Data integrity is not only a concern for large pharmaceutical manufacturers. Small manufacturers can face the same FDA expectations when their records are used to demonstrate that products were manufactured, tested, and released appropriately.
FDA expects CGMP data to be reliable and accurate, and its data-integrity guidance recommends risk-based controls based on the company’s processes, technologies, and business model.
For a small manufacturer, the challenge is often practical: limited staff, paper records, spreadsheets, shared computers, and relatively simple systems can still create significant data-integrity risks.
The ALCOA+ framework provides a practical way to review those risks.
What Does ALCOA+ Mean?
FDA’s data-integrity framework begins with five core principles:
- Attributable
- Legible
- Contemporaneous
- Original
- Accurate
The “+” adds four additional expectations:
- Complete
- Consistent
- Enduring
- Available
Together, these principles help ensure that records accurately represent what actually happened during manufacturing, testing, and quality activities.
1. Attributable
Every GMP record should show who performed the activity and who recorded or reviewed the information.
Checklist
☐ Employees use individual signatures or initials.
☐ Electronic systems have unique user accounts.
☐ Passwords are not shared.
☐ Records identify the person performing each activity.
☐ Changes to electronic records can be attributed to a specific user.
☐ Supervisory reviews identify the reviewer and date.
A common small-manufacturer problem is using a shared computer login because “everyone in the laboratory uses the same system.”
That makes it difficult to determine who created, changed, or approved data.
2. Legible
Records must remain readable and understandable throughout their required retention period.
Checklist
☐ Handwritten entries are readable.
☐ Ink does not easily smear or disappear.
☐ Corrections remain understandable.
☐ Electronic records can be displayed and printed when necessary.
☐ Scanned documents are readable.
☐ Important records are not stored in deteriorating or inaccessible formats.
For paper systems, a simple rule is useful: if another qualified employee cannot understand the record months later, the documentation system needs improvement.
3. Contemporaneous
Data should be recorded when the activity is performed, not reconstructed later from memory.
Checklist
☐ Employees record results immediately after performing the activity.
☐ Actual dates and times are recorded.
☐ Employees do not pre-fill records.
☐ Backdating is prohibited.
☐ Delayed entries are identified and justified.
☐ Computer system clocks are controlled where time is important.
For example, an employee should not perform an equipment check in the morning and complete the checklist at the end of the shift from memory.
If a legitimate delayed entry is necessary, the record should make the timing and reason transparent.
4. Original
The original record—or a true and accurate copy—should be retained.
This becomes particularly important with electronic laboratory data.
A printed result may not contain all of the underlying electronic information, such as audit trails, methods, sequences, or other metadata. FDA has specifically explained that a printed chromatogram generally does not replace the complete electronic raw data used to generate it.
Checklist
☐ Original raw data is retained.
☐ Electronic records are not replaced only by printouts.
☐ Original worksheets are controlled.
☐ True copies accurately reproduce the original record.
☐ Electronic metadata required to understand the record is retained.
☐ Records are protected from unauthorized deletion or alteration.
5. Accurate
Data must accurately represent what actually occurred.
Checklist
☐ Calculations are verified.
☐ Transcription errors are controlled.
☐ Instruments are properly calibrated or qualified as applicable.
☐ Test results are recorded without manipulation.
☐ Invalid or unexpected results are investigated appropriately.
☐ Corrections preserve the original information.
An important principle is that bad results cannot become acceptable simply because they are inconvenient.
If a result is out of specification, unexpected, or inconsistent, the correct response is investigation—not deletion or replacement.
6. Complete
Complete data includes the information necessary to reconstruct an activity.
This means companies should not retain only the “good” results.
Checklist
☐ All required test results are retained.
☐ Failed or invalid results are included.
☐ Repeat testing is documented.
☐ Reanalysis is documented.
☐ Deviations are linked to affected records.
☐ Relevant audit trails are retained.
☐ Supporting calculations and raw data are available.
FDA’s current data-integrity expectations specifically emphasize maintaining complete information, including repeat or reanalysis data where relevant.
A common risk is performing a second test because the first result was unfavorable and retaining only the passing result.
That creates a data-integrity problem because the complete testing history is no longer visible.
