Data integrity failures have become one of the leading causes of FDA Warning Letters and EU GMP non-compliance findings over the past decade. Regulators have made clear that incomplete, altered, or missing records - whether in electronic systems or on paper - represent a fundamental failure of GMP, not merely an administrative oversight.
This guide explains what pharmaceutical data integrity requires, how ALCOA+ forms its conceptual foundation, what regulators specifically look for during inspections, and how to build a programme that will hold up under scrutiny.
ALCOA+: The Foundation of Data Integrity
ALCOA is a mnemonic for the five core attributes of data integrity in pharmaceutical manufacturing. The "+" extends the original five to include four additional attributes adopted by regulators in subsequent guidance:
- Attributable - data must be traceable to the person or system that created it. Anonymous data entries, shared login credentials, and generic system accounts all violate this principle.
- Legible - data must be readable and permanent. Pencilled entries, overwritten text, and faded print fail legibility requirements.
- Contemporaneous - data must be recorded at the time the activity occurs, not retroactively. Backdated entries are one of the most commonly cited data integrity violations.
- Original - the first capture of data is the original record. Transcription without retention of the original, or destruction of paper records after scanning, can violate this principle if not properly controlled.
- Accurate - data must reflect what actually occurred. Rounding results, excluding out-of-specification values, or recording target values instead of actual measurements are accuracy violations.
The "+" adds:
- Complete - all data must be present, including failed runs, out-of-specification results, and cancelled batch records.
- Consistent - data must be consistent across related records (e.g. a batch record temperature matches the chart recorder output for the same time period).
- Enduring - records must be retained for the required retention period and remain readable throughout that period.
- Available - records must be accessible for review during their retention period, by the company and by regulators.
What FDA and EU GMP Expect
The FDA published its Data Integrity and Compliance guidance in 2018, and the EMA published the EU GMP Chapter 4 and Annex 11 revisions that together address data integrity for both paper and electronic records. Both regulatory bodies expect:
- Audit trails that are enabled and reviewed. Electronic systems must generate automatic audit trails for all GxP data entries, changes, and deletions. These audit trails must be reviewed as part of routine operations - not only when a problem is suspected.
- Access control systems. System access must be restricted so that users can only perform functions appropriate to their role. Shared passwords, administrator access for routine operations, and undocumented super-user accounts are all findings.
- Complete records of all testing. Out-of-specification results, invalidated tests, and failed runs must all be documented. Regulators look specifically for evidence of "testing into compliance" - running tests repeatedly and only recording the passing result.
- Blank forms not available to operators. Pre-printed or pre-completed forms left in production areas create risk of backdating. Controlled forms must be issued against specific batch records.
Most Common Data Integrity Violations
Based on FDA Warning Letter data and EMA inspection findings, the most frequent data integrity violations are:
- Audit trail not enabled, reviewed, or protected - by far the most common finding in computerised systems
- Shared user accounts - multiple operators using a single login, destroying attributability
- Backdated entries - recording results, observations, or completion entries after the fact
- Selective data deletion - deleting "failed" injections from HPLC systems before the sequence completes
- Paper records completed in advance - filling in expected values before performing an operation
- Unofficial data storage - saving instrument data to USB drives or local folders not under the quality system
Regulatory stance: The FDA has stated explicitly that data integrity violations can result in import alerts, consent decrees, and criminal referrals - not just warning letters. The agency treats deliberate data falsification differently from systemic control failures, but both trigger enforcement action.
Building a Data Integrity Programme
A robust pharmaceutical data integrity programme has four components:
- Data governance policy - a policy document establishing the company's commitment to data integrity, defining roles and responsibilities, and setting expectations for all data-generating activities
- Data flow mapping - systematic documentation of where GxP data is created, how it flows through systems, how it is stored, and who has access
- Risk-based controls - technical controls (audit trails, access management, validated systems) combined with procedural controls (two-person verification, periodic data reviews) proportionate to the risk of each data activity
- Training and culture - data integrity training for all personnel who generate or review GxP data, combined with management commitment to a culture where reporting data integrity concerns is encouraged and protected
Free Data Integrity Self-Assessment Checklist
Download our 45-point data integrity audit checklist covering ALCOA+ controls, audit trail configuration, access management, and paper record compliance.
Download Free Checklist →