By the PharmaTradz BD Team. Published October 2026.
ALCOA is a memory aid for what good data looks like in a regulated pharmaceutical setting. It stands for Attributable, Legible, Contemporaneous, Original and Accurate. ALCOA+ adds four more qualities: Complete, Consistent, Enduring and Available. Together they describe data integrity, which the US FDA defines as the completeness, consistency and accuracy of data.
Why should a buyer care? Every batch you buy is released on the strength of records: batch records, test results, equipment logs. If those records cannot be trusted, neither can the certificate of analysis that comes with your shipment. This guide explains each letter, the rules behind them, and what to check at a supplier.
What each letter of ALCOA+ means
| Letter | Principle | What it means in practice |
|---|---|---|
| A | Attributable | You can tell who recorded the data or did the task, and when. Each person has their own login or signature; nobody shares an account. |
| L | Legible | The record can be read and understood, now and years later. No unclear handwriting, no overwriting, no unexplained abbreviations. |
| C | Contemporaneous | Data is recorded at the time the work is done, not filled in at the end of the shift from memory. |
| O | Original | The record is the first capture of the information, or a verified "true copy" of it. A neat transcription of rough notes is not the original. |
| A | Accurate | The record reflects what actually happened. Instruments are calibrated, calculations are checked and errors are corrected openly. |
| + C | Complete | All the data is kept, including repeat tests, failed runs and the metadata (data about the data) that gives it meaning. |
| + C | Consistent | Records follow the same conventions throughout, such as date formats and units, and events appear in a logical time order. |
| + E | Enduring | The record survives intact for the whole retention period, on durable media, protected against loss. |
| + A | Available | The record can be found and read when needed, for review, for a batch investigation or for an inspector. |
ALCOA, ALCOA+ and ALCOA++
The five original letters appear directly in the FDA's guidance, which describes data as "attributable, legible, contemporaneously recorded, original or a true copy, and accurate". The UK's MHRA, in its 'GXP' Data Integrity Guidance and Definitions (Revision 1, March 2018), lists the extra ALCOA+ attributes of complete, consistent, enduring and available. It also says plainly that there is no difference in expectations between ALCOA and ALCOA+. The plus simply spells out what was already implied.
You may also see ALCOA++. The European Medicines Agency's 2023 Guideline on computerised systems and electronic data in clinical trials uses that term for ten attributes: the nine above plus Traceable. That means any change to the data or its context can be followed through its life cycle without hiding the original entry. The term comes from clinical trials, but the idea of traceability applies equally on the factory floor.
Why regulators care about data integrity
A regulator cannot watch every batch being made. It relies on the manufacturer's records to show that each batch was made and tested as approved. If a laboratory deletes a failing result and retests until it gets a pass, the paperwork looks perfect, but the medicine may not be. Patients would have no way of knowing.
That is why data integrity problems are treated so seriously. They do not just mean one bad result. They call into question every record the site has produced. The FDA's guidance expects a firm that finds such problems to investigate their full scope and root causes and put a corrective action plan in place. It notes that this may include retaining a third-party auditor and removing the individuals responsible from positions where they can influence the data.
Paper, electronic and hybrid records
ALCOA applies to every format. The MHRA guidance says data should be complete, consistent and accurate "in all its forms, i.e. paper and electronic".
For paper records, the main risks are uncontrolled forms and informal notes. The FDA expects blank forms such as batch records and laboratory worksheets to be controlled by the quality unit, and it says it is not acceptable to record data on loose pieces of paper. PIC/S guidance adds that critical blank forms should be issued with numbered copies and reconciled after use, so a missing or replaced page can be detected.
For electronic records, the risks shift to access rights, audit trails and deletion. A key point here is the difference between a static record, such as a printed page, and a dynamic record, such as a chromatogram that can be reprocessed. The FDA says a static printout of a dynamic record does not meet the requirement to keep the original. The electronic file, with its metadata, is the original.
Many sites run hybrid systems, where an instrument stores data electronically and a printout is signed on paper. These need extra care, because the paper and the electronic data must stay linked and agree with each other.
Audit trails explained
An audit trail is, in the FDA's words, a secure, computer-generated, time-stamped electronic record that allows the course of events relating to the creation, modification or deletion of an electronic record to be reconstructed. In plain terms, it is the system's own diary of who changed what, when, and why.
Having an audit trail is not enough. It must be switched on, protected from editing by ordinary users, and reviewed. The FDA expects audit trails covering changes to data to be reviewed along with the data itself, with risk assessment used to set the frequency where the regulations do not. The MHRA expects routine data review to include a documented audit trail review where risk assessment shows it is needed.
