ALCOA+: Principles for Reliable Data in Regulated Processes

What does ALCOA+ mean?

The terms do not come from a standalone technical standard. They bring together expectations for good documentation and data management practices. PIC/S describes ALCOA+ for paper-based and electronic systems and applies these attributes to the entire data lifecycle.^[2] The MHRA mainly uses the shorter form ALCOA in its guidance, but explicitly states that this does not imply lower expectations: completeness, consistency, endurance, and availability must also be ensured throughout the lifecycle.^[1]

Nine attributes, one connected body of evidence

The nine attributes can be summarized as follows:

The attributes are not independent of one another. A measurement may have been attributed to a person and recorded immediately, yet still be inaccurate because the wrong unit was used. A PDF may be stored durably and retrievable at any time, yet lose essential metadata from an originally dynamic dataset. An audit trail may capture all changes without proving that the original measurement was factually correct.

These interactions are precisely what makes ALCOA+ useful. The mnemonic directs attention to several attributes, rather than assessing data quality solely in terms of immutability, access protection, or backups.

A readable final report leaves the original weighing unresolved

In a fictional review assignment, a durably stored, clearly readable PDF report of a weighing is available. The report shows the final value and batch identifier. However, the original record required for this operation, including the equipment reference and documented correction, is neither included nor available elsewhere.

Legibility and retrievability are therefore established; fidelity to the original and completeness remain unresolved. An available final value does not reliably establish either the first capture or the reason for a subsequent change. Signing the report again would not restore this missing information.

The problem is not the PDF format. A PDF may be suitable for an appropriate static record or true copy. What matters is whether the required content, its meaning, and any necessary functionality are preserved. For dynamic source data, a final report alone may be insufficient.[1][3]

Data provenance describes the relationships to origins. Data integrity considers their reliability throughout the lifecycle. In a specific review assignment, the nine attributes must be assessed against the records actually available.

Original: The first capture and its context

Original generally refers to the first capture of information, whether on paper or electronically. A controlled true copy may take its place if the content and meaning of the original are preserved and equivalence is verified. The form required depends on how the information was originally generated.

For simple equipment, a direct printout may constitute the original record. For dynamic electronic data, however, a static printout may be insufficient. Raw data, metadata, processing steps, or interactive functions may be needed for reconstruction. The MHRA and FDA therefore emphasize that true copies of electronic records must preserve the relevant context and meaning of the original.^[1][3]

“Original” does not mean “never changed.” An error may be corrected. However, the correction must not obscure the original entry, and the relationship between the original value, change, time, person, and reason must remain traceable.

Contemporaneous: Documentation accompanies the activity

Contemporaneous requires actions, events, and decisions to be recorded as they occur. PIC/S describes them as evidence of what was done or decided and which circumstances influenced the decision at that time.^[2]

Creating a first record later from memory must be distinguished from the controlled transfer of an existing original record. Initial capture from memory introduces different risks from documentation during the activity. Sequences may be confused, intermediate results omitted, and deviations smoothed over retrospectively. The workflow and its documentation should therefore not be artificially separated.

Recording during the activity does not necessarily mean that a person must type in every value manually. Measuring equipment, sensors, or executable workflows can generate data directly at the appropriate process step. What matters is that the time of capture reflects the real operation and that subsequent changes remain identifiable as such.

Attributable: Actions must remain attributable

Attributable requires the creation and modification of a record to be attributable to a person or an automated system. PIC/S applies this not only to the original activity but also to corrections, deletions, and other changes: the actor, the time, and—where required—the reason should be identifiable.^[2]

For manual capture, attribution may be established through a controlled signature. In an electronic system, individual user accounts, roles, timestamps, and, where applicable, electronic signatures are relevant. Shared accounts weaken attribution because it is no longer possible to reliably identify which person performed an action. The FDA therefore emphasizes that a specific individual must remain identifiable for actions subject to recordkeeping requirements.^[3]

Attribution does not, however, mean that every automatically generated piece of information must be attributed to a human author. If a value is generated by equipment or an interface, the source system, equipment context, and triggering activity form part of its attribution. It must also be possible to trace which person was responsible for setup, review, or release.

Legible: Readability also includes meaning

Legible is often interpreted too narrowly as clearly readable handwriting. It means that information remains readable, unambiguous, and understandable for its purpose. This applies to all components needed for complete evidence: values, units, identifiers, metadata, comments, and change histories.

For electronic records, legibility may require suitable software. A stored data stream is not practically readable if neither a format specification nor a compatible application is available after the original system has been decommissioned. Conversely, a printout may be visually clear yet still reduce the meaning of the original dataset.

PIC/S therefore connects legibility to the dynamic nature of electronic data. If searching, querying, zooming, recalculating, or viewing trends is relevant to content and meaning, the ability to interact forms part of the record's later usability.^[2]

Accurate: Accuracy requires more than a timestamp

Accurate requires a record to correctly represent the underlying facts. Technical protection alone does not establish factual accuracy. An immutably stored measurement may come from unsuitable or uncalibrated equipment. A fully logged entry may result from an operator error.

