SOP on Data Integrity (Example Template with ALCOA+)

In short: This is an illustrative SOP template for managing data integrity (DI) in a GMP quality control and quality assurance setting. It covers ALCOA+, roles, the data lifecycle, audit trail review, user access, electronic records and signatures, hybrid systems, true copies, data review, DI breaches and training. Adapt it to your own quality system; all periods and limits shown are example in-house criteria, not regulatory requirements.

New to the topic? Read What is data integrity in the pharmaceutical industry? first. For why regulators care, see Data integrity problems as main topic of FDA warning letter.

1. Objective

To define how data generated in GMP activities, on paper, electronically or in hybrid form, is kept complete, consistent and accurate throughout its lifecycle, so that decisions on product quality rest on reliable data.

2. Scope

This SOP applies to all GMP data and records generated, processed, reviewed, reported and archived in Quality Control, Quality Assurance and, by reference, other departments. It covers paper records, standalone instruments, networked computerised systems (for example chromatography data systems) and hybrid systems. Data from contract laboratories and suppliers is handled through quality agreements.

3. Responsibilities

4. Procedure

4.1 Principles: ALCOA and ALCOA+

Data must be attributable, legible, contemporaneous, original (or a true copy) and accurate. The “plus” attributes are complete, consistent, enduring and available. PIC/S PI 041-1 and the WHO guideline use these attributes as the basis of data governance, and the MHRA guidance treats the “plus” terms as emphasis rather than new expectations.

4.2 Data governance and the data lifecycle

1. Data governance means the sum of arrangements that give assurance that data is complete, consistent and accurate, whatever the format. It is part of the pharmaceutical quality system.
2. Define data owners for each system and record type, and map the data flow from generation to archive.
3. Assess DI risk for each process and system using a documented risk approach (ICH Q9 principles), looking at both impact on product quality and the opportunity for error or alteration.
4. Manage each stage of the lifecycle: generation and recording, processing, review and approval, reporting, retention and archival, retrieval, and destruction after the retention period.
5. Define the primary record for each activity in the quality system, so that it is not decided case by case.
6. Retention periods follow the applicable regulation and your marketing-authorisation commitments. Note: records related to a batch must always be retained for at least 1 year after the expiry date of the respective product batch. EU GMP Part I, Chapter 4, para 4.11 requires batch documentation to be kept for one year after expiry of the batch or at least five years after certification of the batch by the Qualified Person, whichever is longer; 21 CFR 211.180(a) requires records to be kept at least 1 year after the batch expiration date. Where a longer period applies (regulation, marketing authorisation or site policy), the longer period governs.

4.3 Good documentation practices for paper records

1. Use controlled, numbered blank forms; issuance is recorded by QA.
2. Write in indelible ink at the time of the activity; do not leave blanks (use “NA” with sign and date).
3. Make corrections with a single line strike-through, new value, initials, date and reason; the original stays legible.
4. Use clocks, and place balances, printers and records near the point of work so entries are not made later from memory.
5. A witnessed or second-person verified step is signed by both the performer and the witness; the witness records contemporaneously. Where the performer cannot countersign at the time, countersign as soon as possible and document it.

4.4 Access control and user management

1. Each user has a unique ID and password; sharing credentials is prohibited. Generic or shared accounts are not used for GMP work.
2. Access rights follow job role (least privilege) and are approved by the system owner and QA. Keep a record of rights granted and changed, including history.
3. System administrator rights are not assigned to people who generate, review or approve the data. If the organisation is too small to separate this, use separate administrator and user accounts with different privileges, and route all administrator changes through the quality system.
4. Remove or disable accounts of leavers and transferred staff promptly (example in-house criterion: on the last working day).
5. Review the user list and rights periodically (example in-house criterion: every 6 months).
6. Lock system clock, date/time and audit-trail settings; only administrators can change configuration, and each change is under change control.
7. Passwords follow the site password policy; sessions lock after inactivity.