The rules behind ALCOA
ALCOA itself is not a regulation. It is a shorthand for expectations spread across several documents.
| Document | Issued by | What it adds |
|---|---|---|
| 21 CFR Part 11, Electronic Records; Electronic Signatures | US FDA | Legal requirements for electronic records, including system validation, access limited to authorised people, and secure, time-stamped audit trails in which changes do not obscure earlier entries (section 11.10(e)). |
| 21 CFR Part 211 (cGMP for finished pharmaceuticals) | US FDA | Requires work to be documented at the time it is performed and laboratory records to contain complete data from all tests. |
| EU GMP Annex 11, Computerised Systems | European Commission (EudraLex Vol 4) | Risk-based audit trails recording GMP-relevant changes and deletions with the reason documented; regular audit trail review; restricted access; secure storage and archiving. |
| Data Integrity and Compliance With Drug CGMP: Questions and Answers (December 2018) | US FDA | Practical answers on audit trail review, shared logins, blank forms, static and dynamic records, and invalidating results. |
| 'GXP' Data Integrity Guidance and Definitions (Revision 1, March 2018) | UK MHRA | Definitions of raw data, metadata, original record, true copy and data governance across all GxP areas. |
| PI 041-1, Good Practices for Data Management and Integrity in Regulated GMP/GDP Environments (in force 1 July 2021) | PIC/S | Detailed expectations for paper and electronic systems, data governance and outsourced activities. |
Annex 11 dates from 2011. A revised draft, alongside a revised Chapter 4 on documentation and a new Annex 22 on artificial intelligence, went out for public consultation from July to October 2025, so check the current version when you audit. For how these rules fit into GMP more broadly, see our guide to GMP versus cGMP.
A worked example: one assay result
An analyst tests a batch of tablets by HPLC (a liquid chromatography method that measures how much drug is present). She logs in to the chromatography software with her own username. The run is saved automatically at 10:14, the time it actually happened. That covers attributable and contemporaneous.
The electronic data file is the original. The signed printout in the batch file is only a summary. When she reviews the peaks, she adjusts how one peak is integrated. The audit trail records the first integration, the new one, her name, the time and her reason. Nothing is overwritten, so the record stays complete and traceable.
A reviewer then checks the result against the audit trail before the batch is released. If the result had failed, the failure would stay on record and go into a formal out-of-specification (OOS) investigation, not be quietly repeated. Ten years later, the data can still be opened and read. That is enduring and available.
Common data integrity failures auditors find
- Shared logins, so no individual can be identified, or analysts with administrator rights who can delete files or change settings.
- Audit trails switched off, or switched on but never reviewed.
- Testing into compliance: running unofficial or "trial" tests and reporting only the passing ones. The FDA says aborted or incomplete injections should be captured in the audit trail, investigated and justified.
- Invalidating results without a documented, scientifically sound reason.
- Uncontrolled paper: notes on scraps of paper, unnumbered blank forms, or pages rewritten "for neatness".
- Records filled in later, such as a full shift's entries in the same pen and handwriting, or signatures dated before the work was done.
- Printouts kept as the "original" while the electronic data is deleted or overwritten.
- No tested backup, so old data cannot be restored or read after a software upgrade.
What buyers should check at a supplier
You do not need to be a computer expert to test a supplier's data integrity. Ask these questions during qualification or an audit:
- Is there a written data integrity or data governance policy, and are staff trained on it?
- Does every user of laboratory and production systems have a unique login? Who holds administrator rights, and are they independent of the people generating data?
- Are audit trails enabled on chromatography, balances and other critical systems? Ask to see a recent audit trail review for a batch you are buying.
- How are blank forms and batch records issued, numbered and reconciled?
- Pick one result on your certificate of analysis and ask to trace it back to the raw electronic data, the audit trail and any repeat tests.
- Are computerised systems validated, and is that work kept current? Our guide to validation explains what to expect.
- How are data backed up and archived, and when was a restore last tested?
- Has the site had regulatory observations on data integrity, and how were they closed?
- Does your quality agreement cover data integrity and your right to audit? PIC/S guidance expects contract givers to review the data management of their contract acceptors.
For the wider supplier checks, see our guide to verifying a pharmaceutical supplier.
How PharmaTradz can help
When you source through PharmaTradz, tell us what quality evidence you need before you commit: audit reports, inspection history, validation summaries or a sample data trail for a recent batch. Our documentation and quality pack gathers these documents up front, and you can send us an RFQ to start matching with manufacturers. If an acronym in a supplier's paperwork is new to you, our pharma abbreviations A-Z explains it.
Frequently Asked Questions(FAQs)
What is the full form of ALCOA in pharma?
ALCOA stands for Attributable, Legible, Contemporaneous, Original and Accurate. It is a shorthand for the qualities that GMP records, on paper or electronic, must have to be trusted.
What is the difference between ALCOA and ALCOA+?
ALCOA+ adds Complete, Consistent, Enduring and Available to the original five letters. The MHRA's 2018 data integrity guidance says there is no difference in expectations between the two; the plus simply makes the extra qualities explicit.
What is ALCOA++?
ALCOA++ adds Traceable to the nine ALCOA+ attributes, so that any change to data can be followed without hiding the original entry. The term is used in the European Medicines Agency's 2023 guideline on computerised systems and electronic data in clinical trials.
What is data integrity in pharma?
Data integrity means that data are complete, consistent and accurate throughout their life, from first recording to archiving. Regulators rely on it because batch release and product approvals depend on the manufacturer's records being true.
Do audit trails need to be reviewed?
Yes. FDA guidance expects audit trails that capture changes to data to be reviewed along with the data, and EU GMP Annex 11 says audit trails should be regularly reviewed, with risk assessment used to decide how often.