PIC/S therefore places accuracy within a broader quality system. Depending on the process, this includes qualification, calibration, maintenance, validation, approved procedures, data review, deviation management, and trained personnel.^[2]

The attribute directs attention to both the value and the conditions under which it was generated. Was the correct equipment used? Did the appropriate method apply? Was the unit transferred correctly? Were calculations and transfers checked? Only this context allows a reliable assessment.

Complete and Consistent: Nothing essential may be missing

Complete requires a sufficiently complete dataset. This does not automatically mean as much data as possible, but all information needed to reconstruct and assess the relevant operation. PIC/S explicitly makes the scope dependent on the criticality of the information and includes relevant metadata as part of a complete electronic dataset.^[2]

Unlimited data collection may even make review and understanding more difficult. This does not permit required data to be made subject to retrospective selection.

For laboratory testing within the FDA CGMP scope discussed here, documentation also includes erroneous, suspect, and failing results. Data from the analysis of product samples must be retained and reviewed; a favorable final result does not replace this testing history. Aborting a test likewise does not justify discarding already generated data subject to retention requirements.^[4] A scientifically justified assessment may classify a result as invalid. It does not remove the obligation to retain the original dataset and the investigation in a traceable form.^[3]

Consistent adds logical coherence to completeness. Chronological sequences, date formats, units, rounding rules, identifiers, and state transitions must follow a defined system. A dataset may contain all expected fields yet still be contradictory—for example, if a release precedes its associated review or quantities in different units are recorded without a traceable conversion.

Consistency does not mean that real processes must always follow the same path. Deviations may be justified on substantive grounds. They must then remain identifiable as deviations, with reasons and links to their consequences.

Enduring and Available: Retention also means remaining usable

Enduring concerns preserving a record throughout the required period. Paper must be protected against loss and changes that make it illegible. Electronic data requires suitable storage media, controlled backups, migration strategies, and protection against unintended or unauthorized modification.

Available additionally requires the record to be accessible and readable by authorized individuals in practice. PIC/S lists release decisions, investigations, trend analyses, periodic reports, audits, and inspections as examples of use.^[2]

A backup alone does not meet these attributes. It protects against certain loss scenarios, but does not establish whether data can be restored completely, with the correct metadata, within a reasonable time, and in an understandable format. Long-term availability therefore also requires tests, assigned responsibilities, and a documented strategy.

ALCOA+ applies to paper and electronic systems

The principles are medium-neutral. Paper, electronic systems, and hybrid workflows nevertheless have different vulnerabilities. For paper, these include controlled forms, permanent entries, blank fields, corrections, and secure filing. Electronic systems require, among other things, individual access, appropriate permissions, audit trails, validated functions, and controlled archiving.

Hybrid systems often increase complexity: a value is read from equipment, written on a slip of paper, later transferred to a spreadsheet, and finally saved as a PDF. Context, timing information, or metadata may be lost at each transition between media. ALCOA+ helps assess the entire chain, not just the final record.

Choosing a digital system therefore does not automatically solve the problem. PIC/S emphasizes that technical and organizational measures must work together and that their design must be guided by data criticality and risk.^[2]

What ALCOA+ does not do

ALCOA+ does not replace a legal assessment. Which data must be generated and reviewed, and how long it must be retained, follows from the applicable rules, the specific process, and the risk assessment. The nine attributes help with design and evaluation, but do not themselves determine the required scope of documentation.

The mnemonic is not proof of data integrity either. A system may provide appropriate functions yet still be configured unsuitably or used incorrectly. Conversely, simple technical systems can enable reliable records through effective organizational controls.

Regulatory finding

Finding: The FDA found that operators at a pharmaceutical manufacturer reported only the final passing result from a series of filter integrity tests. In the example dated July 25, 2024, nine tests included five failing results, three aborted tests, and one final passing result.^[5]

Assessment: The example illustrates the ALCOA+ attribute Complete: a report containing only the passing result does not represent the full testing history. The failing results and aborted tests remain relevant to its assessment. This finding concerns pharmaceutical CGMP and does not itself define documentation requirements for other markets.

Review question: Does the record available for review include all nine tests, their results or aborted status, and the documented assessment of the testing history?

Letter dated 24 February 2025 · Source checked on 18 September 2026.

This section presents the selected regulatory finding as stated at the time of the letter. Company responses and subsequent developments are not assessed here; this account does not describe the company’s current compliance status.

Nine questions about the record actually available

In the final report, some attributes are visibly met, while others cannot be demonstrated. This distinction is precisely what makes ALCOA+ practical: one positive attribute must not conceal missing evidence.

The review must therefore identify which record is available, what it contains, and which required information or functions are missing. This turns the mnemonic into a specific assessment rather than a blanket checkmark next to nine terms.