ALCOA++ Checklist for Pharmaceutical Manufacturers

Subscribe Now

The following checklist is structured by principle and covers both paper-based and electronic record environments. It is designed to be used as a self-assessment tool and as the basis for an internal ALCOA++ gap assessment programme.

Read More: How to Prepare a Vendor Qualification File That Passes Regulatory Review

Attributable

Every paper record entry should be signed or initialled by the individual who made it, with a date recorded at the time of signing. In electronic environments, individual user accounts must be assigned to named individuals with access rights reviewed periodically. Key checklist items include:

Shared login credentials do not exist for any GMP-relevant computerised system
Individual user accounts are disabled when personnel leave the organisation or change roles
The audit trail in every GMP-relevant electronic system captures user identity, action taken, date and time, and the reason for any change
Access rights to GMP-relevant systems are defined by job function and reviewed at defined intervals
Temporary or contractor access to GMP-relevant systems is time-limited and removed promptly when the assignment ends
System administrator accounts are used only for system maintenance and not for routine data entry
Blank or pre-signed forms do not exist anywhere in the GMP environment

Legible

All paper GMP records must be completed in permanent ink and stored in conditions that prevent deterioration. Electronic records stored in proprietary formats must remain accessible using currently available software throughout the retention period. Key checklist items include:

Correction fluid and erasure of any kind is not used on paper GMP records
Corrections to paper records are made by a single line through the incorrect entry, with the correct value written alongside, signed and dated, with a reason for the correction recorded
Paper records are stored in conditions that protect them from light, moisture, and temperature damage
Microfilmed or scanned archival records are periodically checked for legibility and integrity
Printed copies of electronic records are clearly identified as copies and the original electronic record is retained

Contemporaneous

Recording data at the time of the activity rather than reconstructing it later is one of the most operationally challenging ALCOA++ principles to enforce consistently. SOPs must require contemporaneous recording and this requirement must be reinforced through training and internal audit. Key checklist items include:

Pre-printed or pre-completed sections of batch records that could be completed in advance of the relevant activity are reviewed and justified
Rough notes and informal records used in the laboratory or on the production floor are retained as part of the original data set and not discarded after transcription
Timestamps in electronic systems are generated automatically and cannot be altered by individual users
Time synchronisation across all GMP-relevant computerised systems is verified periodically and documented
Back-dated entries in paper records are not permitted and any exception is documented with a clear explanation and quality review

Original

Raw data files from analytical instruments must be retained in their original electronic format. Where data is transcribed from one record to another, both records must be retained. Key checklist items include:

Printing raw data to paper and discarding the electronic file is explicitly prohibited by SOP and verified during internal audits
Laboratory notebooks and worksheets used during analysis are retained as original records even when results are subsequently entered into a LIMS or other electronic system
The data hierarchy for each type of GMP record is defined in the quality system, specifying which record is the original and how copies are identified
Original records are protected from alteration after they have been created and any changes are captured in the audit trail

Accurate

Accuracy failures are among the most serious data integrity violations because they directly affect the validity of quality decisions. All calculations must be verified and all results must faithfully represent the observations made. Key checklist items include:

All calculations in GMP records are verified by a second person or by validated calculation software before the record is approved
Formula cells in spreadsheets used for GMP calculations are protected from accidental or unauthorised modification
Transcription of data between records is verified against the source document by a second reviewer
Analytical methods specify the required integration parameters for chromatographic data and deviations from these parameters are documented and justified
Out-of-specification and out-of-trend results are reported accurately and completely and are not selectively excluded from data sets
Any data exclusions are documented with scientific justification reviewed and approved by the quality function

Complete

Completeness requires that all data generated during a GMP activity is retained, including data from failed runs, aborted analyses, and void batch record entries. Selective retention of favourable data while discarding unfavourable data is one of the most common and most serious data integrity violations globally. Key checklist items include:

Invalidated out-of-specification results are retained with the full investigation record documenting the basis for invalidation
The complete sequence of injections in a chromatographic analysis is retained, including system suitability runs, blanks, and any reinjections
Stability data includes all time points and all results, with missing data points documented and justified
Batch record review confirms that all required entries are present before a batch is released
Data acquisition software is configured to prevent selective deletion of individual data points without generating an audit trail entry

Consistent

Consistency failures are characteristic indicators of data manipulation and are among the first things experienced regulatory inspectors look for when examining GMP records. The chronological sequence of events recorded in batch records and laboratory records should be reviewed during quality review to confirm it is physically plausible. Key checklist items include:

Electronic system timestamps are reviewed for consistency with the recorded sequence of manufacturing or testing activities
The date of sample receipt in the laboratory is confirmed to precede the date of analysis for all samples
Instrument calibration and qualification status is confirmed to have been current at the time of any analysis performed on that instrument
The batch record sequence confirms that each step was completed before the next step was initiated

Enduring

All GMP records must be completed in media appropriate to their required retention period and stored in a manner that ensures they remain intact and readable throughout that period. Key checklist items include:

Electronic records are stored on validated storage systems with defined backup frequency, backup verification, and disaster recovery procedures
The retention period for every category of GMP record is defined in the document retention SOP and is consistent with regulatory requirements for all markets in which products are distributed
Physical archive facilities for paper records are assessed periodically for environmental conditions and the integrity of stored records
Data migration from legacy systems is performed with documented validation confirming that all data has been accurately transferred and remains complete and readable

