Data Integrity and the ALCOA+ Principles in GxP

Overview

Data Integrity is the GxP requirement that every recorded data point — a test result, a batch record entry, a software configuration change — be trustworthy enough to stand on its own as evidence, without requiring anyone’s testimony to back it up. The industry-standard framework for evaluating this is ALCOA+: data must be Attributable, Legible, Contemporaneous, Original, and Accurate, and additionally Complete, Consistent, Enduring, and Available across its entire lifecycle.

This chapter builds directly on the previous two: “Standard Operating Procedures (SOPs): The Documented-Process Foundation of GxP” establishes what is supposed to happen; “Traceability and Audit Trails Across GxP Disciplines” proves what actually did happen. ALCOA+ defines the quality bar the resulting data itself must clear. Two of its principles will already feel familiar: Attributable and Contemporaneous are, in effect, those same traceability and audit trail requirements, restated as properties data itself must possess rather than properties of the system that captures it.

The ALCOA framework has a specific, traceable origin. It was coined by Stan W. Woollen of the FDA’s Office of Enforcement in the early 1990s, and formally articulated in FDA guidance titled Computerized Systems Used in Clinical Trials (FDA, April 1999). Around 2010, the framework was expanded to ALCOA+ with four additional principles — Complete, Consistent, Enduring, and Available — extending its focus from the moment of data capture to the data’s entire lifecycle. ALCOA+ is now referenced directly in FDA’s guidance Data Integrity and Compliance With Drug CGMP: Questions and Answers (FDA, December 2018), the UK’s GxP Data Integrity Guidance and Definitions (Medicines and Healthcare products Regulatory Agency, March 2018), and the World Health Organization’s Guidance on Good Data and Record Management Practices (WHO Technical Report Series No. 996, Annex 5, 2016) — making it a globally harmonized standard rather than an FDA-only expectation.

Understanding the Nine ALCOA+ Principles

A record that fails even one of these nine principles is treated as unreliable evidence, regardless of whether the underlying result it describes was actually correct. This is a recurring theme across the domain-specific chapters later in this Framework — Clinical Development, Manufacturing, and Supply Chain each depend on ALCOA+-compliant data as the foundation their entire compliance posture rests on.

Best Practice: Advance Maturity Deliberately for GxP Data Integrity

Data integrity controls scale meaningfully with enterprise maturity, and organizations should advance deliberately rather than skip stages or over-invest before they’re ready.

At the Crawl stage, data integrity relies primarily on manual discipline and periodic self-inspection — staff are trained on ALCOA+ principles and expected to apply them consistently, with data integrity issues typically caught through scheduled internal audits rather than continuous monitoring. This is a legitimate starting point, but it depends heavily on individual diligence and carries real risk of undetected drift between audits.

At the Walk stage, organizations introduce structured data integrity checks into existing quality processes — periodic risk assessments targeting specific systems, documented data integrity self-inspection programs, and formal review checkpoints built into SOPs rather than relying solely on general staff training.

At the Run stage, data integrity is enforced by system design rather than by policy alone — validated computerized systems with built-in ALCOA+ controls (enforced unique logins, system-generated timestamps, locked audit trails), continuous data integrity monitoring rather than periodic sampling, and systematic trend analysis across audit trail data to proactively surface integrity risks before they become findings.

Organizations should know which stage their data integrity controls currently operate at, and treat advancement as a deliberate, resourced decision rather than something that happens automatically as systems age.

Best Practice

Build ALCOA+ verification into the design of every GxP-relevant process and system from the start, rather than treating it as a checklist applied after the fact. When evaluating any new tool, system, or process change, explicitly test it against all nine principles — a system that satisfies eight of nine still produces unreliable data in a regulator’s eyes. Never treat a “true copy” designation casually; verify and document that a copy is genuinely complete and accurate before relying on it in place of an original.

Benefit(s)

ALCOA+-compliant data gives an organization defensible evidence during inspection — the data speaks for itself rather than requiring staff to explain or reconstruct what “really” happened. It also catches quality problems earlier: a data integrity control designed around Consistency and Completeness often surfaces a process failure before that failure would otherwise be noticed. Finally, it protects the organization’s regulatory standing directly — data integrity findings are treated with particular severity by regulators precisely because they undermine confidence in every other record the organization has ever submitted, not just the one record in question.