rules apply to every logbook and worksheet.

Electronic records and computerised systems

The EU GMP Annex 11 expects, among other things, that data is secured physically and electronically against damage and checked for accessibility, readability and accuracy (§7.1); that regular backups are made and that the ability to restore them is checked during validation and monitored periodically (§7.2); that clear printouts can be obtained, and for batch-release records, printouts showing whether data has changed since original entry (§8); and that physical or logical controls restrict access to authorised persons (§12.1). See also EU guidelines for computerised systems.

In the US, 21 CFR 211.68 requires that computers used in manufacture be routinely calibrated, inspected or checked; that controls ensure changes to master records are made only by authorised personnel; that input and output be checked; and that a backup file of entered data be maintained, with hard copy or alternative systems designed so that backup data are exact, complete and secure from alteration or loss. 21 CFR Part 11 (§11.10) lists the controls for closed systems, including validation (a), accurate and complete copies (b), protection of records for ready retrieval through the retention period (c), limiting access to authorised individuals (d), audit trails (e), authority checks (g) and accountability for e-signature actions (j).

User access and shared logins

MHRA §6.16 says that for systems generating, amending or storing GXP data, shared logins or generic user access should not be used, and where the system supports individual access, it must be used. The FDA Q&A (Q5) explains the concern: when credentials are shared, a unique individual cannot be identified through the login. System administrator rights should be limited to the minimum number of people, the generic administrator account should not be used for routine work, and administrators should be independent of those responsible for the record content (MHRA §6.16; FDA Q&A Q4). Keep a list of authorised users and their privileges, review it periodically, and remove leavers and role-changers promptly.

Audit trails and their review

An audit trail is, in the FDA’s words, a secure, computer-generated, time-stamped electronic record that allows reconstruction of the course of events around the creation, modification or deletion of an electronic record (FDA Q&A, Q1c). Part 11 §11.10(e) says audit trails must independently record the date and time of operator entries and actions, that changes must not obscure previously recorded information, and that audit trail documentation must be kept at least as long as the electronic records. Annex 11 §9 says audit trails should be available, convertible to an intelligible form and regularly reviewed, and that the reason for a change or deletion of GMP-relevant data should be documented.

Practical points:

• Who reviews: the people who review the record also review its audit trail, like looking at cross-outs on paper (FDA Q&A, Q7). The quality unit must still approve production and control records, which include audit trails (§211.192).
• How often: on the same schedule as the data review itself, for example after each significant manufacturing step and before batch release (FDA Q&A, Q8, citing §211.188(b) and §211.22).
• What to look for: deletions, edits after approval, reprocessing, changed integration, changed sample names, changed system clock, failed logins, repeated injections of the same sample, audit trail switched off.
• Always on: WHO TRS 1033 Annex 4 (§11.11) says relevant audit trails should be enabled at installation and stay enabled, with periodic verification.
• Systems without audit trails: WHO (§11.12) expects documented mitigation for defined temporary periods, such as paper-based controls or add-on software, and a plan to fix it.

Metadata, static and dynamic data

Metadata describe other data and give them context and meaning; they form an integral part of the original record (MHRA §6.3). The number “3.5” means nothing without the unit, the product, the date and the person. FDA Q&A (Q1d) distinguishes static records (a paper record or electronic image) from dynamic ones, where the user can interact with the data, as with a chromatography file that can be reprocessed. Converting a dynamic record to a static printout can lose information, which is why FDA Q&A (Q10) specifically addresses whether paper printouts can replace the original electronic records of stand-alone instruments such as FT-IR. A printout or static record can serve as the original only when it captures the complete record (for example a simple balance or pH meter printout); where the electronic record is dynamic and can be reprocessed (for example chromatography or FT-IR data), the electronic data must be kept (FDA Data Integrity Q&A, December 2018).

Hybrid systems

A hybrid system produces electronic data but uses paper for signing, or a printout for the record. MHRA (§4) says that where hybrid systems are used, it should be clearly documented what constitutes the whole data set, and all records defined by it should be reviewed and retained. Increased data review is likely to be needed, because hybrid systems are vulnerable to non-attributable changes (MHRA §6.16). The usual failure is printing only the final result and discarding the electronic data. Plan to move to fully electronic or fully controlled paper.

True copies and backups

MHRA §6.11.2 allows a true copy (for example a scan of a paper record) to replace the original if a documented system verifies and records the integrity of the copy, and says a true copy must preserve the full content and meaning of the original, including the metadata and audit trail needed to keep that meaning. 21 CFR 211.180(d) likewise allows true copies such as photocopies, microfilm or other accurate reproductions. A backup is a safety copy for disaster recovery, not an archive; archived data must stay readable for the retention period, and restore tests should be recorded (Annex 11 §7.2).

