# Data Integrity ALCOA+ Audit Checklist for GMP Operations > Source: https://netray.co/tools/pharma-data-integrity-alcoa-plus-audit-checklist > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer Walk through ALCOA+ expectations for paper records, lab instruments and electronic systems in a regulated plant. ## Category compliance-legal ## Industry Pharma and Life Sciences ## Audience - Quality assurance - Internal auditor - Lab manager ## Tool **Kind:** checklist **Groups:** #### Attributable and legible **Items:** **Text:** Every entry on a paper or electronic record identifies who made it **Critical:** true **Text:** Shared logins are prohibited and verified absent on lab and production systems **Critical:** true A signature log or specimen list maps initials to full names Handwriting is legible and permanent ink is used **Text:** Corrections are single line strikethroughs with date, initials and reason **Critical:** true Electronic records can be displayed in human readable form for inspection Original and corrected values are both visible #### Contemporaneous and original **Items:** **Text:** Entries are made at the time the activity is performed, not later from memory **Critical:** true System clocks are synchronised and users cannot change date or time **Text:** Loose paper, sticky notes and scrap paper are not used for GMP data **Critical:** true Raw data and first captured records are retained, including printouts and electronic files Blank forms are controlled and issued with a unique number Instrument printouts that fade are copied as certified true copies Spreadsheets used for GMP calculations are locked and validated #### Accurate and complete **Items:** **Text:** All data generated is retained, including failed, aborted and repeated runs **Critical:** true Testing into compliance is prohibited and checked by reviewing repeat injections and reprocessing **Text:** Audit trails are enabled and cannot be disabled by analysts **Critical:** true **Text:** Audit trails are reviewed as part of batch or result review **Critical:** true Calculations are verified, with formulas protected from edits Integration and processing parameters in chromatography systems are controlled and reviewed Reprocessing requires a documented reason and second person review #### Consistent, enduring and available **Items:** Records follow the sequence of events and dates are consistent across systems Retention periods are defined and applied to paper and electronic records **Text:** Backups are performed, tested for restore and stored separately **Critical:** true Archived data remains readable after software or hardware upgrades Records can be retrieved quickly during an inspection Access to archives is restricted and logged Legacy systems have a documented plan for data migration or readable retention #### Governance and system controls **Items:** A data integrity policy and training record exist for all GMP staff **Text:** User roles separate analyst, reviewer and administrator duties **Critical:** true Administrator accounts are not used for routine GMP work Computerized systems are validated and periodically reviewed Access is removed promptly when staff leave or change roles **Text:** Data integrity incidents are investigated through the deviation and CAPA process **Critical:** true Supplier and contract lab data integrity is covered in quality agreements Management reviews data integrity metrics and audit findings **Scoring Note:** Count the items answered yes. Any critical item answered no should be raised as an observation and risk assessed before the audit is closed. ## Content **Intro:** ALCOA+ is the shorthand regulators use for good data practice: attributable, legible, contemporaneous, original and accurate, extended by complete, consistent, enduring and available. This checklist turns the principles into audit questions you can walk through on the floor and in the lab. **Sections:** #### How to use the checklist **Body:** Work through one system or process at a time, such as an HPLC with its data system, a weigh and dispense station or an electronic batch record. Tick each item as you observe it, not as it is described, and keep notes against the critical items. Export the result to PDF or Excel to attach to the audit report and the CAPA record. #### The principles behind it **Body:** ALCOA appears in FDA guidance on data integrity and compliance with CGMP, and the extended principles are used by EMA, MHRA and PIC/S guidance. The expectation is that data is trustworthy across its lifecycle, from creation to archive, whether it is on paper or electronic. The checklist groups the principles into five areas so audits stay manageable. #### What to sample **Body:** Do not audit from the SOP alone. Pick a recent batch or test and trace the raw data: the instrument audit trail, the processing method, the reviewer sign-off and the stored file. Look for gaps in time stamps, repeated injections with no explanation, shared accounts and deleted files. A small number of well-traced samples reveals more than a long list of document checks. **Bullets:** - Compare audit trail entries with the reported results. - Check who has administrator rights on each system. - Test one backup restore during the audit. #### Common mistakes **Body:** Teams often assume a validated system is automatically compliant, but controls such as audit trail review and role separation must also be applied in daily use. Another trap is treating hybrid systems, where a printout is signed but the electronic file is the true record, as paper only. Decide which record is the original and control it. **Cta:** Netray can help build a private, on-prem way to pull audit trail and access data from your ERP and lab systems into a single review view, so data integrity checks run on evidence rather than samples alone. **Faq:** #### What does ALCOA+ stand for? **Answer:** ALCOA stands for attributable, legible, contemporaneous, original and accurate. The plus adds complete, consistent, enduring and available. Together they describe how GMP data should be created, kept and retrieved over its whole lifecycle. #### Does this checklist cover 21 CFR Part 11? **Answer:** It covers many of the same controls, such as audit trails, access and signatures, but it is a data integrity audit, not a Part 11 assessment. Use it alongside a Part 11 gap assessment for systems with electronic records and signatures. #### How often should I audit data integrity? **Answer:** Many companies run a risk based programme, with high risk systems such as QC lab data systems audited at least annually and others on a cycle. Also audit after a data integrity deviation, a system change or an inspection finding. #### What counts as a critical finding? **Answer:** Typically, deleted or hidden data, disabled audit trails, shared logins for GMP work, or retesting without documentation. Your quality system defines the severity scale, but these items threaten the reliability of released product data and need prompt escalation. ## Search terms alcoa plus checklist, data integrity audit checklist, gmp data integrity checklist, alcoa principles pharma, lab data integrity audit, audit trail review checklist, paper record data integrity --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json