7. Consistent
Records should follow the expected sequence and use consistent dates, times, formats, and documentation practices.
Checklist
☐ Dates follow a defined format.
☐ Time entries are consistent.
☐ Records follow the approved sequence of activities.
☐ Batch records match supporting documentation.
☐ Electronic and paper records do not conflict.
☐ Corrections follow the same procedure across departments.
For example, if a batch record shows that a manufacturing step occurred before an equipment cleaning record says the equipment was cleaned, the inconsistency needs to be investigated.
8. Enduring
Records must remain intact and protected throughout their required retention period.
Checklist
☐ Paper records are stored securely.
☐ Electronic records are backed up.
☐ Backups are protected from unauthorized alteration.
☐ Records cannot be casually deleted.
☐ Retention periods are defined.
☐ Archived records can still be retrieved.
For dietary supplement manufacturers, FDA’s DS CGMP requirements specify record-retention periods and require records to be maintained as originals, true copies, or compliant electronic records.
9. Available
Data should be accessible when needed for quality activities, audits, investigations, or FDA inspection.
Checklist
☐ Employees can retrieve required records.
☐ QA can access supporting documentation.
☐ Electronic records remain accessible after system changes.
☐ Archived records can be retrieved within a reasonable timeframe.
☐ FDA-required records are available for inspection.
FDA has emphasized that CGMP records cannot simply be kept in systems that make them inaccessible to FDA.
A Small-Manufacturer ALCOA+ Self-Assessment
A practical internal review can start with five areas:
Manufacturing Records
☐ Batch records are completed at the time of activity.
☐ No unexplained blank spaces exist.
☐ Corrections preserve the original entry.
☐ Operators use individual identification.
Laboratory Records
☐ Raw data is retained.
☐ Failed and repeat tests are documented.
☐ Instrument data is controlled.
☐ Audit trails are reviewed where applicable.
☐ Calculations and results are independently checked.
Electronic Systems
☐ Users have individual accounts.
☐ Passwords are controlled.
☐ Access matches job responsibilities.
☐ Data is backed up.
☐ Changes and deletions are controlled.
Paper Records
☐ Controlled forms are used.
☐ Obsolete forms are removed.
☐ Corrections are signed and dated.
☐ Records are protected from damage or loss.
Quality System
☐ Deviations are documented.
☐ Investigations include relevant data.
☐ CAPA records are complete.
☐ Internal audits evaluate documentation practices.
☐ Management understands significant data-integrity risks.
What Small Manufacturers Should Avoid
Data-integrity failures do not always involve deliberate fraud. Poor systems can create the same compliance risk.
Watch for practices such as:
- Shared passwords
- Pre-signing forms
- Backdating records
- Pencil entries on permanent GMP records
- Destroying failed results
- Retaining only passing test results
- Uncontrolled spreadsheets
- Manual transcription without verification
- Reconstructing records after the fact
- Deleting electronic raw data
- Keeping GMP records outside controlled systems
- Treating training as the only corrective action
FDA warning letters continue to identify documentation and data-integrity deficiencies, including failures involving incomplete, inaccurate, or non-contemporaneous records.
How to Start With Limited Resources
Small manufacturers do not necessarily need an expensive electronic quality-management system to improve data integrity.
Start with the highest-risk records.
Identify:
What data affects product quality?
Who creates it?
Where is it stored?
Who can change it?
How is it reviewed?
How long must it be retained?
Then prioritize controls around laboratory results, batch records, specifications, equipment records, complaints, deviations, CAPA, and other records that directly support product quality.
A simple risk assessment can reveal where stronger controls are needed most.
Bottom Line
ALCOA+ is more than a documentation acronym. It is a practical way to determine whether your records can prove what actually happened.
For small manufacturers, the most important goal is consistency: record activities when they happen, preserve original information, control changes, retain complete data, and make records available when needed.
A strong data-integrity program does not have to be complicated. It needs to be appropriate for the risks of the operation and consistently followed.
JJCC Group can help manufacturers assess data-integrity risks, review paper and electronic documentation systems, develop ALCOA+ procedures, and strengthen records before an FDA inspection identifies the gaps.
