| This article is based on official regulatory sources: FDA’s 2018 Data Integrity and CGMP guidance, PIC/S PI 041, EMA’s 2010 Reflection Paper, MHRA’s GxP Data Integrity guidance, and WHO TRS Annex 5. It is for informational purposes only and does not constitute regulatory or legal advice. |
What Is ALCOA+?
ALCOA+ is the universally recognized data integrity framework used in pharmaceutical, biotech, clinical, and laboratory environments regulated by the FDA, EMA, MHRA, WHO, and PIC/S. It defines the minimum quality attributes that every laboratory record — whether written on paper or generated by a LIMS, ELN, or instrument — must satisfy to be considered trustworthy and compliant.
ALCOA stands for Attributable, Legible, Contemporaneous, Original, and Accurate. The original five attributes were introduced in the early 1990s by FDA compliance expert Dr. Stan Woollen as a training tool for GLP inspectors. In 2010, the European Medicines Agency (EMA) formally extended the framework by adding four qualities — Complete, Consistent, Enduring, and Available — creating ALCOA+.
Today, ALCOA+ is referenced explicitly or implicitly in every major data integrity regulatory document globally: FDA’s CGMP guidance (21 CFR Parts 211 and 11), PIC/S PI 041, MHRA’s GxP Data Integrity Guide, WHO TRS Annex 5, and EU GMP Annex 11. It applies equally to paper systems and fully digital laboratory environments.
| ALCOA+ and 21 CFR Part 11 are complementary, not interchangeable. Part 11 defines the technical controls an electronic system must implement (audit trails, e-signatures, access controls). ALCOA+ defines the quality standard that every record — regardless of system — must achieve. A technically Part 11-compliant LIMS can still generate ALCOA+-non-compliant records if organizational processes are inadequate. |
The 9 ALCOA+ Attributes: What Each Means in Practice
Each attribute is both a documentation standard and a practical compliance checkpoint. Regulators use them as the lens through which they evaluate records during inspections, Form 483 observations, and warning letter investigations.
| A — Attributable |
| Regulatory anchor: 21 CFR 211.194(a) — initials/signatures required; EU GMP Annex 11 §12.4 — operator identity must be recorded Paper: Analyst initials and date on every manual entry; no blank lines in batch records Electronic: Unique user login in LIMS/ELN — system captures user ID and timestamp automatically; no shared accounts Common violation: Shared login credentials (e.g., ‘lab1’ / ‘admin’) — one of the most common FDA 483 findings |
| L — Legible |
| Regulatory anchor: 21 CFR 211.180 — records legible and readily available; EU GMP Annex 11 §8.1 — human-readable throughout lifecycle Paper: Ink entries (not pencil), no overwriting; crossed-out errors signed and dated, original value still visible Electronic: LIMS records displayed and exported in consistent, readable format across systems; font and encoding preserved Common violation: Pencil entries, illegible handwriting, whiteout over errors — any of these can invalidate a record during inspection |
| C — Contemporaneous |
| Regulatory anchor: 21 CFR 211.100(b) — each step documented at the time performed; PIC/S PI-041 — contemporaneous recording is a critical ALCOA principle Paper: pH recorded directly onto the batch record during in-process testing, not transcribed later from a scrap note Electronic: Instrument data auto-captured into LIMS with system timestamp at point of generation; no retroactive entry Common violation: Backdating entries, recording results from memory after the fact, or pre-recording anticipated results |
| O — Original |
| Regulatory anchor: 21 CFR 211.194 — original record or true certified copy; FDA Data Integrity Q&A 2018 — ‘first capture of information’ Paper: The handwritten batch record page is the original; a photocopy used as working document must be marked ‘true copy’ and verified Electronic: Raw instrument data file is the original; a PDF export is a secondary copy — both must be retained; data migration must preserve originals Common violation: Deleting raw chromatography files after generating a report, or presenting a printout as the original when the electronic record exists |
| A — Accurate |
| Regulatory anchor: 21 CFR 211.68 — automated systems must produce accurate results; FDA Data Integrity guidance: ‘data should reflect what actually occurred’ Paper: Results transcribed exactly from instrument printout; calculations verified independently before entry Electronic: Instrument integration directly into LIMS eliminates manual transcription; validated calculation routines auditable in system Common violation: Entering assumed or expected values instead of actual measurements; selective reporting that omits out-of-specification results |
The ‘+’ Attributes — Added by EMA (2010) and adopted by PIC/S, MHRA, WHO
The four ‘+’ attributes extend ALCOA from a point-in-time quality check to a lifecycle quality standard. They address what happens to a record after it is created — through its entire retention period.
