ALCOA / ALCOA+ – Data Integrity Principles

This topic is part of the SG Systems Global regulatory glossary series.

Updated October 2025 • GMP / GxP • Data Integrity & Audit Trails

ALCOA (Attributable, Legible, Contemporaneous, Original, Accurate) and ALCOA+ (adding Complete, Consistent, Enduring, Available) are the bedrock data integrity principles behind modern GMP recordkeeping. They underpin controls in 21 CFR Part 11 and EU GMP Annex 11, and they’re operationalized in batch records, LIMS, QMS, labeling, and warehouse systems.

“If it isn’t ALCOA+, it isn’t reliable enough for release. These nine words are the shortest audit checklist you’ll ever use.”

1) What It Is

ALCOA/ALCOA+ describes the expected qualities of regulated data across its lifecycle—from capture and review to retention and retrieval—so inspectors can trust electronic and paper records to support regulatory decisions.

Why it matters. Data integrity failures drive 483s and warning letters in drug cGMP (Part 211), device QSR (Part 820), supplements (Part 111), and food FSMA (Part 117). ALCOA+ is the universal language inspectors use to judge whether your records can be relied on.

ALCOA core:

• Attributable – Who did it? Link each entry to a unique user or instrument ID (see eBR and LIMS integration).
• Legible – Human-readable now and in the future (font, format, metadata, context).
• Contemporaneous – Entered when the work is done; time-stamped by the system (Part 11 audit trails).
• Original – Preserve the first capture/source (raw data) or a certified true copy.
• Accurate – Correct, verified calculations; calibrated instruments; change history intact.

ALCOA “+” expansion:

• Complete – Nothing missing: raw data, results, metadata, CoA lineage, and eBMR exceptions.
• Consistent – Chronology and formats align; versioned templates/specs; synchronized clocks.
• Enduring – Survives time and technology (tested backup/restore; readable archives).
• Available – Rapidly retrievable for inspection, trending, and recall/complaint response.

2) How to Implement ALCOA+ in Practice

System controls (technical):

• Validation for intended use (risk-based per GAMP® 5), with URS→risk→testing→traceability.
• Identity & access – Unique users, RBAC, session timeout, admin oversight (ties to Part 11/Annex 11).
• Audit trails – Secure, time-stamped who/what/when/why; reviewed during batch review.
• E-signatures – Bound to individuals with signature meaning (execute/review/approve).
• Data lifecycle – Proven backup/restore, archiving, and migration; periodic review in QMS.

Procedural controls (governance):

• SOPs for data capture, second-person verification, OOS/OOT, deviations→CAPA, change control.
• Training – Role-based competence; audit-trail review skills for QA and supervisors.
• Supplier oversight – Quality/technical agreements for SaaS/hosted systems (see V5 Connect API ecosystems).
• Label governance – Template control and reconciliation in WMS; claims tied to Part 101.

3) Where ALCOA+ Shows Up

• Pharma/biologics: Part 210, 211, 600–680 with eBMR and CoA.
• Medical devices: 820, postmarket 803/806/807/821/830.
• Food & supplements: 117, 111, importer FSVP (Part 1), and labeling 101.
• GLP studies: Data integrity expectations in Part 58.

Related Industries

• Pharmaceutical Manufacturing
• Medical Device Manufacturing
• Food Processing
• Dietary Supplements
• All Industries Overview

4) How V5 Enforces ALCOA+

V5 by SG Systems Global embeds ALCOA+ into everyday work—tying master data, batch execution, lab results, and labeling into a single, inspectable record set.

• Identity & signatures. Unique users, RBAC, e-signatures with meaning of signature in eBR/eBMR (Part 11-aligned).
• Audit trails. Recipes/specs, weighings, test results, exceptions, and approvals are time-stamped and reviewable.
• Data lineage. Recipe Management → production → CoA, with LIMS integration.
• Label control. Template governance and label→SKU/lot reconciliation in WMS (supports Part 101).
• Quality system linkage. Deviations→CAPA, change control, training records; periodic review dashboards.
• Integrations. ERP/IdP connectivity via V5 Connect API for identity, orders, and inventory coherence.

End-to-end example. QA opens an investigation on a potency deviation. V5 retrieves raw instrument data (Attributable), shows eBR steps with time-stamps (Contemporaneous), enforces certified template versions (Consistent), and renders audit trails and CoA lineage (Complete/Available). Backup-restore evidence confirms records are Enduring. QA signs off corrective actions with e-signatures (Attributable/Accurate) and links CAPA to change control.

Related Glossary & Posts:
• U.S. Electronic Records: 21 CFR Part 11 | EU: Annex 11
• Pharma cGMP: 210 | 211 | 600–680
• Devices: 820 | 803 | 806 | 807 | 821 | 830
• Food & Supplements: 101 | 117 | 111 | 1 (FSVP)
• Deep Dives: GAMP® 5 | eBR Software | LIMS Integration | Certificate of Analysis