ALCOA+
Data Integrity
Data integrity is the degree to which data are complete, consistent and accurate throughout the data lifecycle. It is a quality system property, not a software feature — and it fails at the seams between people, process and technology.
ALCOA+ in practical terms
- Attributable — who performed the action and when, without shared accounts
- Legible — readable and permanent, including archived formats
- Contemporaneous — recorded at the time of the activity
- Original — the first capture, or a verified true copy with defined status
- Accurate — correct, with errors handled transparently
- Complete — including repeats, aborted runs, reprocessing and metadata
- Consistent — sequenced with reliable date/time controls
- Enduring — retained for the required period and retrievable
- Available — accessible for review throughout retention
Data lifecycle mapping
The most effective assessments follow the data, not the org chart. Map generation, processing, review, reporting, transfer, archival and retrieval for each critical data flow, then identify where the record could be altered, deleted or bypassed without detection.
- Hybrid paper/electronic workflows and which record is official
- Local instrument storage and unmanaged file shares
- Manual transcription and copy-paste steps
- Administrator privileges held by data originators
- System clocks, time zones and date/time controls
- Interfaces and data transformation between systems
Remediation programs
Remediation succeeds when it is risk-ranked and sequenced. Immediate compensating controls (privilege separation, audit trail review, secondary review) stabilize the situation while technical remediation, system replacement or process redesign proceeds on a realistic schedule.
Primary references
Information published on ValidationEngineering.com is educational and informational. It is not legal or regulatory advice and is not a guarantee of regulatory compliance or of any inspection outcome. Organizations remain responsible for their own quality decisions.
FAQ
ALCOA+ — common questions
- What does ALCOA+ mean in practice?
- Attributable, Legible, Contemporaneous, Original, Accurate — plus Complete, Consistent, Enduring and Available. In practice it means an audit trail that identifies the person and time, raw data retained in its original form, and no capacity to overwrite or selectively reprocess results without a record.
- How often must audit trails be reviewed?
- Risk-based and defined in procedure. Critical GMP data — chromatographic integration, batch record changes, permission changes — is typically reviewed as part of batch or result review, with periodic review of system-level events.
- What triggers most data integrity findings?
- Shared logins, disabled or unreviewed audit trails, testing into compliance, and local file storage without backup or access control. These are governance failures more often than technology failures.
Next step
Assessing or remediating data integrity risk?
Tell us about the systems, sites and findings involved.