DATA INTEGRITY IN PHARMACEUTICAL

QUALITY CONTROL
ALCOA+ • Electronic & Paper Records • Audit Trails • OOS/OOT • Risk Management

Purpose: Practical training material for pharmaceutical quality-control and GMP teams. This reference
explains regulatory concepts, laboratory expectations, documentation practices, data controls,
investigations and inspection readiness.

Important: Educational reference only. Always verify the current official regulation,
notification, licence conditions, approved procedures and site-specific quality
system before using this material for a compliance decision.

Document Training reference

Audience QC analysts, reviewers, QA, laboratory supervisors, validation/IT, auditors

Format Approximately 10–12 pages

Focus Practical controls, records, systems, investigations and audit readiness

Prepared using official regulatory references available in August 2026.

Pharmaceutical Quality Control Training Reference Page 1

 1. Data Integrity: What It Means in a QC Laboratory
Data integrity is the degree to which data remain complete, consistent, accurate, attributable,
contemporaneous, original or a true copy, and available throughout the data lifecycle. In
pharmaceutical quality control, the issue is not merely whether a final result looks correct. The
laboratory must be able to demonstrate how the result was generated, who performed the work,
which instrument and method were used, what calculations occurred, what changes were made, and
how the original record was protected.

FDA’s data-integrity guidance states that firms should ensure data are reliable and accurate and
should use meaningful, effective, risk-based strategies to prevent and detect integrity problems. The
same principle is relevant to an Indian GMP environment: laboratory records should support
confidence that the reported quality result represents the actual testing performed.

Why the final result alone is not enough

A certificate of analysis, worksheet, chromatogram, balance printout or LIMS result is only one part of
the evidence chain. Reviewers need the underlying records and metadata when applicable. For
example, an HPLC assay result should be traceable to the sample identity, preparation, standard
preparation, sequence, instrument status, integration parameters, calculations, system suitability,
analyst identity, review history and any approved changes.

The laboratory data lifecycle

A useful lifecycle is: plan → generate → process → review → report → retain → retrieve → dispose.
Controls should exist at each stage. Weakness at any stage can undermine the credibility of the final
result. A system that prevents deletion but does not control user access, for example, may still allow
inappropriate changes. Conversely, a technically secure system can still be compromised by poor
procedures or shared passwords.

Core principle: The objective is not to create more paperwork. The objective is to
preserve trustworthy evidence of what actually happened.

Area Practical control

People Unique user identity, training, defined responsibilities and independent review.

Process Approved methods, controlled worksheets, contemporaneous recording and documented deviations.

System Access control, audit trail, backups, time synchronization and validated functionality.

Records Original data, metadata, calculations, review evidence and retention controls.

Pharmaceutical Quality Control Training Reference Page 2

 2. ALCOA+ in Practical Terms
ALCOA is commonly used as a practical framework for evaluating laboratory records: Attributable,
Legible, Contemporaneous, Original and Accurate. The expanded ALCOA+ concept adds
Completeness, Consistency, Enduring and Available. These attributes are not a substitute for
regulation, but they provide a powerful daily checklist for analysts and reviewers.

Attributable
A record should show who performed the activity and, where appropriate, who reviewed or approved
it. The attribution should be linked to a unique individual rather than a generic account. Shared user
IDs make it difficult to establish responsibility and weaken the audit trail.

Legible and contemporaneous

Entries should be readable and made when the activity occurs. Backdating, reconstructing routine
entries from memory, or filling multiple pages at the end of a shift creates uncertainty about
sequence and timing. If a delayed entry is unavoidable, the reason and actual date/time should be
documented according to procedure.

Original and accurate

The original observation, raw electronic data or a verified true copy should be retained. Transcription
should not replace raw data. Accuracy requires correct instruments, methods, calculations, units,
sample identity and review. A neat report cannot compensate for missing or altered source evidence.