| C+ — Complete |
| Regulatory anchor: PIC/S PI-041 §7 — complete records include all raw data, metadata, and audit trails; FDA: ‘all data, including repeats and rejects’ Paper: Batch record includes all in-process checks including failed ones; no pages removed or left blank without explanation Electronic: LIMS retains all instrument runs including failed sequences; audit trail captures all attempts, not just the final accepted result Common violation: Deleting or hiding failed test runs from the record; presenting only passing results to auditors |
| C+ — Consistent |
| Regulatory anchor: PIC/S PI-041 — data must be internally coherent and follow an expected, documented sequence Paper: Logbook entries in chronological order with no gaps; dates and times consistent across related documents Electronic: LIMS timestamps synchronized to a validated, locked time server; no ability for users to manually override system time Common violation: Timestamps in audit trails that precede the login event; logbook entries that are out of sequence or have unexplained time gaps |
| E — Enduring |
| Regulatory anchor: 21 CFR 211.180(a) — records retained for required period; PIC/S PI-041 — records must remain accessible for their entire lifecycle Paper: Batch records stored in controlled, fire-proof archive for defined retention period (typically 1 year post-expiry or 5+ years) Electronic: LIMS/ELN data backed up with verified restore procedures; vendor contract includes post-subscription data portability clause Common violation: Data stored on obsolete media (CDs, old proprietary formats) that cannot be read; cloud subscription ends without data export plan |
| A+ — Available |
| Regulatory anchor: 21 CFR 211.180(c) — records readily available for inspection; EU GMP Annex 11 §17 — available during entire retention period Paper: Archived paper records indexed and retrievable within a defined timeframe; location documented in SOP Electronic: LIMS supports role-based access for inspectors; records exportable in human-readable format on demand; disaster recovery tested Common violation: Records archived in a system that is decommissioned without migration; data technically retained but practically inaccessible |
Why ALCOA+ Matters: Real Regulatory Consequences
ALCOA+ is not a quality aspiration — it is an enforcement framework. FDA inspectors systematically evaluate records against ALCOA attributes during inspections, and deficiencies translate directly into Form 483 observations and warning letters.
A 2025 warning letter to Tyche Industries (India) stated explicitly that the firm’s “quality system does not adequately ensure the accuracy and integrity of data” — language that maps precisely to ALCOA’s Accurate attribute. Both Tyche and Jagsonpal Pharmaceuticals were placed under import alerts following findings that included backdated records (Contemporaneous violation) and selective omission of failing results (Complete violation).
In September 2024, FDA warned two Chinese device-testing labs — Mid-Link and SDWH — for failures to accurately record and verify key research data, resulting in findings that invalidated their test results and blocked their products from US market access. The pattern is consistent across FDA, EMA, and MHRA enforcement actions over the past decade: data integrity deficiencies, framed in ALCOA terms, are among the most common and most consequential findings in regulated laboratory inspections.
| A 2024 analysis of FDA warning letters found that a significant majority of data integrity findings relate to one of three ALCOA+ violations: disabled or missing audit trails (Complete/Attributable), shared user accounts (Attributable), or backdated or out-of-sequence entries (Contemporaneous/Consistent). All three are directly preventable with correct LIMS or ELN configuration and enforced SOPs. |
ALCOA+ for Paper Systems vs Electronic Systems
A persistent misconception is that ALCOA+ only applies to electronic systems — or conversely, that digital tools automatically guarantee ALCOA+ compliance. Neither is true.
