The short answer
ALCOA is five data-integrity attributes — Attributable, Legible, Contemporaneous, Original, Accurate. ALCOA+ adds four more (Complete, Consistent, Enduring, Available) for nine. ALCOA++ adds a tenth, Traceable, and is the form the European Medicines Agency uses for clinical-trial data.[6]
The letters are a memory aid, not a hierarchy of legal obligation. The MHRA settles the question directly: “There is no difference in expectations regardless of which acronym is used.”[3]
If you have landed here trying to work out whether your SOP should say ALCOA, ALCOA+ or ALCOA++, the useful answer is not another definition list. It is knowing which regulator wrote which version, in which document, and what an inspector actually asks for when they say the word. That is what this page sets out, with the source text quoted and dated in every case.
Where ALCOA actually came from — and where it is not written
ALCOA was not created by a rule, a regulation or a guidance document. It was coined in the early 1990s by Stan W. Woollen, then working in the FDA’s Office of Enforcement, as a memory aid for presentations on Good Laboratory Practice and the Bioresearch Monitoring (BIMO) programme. In his own account: “One of the techniques I used was to come up with acronyms that I could easily remember to help me organize my presentations. This is where the acronym ALCOA came in.”[1]
Correcting a widely repeated claim
ALCOA is not defined in 21 CFR Part 11, and Part 11 does not contain the word. Part 11 was published at 62 FR 13464 on 20 March 1997 and sets requirements for validation (§ 11.10(a)) and for “secure, computer-generated, time-stamped audit trails” (§ 11.10(e)).[7] ALCOA is the shorthand the agency’s people use to describe those and the predicate cGMP record rules — it is not itself a regulation. Our 21 CFR Part 11 compliance manual covers the rule text section by section.
Where the FDA does use the acronym is in its final guidance Data Integrity and Compliance With Drug CGMP: Questions and Answers (December 2018), which defines data integrity as “the completeness, consistency, and accuracy of data” and states that such data “should be attributable, legible, contemporaneously recorded, original or a true copy, and accurate (ALCOA)”.[2] Note the phrase “or a true copy” — the FDA’s own wording is broader than the bare word “Original” that most training slides carry.
Which version applies to you
Pick the authority that inspects the record and the medium it lives on. The tool returns the acronym that authority uses, the document that governs, and the control point an inspector goes to first.
1 · Who inspects this record?
2 · What medium is the record on?
Choose an authority and a medium
- Governing text
- Select above to see the document that applies.
- First control point an inspector checks
- Select above to see the control point.
Guide only. Confirm against the current version of the cited document before writing it into an SOP.
The ten attributes, and who requires each one
| Attribute | ALCOA (5) | ALCOA+ (9) | ALCOA++ (10) | What it means in practice |
|---|---|---|---|---|
| Attributable | ✓ | ✓ | ✓ | Who did it and when. Unique logins, no shared accounts, signatures tied to a named person. |
| Legible | ✓ | ✓ | ✓ | Readable and unambiguous for the whole retention period, including after a system migration. |
| Contemporaneous | ✓ | ✓ | ✓ | Recorded as the activity happens. FDA cites §§ 211.100(b) and 211.160(a). |
| Original | ✓ | ✓ | ✓ | First capture — or a verified true copy. FDA wording is “original or a true copy”. |
| Accurate | ✓ | ✓ | ✓ | A truthful representation of what was observed, errors corrected visibly rather than erased. |
| Complete | — | ✓ | ✓ | Nothing deleted, including failed runs and out-of-specification results. FDA cites §§ 211.188 and 211.194(a). |
| Consistent | — | ✓ | ✓ | Created and stored in a logical, standardised sequence — dates, units, version numbering. |
| Enduring | — | ✓ | ✓ | Intact for the whole defined retention period, on validated durable media. |
| Available | — | ✓ | ✓ | Retrievable in readable form on request, throughout retention. |
| Traceable | — | — | ✓ | Every change followable across the whole data life cycle, source through to reported result. |
Scroll the table sideways on a phone.
