A changed value is three facts, and most records keep one
When a result in a record is changed, three facts come into existence: who changed it, when, and what it said before. A fourth, why, tends to be a required field only on paper. Systems keep the middle one, a timestamp, and lose the other two. The account is shared ("QC_LAB"), the previous value is overwritten, and the reason has no field to live in. Nobody has done anything dishonest. The record simply cannot answer the questions that will be put to it, and every one of those questions is an ALCOA+ question.
ALCOA+ is not a poster for the QC corridor. It is nine conditions that can be tested on any record in a few minutes, and each one has a clause behind it. This post takes each condition in turn: the clause, the way it breaks on a real site, the hybrid paper-and-screen join where it breaks most quietly, and the one control, audit-trail review, that makes the other eight hold.
Nine attributes, and where they came from
ALCOA started inside FDA in the 1990s as a mnemonic for what a trustworthy record looks like. The "+" came later, from European and international guidance, as regulators wrote down the things they were already checking. Today FDA, MHRA, PIC/S and WHO all describe the same nine.
| Attribute | What it means | The question an inspector asks |
|---|---|---|
| Attributable | You can tell who created, changed or approved the record, as an individual | "Who did this?" |
| Legible | It can be read and understood, now and for the retention period, including the metadata | "Can I read it, and does it still mean what it meant?" |
| Contemporaneous | It was recorded when the activity happened, not afterwards from memory | "When was this actually written down?" |
| Original | The first capture is preserved, or a verified true copy that keeps its content and meaning | "Is this the source, or a copy of something I can't see?" |
| Accurate | The content is correct, and corrections keep the original visible with a reason | "Is it right, and if it was fixed, why?" |
| Complete | All the data is there: repeats, aborted runs, failures, the audit trail, the metadata | "What isn't in here?" |
| Consistent | The sequence and timing make sense across systems and across the record | "Do the times and steps agree?" |
| Enduring | It survives, intact and usable, for as long as it must be kept | "Will this still open in eight years?" |
| Available | It can be retrieved for review or inspection when needed | "Show me. Now." |
Some industry guidance adds a tenth, Traceable, and calls the result ALCOA++. The regulators' documents stop at nine, and nine is what gets cited.
The regulators mean the same thing
It's worth being precise about who says what, because "ALCOA+" is often quoted with no source.
- FDA, Data Integrity and Compliance With Drug CGMP: Questions and Answers (2018), defines data integrity as completeness, consistency and accuracy, and states that complete, consistent and accurate data should be attributable, legible, contemporaneously recorded, original or a true copy, and accurate. That's ALCOA, with Complete and Consistent already in the definition.
- MHRA, GxP Data Integrity Guidance and Definitions (2018), uses ALCOA+ by name and stresses that the effort put into controls should match the risk to product quality and patient safety.
- PIC/S, PI 041-1, Good Practices for Data Management and Integrity in Regulated GMP/GDP Environments (in force 1 July 2021), is written for inspectors. It walks each ALCOA+ attribute with expectations for paper, computerised and hybrid systems, which is why it's the most useful of the four to read if you want to know what will be asked.
- EU GMP Chapter 4 (Documentation) sets the paper-side rules: entries clear, legible, indelible, made at the time, corrections dated and signed with the original still readable.
The common thread: the format doesn't earn trust. A PDF is not more trustworthy than a notebook. The controls around the record are what make it defensible, and the same nine tests apply either way.
Each attribute has a clause behind it
ALCOA+ findings rarely arrive labelled "ALCOA+". On a US inspection they arrive as a Part 211 citation. Knowing the mapping tells you which attribute an observation is really about.
| Attribute | Where it lives in 21 CFR Part 211 (finished pharmaceuticals) |
|---|---|
| Attributable | §211.188(b)(11): identification of the persons performing and checking each significant step · §211.194(a)(7): initials or signature of the person who performed each test, and the date |
| Legible | §211.180(d): records retained as originals or true copies that are accurate reproductions · §211.68(b): controls so that records are not altered or erased without authority |
| Contemporaneous | §211.100(b): procedures followed and documented at the time of performance · §211.188: batch records completed as each step is performed |
| Original | §211.180(d): original records or true copies · §211.194(a): complete data derived from all tests, including raw data |
| Accurate | §211.68(b): input to and output from the computer checked for accuracy · §211.192: discrepancies investigated, not overwritten |
| Complete | §211.194(a): complete data from all tests, including those that failed or were repeated |
| Consistent | §211.68(b): controls over computer systems · §211.188: sequential batch record entries |
| Enduring | §211.180(a)–(c): retention for at least one year after expiry (or as specified) |
| Available | §211.180(c): records readily available for authorised inspection during the retention period |
Under 21 CFR Part 11 the electronic controls (individual accounts, audit trail, copies, retention) are what let an electronic record satisfy these clauses. Part 11 is the "how" for electronic records; ALCOA+ is the "what" for every record.
Where each attribute breaks on a real site
None of these are exotic. All of them show up in 483s and warning letters year after year, and most of them happen to conscientious teams.
- Attributable: the shared login. One "QC_LAB" or "ADMIN" account used by a shift. Every record that account touched is unattributable, and FDA's 2018 Q&A treats shared credentials as a control failure, not a convenience. Related: administrator rights held by the same people who generate the data.
- Legible: the export that lost its meaning. A chromatogram printed to PDF with no integration parameters, no processing history. It's readable. It's no longer legible in the sense that matters, because you can't tell what was done to it.
- Contemporaneous: the end-of-shift catch-up. Batch record steps completed in a block at 17:50 for work done since 09:00. Backdating a date field is worse, but block entry is the common form.