Available

All GMP records must be locatable and retrievable within a timeframe that allows provision to a regulatory inspector on the first day of an inspection. Key checklist items include:

The index or inventory of archived records is current and accurate
Legacy computerised systems that are no longer in active use but hold GMP-relevant data within the retention period are maintained in a readable state or the data has been migrated to a current system
Remote access to electronic records for regulatory inspection purposes has been tested and confirmed to function correctly
The process for providing records to a regulatory inspector, including identification, retrieval, and copying of records, is documented and has been practised

What Regulators Find When They Examine Data Integrity

Understanding the checklist items above is valuable but understanding how regulators discover data integrity failures in practice is equally important. Inspectors do not simply review documentation and ask whether procedures exist. They use specific investigative techniques designed to surface failures that routine internal audits do not detect.

The techniques regulators commonly use during data integrity focused inspections include:

Requesting the audit trail for specific electronic records and cross-referencing it against paper batch record entries for the same activity, looking for discrepancies in timing, sequence, or content
Asking operators to demonstrate activities in the facility and observing whether they record data at the time of the activity or accumulate entries and complete records later
Requesting the complete data set for a specific analytical sequence, including all injections, system suitability runs, and any aborted or failed runs
Comparing the metadata of electronic files including creation dates, modification dates, and access logs with the recorded dates in corresponding paper records
Interviewing laboratory analysts, production operators, and supervisors separately to assess consistency of accounts regarding data recording practices
Reviewing training records to assess whether data integrity training has been conducted and whether it covers the specific systems and processes used at the site

One unique fact that is rarely discussed in data integrity guidance but that has significant practical implications is that modern electronic systems retain metadata that is not visible in the standard user interface. Chromatography data systems, for example, typically retain information about every action taken in the system including deleted injections, modified integration parameters, and changed sequence files, even when the user interface appears to show only the final approved result. Inspectors with technical expertise in these systems know how to access this underlying metadata and have used it to uncover data manipulation that would not have been visible through routine record review.

Building a Culture of Data Integrity Beyond Procedural Compliance

The most important thing that data integrity guidance documents consistently emphasise, and that organisations consistently underinvest in, is the cultural dimension of data integrity. Procedural controls, technical system controls, and audit trail review are all necessary components of a data integrity programme but they are not sufficient on their own.

Data integrity failures in pharmaceutical organisations almost never occur because individuals do not know that falsifying data is wrong. They occur because individuals are operating in environments where there is pressure to produce results, meet timelines, avoid negative outcomes, or protect themselves from the consequences of failure.

Organisations that build genuine data integrity cultures address these pressures by:

Creating visible leadership commitment to data integrity that explicitly prioritises accurate data over favourable data
Establishing a reporting environment where individuals can raise data integrity concerns without fear of retaliation
Reviewing workload and timeline pressures in GMP environments to identify situations where the structural pressure to cut corners is embedded in operational planning
Including data integrity behaviour as a dimension of performance review for all GxP personnel
Conducting periodic data governance reviews at management level that examine data integrity metrics alongside quality KPIs
Ensuring that quality and compliance failures are investigated without creating an environment where individuals feel that accurate reporting carries greater personal risk than concealment

Common ALCOA++ Failures That Generate Regulatory Action

Across FDA warning letters, MHRA inspection reports, and EMA inspection findings, certain patterns of ALCOA++ failure appear repeatedly. Understanding these failure modes helps quality teams prioritise their gap assessment activities. The most commonly cited data integrity failures across global regulatory inspections include:

Shared login credentials in laboratory computerised systems, particularly chromatography data systems and LIMS platforms
Audit trails that are disabled, incomplete, or not routinely reviewed as part of the quality oversight programme
Pre-recording of batch record entries before the corresponding activity has been completed
Selective deletion or exclusion of out-of-specification analytical results without adequate scientific justification and quality review
Paper records completed in pencil or with correction fluid obscuring original entries
Raw electronic data files overwritten or discarded when paper printouts are taken
System clocks on analytical instruments that have not been verified against a controlled time source and that show discrepancies with other site records
Data stored in formats that can no longer be read because the software used to generate them is no longer available or supported

How Quality and Vigilance Supports Data Integrity Compliance

At Quality and Vigilance we support pharmaceutical manufacturers, contract organisations, and MAHs with comprehensive data integrity programme assessments across both paper-based and electronic GMP environments. Our team brings direct experience of data integrity focused regulatory inspections and understands the investigative techniques regulators use to surface failures that internal programmes miss.

Our data integrity services include:

ALCOA++ gap assessments against current FDA, MHRA, and EMA expectations
Computerised system data integrity reviews including audit trail assessment
Data integrity training programmes for GxP teams at operator, supervisor, and management level
Remediation support for organisations that have received data integrity findings from a regulatory inspection
Independent review of data integrity SOPs and procedural controls against current regulatory guidance

Contact Quality and Vigilance today to assess your data integrity programme and ensure your organisation is prepared for the level of scrutiny that global regulators are applying to pharmaceutical data in 2026.