4.5 Audit trail review

1. Computerised systems that create GMP data have a secure, computer-generated, time-stamped audit trail that records creation, modification and deletion of data without obscuring the earlier entry. The audit trail cannot be switched off or edited by users.
2. Audit trail review is part of routine data review before results are approved, performed by the group that generated the data. The reviewer checks entries relevant to the batch or run, for example changes to results, integration or processing parameters, method or sequence edits, aborted or repeated injections, deletions and time/date changes. Review is documented.
3. Example in-house criterion: audit trail for each analytical run reviewed before release of the result; system-level audit trail (configuration, user management) reviewed every 3 months.
4. QA samples audit trails, raw data and metadata during self-inspection (example: a risk-based sample each quarter).
5. Typical red flags: injections without a sample entry, reprocessing without a documented reason, sequence changed after start, results deleted or “test” injections before official runs, time stamps out of order with the logbook.
6. If the system cannot generate an audit trail, record the risk, use compensating controls (for example a controlled paper log with second-person review) and plan replacement.

An old checklist in this SOP listed laboratory do’s and don’ts (additional runs, integration changes, logbook times, missing vials). In the example below they are kept as practical rules:

4.6 Electronic records and electronic signatures

1. Systems that create, modify, store or transmit GMP records are validated for intended use, with a risk-based approach. See SOP for computerised system introduction and validation.
2. EU GMP Annex 11 sets the expectations for computerised systems in the EU (the 2011 version is the one in force; a revised draft was published for consultation in 2025).
3. For US-regulated records, 21 CFR Part 11 sets criteria for electronic records and signatures, including validation, audit trails, access limits, authority checks and signature manifestation (printed name, date/time and meaning of the signature).
4. A signed electronic record shows who signed, when, and why (review, approval, authorship). An electronic signature is linked to its record so it cannot be copied to another.
5. Signature credentials are unique to one person and never reused or reassigned.
6. Data is backed up on a defined schedule, and restore is tested (example in-house criterion: daily backup, restore test yearly).

4.7 Hybrid systems

A hybrid system combines electronic data with paper records or paper printouts (for example an instrument that creates electronic data, then a printed and signed report).

1. Define which is the master record. If the electronic data is the original, the printout is not enough on its own: the electronic raw data, metadata and audit trail must be retained and available.
2. Link paper and electronic parts with a unique reference (for example sequence name and run ID on the printout).
3. Ensure the printout is complete, including all processing, and that it is signed and dated by the person who reviewed it.
4. Control the electronic data against alteration (access control, folder permissions, audit trail) because it is easier to change than paper.
5. Plan migration to a fully electronic workflow where practicable.

4.8 True copies and archiving

1. A true copy is an exact copy of the original that keeps the content and meaning and is verified. For example a scan of a paper record may replace the original if a documented process verifies completeness and accuracy of the copy.
2. For electronic data, a true copy includes the data and the metadata required to reconstruct the activity, and a verified copy of results, methods, processing and software version details for each run.
3. Printouts from basic equipment that does not store data (for example some balances or pH meters) are the raw data.
4. Archived records are locked against change or deletion without detection, are indexed, and remain readable and recoverable through the retention period, including after software or hardware change.
5. File structure matters: flat files that users can edit or delete need stronger technical and procedural control than data held in a secure database.

4.9 Data review and approval

1. Second-person review covers raw data, calculations, audit trail, metadata, logbooks, instrument use and calibration status, and compliance with the method.
2. Reviewers have access to the original data, not only to printed summaries.
3. Review must be independent: the person who generated the data does not review it.
4. All data is considered when investigating an out-of-specification result or anomaly, including invalidated, repeated or excluded runs.
5. Data checks that rely on a calculation sheet or spreadsheet are performed using validated, locked templates. See SOP for preparation and validation of Excel spreadsheet.