- Original: the "master" that isn't. A signed paper printout treated as the record while the electronic source data sits unreviewed on the instrument. PIC/S is blunt: the original is the first capture, and if the electronic data has an audit trail and the paper doesn't, the paper is the copy.
- Accurate: the silent correction. A value overwritten with no reason, or a "typo" fix after review. Corrections aren't the problem. Corrections with no reason, no original value and no reviewer are.
- Complete: the aborted run that vanished. A system-suitability injection re-run until it passed, with the failures deleted or filed as "test". §211.194(a) says complete data from all tests. Repeats, aborts and failures are data.
- Consistent: two clocks. LIMS on one time source, the batch record on another, the training system on a third. The record is true and still fails, because nobody can reconstruct the sequence.
- Enduring: dynamic data flattened. Ten years of retention, but the instrument software is gone and only the PDFs remain. The data endured; the ability to reprocess it didn't.
- Available: the three-day retrieval. The record exists in an archive a contractor manages. An inspector asks on Tuesday and sees it on Friday. "Readily available" has a meaning.
Spreadsheet-based processes fail several of these at once, which is why they attract so many findings; why spreadsheets fail in regulated quality systems goes through the mechanics.
Hybrid records: the join between paper and screen
Most sites in 2026 aren't paper or electronic. They're both, and the join is where ALCOA+ fails most quietly.
A typical hybrid chain: the balance prints a ticket, the ticket is stapled into a paper batch record, the batch record is scanned to PDF after release, the PDF is the "record" in the eQMS. Four formats, four owners, and some questions no one has answered:
- Which is the original? The balance's electronic output, if it has one. If the ticket is the only capture, the ticket is, and its legibility and retention have to be managed as an original.
- Who reviews the electronic audit trail behind the paper signature? The paper says "verified by". The instrument software says a method parameter changed that morning. If nobody looks at the second, the first is theatre.
- Is the paper reconcilable to the data? Can you go from the result on the batch record back to the raw data file, and forward from the raw data to the reported result, without a gap?
- When the scan becomes the record, what happened to the paper? Destroyed under a procedure with a true-copy verification, or in a box under a desk?
MHRA and PIC/S both expect a documented map of hybrid systems: which element is the master record for each data item, and which controls apply to each. Download the data integrity checklist and fill that hybrid-systems row first. It is the row most sites cannot complete.
Audit-trail review: the control that makes ALCOA+ real
An audit trail proves attributability, accuracy and completeness only if someone reads it. FDA's 2018 Q&A sets the expectation plainly: audit trails that capture changes to critical data should be reviewed with each record and before final approval, by the people who review the record, and the frequency should follow the risk. A quarterly export by IT is not that.
What a useful review looks for, in practice:
- Changes after approval. Anything modified once the record was signed, and by whom.
- Deletions and aborted actions. Not just what's in the record: what was removed from it.
- Reasons that don't explain. "Typo" on a result change. "Update" on a specification edit.
- Timing that doesn't fit. Entries seconds apart from the same user on different instruments; results entered before the run finished.
- Privilege use. Administrator actions on production data.
Two things make review sustainable rather than heroic: the trail has to be readable in context (on the record, not decoded from a log table), and the reviewer has to be able to record that they reviewed it. If either is missing, the review won't happen, and the audit trail will fail at the exact moment it's needed.
Fragmented versus governed, side by side
| Fragmented process | Governed process |
|---|---|
| Updates land across files, inboxes and instruments | The record lives in one controlled workflow |
| Traceability is assembled after the fact | History is captured with the action |
| "Who changed this?" is a conversation | "Who changed this?" is a field |
| Corrections overwrite; reasons live in email | Corrections keep the original; the reason is on the record |
| Review depends on someone remembering | Review is a step with evidence that it happened |
| Retrieval means searching three archives | Retrieval is a query |
The right-hand column isn't a product description. It's what each ALCOA+ attribute looks like when it's designed in rather than checked for afterwards.
How to run an ALCOA+ self-assessment in an afternoon
Don't start with policy. Start with three records.
- Pick them adversarially. One deviation, one batch record, one lab result, chosen from the log, not from the examples you know are clean.
- Walk the nine questions from the first table against each. Write down the evidence you looked at, not just the answer. "Attributable: yes, audit trail shows J. Patel, 14:02" is an assessment. "Attributable: yes" is an opinion.
- Follow every seam. Where the record crosses from one system or format to another, ask the four hybrid questions.
- Score the gaps by risk, using the MHRA principle: effort proportional to impact on product quality and patient safety. An unattributable cleaning log and an unattributable release decision are not the same gap.
- Give each gap an owner and a date. The checklist at the end of this post has the nine attribute rows plus three governance rows (policy and training, audit-trail review, hybrid mapping), with evidence, owner and status columns, so the assessment itself meets the standard it's applying.
Then do it again next quarter with three different records. The point isn't the score. It's that the next inspector's ten-minute test has already been run by you.
How Complere supports trustworthy records
Every action has a name on it. Each user works under their own credentials, so "who did this?" is answered by the record itself, never by asking around.
Corrections keep the original in view. When a value changes, the earlier value, the person, the time and the reason stay with the record. Nothing is overwritten into silence.
The history reads like a record, not a log. A reviewer can see what changed on a deviation or an approval in context, and can mark that they reviewed it, so audit-trail review is a step that gets completed rather than deferred.
The chain stays connected. A deviation stays tied to the investigation, the actions and the change that followed, so consistency across the sequence is something you read, not something you reconstruct.
Retrieval is minutes, for the whole retention period. Records and their histories can be produced as complete, readable copies when an inspector asks, not after a request to an archive.
Which records are critical, how hybrid data is mapped and who reviews what: those are still your decisions. The system's part is that each of them leaves a record that passes the nine questions without anyone rebuilding the story.
