PIC/S Data Integrity Guidance Implementation (Part 4)

General Data Integrity Principles and Validation

Introduction to Pharmaceutical Quality Systems and Data Integrity

The Pharmaceutical Quality System (PQS) must be implemented throughout the various stages of the lifecycle of Active Pharmaceutical Ingredients (APIs) and medicinal products, encouraging the use of science-based and risk-based approaches. To ensure that inspectors are provided with sufficient information for decision-making and that this information is trustworthy, it is essential to adequately document the events or actions that informed those decisions.

Good Documentation Practices (GDocPs) are therefore fundamental components of a well-designed pharmaceutical quality system to ensure data integrity. While the application of GDocP may differ depending on the medium used to record data—paper records versus electronic records—the underlying principles apply to both formats equally.

Understanding ALCOA and ALCOA+ Principles

The fundamental concepts of GDocP are encapsulated in the ALCOA principles: Attributable, Legible, Contemporaneous, Original, and Accurate. In addition to these core principles, four supplementary attributes can be added to form what is known as ALCOA+: Complete, Consistent, Enduring, and Available. Together, these expectations ensure that events are appropriately documented and that data can be used to support informed decision-making.

Note: In recent regulatory developments, the concept of ALCOA++ has also emerged in industry practice. ALCOA++ adds two additional elements to ALCOA+: Current (ensuring data reflects the present state) and Comprehensive (ensuring all relevant contextual information is included). However, the primary regulatory framework still centers on ALCOA and ALCOA+.

ALCOA and ALCOA+ represent fundamental data integrity principles applicable to both paper-based and electronic records. These principles are embedded in various regulatory frameworks including:

• FDA 21 CFR Part 211.68 (Controls of automated systems)
• FDA 21 CFR Part 211.100 (Production and process controls)
• FDA 21 CFR Part 211.180 (Record retention)
• FDA 21 CFR Part 211.194 (Laboratory records)
• PIC/S PI-041-1 (Good Practices for Data Management and Integrity in Regulated GMP/GDP Environments, effective July 1, 2021)
• EU GMP Annex 11 (Computerized Systems) – Updated draft published October 2025
• EU GMP Chapter 4 (Documentation) – Updated draft published July 2025
• WHO Technical Report Series No. 996, Annex 5 (Guidance on Good Data and Records Management Practices)
• WHO Technical Report Series No. 1033, Annex 4 (Guideline on Data Integrity)
• USP <1029> (Good Documentation Practices) – Proposed update published July 2025

Detailed Explanation of ALCOA Principles

ALCOA refers to the state where electronic data possesses the same attributes as paper records:

A – Attributable: Data must be traceable to the individual who generated it. This requires clear identification through signatures, initials, or electronic user credentials. Regulatory anchor: 21 CFR 211.194(a) requires documentation of the identity of individuals performing and reviewing laboratory tests.

L – Legible: Data must be readable and permanent. Records must remain clear and understandable throughout their retention period. This applies to both handwritten entries (which must be in clear, legible handwriting) and electronic records (which must be readable without loss of information).

C – Contemporaneous: Data must be recorded at the time the activity is performed. Recording on scrap paper for later transcription is not acceptable. Regulatory anchor: 21 CFR 211.100(b) requires documentation of each significant step at the time it is performed; PIC/S PI-041 emphasizes contemporaneous recording as a critical principle.

O – Original: Data must be the original record or a true copy thereof. The first capture of data constitutes the true record. Regulatory anchor: 21 CFR 211.180 requires retention of original data or true copies; EU GMP Annex 11 (§8.2) requires records to indicate when data have been changed.

A – Accurate: Data must be correct, complete, truthful, and representative of the observed facts. Accuracy encompasses both precision in measurement and faithfulness in representation.

Detailed Explanation of ALCOA+ Additional Attributes

In addition to ALCOA, the following attributes define ALCOA+:

C – Complete: All data generated during an activity must be retained and available. This includes any repeat analyses, reanalysis, or reprocessing. Selective recording or cherry-picking of data is not acceptable. Complete documentation means that anyone reviewing the records can fully reconstruct the activity and understand what occurred.

C – Consistent: Data must be presented, recorded, dated, and time-stamped in the expected and defined sequence. Records should follow a logical progression with no unexplained gaps. Batch numbers, time stamps, and entries must align across the entire process. Consistency helps ensure that the chronological integrity of events is maintained.

E – Enduring: Data must be preserved in a permanent and durable manner throughout the required retention period. Records maintained on temporary media (such as scrap paper or temporary digital files) do not meet this requirement. The storage medium must be stable and protected from degradation, ensuring long-term accessibility.

A – Available: Data must be readily accessible and retrievable for review throughout its retention period. During inspections, audits, or internal reviews, authorized personnel must be able to access records without undue delay. This includes ensuring that necessary software, hardware, and documentation are maintained to read archived electronic records.

Practical Application Considerations

For Paper-Based Systems

Paper-based systems must implement robust controls including:

• Control of master templates and blank forms with proper accountability
• Version control to prevent use of obsolete forms
• Clear procedures for making corrections (single line through, initials, date)
• Prohibition of white-out, overwriting, or obliteration
• Completion of all fields or voiding of unused fields
• Storage in conditions that preserve legibility (protection from water damage, fading, etc.)

