Regulatory Requirements

Data Integrity and ALCOA+: Principles, Regulatory Requirements and Implementation in the GxP Environment

Short answer: Data integrity means that GxP data remain complete, consistent and accurate throughout their life cycle. The criteria are summarised by the acronym ALCOA, extended as ALCOA+ and ALCOA++. The FDA's 2018 guidance uses the five ALCOA attributes.[1] The MHRA, PIC/S and WHO use the nine-attribute ALCOA+.[2][3][4] Since 2023 the EMA has required the ten-attribute ALCOA++ for clinical trials.[5]

1. What data integrity means

The FDA defines data integrity as “the completeness, consistency, and accuracy of data”.[1] PIC/S PI 041-1 describes it as the degree to which data are complete, consistent, accurate, trustworthy and reliable, with these characteristics maintained throughout the data life cycle.[3] Patient safety, product quality and regulatory decisions depend on it. The FDA treats a data integrity breach as a CGMP violation.[1]

Raw data are the originally captured information. For electronic systems this means the original electronic data, not only the printout.[2] Metadata give data their context and meaning, such as time stamps, user ID, instrument or audit trail.[1][2] The original is the first recording. A certified or true copy is a verified copy that preserves the content and meaning of the original, including its metadata. 21 CFR 211.180(d) allows records to be retained as originals or as true copies.[14] The data life cycle runs from generation through processing, review, reporting, transfer, retention and retrieval to destruction.[2][3]

2. ALCOA, ALCOA+ and ALCOA++

ALCOA was coined in the early 1990s by Stan W. Woollen in the FDA's Office of Enforcement, as a memory aid for talks on Good Laboratory Practice and Bioresearch Monitoring. Woollen described its origin himself in summer 2010 in the SRCSQA newsletter The Compass (“Data Quality and the Origin of ALCOA”), recalling an audience member who later asked what the “government jargon” ALCOA on his slide stood for. These details come from secondary sources; the original was not consulted.[19] The four “plus” attributes are attributed to the EMA's 2010 reflection paper on electronic source data in clinical trials.[19] The tenth attribute, Traceable, was added by the EMA in 2023.[5]

Principle – Meaning – Paper-based example – Electronic example
PrincipleMeaningPaper-based exampleElectronic example
AttributableClear who did what and whenInitials and date next to every batch record entry, signature listPersonal user account, no shared logins
LegibleReadable and permanently understandableIndelible ink, no pencil, no correction fluidData retrievable in readable format, interpretable audit trail
ContemporaneousRecorded when the activity is performedWeight entered directly on the form, not on scrap paperSystem time stamp from synchronised time source
OriginalFirst recording or certified copyOriginal balance printout attached to the recordElectronic raw data, not a PDF printout, used for review
AccurateError-free and truthfulSecond-person check of critical transcriptionsValidated calculations, input plausibility checks
CompleteAll data including repeats and metadataFailed measurements remain documentedAborted injections visible in the audit trail
ConsistentCoherent and chronologicalSequential page numbering, uniform date formatSingle time zone (e.g. UTC), consistent sequences
EnduringLasting for the retention periodBound logbooks, thermal paper copiedValidated archiving on durable media
AvailableAccessible for review and inspectionArchive index, controlled retrievalRestorable back-ups, readability after migration
Traceable (ALCOA++)Followable across the whole life cycleCorrection with single line, date, initials and reasonAudit trail records every change, data flow from instrument to report

Which regulator uses which variant?

  • FDA (2018): data should be “attributable, legible, contemporaneously recorded, original or a true copy, and accurate (ALCOA)”.[1]
  • MHRA (2018): uses the term ALCOA but explicitly includes the “+” (Complete, Consistent, Enduring, Available).[2]
  • PIC/S PI 041-1 (1 July 2021): section 7.5 sets out the “Basic data integrity principles applicable to both paper and electronic systems (i.e. ALCOA+)”.[3]
  • WHO TRS 1033 Annex 4 (2021): uses ALCOA+ and replaces TRS 996 Annex 5 (2016).[4]
  • EMA GMP Q&A on data integrity (August 2016): the main regulatory expectation is compliance with the “ALCOA principles”.[6]
  • EMA guideline on computerised systems and electronic data in clinical trials (2023, effective 10 September 2023): “All data collected or generated in the context of a clinical trial should fulfil ALCOA++ principles.”[5]
  • Draft EU GMP Annex 11 (2025): explicitly refers to ALCOA+. The 2011 text does not use the term.[9]

The variants are compatible. The MHRA states that ALCOA and ALCOA+ describe the same expectations.[2] Using all ten attributes as a single yardstick across GMP and GCP is the pragmatic choice.

