ALCOA and ALCOA+ principles explained for pharma, clinical research and FDA compliance. Learn what each principle means and how regulators apply them.
Regulators judge a company’s products and clinical trials by the reliability of the data behind them. If an inspector cannot trust a batch record, a chromatogram, or a case report form, they cannot trust the product or the trial result it supports. That is why data integrity failures remain one of the most common reasons for FDA warning letters and inspection findings.
Regulators use ALCOA to define what trustworthy data looks like. Most quality and clinical professionals first meet the acronym in training. Applying it consistently across paper records, electronic systems, and outsourced partners is harder than memorizing five words.
This guide covers the meaning of each principle, how ALCOA+ and ALCOA++ extend it, how the FDA, MHRA, EMA, and other authorities apply it, and what it looks like in GMP manufacturing, in the lab, and in clinical research. It also sets out the failures inspectors cite most often and how to build ALCOA+ into your quality system.
ALCOA is an acronym for five attributes that every GxP record must have: Attributable, Legible, Contemporaneous, Original, and Accurate. The term is generally credited to the FDA in the 1990s, and it has since become shared shorthand across regulators, industry, and training programs worldwide.
The principles apply to every record that supports a GxP decision, whatever its format: a handwritten logbook entry, a printout from a balance, electronic data in a chromatography data system, or source data captured in an electronic data capture (EDC) system. They are the measurable side of good documentation practice (GDocP). GDocP sets out how records should be created and corrected. ALCOA describes the qualities those records must have.
If you are asking what is ALCOA in clinical research, the answer is the same five attributes applied to source data and trial records. Investigator site files, case report forms, eSource, and electronic patient-reported outcomes all need to show who recorded what, when, and from which original source. Sponsors and CROs check this through GCP audit and monitoring, including source data verification.
Here is what each principle means in practice:
ALCOA+ adds four further attributes: Complete, Consistent, Enduring, and Available. Where the original five focus on how a record is created, these four address how data is managed over time.
They reflect two shifts. The first is the move from paper to electronic systems, where data can be deleted or overwritten without a visible trace. The second is longer data lifecycles, where records must survive software upgrades, system migrations, decommissioning, and retention periods that can run for decades.
The ALCOA+ data integrity principles are now the baseline expectation in most guidance documents. If your training covered only the original five, treat the ‘plus’ as part of the standard, not an optional extra.
The acronym has grown as regulators added expectations. The variations are not competing standards. Each is a successive expansion of the one before, and all of them share the same five core attributes. The label you see mostly reflects which guidance document you are reading and when it was written.
Traceable, the tenth attribute, means you can reconstruct the full history of a data point, from first capture through every change to its final use, with metadata and audit trails that show who did what, when, and why. Regulators working to ALCOA+ already expect audit trails, so ALCOA++ largely makes explicit what inspectors were already looking for.
Data integrity is ultimately about patient safety. Batch release decisions, stability conclusions, and clinical efficacy and safety findings all rest on data. If that data is incomplete, altered, or unverifiable, a product that should have been rejected can reach patients, or a trial can reach the wrong conclusion. Regulators cannot observe every batch or every patient visit, so they rely on the integrity of your records to show what happened.
That is why data integrity is a recurring theme in FDA warning letters. Citations range from missing audit trails and shared passwords to deliberate falsification, and the consequences can include import alerts, withheld approvals for new applications, and lengthy remediation. Data integrity also sits at the heart of quality assurance in the pharmaceutical industry: a quality system is only as reliable as the data that feeds it.
The risk has grown. More GxP activity now runs on electronic and cloud-based systems, more work is outsourced to CDMOs, CROs, and contract laboratories, and supply chains span many jurisdictions. In June 2026, for example, the FDA published a notice on unreliable testing data generated by third-party facilities supporting medical device submissions. AI and automation are also entering GxP processes, which raises new questions about how data is generated, transformed, and reviewed. Each of these trends adds handoffs where ALCOA+ can break down.
All major regulators share the same underlying expectation: data must be reliable, complete, and reconstructable throughout its lifecycle. They express that expectation in different documents, use slightly different terminology, and apply it through different inspection programs. For companies supplying several markets, those differences matter, particularly as US and EU pharma regulations are diverging in other areas.
The FDA’s core reference is its December 2018 guidance, Data Integrity and Compliance With Drug CGMP: Questions and Answers. It describes data integrity in terms of the ALCOA attributes and answers the practical questions inspectors raise, including when audit trails should be reviewed, why shared logins are not acceptable, and why “testing into compliance” (running unofficial samples until a passing result appears) is a violation.
If you are searching for the ALCOA principles FDA inspectors apply, it helps to know that the FDA does not have a standalone ‘ALCOA regulation’. ALCOA is how the agency describes what compliant data looks like. The legal requirements sit in the regulations: 21 CFR Part 211 for drug CGMP, including laboratory and batch production records, and 21 CFR Part 11 for electronic records and electronic signatures. In clinical research, the FDA’s Bioresearch Monitoring (BIMO) program applies the same expectations to sponsors, CROs, and investigator sites.
Much of the FDA’s inspection and enforcement activity is public, including warning letters, inspection classifications, and selected Form 483 observations. That lets you see how these expectations play out in practice. Our guide to the FDA inspection database explains where to find these records and how to use them.