Is there an ALCOA+++ or ALCOA++++?
No regulator defines either. Searches for them are common, but the primary texts stop at nine attributes (FDA, MHRA, WHO, PIC/S) or ten (EMA). Anything beyond that is a trainer’s or vendor’s coinage. The same applies to ALCOA-C: it appears in clinical data-management training where the “C” is Complete, but it is not a separate standard in any of the five source documents cited on this page.
The five original attributes, in working detail
AAttributable
Every entry, change and approval traces to one identified person and a time. In practice that means unique user IDs, no shared credentials, and audit trails that capture user, timestamp and action type automatically.
Typical failure: a batch record reviewed but not signed; a shared analyst login on an HPLC workstation.
LLegible
Readable and unambiguous, on paper and on screen, for the whole retention period. Corrections on paper use a single strikethrough with initials, date and reason — never an eraser or correction fluid. Electronic records need human-readable metadata that survives migration.
Typical failure: thermal printer output that has faded; a proprietary file format no longer supported.
CContemporaneous
Recorded as the activity occurs. The FDA guidance ties this to §§ 211.100(b) and 211.160(a), which require activities to be documented at the time of performance.[2]
Typical failure: chamber temperatures written up at end of shift from a scrap of paper.
OOriginal
The first or source capture. The MHRA defines it as “the first or source capture of data or information e.g. original paper record of manual observation or electronic raw data file from a computerised system.”[3] A copy only substitutes when it is a verified true copy.
Typical failure: a supplier certificate of analysis photocopied without verification.
AAccurate
A truthful representation of what happened. Corrections are made visibly, with the original value, the new value, the reason, the date and the signature all preserved.
Typical failure: re-integrating a chromatogram until it passes, without recording the earlier integration.
+The four additions
Complete — nothing removed, failed runs included. Consistent — standardised format and sequence. Enduring — survives the retention period. Available — retrievable on request. The MHRA states these plainly as the “+”.[3]
“A copy (irrespective of the type of media used) of the original record that has been verified (i.e. by a dated signature or by generation through a validated process) to have the same information, including data that describe the context, content, and structure, as the original.”
MHRA definition of a true copy, ‘GXP’ Data Integrity Guidance and Definitions, Revision 1, March 2018[3]How it lands in each function
The attributes are constant. What changes is the control point the inspector goes to. Pick the function you work in.
Where the laboratory loses data integrity
- Audit trail review. The FDA guidance treats audit trails as part of the production and control records that § 211.192 requires the quality unit to review and approve.[2] The WHO guideline makes the frequency risk-based: “criticality of the system (high impact versus low impact) … should be considered when determining the frequency of the audit trail review.”[4]
- Dynamic versus static records. The FDA distinguishes a static record (“a fixed-data record such as a paper record or an electronic image”) from a dynamic one where “the record format allows interaction between the user and the record content.”[2] A printed chromatogram is not the original for a dynamic system.
- Instrument qualification. USP General Chapter <1058> Analytical Instrument Qualification is the reference for demonstrating the instrument generating the data is fit for purpose.[12]
- Metadata. FDA defines metadata as “contextual information required to understand data.”[2] Integration parameters, sequence files and processing methods are part of the record, not accessories to it.
Batch records and in-process control
- Contemporaneous entry is a rule, not a habit. §§ 211.100(b) and 211.160(a) require activities to be documented at the time of performance.[2] Back-filled entries are the single most common finding in this area.
- Complete data means all of it. §§ 211.188 and 211.194(a) require complete information and complete data derived from all tests[2] — including the run you would rather not show.
- Backups are records too. FDA defines a backup as “a true copy of the original record that is maintained securely throughout the record retention period.”[2] A convenience copy on a shared drive is not a backup.