Complete, consistent, enduring and available

Completeness includes relevant records, including data that may be associated with an investigation
or failed run. Consistency means dates, times, sequence and record relationships make sense.
Enduring means the record remains protected for the required retention period. Available means
authorized personnel can retrieve and understand the record when needed.

ALCOA+ QC example

Attributable Analyst logs in with a unique account and electronically signs the result.

Contemporaneous Sample weight is recorded at the time of weighing.

Original Instrument raw files and associated metadata are retained.

Complete All relevant injections, system suitability and calculations are retained.

Available Records can be retrieved in readable form during an audit.

Pharmaceutical Quality Control Training Reference Page 3

 3. Paper Records and Good Documentation Practices
Paper systems remain important even in highly computerized laboratories. Good documentation
practice requires entries that are permanent, readable, traceable and protected from unauthorized
alteration. A paper record should tell the story of the activity without requiring the reviewer to guess
what happened.

Corrections should preserve the original entry. A common good practice is to draw a single line
through the incorrect entry so it remains readable, enter the corrected information, and provide
initials/date and a reason when required by the procedure. Erasing, overwriting, using correction
fluid, tearing out pages or obscuring the original entry defeats traceability.

Controlled forms
Forms should have an identifier, version or revision status, controlled issuance where appropriate,
and defined retention. Blank forms should be controlled to reduce the risk of unauthorized copies.
Unused fields should be handled according to the approved procedure; they should not be left in a
condition that permits later insertion of undocumented activity.

Raw data versus summaries

A summary table is not a replacement for raw observations. If a calculation is transferred to another
form, the source should remain identifiable. Reviewers should be able to move backward from the
reported result to the original evidence.

A strong paper record allows an independent reviewer to reconstruct the activity

without relying on the analyst’s memory.

Pharmaceutical Quality Control Training Reference Page 4

 4. Electronic Data, Metadata and Audit Trails
Electronic laboratory systems generate more than the visible result. Metadata may include user
identity, timestamps, instrument configuration, sequence information, processing parameters,
method versions and audit-trail entries. These elements can be critical for reconstructing the data
lifecycle.

An audit trail should be treated as a quality record, not merely an IT feature. The organization should
define which audit trails are enabled, who reviews them, when review occurs, how exceptions are
investigated, and how audit-trail records are retained. Risk-based review can focus on functions
capable of changing, deleting, reprocessing or approving data.

Access management
Users should receive only the privileges needed for their role. Administrator access should be tightly
controlled and monitored. Passwords or electronic signatures should not be shared. Departed or
transferred users should have access removed or adjusted promptly.

System time and identity

Accurate timestamps help establish sequence. Time synchronization should therefore be controlled
where the system depends on timestamps for traceability. Unique user identity is equally important
because attribution is part of data integrity.

Backup and restore

Backup is not the same as retention. A backup strategy should protect data from accidental loss and
allow recovery, while retention controls define how long records must remain available and readable.
Restore testing is important because an untested backup is only an assumption of recoverability.

Control Questions for QC/QA

Audit trail Is it enabled where relevant, protected, retained and reviewed?

Access Are privileges role-based and periodically reviewed?

Backup Are backups protected and are restore tests documented?

Metadata Can relevant metadata be retrieved with the record?

Pharmaceutical Quality Control Training Reference Page 5

 5. Chromatography and Instrument Data Integrity
Chromatography systems are a frequent focus of laboratory data-integrity review because a single
analytical run can generate multiple layers of data. The laboratory should control sample preparation
records, sequence creation, instrument methods, acquisition data, processing methods, integration
parameters, calculations, system suitability and final reporting.

Analysts should use approved methods and controlled processing procedures. Reprocessing should
be justified and documented. Changing integration parameters may be legitimate when supported by
procedure and scientific rationale, but unexplained or repeated reprocessing can create questions
about result selection.