Record retention

Keep batch-related records at least 1 year after the expiry date of the respective product batch (EU GMP Part I Chapter 4 §4.11, or 5 years after QP certification if longer; 21 CFR 211.180(a)), longer if local law or the marketing authorisation requires. This applies to raw data, metadata and audit trails alike, and the system must be able to show them for the whole period. Part 11 §11.10(e) requires audit trail documentation to be retained as long as the related records.

What FDA warning letters keep saying (themes)

The following themes recur in US FDA warning letters on data integrity. The list is a summary of themes, not quotations from a letter.

For real cases explained in plain language, read data integrity problems as a main topic of FDA warning letters and unofficial HPLC injections and shared common login lead to an FDA warning letter.

Worked example (fictional)

This is an invented case for teaching. The company, people and numbers are fictional.

Situation. At Zeta Pharma’s QC lab, an assay of Product X batch 24-017 gives 97.9% against a 98.0 to 102.0% limit. The analyst, Rina, notes this and tells her supervisor. Later, the batch is released after a second sample gives 99.6%. The QA reviewer, during the routine data review, opens the HPLC audit trail and finds:

• The instrument is used with a shared login “QCuser”.
• There are three injections of the same sample, with names “test”, “test2” and “test3”, before the reported sequence. No entry exists in the notebook for them.
• The first reported run was reprocessed twice with different integration parameters.

What went wrong.

What the company did.

1. Opened a deviation, put batch 24-017 on hold and started an OOS investigation under its procedure (see the OOS investigation guide).
2. Pulled the full electronic data and audit trail for the sequence and compared it with the notebook.
3. Interviewed staff without blame; found that the group had one licence, so everyone used a shared account.
4. Concluded that the second result could not be used to invalidate the first, since the first showed no assignable laboratory error.
5. Raised CAPA: buy individual licences; enforce unique logins; make audit trail review part of every data review; add a rule that all injections are recorded and any trial injection needs a deviation; retrain staff; check effectiveness after three months by sampling 20 sequences a month (example in-house criterion).
6. Reviewed other batches tested on the same instrument and assessed impact on released product.

The lesson: the failure was found because the reviewer looked at the audit trail, not just the printed report.

Self-audit checklist (printable)

This is an example in-house checklist for a QC lab or production area. Mark each Yes, No or N/A, and raise a deviation for every “No”.

Frequently asked questions

What is the difference between ALCOA and ALCOA+?

ALCOA has five attributes (attributable, legible, contemporaneous, original, accurate). ALCOA+ adds complete, consistent, enduring and available. The MHRA guide says expectations are the same whichever acronym is used.

Is a signed printout enough for a computerised system?

Not if the electronic data and audit trail are the original. Under a hybrid approach the complete data set must be defined, reviewed and retained (MHRA). A printout may be a true copy only if it preserves the full meaning of the record.

How often should audit trails be reviewed?

On the same schedule as the associated data. The FDA Q&A (Q8) gives examples where regulations already set the frequency, such as review after each significant manufacturing step and before batch release.

Can a small lab with one licence share a login?

No. Where the system supports individual accounts, they must be used (MHRA §6.16). If a system truly cannot, document a justified, time-limited mitigation and plan a fix (WHO TRS 1033 Annex 4, §11.12).

Is a trial injection ever allowed?

Only for a defined, documented purpose, such as system suitability or method development under procedure, and recorded. Running an injection to see what the result will be, and hiding it, is not acceptable. All data from the sample must be complete.

Does data integrity apply to paper records?

Yes. PI 041-1 and WHO TRS 1033 apply ALCOA+ to paper as well as electronic records.

Who owns data integrity?

Senior management is responsible for the data governance system (WHO TRS 1033 Annex 4, §4.3); every person who creates or reviews a record is responsible for its integrity.

References

1. MHRA, GXP Data Integrity Guidance and Definitions, Revision 1, March 2018 (§3.10, §4, §5.1, §6.3, §6.4, §6.11.2, §6.13, §6.16).
2. WHO, Guideline on data integrity, WHO Technical Report Series No. 1033, 2021, Annex 4.
3. PIC/S, PI 041-1, Good Practices for Data Management and Integrity in Regulated GMP/GDP Environments (1 July 2021).
4. US FDA, Data Integrity and Compliance With Drug CGMP: Questions and Answers, Guidance for Industry (December 2018).
5. 21 CFR 211.22, 211.68, 211.180, 211.188, 211.194, eCFR.
6. 21 CFR Part 11, §11.10, eCFR.
7. EudraLex Volume 4, Annex 11: Computerised Systems (2011), §7, 8, 9, 12.
8. EudraLex Volume 4, Part I, Chapter 4: Documentation, §4.11.