- Environmental and utility data. Continuous monitoring output is subject to the same nine attributes as a batch record. If you are building or upgrading a site, the pharma plant GMP due-diligence checklist covers where these systems usually fail an audit.
Clinical trial data — the only place ALCOA++ is formally required
- The EMA Guideline on computerised systems and electronic data in clinical trials (EMA/INS/GCP/112288/2023, adopted 7 March 2023) requires data to be “attributable, legible, contemporaneous, original, accurate, complete, consistent, enduring, available when needed and traceable” — the ten attributes it labels ALCOA++.[6]
- Traceable is the addition: data must be followable across the whole life cycle, so a reported result can be walked back to the source record and every transformation in between.[6]
- Note the ordering: the EMA guideline came into effect six months after publication. GMP inspectorates have not adopted the ten-attribute form — PIC/S PI 041-1 still lists nine.[5]
Paper, electronic and everything in between
- The WHO guideline states its scope covers “electronic, paper and hybrid systems.”[4] There is no lighter standard for paper.
- The MHRA GXP data integrity guidance warns against treating a change of medium as a fix: “reverting from automated or computerised systems to paper-based manual systems or vice-versa will not in itself remove the need for appropriate data integrity controls.”[3]
- Hybrid systems are the hardest case, because the signature, the raw data and the review can live in three places. Define which artefact is the original record before validating anything else.
- India: the Revised Schedule M addresses this through its documentation chapter rather than a named data-integrity clause — see the section below, and the CDSCO Schedule M compliance self-assessment.
India: what Revised Schedule M actually says
Roughly half the people reading this page are in India, and Indian manufacturers are now inside the Revised Schedule M regime rather than approaching it. Two instruments matter:
- G.S.R. 922(E), 28 December 2023 — the Drugs (Amendment) Rules, 2023, which replaced Schedule M of the Drugs Rules, 1945.[10]
- G.S.R. 127(E), 11 February 2025 — Ministry of Health and Family Welfare notification allowing manufacturers with turnover below ₹250 crore to seek an extension to 31 December 2025, conditional on applying in Form A to the Central Licence Approving Authority within three months of publication with a plan of upgradation.[11]
The point most Schedule M summaries miss
Revised Schedule M does not use the phrase “data integrity” and does not mention ALCOA. It reaches the same place through its documentation chapter, which requires documentation to provide “documented evidence, traceability and to provide records and an audit trail that will permit investigation”, and through its electronic-records clause, which requires a record of changes and deletions, password-controlled access, and independent checking of critical data entry.[10]
Practical consequence: an Indian manufacturer cannot answer a Schedule M finding by pointing at the absence of the words. Traceability and audit trail are stated obligations. For the timeline and category-by-category position, see our Revised Schedule M key points guide.
What is changing next — the 2026 watch list
The EU rulebook for computerised systems is mid-revision, and this is the change most likely to affect ALCOA wording in the next SOP cycle.
- Annex 11 (Computerised Systems) in EudraLex Volume 4 is still the January 2011 version.[8]
- The European Commission ran a stakeholders’ consultation on revised Chapter 4 (Documentation), revised Annex 11 and a new Annex 22 on artificial intelligence, open from 7 July 2025 to 7 October 2025. The consultation is closed; the revised texts have not been adopted.[9]
- Until adoption, the operative EU GMP position on computerised systems remains the 2011 Annex 11 read alongside PIC/S PI 041-1 (1 July 2021).[5]
If your quality system quotes a draft as though it were in force, that is itself a finding. Date every regulatory reference in your SOPs.
