Data Integrity (ALCOA+) Guide
ALCOA+ across GxP systems — with gap assessments, remediation patterns and a monitoring cadence that keeps it from drifting.
ALCOA+ is the set of attributes regulated data must have to be trusted: Attributable, Legible, Contemporaneous, Original and Accurate, extended with Complete, Consistent, Enduring and Available. It applies to paper and electronic records alike, and to every point where regulated data is created, changed, transferred or archived.
- 14:32Signed: Approved for releaseQA Manager
- 11:05Changed risk of URS-015Validation lead · Supplier test evidence acceptedMedium → Low
- 10:48Edited expected result, OQ-07Validation lead · Lockout after 5 attempts, per URSv3 → v4
- 09:12Recorded result, OQ-07Tester · Evidence attachedPassed
The original five
- 1
Attributable
You can tell who created or changed each record and when. Shared logins break this at the first question.
- 2
Legible
Readable and permanent, for people and for systems, throughout the retention period — including after a platform migration.
- 3
Contemporaneous
Recorded as the work happens, not written up afterwards. Timestamps come from the system, not from the user.
- 4
Original
The first capture, or a verified true copy with the verification recorded. For instruments, this usually means the raw data file, not a printout.
- 5
Accurate
Correct and complete, with errors corrected through a controlled process that preserves the original value.
The plus four
- 6
Complete
All data including repeats, failures and reprocessing. Deleting a failed run and keeping the passing one is the classic integrity failure.
- 7
Consistent
Sequenced correctly, with date and time applied uniformly across systems and time zones.
- 8
Enduring
Survives for the full retention period on durable media, through system replacement.
- 9
Available
Retrievable for review or inspection throughout that period, without heroic effort.
Where integrity actually breaks
In practice, findings cluster around a small number of recurring situations rather than the principles themselves.
- 10
Shared or generic accounts
Eliminated wherever regulated data is created or approved. One account, one person.
- 11
Users able to delete or overwrite raw data
Permissions prevent it. Where a system allows it, the audit trail must capture it and someone must review that.
- 12
System clocks unsynchronised
Clocks synchronised to a controlled source, and users cannot change them.
- 13
Audit trail switchable off
Cannot be disabled by any user role available in production.
- 14
Spreadsheets as uncontrolled records
Any spreadsheet holding regulated data is validated, access-controlled and version-managed, or replaced.
- 15
Unreviewed audit trails
Review is defined, scheduled, performed by someone competent to spot a problem, and recorded.
- 16
Testing into compliance
Repeating a test until it passes, without recording the earlier results, is falsification. Controls must make it impossible rather than discouraged.
The data lifecycle, point by point
Assess integrity where data moves, not only where it lives. Transfers and migrations are where it is most often lost.
- 17
Creation and capture
Instrument interfaces verified, manual entry subject to a second check where critical.
- 18
Processing
Calculations and transformations validated and reproducible, with processing parameters recorded.
- 19
Review and approval
Reviewers see the underlying data and the audit trail, not only the summary.
- 20
Transfer between systems
Checks confirm the data arrived complete and unchanged.
- 21
Archive and migration
Readability preserved across platform changes, with migration verified record by record for critical data.
- 22
Destruction
Only after the retention period, through a controlled, documented process.
Data integrity is a culture question before it is a technical one. Most serious breaches happen where people feel unable to report a bad result — controls reduce opportunity, but they do not remove the pressure that creates the motive.
Apply ALCOA+ to paper as rigorously as to electronic records. Hybrid processes, where a printout is signed against an electronic original, are where integrity is most often quietly lost.
This is a working aid, not a regulatory document, and it does not replace your own quality system procedures.
Explore related resources, products and services: GxP Copilot, TraceDraft, validation services, AI transformation.
Sources
Primary documents referred to on this page, from their official publishers.
Common questions
Prefer to talk first? Chat with us on WhatsApp or book a call with an expert.
What does ALCOA+ stand for?
Attributable, Legible, Contemporaneous, Original and Accurate — the original ALCOA attributes — extended with Complete, Consistent, Enduring and Available. Together they define the properties regulated data must have to be considered reliable, and they apply equally to paper and electronic records.
What is the difference between ALCOA and ALCOA+?
ALCOA is the original five attributes: Attributable, Legible, Contemporaneous, Original, Accurate. ALCOA+ adds Complete, Consistent, Enduring and Available, which were introduced to address gaps that became obvious with electronic systems — particularly around retaining all data including failed runs, and keeping it readable for its full retention period.
What are the most common data integrity findings?
Shared or generic user accounts that break attributability, audit trails that are never reviewed, users able to delete or overwrite raw data, unsynchronised or user-changeable system clocks, uncontrolled spreadsheets holding regulated data, and repeating a test until it passes without retaining the earlier results.
Does ALCOA+ apply to paper records?
Yes. The principles are format-independent. Hybrid processes deserve particular attention — where a printout is signed against an electronic original, it must be clear which is the raw data, how the two are linked, and that changes made after the original entry remain visible.
Who is responsible for data integrity?
Everyone who creates, reviews or approves regulated data, with senior management accountable for the culture and the systems that make integrity achievable. Most serious breaches occur where staff feel unable to report an unfavourable result, so governance has to address pressure as well as technical controls.
Put this to work on your system.
Bring a URS. We show you risk-sized testing on your own requirements.
- We reply within one business day
- We run your URS live on the call
- You get a clear plan for your system