Understanding ALCOA: The Foundation of Data Integrity in the Pharmaceutical Industry

Growing Interest in Data Integrity

In recent years, the pharmaceutical industry has seen heightened interest in data integrity. This increased focus stems from a notable rise in Warning Letters issued during recent inspections that are related to data integrity violations.

It is important to note that while data integrity is often perceived as primarily focused on electronic records, the requirements apply equally to both handwritten (paper-based) and electronic data. This dual applicability is a critical point that organizations must not overlook.

Historical Development of Data Integrity Concepts

The term “data integrity” was first introduced by the FDA in conjunction with the implementation of 21 CFR Part 11, which became effective in August 1997. This regulation marked a pivotal moment in establishing formal requirements for electronic records and electronic signatures in FDA-regulated industries.

Evolution of Regulatory Guidance

The regulatory landscape for data integrity has evolved significantly over the past two decades:

In January 2015, the UK Medicines and Healthcare Products Regulatory Agency (MHRA) issued guidance titled “MHRA GMP Data Integrity Definitions and Guidance for Industry,” followed by Revision 1.1 in March 2015. The MHRA subsequently expanded this guidance to encompass Good Laboratory Practice (GLP), Good Clinical Practice (GCP), Good Manufacturing Practice (GMP), Good Distribution Practice (GDP), and Good Pharmacovigilance Practice (GVP). In 2018, the MHRA published an updated version titled “MHRA GxP Data Integrity Definitions and Guidance for Industry,” reflecting a more comprehensive, global perspective on data integrity requirements across all GxP domains.

The World Health Organization (WHO) approved “Guidance on Good Data and Record Management Practices (GDRP)” at a meeting held on May 31, 2016. This guidance, published as Annex 5 to WHO Technical Report Series No. 996, provided international standards for data management practices.

The FDA issued a draft guidance titled “Data Integrity and Compliance With CGMP” in April 2016. This draft guidance was developed in response to an increase in data integrity-related findings during inspections. Following a public comment period, the FDA published the final guidance “Data Integrity and Compliance With Drug CGMP: Questions and Answers” in December 2018. This final guidance provides clarification on the role of data integrity in current good manufacturing practice for drugs and addresses 18 specific questions regarding data integrity requirements.

The ALCOA Concept and Its Origins

Each of these regulatory guidances—from MHRA, WHO, and FDA—introduces and emphasizes the concept known as “ALCOA.”

The FDA first formally articulated the ALCOA concept in the guidance “Computerized Systems Used in Clinical Trials,” issued in April 1999. This guidance was developed following the implementation of 21 CFR Part 11 to address the rapidly developing field of electronic data capture and related technologies. In the introduction to this guidance, the FDA explicitly stated the ALCOA principles for the first time:

“FDA’s acceptance of data from clinical trials for decision-making purposes is dependent upon its ability to verify the quality and integrity of such data during its onsite inspections and audits. To be acceptable, the data should meet certain fundamental elements of quality whether collected or recorded electronically or on paper. Data should be attributable, legible, contemporaneous, original, and accurate.”

ALCOA is an acronym derived from the first letters of five fundamental data quality attributes: Attributable, Legible, Contemporaneous, Original, and Accurate. Essentially, the FDA’s acceptance of submission data hinges upon the agency’s ability to confirm during inspections that electronic records comply with the ALCOA principles.

This ALCOA concept was reaffirmed and maintained in the revised guidance “Computerized Systems Used in Clinical Investigations,” which was published in May 2007 to supersede the 1999 guidance.

Evolution to ALCOA+ and Beyond

As pharmaceutical manufacturing and data management practices evolved, particularly with the increasing adoption of electronic systems, regulatory authorities recognized that the original five ALCOA principles needed expansion to address the complete data lifecycle more comprehensively.

Around 2010, the ALCOA principles were expanded to ALCOA+, which adds four additional principles collectively known by the acronym CCEA: Complete, Consistent, Enduring, and Available. These extended principles are now widely recognized and referenced in various regulatory guidances, including the FDA’s 2018 final guidance on data integrity and the MHRA’s 2018 GxP data integrity guidance.

ALCOA+ represents a more holistic approach to data integrity that addresses not only the quality of individual data points but also the management of data throughout its entire lifecycle—from creation through archiving and eventual disposition.

Detailed Explanation of ALCOA Principles

Attributable

“Attributable” means that data can be identified with regard to its origin and the individual who recorded it. For example, analytical data should be recorded together with both the identification of the instrument used for the analysis and the identification of the staff member who performed the analysis. This attribution must be captured contemporaneously with the data generation.

In modern electronic systems, attribution is typically achieved through secure, individual user credentials that create an audit trail linking each action or data entry to a specific person at a specific time. The use of shared login accounts is explicitly prohibited under CGMP requirements, as such practices undermine the fundamental principle of attributability.