For paper systems:
- All entries must be in indelible ink — pencil entries are an automatic ALCOA failure
- Errors are crossed out with a single line, signed, and dated — never whited out or overwritten
- Every entry is dated and signed at the time of recording — scrap paper notes transcribed later violate Contemporaneous
- Original pages are retained — torn-out or missing pages create an Available/Complete violation
For electronic systems:
- Unique user accounts mandatory — shared logins make Attributable unenforceable
- System time locked and validated — user-adjustable clocks violate Consistent and Contemporaneous
- Audit trails enabled and protected from modification — disabling audit trails is a severe regulatory finding
- Raw data files retained alongside processed results — deleting source files violates Original and Complete
- Backup and recovery tested regularly — data technically retained but unrecoverable violates Available
| A LIMS or ELN does not make your records ALCOA+ compliant by default. The platform must be correctly configured (audit trails on, user accounts individual, time server locked) and your SOPs must enforce the correct behaviors. Vendor validation documentation proves the system can support ALCOA+ — your validation and operational procedures prove it actually does. |
ALCOA+ and Laboratory Software: What to Look for in a LIMS or ELN
When evaluating LIMS or ELN platforms for use in a regulated environment, ALCOA+ compliance is a practical evaluation checklist — not just a box-ticking exercise. The following capabilities must be verifiable, not just claimed. If you want to learn more about LIMS and ELN here is our pratical guide on how to choose a LIMS and here is our pratical guide on how to chose an Electronic Lab Notebook.
Audit trail implementation
The audit trail must be automatic (no user action required to activate it), tamper-proof (no user — including administrators — can edit or delete entries), and complete (every creation, modification, and deletion is captured with user ID, timestamp, and reason for change). This directly supports Attributable, Contemporaneous, Complete, and Consistent. Ask vendors: can an admin disable the audit trail? Can any record be edited without triggering an audit event? The answers must both be no.
Raw data retention
The system must retain raw data files alongside processed and reported results. An ELN that stores only a PDF summary of an instrument run — discarding the original data file — fails Original and Complete. Check whether the system retains all instrument runs — including failed and repeated sequences — and whether they remain linked to the experiment record.
Data export and portability
The Enduring and Available attributes require that records remain accessible throughout the entire retention period — which may be 15 years or longer in some regulated environments. Before committing to any cloud-based LIMS or ELN, contractually establish: what format does data export in? Is the format human-readable without the vendor’s software? What happens to data if the company is acquired or your subscription lapses?
Official Sources and Reference Documents
All claims in this article reference the primary regulatory documents listed below. For compliance decisions, always consult the current, official version of each document directly.
| Source | Description | Publisher |
|---|---|---|
| FDA — Data Integrity & CGMP Guidance (2018) | Primary FDA guidance defining ALCOA under 21 CFR 211.68 and 211.100 | FDA.gov |
| PIC/S PI 041 — Data Integrity Guidance | Reference international GMP data integrity framework — defines ALCOA+ | PIC/S (picscheme.org) |
| EMA — Reflection Paper (electronic source data) | 2010 EMA paper that introduced Complete, Consistent, Enduring, Available — origin of ALCOA+ | EMA (ema.europa.eu) |
| MHRA — GxP Data Integrity Guidance (2018) | UK regulator’s definitive guide: ALCOA, audit trails, computerised systems | MHRA (gov.uk) |
| WHO TRS Annex 5 — Data Integrity | WHO technical report on good data and records management practices (ALCOA+) | WHO |
| eCFR — 21 CFR Part 211 (cGMP) | Predicate rule for pharmaceutical manufacturing records | US Gov. (eCFR) |
| FDA — 21 CFR Part 11 (electronic records) | Electronic records and signatures regulation underpinning ALCOA in digital systems | FDA.gov / eCFR |
| EU GMP Annex 11 — Computerised Systems | EU equivalent of 21 CFR Part 11 — defines requirements for ELN/LIMS in EU GMP environments | EMA (ema.europa.eu) |
Frequently Asked Questions
Does ALCOA+ apply to academic and non-regulated labs?
