Data integrity is the degree to which a record is complete, consistent and accurate throughout its life, so that a decision made on it, a batch released, a result reported, a cleaning signed off, is a decision made on what actually happened. That is the whole idea. It is not an IT topic and it is not new. EU GMP Chapter 4 has required legible, contemporaneous, attributable records for decades, and the batch record requirement now at 4.20 has been the same in substance since the first edition of the EU GMP Guide in 1989. What changed around 2015 is that regulators started to inspect for it directly, and to publish what they found.
What the regulations actually say
EU GMP Chapter 4, paragraph 4.1, requires that documentation be designed and controlled so that 'the accuracy of records' can be relied on, and covers both paper and electronic records. Paragraph 4.8 says records should be made at the time each action is taken, and 4.9 that any alteration is signed and dated and leaves the original readable. Annex 11 extends the same expectations to computerised systems: section 9 requires audit trails, section 12 restricts access to authorised people, and section 14 governs electronic signatures. Section 4 requires the systems themselves to be validated, section 7 that data are secured against damage and backed up, and section 17 that archived records stay readable, so that an electronic record is as trustworthy as the paper one it replaces.
The guidance documents do not add requirements; they explain how the requirements are inspected. PIC/S PI 041-1, Good Practices for Data Management and Integrity, is the one inspectors across the EU and the wider PIC/S membership are trained on, and it is the longest. The EMA's questions and answers on data integrity, published by the GMP/GDP Inspectors Working Group, are shorter and more readable, and several of them, on the scope of data integrity, on risk-based review and on outsourced activities, are quoted in EU inspection reports almost word for word.
ALCOA+, one attribute at a time
ALCOA is a mnemonic that inspectors started using in the 1990s; the plus was added later in European guidance. It is not in any regulation, but every regulator uses it as the checklist, so it is the most useful way to think about a record. Each attribute below is paired with the failure that most often breaks it.
- Attributable: it is possible to say who did the work and who made the entry. Broken by shared logins, missing initials, and entries made by someone other than the person who did the activity.
- Legible: the record can be read, now and at the end of its retention period. Broken by illegible handwriting, faded thermal printouts, and electronic formats nobody can open.
- Contemporaneous: recorded at the time of the activity. Broken by end-of-shift completion, entries from scraps of paper, and backdating.
- Original: the first capture of the data, or a verified true copy. Broken by treating a printout as the record while the electronic file is overwritten, and by transcribing results without keeping the source.
- Accurate: the record shows what was actually observed. Broken by selective reporting, testing into compliance, and uncontrolled calculations.
- Complete: all the data, including repeats, reprocessing and failures. Broken by aborted runs that are not reported and by deleted files.
- Consistent: the sequence of events makes sense. Broken by time stamps that run backwards and by entries that contradict equipment logs.
- Enduring: the record survives its retention period intact. Broken by ink that fades, disks that fill, and systems decommissioned without migration.
- Available: the record can be retrieved when needed for review or inspection. Broken by archives nobody can search and by records held on a leaver's laptop.
Why inspectors lead with it
Every other GMP requirement is demonstrated through records. Cleaning validation, training, calibration, batch release: the inspector cannot watch any of it happen, so they read the record and decide whether to believe it. If the records cannot be trusted, nothing else the site says can be verified, and the inspection changes character. That is why the first questions on the first day are so often about the audit trail on the chromatography data system, the user list on the LIMS, and how corrections are made in the batch record.
The published deficiency data show the consequence. In the deficiency analyses that EU national competent authorities publish, documentation and data integrity together account for one of the largest categories of findings every year, and a data integrity deficiency is disproportionately likely to be classified as critical. Statements of non-compliance on EudraGMDP citing Chapter 4 and Annex 11 have been a constant since 2014, and the failures are the same each time: shared accounts, audit trails disabled or unreviewed, unofficial testing, incomplete records.
Worked examples: is it a data integrity problem?
What to do this week
- Pick one system that generates release data and ask who can log in, whether the audit trail is on, and when it was last reviewed. Write down the answers.
- Pull one completed batch record and check five entries against the equipment log for the same activity. Do the times agree?
- Ask three people who make GMP entries what 'contemporaneous' means. If the answers differ, the training has not landed.
Module 1 of the course does this in more depth, with the deficiency data, the guidance documents cross-referenced, and a set of records to assess against each ALCOA+ attribute before you move on to the practice.