3. Regulatory framework

  • FDA, Data Integrity and Compliance With Drug CGMP – Q&A (December 2018): 18 questions, covering access control, shared logins, control of blank forms, and audit trail review frequency and responsibility.[1]
  • MHRA GXP Data Integrity Guidance and Definitions (Revision 1, March 2018): covers GMP, GCP, GLP, GDP and GPvP, with a risk-based approach to data criticality.[2]
  • PIC/S PI 041-1: 63-page inspector guidance for GMP and GDP.[3]
  • WHO TRS 1033 Annex 4: GxP-wide data integrity guideline.[4]
  • EU GMP Chapter 4 and Annex 11 (in operation since 30 June 2011): Chapter 4 governs documentation, including hybrid forms.[7] Annex 11 governs computerised systems, covering validation, audit trails, data back-up and periodic evaluation.[8] The revision drafts of Chapter 4 and Annex 11, together with a new Annex 22 on artificial intelligence, were consulted on from 7 July to 7 October 2025.[9] The draft Chapter 4 requires a data governance system integral to the PQS for electronic, paper and hybrid documentation.[10] No final version was available to us at the access date.
  • EMA guideline on computerised systems in clinical trials (2023): requires procedures for risk-based audit trail review.[5]
  • 21 CFR Part 11: electronic records and signatures, including secure, computer-generated, time-stamped audit trails.[13] See 21 CFR Part 11.
  • ICH E6(R3): section 4, “Data governance – investigator and sponsor”, says audit trails must not be disabled and must be interpretable, time stamps must be unambiguous (e.g. UTC), and procedures must exist for reviewing data and metadata.[11] The Principles and Annex 1 have applied in the EU since 23 July 2025, and Annex 2 applies from 15 January 2027.[12] See Good Clinical Practice.

Note: the ISPE GAMP Guide “Records and Data Integrity” is an important industry standard. It was not reviewed in full for this article and is therefore not cited for content.

4. Data integrity in electronic systems

Audit trail and audit trail review. The FDA defines an audit trail as a “secure, computer-generated, time-stamped electronic record” that allows the creation, modification and deletion of records to be reconstructed. Reviewing it is comparable to assessing cross-outs on paper. Reviewers of CGMP records should review the audit trails for critical data before final approval.[1] ICH E6(R3) and the EMA require the review to be planned, risk-based and documented.[5][11]

Access control and roles. Unique accounts, role-based privileges and separation of system administration from data processing are core requirements.[1][3] According to the EMA, separating duties between data life cycle stages reduces the opportunity for individuals to alter or falsify data undetected.[6]

Time stamps. System clocks must be protected and accurate, and ICH E6(R3) requires unambiguous time stamps.[4][11]

Back-up and archiving. Annex 11 requires regular back-ups. The integrity of the back-ups and the ability to restore them must be checked during validation and monitored periodically.[8]

Hybrid systems. Where electronic data and paper signatures are combined, the link between the two must be controlled. A printout does not replace dynamic electronic raw data.[1][3]

Data migration. Data and metadata, including audit trails, must be transferred completely and readably, and this must be verified.[5][11]

Data governance and data integrity risk assessment. The effort applied should be commensurate with the risk and impact of a data integrity failure.[4] Data flow mapping and criticality assessment are part of this.[2]

Benefits and prerequisites. Validated electronic systems enforce several ALCOA+ attributes technically: personal accounts make data attributable, system time stamps make them contemporaneous, immutable audit trails make them traceable, and controlled archives keep them available. One supplier source summarises typical requirements for electronic document management in biotech and CROs.[20] These benefits arise only when systems are validated (see Computer System Validation), audit trails are enabled and correctly configured, roles are segregated, users are trained and review processes are in place.