ALCOA+ is a regulatory requirement specifically in FDA, EMA, MHRA, and WHO-regulated environments — pharmaceutical manufacturing, clinical trials, GLP studies, and GMP quality control. Non-regulated academic labs are not subject to ALCOA+ enforcement. However, the framework is increasingly adopted voluntarily in research settings as a good practice for data integrity, particularly as NIH Data Management & Sharing Policy requirements push all federally-funded research toward structured, documented, and reproducible data management.
What is the difference between ALCOA, ALCOA+, and ALCOA++?
ALCOA (original five attributes) was the FDA’s initial framework. ALCOA+ added Complete, Consistent, Enduring, and Available — introduced by EMA in 2010 and now adopted universally. ALCOA++ is an informal industry extension (not a formal regulatory document) that adds a defined audit trail review cadence and escalation process: high-risk systems reviewed daily, lower-risk systems weekly, with deviations automatically routed to the QMS. ALCOA++ represents best practice in mature pharmaceutical quality systems but is not itself a regulatory requirement.
Can a paper-based lab be ALCOA+ compliant?
Yes. ALCOA+ applies equally to paper and electronic systems. A paper-based lab can be fully ALCOA+ compliant with correct procedures: indelible ink, contemporaneous documentation, controlled templates, signed corrections, defined retention schedules, and secure indexed archives. The practical challenge is that paper systems make Consistent (detecting out-of-sequence entries), Available (rapid retrieval during inspection), and Complete (verifying nothing has been removed) significantly harder to demonstrate than validated electronic systems with audit trails.
How do I know if my LIMS is truly ALCOA+ compliant?
You need three things: the vendor’s validation documentation package confirming the system’s technical capabilities; your own IQ/OQ/PQ validation confirming the system operates correctly in your specific configuration; and your SOPs confirming that your organizational processes enforce the correct behaviors (no shared logins, audit trails reviewed regularly, data exported and archived per retention policy). All three layers must be in place — vendor claims alone are insufficient.
Summary
ALCOA+ is the data integrity backbone of every regulated laboratory environment. Its nine attributes — Attributable, Legible, Contemporaneous, Original, Accurate, Complete, Consistent, Enduring, Available — define what makes a laboratory record trustworthy under the eyes of the FDA, EMA, MHRA, WHO, and PIC/S. They apply to every record, on every medium, at every stage of its lifecycle.
For laboratory software, ALCOA+ is the practical evaluation standard that sits above and beyond technical compliance with 21 CFR Part 11 or EU GMP Annex 11. A platform can pass every technical check and still generate non-compliant records if its configuration or the organization’s processes fail to enforce ALCOA+ behaviors in daily operation.
Understanding ALCOA+ is not just a compliance exercise — it is the foundation for building a laboratory documentation system that will withstand regulatory inspection, support reproducible science, and protect both product quality and patient safety.
| This article is part of labsoftwareguide.com’s regulatory compliance series. Related reading: What is 21 CFR Part 11? A Practical Guide for Lab Software | Best LIMS for FDA-Regulated Environments (2026) | EU Annex 11 vs 21 CFR Part 11: Key Differences | How to Validate a LIMS: An IQ/OQ/PQ Guide |
This article is for informational purposes only and does not constitute legal, regulatory, or compliance advice. Regulatory guidance is subject to revision. Always consult current official sources (FDA.gov, EMA, MHRA, PIC/S, WHO) and qualified regulatory counsel for decisions specific to your organisation.
