Data Integrity ALCOA+ Audit Checklist (Free)

0%

0 of 36 items complete

11 critical items still open - these are the highest-risk gaps.

Download checklist:

Attributable and legible

Every entry on a paper or electronic record identifies who made itCRITICALShared logins are prohibited and verified absent on lab and production systemsCRITICALA signature log or specimen list maps initials to full namesHandwriting is legible and permanent ink is usedCorrections are single line strikethroughs with date, initials and reasonCRITICALElectronic records can be displayed in human readable form for inspectionOriginal and corrected values are both visible

Contemporaneous and original

Entries are made at the time the activity is performed, not later from memoryCRITICALSystem clocks are synchronised and users cannot change date or timeLoose paper, sticky notes and scrap paper are not used for GMP dataCRITICALRaw data and first captured records are retained, including printouts and electronic filesBlank forms are controlled and issued with a unique numberInstrument printouts that fade are copied as certified true copiesSpreadsheets used for GMP calculations are locked and validated

Accurate and complete

All data generated is retained, including failed, aborted and repeated runsCRITICALTesting into compliance is prohibited and checked by reviewing repeat injections and reprocessingAudit trails are enabled and cannot be disabled by analystsCRITICALAudit trails are reviewed as part of batch or result reviewCRITICALCalculations are verified, with formulas protected from editsIntegration and processing parameters in chromatography systems are controlled and reviewedReprocessing requires a documented reason and second person review

Consistent, enduring and available

Records follow the sequence of events and dates are consistent across systemsRetention periods are defined and applied to paper and electronic recordsBackups are performed, tested for restore and stored separatelyCRITICALArchived data remains readable after software or hardware upgradesRecords can be retrieved quickly during an inspectionAccess to archives is restricted and loggedLegacy systems have a documented plan for data migration or readable retention

Governance and system controls

A data integrity policy and training record exist for all GMP staffUser roles separate analyst, reviewer and administrator dutiesCRITICALAdministrator accounts are not used for routine GMP workComputerized systems are validated and periodically reviewedAccess is removed promptly when staff leave or change rolesData integrity incidents are investigated through the deviation and CAPA processCRITICALSupplier and contract lab data integrity is covered in quality agreementsManagement reviews data integrity metrics and audit findings

Count the items answered yes. Any critical item answered no should be raised as an observation and risk assessed before the audit is closed.

Evidence-based data integrity reviews

An optional discussion of pulling audit trail and access data from your systems into one private review view.

Optional. The tool and every export work without this. No spam.

How to use the checklist

Work through one system or process at a time, such as an HPLC with its data system, a weigh and dispense station or an electronic batch record. Tick each item as you observe it, not as it is described, and keep notes against the critical items. Export the result to PDF or Excel to attach to the audit report and the CAPA record.

The principles behind it

ALCOA appears in FDA guidance on data integrity and compliance with CGMP, and the extended principles are used by EMA, MHRA and PIC/S guidance. The expectation is that data is trustworthy across its lifecycle, from creation to archive, whether it is on paper or electronic. The checklist groups the principles into five areas so audits stay manageable.

What to sample

Do not audit from the SOP alone. Pick a recent batch or test and trace the raw data: the instrument audit trail, the processing method, the reviewer sign-off and the stored file. Look for gaps in time stamps, repeated injections with no explanation, shared accounts and deleted files. A small number of well-traced samples reveals more than a long list of document checks.

Compare audit trail entries with the reported results.
Check who has administrator rights on each system.
Test one backup restore during the audit.

Common mistakes

Teams often assume a validated system is automatically compliant, but controls such as audit trail review and role separation must also be applied in daily use. Another trap is treating hybrid systems, where a printout is signed but the electronic file is the true record, as paper only. Decide which record is the original and control it.

Frequently Asked Questions

What does ALCOA+ stand for?

ALCOA stands for attributable, legible, contemporaneous, original and accurate. The plus adds complete, consistent, enduring and available. Together they describe how GMP data should be created, kept and retrieved over its whole lifecycle.

Does this checklist cover 21 CFR Part 11?

It covers many of the same controls, such as audit trails, access and signatures, but it is a data integrity audit, not a Part 11 assessment. Use it alongside a Part 11 gap assessment for systems with electronic records and signatures.

How often should I audit data integrity?

Many companies run a risk based programme, with high risk systems such as QC lab data systems audited at least annually and others on a cycle. Also audit after a data integrity deviation, a system change or an inspection finding.

What counts as a critical finding?

Typically, deleted or hidden data, disabled audit trails, shared logins for GMP work, or retesting without documentation. Your quality system defines the severity scale, but these items threaten the reliability of released product data and need prompt escalation.

Netray can help build a private, on-prem way to pull audit trail and access data from your ERP and lab systems into a single review view, so data integrity checks run on evidence rather than samples alone.

Talk to an Expert Explore More Free Tools

Related Tools

Developer Tools

More Compliance & Contracts tools

See all

Data Integrity ALCOA+ Audit Checklist for GMP Operations