Typical integrity risks

Examples include deleting injections, hiding failed sequences, using shared accounts, changing
processing methods without traceability, selecting only favorable chromatograms, manipulating peak
integration without documentation, or failing to retain original raw files.

Review expectations
A reviewer should confirm sample identity, sequence completeness, system suitability, integration,
calculations, method version, instrument status and any reprocessing. Review should consider
whether the reported result is supported by the full data set rather than only the final printed report.

Never treat a chromatogram printout as the complete electronic record when the
system retains additional raw data or metadata.

Pharmaceutical Quality Control Training Reference Page 6

 6. Microbiology and Other QC Data
Data-integrity principles apply equally to microbiology, wet chemistry, physical testing and stability.
Microbiology adds specific traceability needs because incubation conditions, plate identity, media,
environmental conditions and observations can be critical to interpretation.

For microbial enumeration or sterility-related work, the laboratory should ensure that sample identity,
media lot, preparation status, incubation conditions, analyst identity and observations are traceable.
Photographs, electronic images or instrument-generated results should be handled as records when
they form part of the evidence supporting a conclusion.

Balances and weighing

The sample weight is a critical input to many calculations. The balance should be appropriately
qualified or calibrated, status should be known, and the weight should be captured
contemporaneously. Manual transcription should be controlled where it cannot be avoided.

pH, UV, dissolution and other instruments

Instrument printouts and electronic records should be linked to the correct sample and run. Where
systems permit changes, access and audit trails should be appropriately controlled. Review should
confirm that the instrument was suitable and within its required status.

Stability data
Stability records should preserve the planned time point, actual test date, sample identity, conditions,
method, result and any deviation. Missing or delayed testing should be visible rather than silently
corrected.

Pharmaceutical Quality Control Training Reference Page 7

 7. Data Integrity in OOS, OOT and Deviations
A data-integrity program is especially important during investigations because pressure to explain an
unexpected result can create incentives for inappropriate retesting or selective data review. The first
response to an OOS result should follow the approved investigation procedure and preserve the
original evidence.

The laboratory should distinguish between a scientifically justified repeat test and an attempt to test
into compliance. Any repeat or additional analysis should have a documented rationale and follow the
approved investigation process.

Preserve first, investigate second

When an unexpected result occurs, protect the original data and associated metadata. Do not delete,
overwrite or alter the source record merely because the result appears anomalous. Review the
method, sample, instrument, calculations, system suitability and analyst execution according to
procedure.

Interviewing analysts
Investigators may interview analysts to understand what happened, but the investigation should be
based on records and objective evidence rather than memory alone. Training, workload, equipment
status and procedure clarity can be relevant systemic factors.

CAPA
CAPA should address the root cause and the risk of recurrence. If a data-integrity issue is found,
consider whether similar records, systems, products, analysts or time periods could be affected. The
scope should be scientifically and risk-based.

Pharmaceutical Quality Control Training Reference Page 8

 8. Data Integrity Risk Assessment
Risk assessment helps organizations focus resources on systems and activities that can most affect
product quality or regulatory decisions. A useful assessment maps data flows from sample receipt to
final disposition and identifies points where data can be created, modified, transferred, reviewed or
deleted.

Questions to ask
• Can a user create, modify or delete data without leaving a trace?

• Are users uniquely identified?

• Can the system distinguish original data from processed data?

• Are audit trails enabled and reviewed where appropriate?

• Can data be exported without losing critical metadata?

• Can records be retrieved throughout the retention period?

• Are paper-to-electronic transcription steps controlled?

• Are calculations independently verified?

• Are failed, aborted or repeated runs retained and assessed?

Risk ranking
Consider the potential impact on patient safety, product quality, regulatory decisions, detectability,
likelihood and the effectiveness of existing controls. High-risk systems deserve stronger technical and
procedural controls and more frequent review.