Legible

“Legible” means that data must be readable so that appropriate actions can be taken based on that data. For electronic records, this requirement extends beyond mere readability to include meaningful interpretation. For example, if an electronic record contains an employee number recorded as “12345,” or uses numeric codes where “1” represents male and “2” represents female, or “1” represents inpatient and “2” represents outpatient, displaying or printing only these codes without proper interpretation renders the information incomprehensible and fails to meet the legibility requirement.

Electronic systems should be designed to present data in a human-readable format, with appropriate data dictionaries and display configurations that translate coded values into meaningful information. The legibility principle also applies to the duration of the record’s retention period—data must remain readable throughout the entire lifecycle, which may span decades in the pharmaceutical industry.

Contemporaneous

“Contemporaneous” means that data must be recorded at the time it is generated or observed. Records should not be created from memory after a significant time has elapsed following the actual performance of the work. The principle of contemporaneous recording is fundamental to ensuring data authenticity and reliability.

This requirement presents particular challenges in paper-based systems where there may be temptation or practical difficulties in recording data in real-time. However, it applies equally to both paper and electronic records. Modern electronic data capture systems can help enforce contemporaneous recording by using timestamps and controlling when data entry is permitted relative to when activities are scheduled or performed.

Original

“Original” means that the initial recorded date and any subsequent change history must be preserved. In Japanese regulatory terminology, this concept is referred to as “真正性” (authenticity or genuineness)—essentially proving that data is genuine and has not been altered inappropriately.

Documentation must demonstrate that the data is authentic. If either the original recorded date or the complete change history is missing, it becomes impossible to prove that the record is authentic. For electronic systems, this requirement is typically met through comprehensive audit trails that capture all data creation and modification events with timestamps and user attribution. For paper records, this is achieved through proper documentation practices where any corrections are made by striking through the original entry (while leaving it legible), recording the new value, and documenting the reason for change along with date and signature.

The 2018 FDA guidance emphasizes that dynamic electronic records must preserve their dynamic nature, and that simple printouts or static records may not satisfy the “original” requirement if they fail to capture the full metadata and interactive capabilities of the source system.

Accurate

“Accurate” means that it must be possible to demonstrate that data is correct. Proving data accuracy requires extensive documentation of work performed and multiple verification checks. For example, one must be able to demonstrate that: the analytical instrument was operated correctly; reagents were prepared correctly; reagent quantities were measured correctly; reagents were within their expiration dates; configured parameters were correct; and analytical programs were error-free.

Accuracy encompasses multiple dimensions including precision (consistency of measurements), correctness (freedom from errors), and reliability (consistency over time). Achieving and demonstrating accuracy requires robust quality systems that include equipment qualification and calibration, method validation, analyst training and qualification, documented procedures, and appropriate review and approval processes.

The accurate principle also extends to data transcription and transfer—when data is moved from one system to another or transcribed from one format to another, accuracy must be maintained and verified.

Understanding ALCOA+ (ALCOA-CCEA): The Extended Principles

As mentioned earlier, the pharmaceutical industry and regulatory authorities have expanded the original ALCOA principles to ALCOA+ by adding four essential attributes for comprehensive data integrity:

Complete

Data must be complete—a whole and intact dataset. Completeness means that all data generated during an activity must be retained, including any metadata necessary to understand and reconstruct the activity. This includes failed runs, out-of-specification results, and any data that was repeated or invalidated, along with proper justification.

The principle of completeness prohibits the selective retention of only favorable data while discarding unfavorable results. It requires that the entire data lifecycle be documented, including all relevant contextual information. For electronic systems, completeness extends to system-generated data such as audit trails, which are considered integral parts of the record.

Consistent

Data must be self-consistent and presented in chronological order. Consistency means that information should not contradict itself within or across different records, and that data definitions, units of measurement, and time sequencing must be standardized and properly aligned.

Timestamps should be synchronized across systems, and any time zone differences must be clearly documented. Data formats should remain consistent throughout the record’s lifecycle. The consistent principle helps ensure that data can be properly correlated across multiple systems and datasets, which is increasingly important in modern pharmaceutical operations that may involve multiple interconnected systems.

Enduring

Data and records must be durable, lasting throughout the required data retention period. The materials and media used to record and store data must be capable of maintaining readability and accessibility for the duration required by applicable regulations—which may be decades for pharmaceutical products.

For electronic records, enduring requires robust backup systems, disaster recovery capabilities, media migration strategies, and consideration of long-term software and hardware obsolescence. Organizations must ensure that even if original software or hardware becomes obsolete, data can still be accessed and read in its original format. The FDA’s 2018 guidance emphasizes that hybrid systems, where both paper and electronic elements contribute to the complete record, must be managed carefully to ensure all components remain enduring.

Available

Data must be readily available for review, audit, or inspection purposes throughout the retention period. Availability means that authorized personnel must be able to retrieve and review data whenever needed, within a reasonable timeframe.