The UK MHRA’s GXP Data Integrity Guidance and Definitions (March 2018) is one of the most widely referenced documents on the topic. It applies across all GxP areas: GMP, GCP, GLP, GDP, and pharmacovigilance. It explicitly sets out ALCOA+ expectations alongside data governance and data criticality and risk, so you can focus your strongest controls on the data that matters most to product quality and patient safety.
The MHRA puts particular emphasis on organizational culture and management responsibility. Data integrity is not treated as a purely technical problem. Senior management is accountable for creating an environment where staff can report errors and omissions openly, without pressure to make results look better than they are.
For companies supplying both the US and UK markets, this guidance is a practical asset. Its expectations align closely with the FDA’s, but its cross-GxP scope gives you a single framework you can apply consistently across manufacturing, laboratories, and clinical operations.
In the EU, the GMP basis for data integrity is EU GMP Chapter 4 (Documentation) and Annex 11 (Computerised Systems), part of EudraLex Volume 4. Chapter 4 sets out requirements for records and their retention. Annex 11 covers validation, audit trails, access control, and data security for computerized systems.
For clinical trials, the reference is the EMA Guideline on computerised systems and electronic data in clinical trials, which came into effect in 2023. It introduced ALCOA++ by adding Traceable to the ALCOA+ attributes, and it applies to sponsors, CROs, and investigators using electronic systems for trial data.
Further change is in progress. In July 2025, draft revisions of Chapter 4 and Annex 11 were published for consultation, together with a new draft Annex 22 on artificial intelligence. The draft Chapter 4 brings ALCOA++ into the GMP documentation framework, and the draft Annex 11 expands expectations on audit trails, access management, and periodic review. At the time of writing, the final texts have not been published and the 2011 versions remain in force. Once adopted, all three are expected to strengthen data integrity expectations. For the AI-specific requirements, see our guide to EU GMP Annex 22.
The WHO Guideline on data integrity, published in the WHO Technical Report Series (TRS 1033, Annex 4, 2021), provides a global reference for GxP data integrity. It is particularly relevant for national authorities that base their requirements on WHO standards.
PIC/S PI 041, Good practices for data management and integrity in regulated GMP/GDP environments (2021), is written for inspectors. That is why it matters: PIC/S guidance shapes inspection practice across dozens of participating authorities, including the FDA, the MHRA, and EU national inspectorates. Inspectors trained on PI 041 look for the same controls wherever they inspect.
ICH E6(R3) Good Clinical Practice, finalized by ICH in January 2025, places data integrity and risk-based quality management at the center of trial conduct. It expects sponsors and investigators to identify the data critical to trial reliability and participant safety, and to apply proportionate controls across the full data lifecycle, including the computerized systems used to capture and manage it.
The table below summarizes how the main regulators compare.
On the shop floor and in the lab, the ALCOA+ data integrity principles for GMP become specific, checkable controls. Here is what they look like in the records inspectors review most closely.
Batch manufacturing records: each step is recorded by the person who performed it, at the time it was performed (Attributable, Contemporaneous). Corrections are single-line, dated, and justified, so the original entry stays readable (Legible, Accurate). Blank forms are issued, numbered, and reconciled, so no page can be quietly replaced or lost (Complete).
Logbooks and equipment printouts: equipment use, cleaning, and maintenance logbooks need sequential, dated entries with no gaps (Consistent, Complete). Printouts from balances, pH meters, and other simple instruments are original records. They must be signed, attached to the batch or test record, and retained, not transcribed and discarded (Original). Thermal paper fades, so a certified true copy may be needed to keep it readable for the full retention period (Enduring).
Laboratory instrument data: for chromatography and other computerized lab systems, the original record is the electronic raw data, including metadata, processing methods, and audit trails, not the printed report. Every injection, including aborted runs and reintegrations, must be retained and explainable (Original, Complete).
Four controls hold these records together:
The failures inspectors cite most often map directly onto the framework. Each is shown here with the principle it breaches:
These failures are not hypothetical. They are visible in public FDA warning letters and inspection records, often described in similar terms year after year. That makes enforcement records one of the most practical data integrity resources available to QA teams. Monitoring which findings inspectors are citing, at which types of site, and in which systems shows you where to look in your own operations before an inspector does.
ALCOA+ is not something you achieve once. It needs to be designed into your quality system and maintained as part of ongoing inspection readiness. Use this checklist to test your current approach:
Expectations keep moving. ICH E6(R3) is reshaping GCP, the EU GMP revisions to Chapter 4 and Annex 11 are in progress, and regulators are still defining how AI should be used in GxP processes. Staying current is part of compliance, not separate from it.
Data integrity expectations are not set by a single document. They are set and refined through a constant stream of guidance updates, consultations, warning letters, and inspection findings across many regulators. A new warning letter can signal what inspectors will focus on next. A consultation draft can show what inspections will look like once the final text is adopted. QA, GxP, and regulatory teams need a reliable way to track all of it, without adding hours of manual searching to already full workloads.
Infodesk helps in two ways. With our regulatory intelligence solution, you can monitor updates from global health authorities in one place, so new data integrity guidance, consultations, and revisions reach the right people quickly. With inspection and enforcement intelligence, you can track inspection records and enforcement actions across seven health authorities, and check a partner’s history before you rely on its data. Together, they help you spot data integrity trends before they appear in your own inspections.
Learn more about how Infodesk supports Quality Assurance & GxP teams.
Infodesk helps QA, GxP, and regulatory teams monitor data integrity guidance, warning letters, and inspection trends across global health authorities, and act on them with confidence. Book a meeting to see how.
Share this article
Blogs
Read more