ALCOA, ALCOA+ and ALCOA++ Explained | Data Integrity

Our services for ALCOA+ compliance

If you need to prove the principles rather than just understand them, we support you with an ALCOA gap analysis. We always check both: the system configuration and the way of working before and after it.

Gap analysis per system

Each system is assessed against all applicable principles, from Attributable to Traceable, electronic and paper-based.

Prioritised action plan

Actions ordered by patient risk and effort, so that critical gaps are closed first.

Technical implementation

Audit trail, user and access model, and a secured, synchronised system time that users cannot change.

Draft SOPs

Work instructions for data correction, audit trail review and data release, written so QA and inspectors can verify them.

Training and records

Training material with attendance records in German and English, using everyday examples like the ones on this page.

GxP applications with audit trail

We build custom GxP applications with an audit trail and role model from the start, instead of retrofitting both later.

Which systems should be reviewed first?

Book an intro call

ALCOA pathfinder

Where does your data stand today?

Choose your starting point. You get a focused entry with a matching reference and a way to contact us.

Find your position with the Data Integrity Check

Eight questions on ALCOA+, audit trails, the data lifecycle and laboratory systems show your maturity level and prioritised fields of action before the gap analysis starts.

Start the Data Integrity Check Principles with everyday examples

What Is ALCOA?

ALCOA is an acronym of five English terms: Attributable, Legible, Contemporaneous, Original, Accurate. Together they describe when a record can be trusted. The formula is not a law. It emerged in the 1990s as a memory aid used by FDA inspectors, coined by Stan W. Woolen of the FDA Office of Enforcement. From there it spread into regulatory guidance worldwide.

Four additions followed later (ALCOA+), and most recently a tenth attribute (ALCOA++). The core always stays the same: whoever reads a number must be able to rely on it being genuine, complete and reconstructable.

Reference: DI gap assessment on validated GxP software covering ALCOA++, audit trail and access control. Read the case story

The Five Core ALCOA Principles with Everyday Examples

Attributable

Every record shows who created or changed it. In everyday life: you sign for a parcel with your own name, not with "the Miller family". In a GxP system this means a unique user ID per person. Shared accounts break this principle and are among the most frequent inspection findings.

Legible

Data must remain unambiguously readable at creation and throughout the retention period. In everyday life: a till receipt on thermal paper has faded after two years and no longer helps with a warranty claim. In a GxP context this applies to handwritten entries as much as to file formats whose software will no longer run in ten years.

Contemporaneous

Recording happens the moment something happens. In everyday life: you fill in a mileage log right after the trip, not from memory at the end of the year. Backdating and later additions without justification are critical observations. The prerequisite is a secured, synchronised system time that users cannot change.

Original

The first record or a certified true copy is retained. In everyday life: you submit the original invoice to the tax office, not a retyped list. In the laboratory, a PDF printout does not replace the raw data of a chromatography system, because metadata and processing parameters are missing.

Accurate

Data matches what actually happened. Corrections stay traceable: the original value remains visible, and the reason and author of the change are recorded. In everyday life: in a household ledger you cross out a wrong amount and write the correct one next to it. You do not erase it.

ALCOA+: The Four Additions

ALCOA+ adds four attributes that mainly need technical safeguards in electronic systems.

Complete

All data belong to the record, including repeat measurements, aborted runs and out-of-specification results. In everyday life: a bank statement shows every transaction, not just the pleasant ones. Selecting only the favourable results is not permitted.

Consistent

Timestamps, data formats and process sequences line up across systems. In everyday life: if the purchase receipt carries a later date than the warranty card, something is wrong. Time differences between LIMS, balance and chromatography system are a standard line of enquiry in audits.

Enduring

Records stay preserved, legible and unaltered across the prescribed period. In everyday life: you do not keep important contracts on fading thermal paper. Obsolete media and discontinued software are the main risk, see Data Archiving.

Available

Data is promptly accessible for inspection and review. In everyday life: the tax documents sit in a labelled folder, not somewhere in the basement. An archive that takes weeks to restore does not satisfy this principle.

ALCOA++: Traceable as the Tenth Attribute

Traceable

ALCOA++ adds Traceable, meaning traceability: the history, changes and storage location of the data can be reconstructed through recorded identifiers. It must always be possible to answer who changed what, when, and where the data came from.