Pharmaceutical Quality Control Training Reference Page 9

 9. Governance, Training and Culture
Technology alone cannot create data integrity. The organization needs a culture in which employees
understand that accurate records are part of the product-quality system. Management should provide
adequate staffing, equipment, training, time and supervision so that employees are not pressured
into shortcuts.

Roles
Analysts are responsible for truthful, contemporaneous records. Supervisors ensure appropriate
execution and review. QA provides independent oversight. IT supports secure, controlled systems.
Validation functions help demonstrate that computerized systems are fit for intended use.
Management provides resources and sets expectations.

Training
Training should cover ALCOA+, laboratory-specific risks, good documentation practices,
electronic-system behavior, audit trails, password controls, corrections, deviations, OOS
investigations and escalation. Effectiveness should be assessed rather than relying only on
attendance.

Speaking up
Employees should be able to report suspected data-integrity issues without fear of retaliation. The
response should preserve evidence, protect patients and products, and investigate objectively.

Pharmaceutical Quality Control Training Reference Page 10

 10. Inspection Readiness: Practical QC Checklist
Inspection readiness means being able to explain the laboratory’s data lifecycle and demonstrate
that controls work in practice. It is not achieved by preparing documents immediately before an
inspection.

• Unique accounts are active and shared accounts are prohibited or controlled.

• Access rights are current and periodically reviewed.

• Audit trails are enabled where required and reviewed according to risk.

• Original raw data and relevant metadata are retained.

• Paper records are controlled and corrections are traceable.

• Methods, calculations and worksheets are current and approved.

• Instrument qualification/calibration status is evident.

• OOS/OOT/deviation investigations preserve original evidence.

• Backup and restore activities are documented and tested.

• Training records demonstrate competency for assigned activities.

What a strong laboratory can demonstrate

A strong laboratory can take a selected reported result and reconstruct the complete chain: sample
receipt → preparation → test execution → instrument/raw data → processing → calculations → review →
approval → reporting. It can also explain exceptions, reprocessing, deviations and changes without
relying on undocumented explanations.

Pharmaceutical Quality Control Training Reference Page 11

 11. Summary and Action Plan
Data integrity is ultimately about trust. A pharmaceutical quality-control result is valuable only when
the organization can demonstrate that the result is supported by reliable evidence. The strongest
programs combine sound procedures, competent people, secure systems, controlled instruments and
independent review.

30-day action plan

• Map critical QC data flows and identify high-risk systems.

• Review user accounts and remove inappropriate access.

• Confirm audit-trail functionality and review practices.

• Perform a focused ALCOA+ review of representative paper and electronic records.

• Check OOS/OOT investigations for preservation of original data.

• Verify backup, restore and retention controls.

• Refresh data-integrity training using site-specific examples.

• Document CAPA for identified gaps and verify effectiveness.

Remember: the best data-integrity system makes the right behavior easy, the wrong
behavior difficult, and the evidence of every critical activity trustworthy.

References and Further Reading

• FDA, Data Integrity and Compliance With Drug CGMP: Questions and Answers, Guidance for Industry, December 2018: htt
ps://[Link]/regulatory-information/search-fda-guidance-documents/data-integrity-and-compliance-drug-cgmp-questio
ns-and-answers

• FDA, Data Integrity and Compliance With Current Good Manufacturing Practice Guidance for Industry: [Link]
/files/drugs/published/[Link]

• FDA, Part 11, Electronic Records; Electronic Signatures — Scope and Application: [Link]
on/search-fda-guidance-documents/part-11-electronic-records-electronic-signatures-scope-and-application

• FDA, Laboratory Controls / 21 CFR 211.194 key points: [Link]

crobiology-Testing-%E2%80%[Link]

Regulatory note: requirements can change through amendments, corrigenda, notifications, guidance updates and
site-specific licence conditions. Check the official source before use for inspections, submissions, CAPA decisions, validation,
release decisions or other regulated activities.

Pharmaceutical Quality Control Training Reference Page 12