Common findings, and the clause they are written against
| Attribute at fault | What it looks like on the floor | Written against | Remediation that holds up |
|---|---|---|---|
| Attributable | Shared login on a laboratory workstation; unsigned batch review | 21 CFR 11.10(e) audit trails[7] | Unique IDs, role-based access, electronic signature workflow, periodic access review |
| Contemporaneous | Chamber temperatures transcribed at end of shift | 21 CFR 211.100(b), 211.160(a)[2] | Point-of-activity capture; remove the intermediate notebook from the process entirely |
| Original | Printed chromatogram filed as the raw data for a dynamic system | FDA static vs dynamic record definition[2] | Retain the electronic record with metadata; define the original in the SOP |
| Complete | Trial injections or failed runs excluded from the data set | 21 CFR 211.188, 211.194(a)[2] | Retain and investigate every result; document the investigation, not just the conclusion |
| Enduring | Records on an unsupported system with no validated migration path | WHO TRS 1033 Annex 4, retention[4] | Defined retention periods in authorised procedures; validated migration with verification |
| Available | Three-year-old records cannot be produced during an inspection | WHO TRS 1033 Annex 4[4] | Indexed archive, documented retrieval procedure, periodic retrieval drills |
| Traceable | Reported clinical result cannot be walked back to source | EMA/INS/GCP/112288/2023[6] | Documented data flow map from source through every transformation to the report |
Scroll the table sideways on a phone.
If you are preparing for a USFDA inspection specifically, our USFDA compliance and inspection readiness guide covers Form 483 response timelines and observation trends for Indian sites, and the USFDA approval roadmap for Indian formulation plants sets out the sequence for a first filing.
Frequently asked questions
ALCOA stands for Attributable, Legible, Contemporaneous, Original and Accurate. The FDA states the fourth attribute slightly more broadly in its December 2018 data integrity guidance as “original or a true copy”. The five attributes describe what makes a GxP record trustworthy enough to base a batch release or a regulatory submission on.
All three counts are correct depending on the document you are reading. ALCOA is five. ALCOA+ is nine, adding Complete, Consistent, Enduring and Available, and is the form used by the MHRA, the WHO and PIC/S. ALCOA++ is ten, adding Traceable, and is used by the EMA for clinical trial data. The MHRA states there is no difference in regulatory expectation between the acronyms.
Not in any regulatory text. The FDA, MHRA, WHO and PIC/S documents stop at nine attributes and the EMA guideline stops at ten. Longer variants circulate in training material and vendor marketing but have no source in guidance, so they should not appear in an SOP or a validation document.
Stan W. Woollen, working in the FDA’s Office of Enforcement, coined it in the early 1990s as a memory aid for presentations on Good Laboratory Practice and the Bioresearch Monitoring programme. He described its origin himself in an article for The Compass in Summer 2010. It began as a speaking aid, not as a regulation.
No. Part 11, published at 62 FR 13464 on 20 March 1997, sets requirements for validation, audit trails, record protection and electronic signatures, but never uses the word ALCOA. The acronym appears in FDA guidance rather than in the regulation, and describes expectations that flow from the predicate cGMP record rules in 21 CFR Parts 210 and 211 as much as from Part 11.
The FDA’s December 2018 guidance uses the five-attribute form. It does not use ALCOA+. However, the underlying cGMP requirements it cites — complete data from all tests under 21 CFR 211.194(a), retention, and quality unit review of records including audit trails under 211.192 — cover the same ground the “+” attributes describe. Writing ALCOA+ into your quality system does not put you in conflict with FDA expectations.
ALCOA-C appears mainly in clinical data-management training, where the C stands for Complete. It is not defined as a separate standard in the FDA, MHRA, WHO, PIC/S or EMA texts cited on this page — those either use the five-letter form or the nine-attribute ALCOA+. Treat it as informal shorthand rather than a regulatory term.
Revised Schedule M, notified by G.S.R. 922(E) on 28 December 2023, does not use the phrase “data integrity” or the acronym ALCOA. It reaches the same requirements through its documentation chapter, which calls for documented evidence, traceability and an audit trail that permits investigation, and through its electronic records clause requiring recorded changes and deletions, restricted access and independent checking of critical data entry.