For electronic systems, this requires appropriate indexing, search capabilities, and access controls. Data should be stored in a manner that facilitates prompt retrieval without requiring extensive manual effort or specialized expertise. The available principle also addresses business continuity—data must remain accessible even if service providers change, systems are decommissioned, or organizational structures evolve. For outsourced activities, contracts must ensure continued data availability even after the contract relationship ends.

Summary Table: ALCOA+ Principles

Principle	Definition	Key Requirements
Attributable	Data can be traced to its source and the person responsible	Individual user accounts; secure authentication; contemporaneous capture of user ID, timestamp, and system ID
Legible	Data is readable and meaningful throughout its lifecycle	Human-readable format; proper data dictionaries; maintained readability over retention period
Contemporaneous	Data is recorded at the time of generation	Real-time or immediate recording; timestamps; no retrospective data entry from memory
Original	First recording and all changes are preserved	Complete audit trails; version control; appropriate handling of true copies
Accurate	Data correctness can be demonstrated	Equipment qualification; method validation; trained personnel; documented procedures; verification checks
Complete	All data, including metadata, is retained	No selective data deletion; retention of all runs including failures; complete contextual information
Consistent	Data is self-consistent and chronological	Standardized definitions; aligned timestamps; no contradictions; proper sequencing
Enduring	Data persists throughout retention period	Durable media; backup systems; migration strategies; format longevity planning
Available	Data is readily retrievable when needed	Searchable systems; appropriate indexing; defined access procedures; business continuity

Practical Implementation Considerations

System Design and Configuration

Computerized systems should be designed and configured with ALCOA+ principles embedded from the outset. This includes:

• Enforcing individual user authentication and preventing shared accounts
• Implementing comprehensive audit trails that cannot be disabled or modified by users
• Providing user-friendly interfaces that display data in human-readable formats
• Incorporating appropriate controls to prevent unauthorized data modification or deletion
• Ensuring system time synchronization and appropriate timestamp generation
• Building in controls that enforce contemporaneous data entry where practical

Data Lifecycle Management

Organizations must establish comprehensive data governance frameworks that address the entire data lifecycle:

• Data generation and capture
• Data processing and analysis
• Data review and approval
• Data storage and archiving
• Data retrieval and use
• Data retention and eventual disposition

At each stage, appropriate controls must be in place to maintain all ALCOA+ principles.

Quality Culture and Training

Perhaps most importantly, maintaining data integrity requires a strong quality culture where data integrity is recognized as a core organizational value. This includes:

• Executive management commitment to data integrity
• Comprehensive training programs that educate personnel on data integrity principles and their practical application
• Clear policies and procedures that define expectations for data handling
• Effective oversight through quality assurance review and audit programs
• Mechanisms for reporting and addressing data integrity concerns without fear of reprisal

The FDA’s 2018 guidance specifically emphasizes management’s responsibility in creating a quality culture that values data integrity.

Current Industry Focus and Inspection Trends

Data integrity continues to be a primary focus area for regulatory inspections globally. FDA Warning Letters and inspection observations (Form FDA 483) from recent years show persistent data integrity violations, including:

• Use of shared login credentials
• Inadequate audit trail review
• Failure to investigate and document anomalous data
• Deletion or modification of data without appropriate justification
• Inadequate backup and disaster recovery procedures
• Failure to retain complete data including out-of-specification results

These findings underscore the critical importance of implementing robust data integrity controls and maintaining vigilance across all aspects of pharmaceutical operations.

Conclusion

ALCOA and ALCOA+ represent fundamental principles that ensure the quality, reliability, and trustworthiness of data in pharmaceutical development and manufacturing. These principles are not merely abstract concepts but practical standards that must be embedded in systems, processes, and organizational culture.

Whether data is captured on paper or electronically, in clinical trials, manufacturing, or laboratory settings, ALCOA+ principles provide the framework for ensuring that data can be trusted to support critical decisions about drug safety, efficacy, and quality. As technology continues to evolve and data systems become increasingly complex, these foundational principles remain as relevant today as when they were first articulated—serving as the cornerstone of data integrity in the pharmaceutical industry.

Organizations that embrace ALCOA+ principles and integrate them throughout their operations position themselves not only for regulatory compliance but also for operational excellence, building the robust data foundation necessary to consistently produce high-quality pharmaceutical products that protect and improve patient health.

Key References:

• FDA Guidance for Industry: “Computerized Systems Used in Clinical Trials” (April 1999)
• FDA Guidance for Industry: “Computerized Systems Used in Clinical Investigations” (May 2007)
• FDA Guidance for Industry: “Data Integrity and Compliance With Drug CGMP: Questions and Answers” (December 2018)
• MHRA: “GxP Data Integrity Definitions and Guidance for Industry” (March 2018)
• WHO Technical Report Series No. 996, Annex 5: “Guidance on Good Data and Record Management Practices” (2016)
• 21 CFR Part 11: “Electronic Records; Electronic Signatures” (August 1997)