4.10 Handling data integrity breaches and investigations

1. Anyone who suspects a DI problem reports it at once to the supervisor and QA, with no penalty for honest reporting. Deliberate falsification is treated under HR and disciplinary procedure.
2. QA opens a deviation, secures the evidence (do not alter the system, preserve audit trails and backups), and assesses immediate risk to product, including quarantine of affected batches if needed. Example in-house criterion: initial assessment within 1 working day.
3. Investigate to root cause: scope across other users, instruments, products, time period and sites; check whether similar issues exist elsewhere; separate human error from intentional acts.
4. Assess impact on released batches, stability data, submissions and customers; decide on recall, notification of regulators or customers where required by law or contract.
5. Define corrective and preventive actions (CAPA), including system fixes, procedural changes, retraining and, where needed, removal of access. Example in-house criterion: CAPA closed within 30 days unless justified, with an effectiveness check.
6. Management reviews DI trends in the periodic quality review.

4.11 Culture, self-inspection and periodic review

1. Management sets the tone: results are not pressured, and errors are discussed openly.
2. QA includes DI in self-inspection, with particular attention to data that bypasses normal flow (unofficial trial runs, unlogged instruments, local data folders).
3. This SOP and the DI risk assessments are reviewed periodically (example in-house criterion: every 2 years) or after an incident.

5. Training

Trainer: Head QC or QA designee. Trainees: all analysts, reviewers, system owners and administrators, and new joiners before they work on GMP data. Training covers this SOP, ALCOA+, system-specific functions, audit trail review, and consequences of falsification. Retrain after revision or a DI event (example: refresher yearly). Keep training records and an assessment of effectiveness.

6. Distribution

Controlled copy 1: Head QA. Controlled copy 2: Head QC. Original: QA.

7. Annexures

Optional: audit trail review checklist, user access matrix, DI risk assessment form.

8. Abbreviations

9. Revision history

Frequently asked questions

What is the difference between data integrity and data quality?

Data integrity is about keeping data complete, consistent and accurate over its lifecycle. Data quality is about whether the data is fit for its purpose. Good integrity controls do not by themselves guarantee good quality data.

Does every audit trail entry need review?

Regulators accept a risk-based approach: review the entries that matter for GMP decisions, such as creation, change and deletion of data, processing and result changes. The depth and frequency are set by you and justified, as in the example criteria above.

Is a printout enough as the original record?

Only if the printout is the full original record, as with a simple balance. If the system keeps electronic data, the electronic raw data and metadata remain the original and must be kept and be reviewable.

Are ALCOA principles a legal requirement?

ALCOA and ALCOA+ are the way regulators describe good data. The legal requirements sit in GMP rules (for example EU GMP Chapter 4 and Annex 11, 21 CFR 211 and Part 11); the guidance documents below explain how inspectors read them.

References

• MHRA, “GXP” Data Integrity Guidance and Definitions, Revision 1, March 2018 (GOV.UK; its page notes that an OECD advisory document of 2021 takes precedence for GLP).
• US FDA, Guidance for Industry: Data Integrity and Compliance With Drug CGMP, Questions and Answers, December 2018.
• WHO, Guideline on data integrity, Annex 4, WHO Technical Report Series No. 1033, 2021.
• PIC/S, PI 041-1, Good Practices for Data Management and Integrity in Regulated GMP/GDP Environments, 1 July 2021.
• European Commission, EudraLex Volume 4, Annex 11: Computerised Systems (2011); revised draft Annex 11 published for consultation in 2025 (not adopted as of October 2026).
• US FDA, 21 CFR Part 11, Electronic Records; Electronic Signatures (eCFR).
• European Commission, EudraLex Volume 4, Part I, Chapter 4: Documentation (2011), para 4.11 (batch documentation retention).
• US FDA, 21 CFR 211.180(a), General requirements (record retention), eCFR.
• ICH Q9(R1), Quality Risk Management, Step 4, 18 January 2023.