Yes, and equally. The WHO guideline states its scope covers electronic, paper and hybrid systems. The MHRA adds that moving from computerised to paper systems or the other way round does not remove the need for appropriate data integrity controls. Paper simply shifts the controls from system configuration to procedure, review and physical custody.
Use ALCOA+ for GMP quality systems and ALCOA++ where clinical trial data is in scope, and cite the specific document and date you are relying on rather than the acronym alone. An SOP that says “records shall meet ALCOA+ as defined in MHRA GXP Data Integrity Guidance Revision 1, March 2018” survives an inspection question that “records shall be ALCOA compliant” does not.
Related on Laafon
- 21 CFR Part 11 compliance manual — the rule text behind electronic records and signatures, section by section.
- CDSCO Schedule M compliance dashboard — a twelve-question self-assessment that scores your current readiness.
- MHRA guidelines for quality manufacturers — the UK expectations that sit behind the ALCOA+ definitions quoted above.
- WHO-GMP versus USFDA compliance — where the two systems diverge on documentation and inspection.
- USFDA compliance and inspection readiness guide — Form 483 response timelines and Indian-site observation trends.
- Pharma manufacturing plant cost in India — what a Schedule M-compliant build actually costs.
References
- Woollen SW. Data Quality and the Origin of ALCOA. The Compass. Summer 2010. Accessed August 2026.
- US Food and Drug Administration. Data Integrity and Compliance With Drug CGMP: Questions and Answers. Guidance for Industry. Rockville (MD): CDER, CBER, CVM; December 2018. Accessed August 2026.
- Medicines and Healthcare products Regulatory Agency. ‘GXP’ Data Integrity Guidance and Definitions. Revision 1: March 2018 (page updated 27 September 2021). London: MHRA. Accessed August 2026.
- World Health Organization. Guideline on data integrity. WHO Expert Committee on Specifications for Pharmaceutical Preparations, fifty-fifth report. WHO Technical Report Series No. 1033, Annex 4. Geneva: WHO; 2021. Accessed August 2026.
- Pharmaceutical Inspection Co-operation Scheme. Good Practices for Data Management and Integrity in Regulated GMP/GDP Environments. PI 041-1. Geneva: PIC/S; entry into force 1 July 2021. Accessed August 2026.
- European Medicines Agency. Guideline on computerised systems and electronic data in clinical trials. EMA/INS/GCP/112288/2023. Adopted 7 March 2023. Amsterdam: EMA. Accessed August 2026.
- United States. Electronic Records; Electronic Signatures, 21 CFR Part 11. 62 FR 13464, 20 March 1997. Accessed August 2026.
- European Commission. EudraLex Volume 4, Good Manufacturing Practice Guidelines, Annex 11: Computerised Systems. Revision January 2011. Accessed August 2026.
- European Commission. Stakeholders’ consultation on EudraLex Volume 4: Chapter 4, Annex 11 and new Annex 22. Consultation open 7 July 2025 to 7 October 2025; closed. Accessed August 2026.
- Ministry of Health and Family Welfare (India). Drugs (Amendment) Rules, 2023 — Revised Schedule M. Notification G.S.R. 922(E), 28 December 2023. New Delhi: Gazette of India. Index of notifications: CDSCO Gazette Notifications. Clause references read from a publicly hosted copy of the notified text; confirm against the CDSCO gazette file before citing in a controlled document.
- Ministry of Health and Family Welfare (India). Notification G.S.R. 127(E), 11 February 2025 — extension of timeline for implementation of revised Schedule M for small and medium manufacturers. New Delhi: Gazette of India. Accessed August 2026.
- United States Pharmacopeia. General Chapter <1058> Analytical Instrument Qualification. USP–NF. Rockville (MD): USP. Accessed August 2026.
Technical and educational content for pharmaceutical professionals. Not medical, legal or investment advice. Pharmacopoeial texts and Indian statutory instruments change frequently — verify every citation against the current official version before relying on it in a controlled document or a regulatory submission. Reviewed August 2026.