For Electronic Systems

Electronic systems must include:

• User access controls with unique individual accounts (no shared logins)
• Comprehensive audit trails recording all data creation, modification, and deletion
• Time synchronization with validated time sources
• Electronic signatures compliant with 21 CFR Part 11 or equivalent standards
• Validated data backup and recovery procedures
• Controls preventing unauthorized data manipulation

For Hybrid Systems

Hybrid systems (combining paper and electronic elements) present unique challenges and require:

• Clear definition of what constitutes the original record
• Procedures ensuring both paper and electronic components meet ALCOA+ requirements
• Controls preventing intentional or unintentional data manipulation through format conversion
• Adequate metadata retention during data transfer between systems

Data Governance and Quality Culture

Recent regulatory updates emphasize that data integrity is not solely a technical issue but fundamentally a cultural one. Organizations must:

• Establish a transparent quality culture where personnel feel empowered to report issues
• Provide adequate resources and training for data integrity
• Implement regular management review of data integrity metrics
• Conduct risk assessments focusing on business processes, not just IT systems
• Foster an environment that values accuracy over expediency

Contemporary Regulatory Landscape (2025-2026)

The regulatory environment for data integrity continues to evolve:

1. EU GMP Annex 11 Revision: The draft revision (consultation closed October 2025, expected publication mid-2026) strengthens requirements for computerized systems, explicitly requiring audit trails to be treated as GMP data subject to review and retention.
2. EU GMP Chapter 4 Update: The July 2025 draft emphasizes data governance systems and risk-management principles integrated into all documentation practices.
3. USP <1029> Update: The July 2025 proposed revision incorporates ALCOA+ principles and data integrity concepts, with plans for a separate chapter on data governance.
4. Increased Enforcement: Regulatory authorities worldwide, including FDA, EMA, MHRA, and PIC/S member authorities, continue to issue warning letters and 483 observations citing data integrity deficiencies. In 2024, a substantial proportion of FDA warning letters included data integrity citations.

Conclusion

ALCOA and ALCOA+ principles provide a comprehensive framework for ensuring data integrity throughout the pharmaceutical product lifecycle. These principles apply universally to paper-based, electronic, and hybrid systems. Successful implementation requires not only technical controls but also strong organizational commitment, adequate resources, ongoing training, and a quality culture that prioritizes integrity in all data-related activities. As regulatory expectations continue to evolve, organizations must maintain vigilance and continuously improve their data governance systems to ensure compliance and, ultimately, patient safety.

Comparative Overview: ALCOA, ALCOA+, and ALCOA++

Principle	ALCOA	ALCOA+	ALCOA++ (Industry Practice)	Regulatory Basis
Attributable	✓	✓	✓	21 CFR 211.194(a)
Legible	✓	✓	✓	GMP fundamental requirement
Contemporaneous	✓	✓	✓	21 CFR 211.100(b), PIC/S PI-041
Original	✓	✓	✓	21 CFR 211.180, EU Annex 11 §8.2
Accurate	✓	✓	✓	21 CFR 211.194
Complete	–	✓	✓	PIC/S PI-041, WHO TRS 1033
Consistent	–	✓	✓	PIC/S PI-041, WHO TRS 996
Enduring	–	✓	✓	Record retention requirements
Available	–	✓	✓	Inspection accessibility
Traceable	–	–	✓	Enhanced industry practice
Risk-based oversight	–	–	✓	Enhanced industry practice

Note: ALCOA++ is primarily an industry term that extends ALCOA+ with additional operational rigor, including formal traceability and risk-based review cadences. While not officially codified in most regulatory documents, it represents best practices emerging from regulatory scrutiny and enforcement actions.

Comparison of Major Regulatory Documents

Document	Issuing Body	Publication/Update Date	Key Focus Areas
PIC/S PI-041-1	PIC/S	July 1, 2021 (Effective)	Comprehensive data integrity guidance (63 pages); covers paper, electronic, and hybrid systems; outsourcing considerations
FDA Data Integrity Guidance	FDA	December 2018	Questions and answers format; CGMP compliance; risk-based approach
EU GMP Annex 11	EMA/EC	2011 (Current); Draft revision October 2025	Computerized systems; audit trails as GMP data; metadata management
EU GMP Chapter 4	EMA/EC	2011 (Current); Draft update July 2025	Documentation requirements; data governance; hybrid systems
WHO TRS 996 Annex 5	WHO	2016	Good data and records management; ALCOA principles detailed in Appendix 1
WHO TRS 1033 Annex 4	WHO	2021	Data integrity guideline; ALCOA+ framework
MHRA GXP Data Integrity	MHRA	March 2018	Good practice guide; risk-based approach; definitions
USP <1029>	USP	Draft July 2025	Good documentation practices; data integrity; future data governance chapter planned

This table illustrates the global harmonization efforts while highlighting the specific emphases of different regulatory authorities.