5. Typical data integrity findings

In its guidance, the FDA cites, among other things, shared logins, uncontrolled blank forms, recording data on scraps of paper and discarding results without scientific justification.[1] Figures:

  • An analysis of 85 FDA warning letters to drug manufacturers posted between 1 January and 9 December 2025 found that 15% cited data integrity: 60% for sites in India, 21% for China and 10% for the US. The FDA recommended a GMP consultant in 87% of the letters.[15]
  • According to GMP Trends' “FY 2023 Review of FDA Inspection Observations” (January 2024), the FDA “issued 510 Form 483s to drug facilities” in FY2023. The most frequent observation was 21 CFR 211.22(d) with 152 citations (19%), and 211.68(b) on computer controls ranked eighth with 61 (secondary analysis).[16]
  • The MHRA classifies data integrity and governance deficiencies mainly under Chapter 4 or Annex 11. According to Barbara Unger's analysis of the MHRA's 2018 data (285 inspections), Chapter 4 was the second most cited chapter with “almost 760 deficiencies”, after Chapter 1 with “approximately 1,500 citations”. A further analysis (PharmaWhiz, checked only as a search excerpt) gives 757 deficiencies for Chapter 4 (12% of 6,209) and 1,519 for Chapter 1.[17]
  • In its GCP metrics report for 2018/19 (91 inspections, published 12 February 2021), the MHRA records a critical finding at a CRO: “The eTMF system audit trial [sic] was extremely limited and could not be used for the review of TMF completeness over time.”[18]

A widely repeated claim that about 40% of all critical and major MHRA GMP findings from 2016 to 2023 related to data integrity could not be traced to any MHRA source, so we do not use it.

6. Culture and governance

The FDA expects management with executive responsibility to create a quality culture in which employees understand data integrity as a core value and report problems.[1] The EMA places responsibility for promoting a quality culture, together with organisational and technical measures, on senior management.[6] PIC/S stresses that companies must examine their own data management systems for weaknesses.[3] In practice this means a speak-up culture without blame for reported errors, regular ALCOA+ training and self-inspections that examine audit trails and raw data. For outsourced work, data integrity belongs in quality agreements and audits (see CRO Sponsor Oversight). How ALCOA+ is applied to controlled documents is covered in GxP Document Control and Good Documentation Practice. See also TMF/eTMF and GMP.

FAQ

What does ALCOA+ mean?

Attributable, Legible, Contemporaneous, Original, Accurate, plus Complete, Consistent, Enduring and Available.[2][3]

What is the difference between ALCOA, ALCOA+ and ALCOA++?

ALCOA has five attributes (FDA), ALCOA+ nine (MHRA, PIC/S, WHO), and ALCOA++ adds Traceable (EMA, clinical trials).[1][2][5]

Does ALCOA+ apply to paper records?

Yes. PIC/S applies the principles to both paper and electronic systems.[3]

What is an audit trail review?

A planned, risk-based review of the computer-generated change history of critical data. For the FDA, it takes place before final approval of the record.[1][11]

Which authorities require ALCOA+?

The MHRA, PIC/S inspectorates and the WHO use ALCOA+. The EMA requires ALCOA++ for clinical trials, and the FDA uses ALCOA.[1][2][3][4][5]

What are typical data integrity violations?

Shared logins, disabled or unreviewed audit trails, testing into compliance, uncontrolled forms, non-contemporaneous entries and review of printouts instead of raw data.[1][15][17]

