Data integrity means data are complete, consistent, and accurate across their lifecycle and are ALCOA: attributable, legible, contemporaneous, original/true copy, and accurate. Many authorities expect firms to extend this to ALCOA+ (complete, consistent, enduring, available). Failures are a frequent inspection focus; regulators expect effective, risk-based data governance embedded in the PQS.
ALCOA+ essentials (what authorities actually say)
- Attributable, Legible, Contemporaneous, Original/True copy, Accurate — FDA’s definition of data integrity explicitly ties to ALCOA. U.S. Food and Drug Administration
- Complete, Consistent, Enduring, Available — widely adopted by MHRA and PIC/S as part of modern GxP expectations. GOV.UKPIC/S
Key predicate-rule expectations often cited with data integrity: retain original/true copies (§211.180), maintain complete laboratory records with second-person review (§211.194), and ensure suitable controls for automatic/mechanical/electronic equipment (§211.68)
Focus areas for QC laboratories
1) Audit trails (scope, content, and review)
- What they are: secure, computer-generated, time-stamped records that reconstruct creation/modification/deletion of electronic CGMP records (e.g., HPLC audit trail must capture user, date/time, integration parameters, and any reprocessing with justification). U.S. Food and Drug Administration
- Where required: for systems that create, modify, maintain, archive, retrieve, or transmit CGMP electronic records subject to predicate rules (Part 11 scope). U.S. Food and Drug Administration
- Review: audit trails must be reviewed by personnel responsible for record review (including quality unit review) at a risk-based frequency aligned to the record review cadence. U.S. Food and Drug Administration
2) Computerized system validation for intended use
- Drug CGMP requires controls for computerized systems (e.g., validation appropriate to risk/impact) under §211.68; FDA’s 2018 DI guidance reiterates risk-based controls across software, hardware, personnel, and documentation. eCFRU.S. Food and Drug Administration
- Part 11 governs when electronic records/signatures are considered trustworthy and equivalent to paper, when applicable to records under predicate rules. eCFR
3) Access control & user privileges
- Limit the ability to alter specifications/parameters by technical means; system admin rights should be independent from record owners; avoid shared logins (only read-only viewing may be shared). Maintain documented access privileges. U.S. Food and Drug Administration
4) Raw data management (static vs dynamic)
- Dynamic electronic records (e.g., chromatography spectral/peak data) must be retained in their original electronic format with metadata; paper printouts or static images do not preserve the complete original record. Save data and changes at the time of performance; capture aborted/incomplete injections and any reprocessing in the audit trail with justification. U.S. Food and Drug Administration
5) Manual integration & chromatography
- FDA expects transparency around integration parameters and any reprocessing; these must be recorded with justification and available for second-person review.
6) Data governance (organization-wide)
- Regulators expect a defined data governance system (policies, procedures, training, technical controls, and quality culture) with management accountability to prevent, detect, and remediate issues. MHRA’s guidance is explicit on culture and governance; FDA likewise emphasizes management’s role.
Regulatory Guidance
- FDA, Data Integrity and Compliance With Drug CGMP: Q&A (Dec 2018) — FDA’s definitions (ALCOA), audit trail expectations and reviews, static vs dynamic records, access controls, and lifecycle controls. Data Integrity and Compliance With Drug CGMP
- 21 CFR Part 11 — criteria under which electronic records/signatures are trusted and considered equivalent to paper for records subject to predicate rules. PART 11—ELECTRONIC RECORDS; ELECTRONIC SIGNATURES
- 21 CFR 211 — predicate-rule requirements often implicated in DI findings: §211.68 (computerized systems), §211.180 (records: originals/true copies), §211.194 (complete lab records; second-person review). 211.68 Automatic, mechanical, and electronic equipment.
- MHRA GxP Data Integrity Guidance & Definitions (v2.2, 2021 update) — governance/culture and ALCOA+ expectations. Guidance on GxP data integrity
- PIC/S PI 041-1 (2021) — harmonized GMP/GDP expectations for data management and integrity.