What is ALCOA+ and what does it mean for IT?
ALCOA+ is the set of data-integrity principles regulators expect for GxP records: data must be Attributable, Legible, Contemporaneous, Original and Accurate, plus Complete, Consistent, Enduring and Available. FDA's 2018 guidance defines the ALCOA core; PIC/S guidance adds the plus attributes. For IT, it means unique user accounts, audit trails, controlled time stamps, protected original data and reliable backup and archive.
Where the principles come from
FDA's December 2018 guidance on data integrity for drug CGMP defines data integrity as the completeness, consistency and accuracy of data, and says complete, consistent and accurate data should be attributable, legible, contemporaneously recorded, original or a true copy, and accurate: ALCOA. The guidance is nonbinding, but it ties each attribute to specific CGMP regulations in 21 CFR parts 211 and 212.
The PIC/S guidance PI 041-1, published July 1, 2021 for GMP and GDP environments, adds complete, consistent, enduring and available, commonly called ALCOA+.
What each attribute means for systems
- Attributable: every action ties to one person. That means unique logins, no shared accounts for anything beyond read-only viewing.
- Legible: records stay readable for their whole retention period, including after software upgrades.
- Contemporaneous: data is recorded when the work happens, with system clocks that users cannot change.
- Original: the first capture, or a verified true copy, is kept, including instrument raw data, not just a printout or PDF.
- Accurate: systems are validated for their intended use, and changes are controlled.
- Complete: all data and metadata needed to reconstruct the activity are kept, including reprocessing and failed runs.
- Consistent: time stamps and sequences make sense across systems.
- Enduring: records survive on durable, backed-up media for the full retention period.
- Available: records can be retrieved for review or inspection when needed.
Audit trails and metadata
FDA defines an audit trail as a secure, computer-generated, time-stamped electronic record that allows reconstruction of the creation, modification or deletion of an electronic record. Metadata, such as units, user IDs, instrument IDs and time stamps, must be kept with the data for the record's retention period.
FDA gives concrete examples. The number 23 is meaningless without metadata such as the unit, mg. An HPLC audit trail should include the user name, date and time of the run, the integration parameters used, and details of any reprocessing, with a documented justification for the change. If your systems cannot produce that, an inspector will notice.
On review frequency, FDA says to follow the CGMP-specified frequency for the underlying data where one exists, for example before batch release, and otherwise to set it by risk assessment based on data criticality and impact on product quality.
Where IT usually falls short
- Instrument PCs with a shared local login, or users with admin rights who can change the clock or delete files
- Raw data saved only to the instrument PC's local drive, with no backup
- Audit trails switched off, or never reviewed
- Cloud file shares used for GxP records without access control, versioning and retention settings
- Unvalidated spreadsheets driving release decisions
A practical starting point
List the systems that create or hold GxP data, from lab instruments to your ELN, LIMS and quality system. For each, check unique accounts, audit trail status, clock control, where the original data lives, and how it is backed up and archived. Fix the gaps by risk, document the decisions, and fold the checks into your normal change control.
Common follow-up questions
Is ALCOA+ a legal requirement?
The acronym is not itself in the regulations, but the principles map to binding CGMP requirements in 21 CFR parts 211 and 212 and to Part 11 for electronic records. FDA's guidance and PIC/S guidance are how inspectors explain what those regulations expect.
Does ALCOA+ apply to an early-stage biotech?
Formal GMP expectations apply once you make or test regulated product, and GLP or GCP rules apply to those studies. Building unique accounts, audit trails and good data storage early is far cheaper than retrofitting them before your first regulated work.
Can shared logins ever be acceptable?
FDA says shared, read-only accounts that cannot modify data or settings are acceptable for viewing data. Any account used to create, change, review or approve records must identify a unique individual.
LAN Service Group provides GxP-regulated IT for life-science companies, including unique-account and audit-trail controls on lab systems, protected storage of original data, and backup and archive that meet ALCOA+ expectations.
Talk to LAN Service Group (888) 281-7243