References

  1. U.S. FDA: Data Integrity and Compliance With Drug CGMP – Questions and Answers. Guidance for Industry, December 2018. https://www.fda.gov/media/119267/download (accessed 6 November 2026)
  2. MHRA: ‘GXP’ Data Integrity Guidance and Definitions, Revision 1, March 2018. https://assets.publishing.service.gov.uk/media/5aa2b9ede5274a3e391e37f3/MHRA_GxP_data_integrity_guide_March_edited_Final.pdf (accessed 6 November 2026)
  3. PIC/S: PI 041-1 Good Practices for Data Management and Integrity in Regulated GMP/GDP Environments, 1 July 2021. https://picscheme.org/docview/4234 (accessed 6 November 2026)
  4. WHO: TRS No. 1033, Annex 4, Guideline on data integrity, 2021. https://cdn.who.int/media/docs/default-source/medicines/norms-and-standards/guidelines/inspections/trs1033-annex4-guideline-on-data-integrity.pdf (accessed 6 November 2026)
  5. EMA: Guideline on computerised systems and electronic data in clinical trials, EMA/INS/GCP/112288/2023. https://www.ema.europa.eu/en/documents/regulatory-procedural-guideline/guideline-computerised-systems-and-electronic-data-clinical-trials_en.pdf (accessed 6 November 2026)
  6. EMA: Guidance on good manufacturing practice and good distribution practice: Questions and answers, Data integrity section (August 2016). https://www.ema.europa.eu/en/human-regulatory-overview/research-development/compliance-research-development/good-manufacturing-practice/guidance-good-manufacturing-practice-good-distribution-practice-questions-answers (accessed 6 November 2026)
  7. European Commission: EudraLex Vol. 4, Chapter 4 Documentation, revision January 2011. https://health.ec.europa.eu/system/files/2016-11/chapter4_01-2011_en_0.pdf (accessed 6 November 2026)
  8. European Commission: EudraLex Vol. 4, Annex 11 Computerised Systems, 2011. https://health.ec.europa.eu/system/files/2016-11/annex11_01-2011_en_0.pdf (accessed 6 November 2026)
  9. European Commission: Stakeholders’ Consultation on EudraLex Volume 4: Chapter 4, Annex 11 and New Annex 22, 7 July to 7 October 2025. https://health.ec.europa.eu/consultations/stakeholders-consultation-eudralex-volume-4-good-manufacturing-practice-guidelines-chapter-4-annex_en (accessed 6 November 2026)
  10. European Commission: Chapter 4 Documentation, consultation draft 2025. https://health.ec.europa.eu/document/download/fa336a6e-753b-46fc-b53b-9178bacd8878_en?filename=mp_vol4_chap4_consultation_guideline_en.pdf (accessed 6 November 2026)
  11. ICH/EMA: ICH E6(R3) Guideline for good clinical practice, Step 5, EMA/CHMP/ICH/135/1995. https://www.ema.europa.eu/en/documents/scientific-guideline/ich-e6-r3-guideline-good-clinical-practice-gcp-step-5_en.pdf (accessed 6 November 2026)
  12. EMA: ICH E6 Good clinical practice – Scientific guideline (effective dates). https://www.ema.europa.eu/en/ich-e6-good-clinical-practice-scientific-guideline (accessed 6 November 2026)
  13. eCFR: 21 CFR Part 11 Electronic Records; Electronic Signatures. https://www.ecfr.gov/current/title-21/chapter-I/subchapter-A/part-11 (accessed 6 November 2026)
  14. eCFR: 21 CFR Part 211. https://www.ecfr.gov/current/title-21/chapter-I/subchapter-C/part-211 (accessed 6 November 2026)
  15. Pazhayattil A. B., Ingram M., Bhimavarapu K. R.: What 2025 FDA Warning Letters Tell Us About GMP Compliance. Pharmaceutical Online, 15 December 2025. https://www.pharmaceuticalonline.com/doc/what-fda-warning-letters-tell-us-about-gmp-compliance-0001 (accessed 6 November 2026)
  16. GMP Trends: FY 2023 Review of FDA Inspection Observations, 15 January 2024. https://gmptrends.com/wp-content/uploads/2024/01/FY-2023-Review-of-FDA-Inspections.pdf (accessed 6 November 2026)
  17. Unger B.: An Analysis Of MHRA's Annual GMP Inspection Deficiencies Report. Pharmaceutical Online. https://www.pharmaceuticalonline.com/doc/an-analysis-of-mhra-s-annual-gmp-inspection-deficiencies-report-0001 (accessed 6 November 2026)
  18. MHRA GCP Inspectorate: GCP Inspections Metrics Report, 1 April 2018 to 31 March 2019, published 12 February 2021. https://assets.publishing.service.gov.uk/media/602a8e3cd3bf7f03190cbe43/GCP_INSPECTIONS_METRICS_2018-2019_final_12-02-21.pdf (accessed 6 November 2026)
  19. Lab Manager: ALCOA and ALCOA+ Principles Explained (secondary source on origin, citing Woollen S. W., Data Quality and the Origin of ALCOA, 2010). https://www.labmanager.com/alcoa-and-alcoa-principles-explained-35921 (accessed 6 November 2026)
  20. Docuply: EDMS requirements for GxP, biotech and CROs. https://docuply.io/en/edms-requirements-gxp-biotech-cro/ (accessed 6 November 2026)