Principles of Data Integrity
The ALCOA-plus framework articulates the essential attributes that data must possess to be considered reliable and trustworthy. Data must be attributable to the individual who generated it, legible and permanently recorded, contemporaneous with the activity being documented, original or a certified true copy, and accurate, reflecting the true value observed. The extended plus attributes require that data additionally be complete, encompassing all data generated including repeat or reprocessed results; consistent, reflecting a chronologically logical sequence of events; enduring, recorded on durable media that persists throughout the required retention period; and available for review and audit throughout its lifecycle. This framework applies equally to paper-based and electronic records and underpins the regulatory expectation that quality decisions are based upon complete and reliable data.
Data integrity vulnerabilities frequently identified during regulatory inspection include selective reporting of favourable results while suppressing unfavourable results, referred to as testing into compliance; inadequate audit trail review, whereby electronic records generated by analytical instrumentation are not systematically examined for evidence of data manipulation or deletion; shared user login credentials, which compromise the attributability of electronic records to a specific individual; and backdating or fabrication of manual records. Robust data governance requires a combination of appropriate technical controls, such as validated computer systems with active audit trail functionality, and organisational controls, including a quality culture that does not create undue pressure to produce favourable results.
ALCOA+ is a data integrity framework developed to ensure that pharmaceutical data are reliable, complete, accurate, and trustworthy throughout their lifecycle. It is recommended by regulatory agencies such as the US FDA, MHRA, WHO, PIC/S, and EMA and forms a fundamental part of Good Manufacturing Practice (GMP) and Good Laboratory Practice (GLP).
Data should clearly identify who performed the activity and who recorded the data.
Example
Every HPLC chromatogram should include the analyst's name, date, and instrument identification.
Data should be clear, readable, and permanently recorded throughout the record retention period.
Example
Laboratory notebooks and electronic records must remain readable without alteration.
Data should be recorded immediately when the activity is performed.
Example
HPLC observations should be entered directly during analysis rather than later from memory.
The recorded data should be the original record or a certified true copy.
Example
Original chromatograms and raw electronic files should be retained.
Data must correctly represent the actual observations without errors.
Example
Peak areas and retention times should accurately reflect the analytical results.
All data, including valid, invalid, repeat, and failed results, must be retained.
Example
Both successful and unsuccessful HPLC runs should be documented.
Data should follow a logical chronological sequence.
Example
Sample preparation, analysis, calculations, and reporting should occur in the correct order.
Data should be recorded using durable media that remain available throughout the retention period.
Example
Electronic records stored in validated systems with secure backup.
Data should be easily retrievable whenever required for review, inspection, or audit.
Example
Electronic chromatograms should be accessible during regulatory inspections.
Repeating analyses until a desired result is obtained while ignoring failed results.
Failure to routinely review electronic audit trails that record modifications or deletions.
Using common usernames and passwords, making it impossible to identify the actual analyst.
Recording data after the event or creating fictitious results.
To maintain data integrity, laboratories should:
- Validate computerized systems.
- Use unique user IDs and secure passwords.
- Perform routine audit trail reviews.
- Implement robust SOPs and staff training.
- Promote a quality culture that discourages data manipulation.