Important context: the July 2025 draft revision of EU GMP Chapter 4 uses the term ALCOA++. The current FDA, MHRA, WHO and PIC/S guidance still says ALCOA or ALCOA+. When we write ALCOA++ on this website, we mean the full current attribute set, not a new legal situation. Quoted guidance always keeps its own term.

Where Is ALCOA Defined?

There is no single ALCOA statute. The principles appear in several regulatory guidance documents that confirm each other. They become binding through the GxP regulations that demand trustworthy records.

USA · FDA

ALCOA

FDA: Data Integrity and Compliance With Drug CGMP describes ALCOA for US oversight.

MHRA · WHO · PIC/S

ALCOA+

MHRA: GxP Data Integrity Guidance uses ALCOA+ for all GxP areas.
WHO: TRS 1033, Annex 4 describes ALCOA+ for manufacturers worldwide.
PIC/S: PI 041 is the GMP inspectorates' inspection guide on data integrity.

European Union

EU GMP

Annex 11 governs computerised systems.
The July 2025 draft of Chapter 4 introduces ALCOA++.

Who Must Follow ALCOA?

ALCOA applies to everyone who creates or manages GxP records: pharma and biotech companies, contract laboratories and parts of the medical device industry, wherever GMP, GLP or GCP applies. It equally applies to operators of computerised systems that hold such records, from a LIMS to a validated Excel sheet.

The simple rule of thumb: if your data feeds into a batch release, a study or a regulatory submission, the principles apply. They do not apply to a website or web shop without a GxP context. Our customers in life science almost always work within scope.

Why Part 11 and Annex 11 Alone Are Not Enough

21 CFR Part 11 and EU GMP Annex 11 are rules for computerised systems. They cover one slice, not the whole.

Part 11 and Annex 11 govern

Electronic records
Electronic signatures
Audit trail
Access control

View electronic signatures ›

ALCOA and DI guidance add

Completeness and contemporaneous capture
Enduring availability
Reconstructing who changed what
Paper records and the processes around the system

View Data Integrity ›

That is why our data integrity and Computer System Validation (CSV) projects always check both: the system configuration and the way of working before and after it.

ALCOA in Practice: Examples from Our Products

This is what the principles look like once they are implemented in software.

STREAM

STREAM calculates a SHA-256 hash per file before and after a data migration and compares the two. The migration report evidences Original, Accurate and the traceability of the transfer.

RADAR

RADAR continuously compares file access rights against the approved target state and logs every change with timestamp and executing account: attributable and contemporaneous, with reports that are instantly available in an audit.

Excel Sheet Validation

Critical spreadsheets get a change record: user, time, old value, new value and reason are logged.

Access-to-WebApp Upgrade

A granular role and permission model replaces unprotected file access: who enters data and who approves it stays separated and traceable. How that worked in 270 hours is shown in the Access-to-WebApp case story.

We build custom GxP applications with an audit trail and role model from the start, see Software Development for Life Science.

Implement ALCOA in your own system?

Book an intro call

Our approach in GxP projects runs from planning through release. Each step delivers evidence you can present in QA review and audit. View GxP consulting in five steps

FAQ: ALCOA, ALCOA+ and ALCOA++

Is ALCOA a law?

No. ALCOA is a memory aid that comes from FDA inspection practice and was later adopted in regulatory guidance. The principles become binding through GxP regulations such as the EU GMP Guide or 21 CFR, which demand trustworthy records.

Do I have to write ALCOA++ instead of ALCOA+ now?

No. ALCOA++ comes from the July 2025 draft revision of EU GMP Chapter 4 and from professional literature. FDA, MHRA, WHO and PIC/S still use ALCOA or ALCOA+. In your own documents you may use ALCOA++ when you mean the full attribute set. Quotations from guidance keep their own term.

Does ALCOA+ also apply to paper-based records?

Yes. ALCOA+ applies equally to electronic and paper-based records. Illegible or non-attributable handwritten entries breach the same principles as a missing audit trail in an IT system.

Which ALCOA+ violations are particularly critical during inspections?

Particularly critical are: missing or manipulated audit trails, shared user accounts, data deletions without justification, retroactive data entries, and selective documentation (cherry-picking of results).

How long must data be retained under ALCOA+?

The period follows the applicable regulation and the product, not ALCOA+ itself. EU GMP Chapter 4 states at least one year past expiry and at least five years after certification for batch documentation; national rules such as the German AMWHV can go further. The enduring principle must hold across the whole period.

ALCOA, ALCOA+ and ALCOA++: Data Integrity Explained