Data Integrity

Data integrity in regulated environments

Data integrity is one of the most critical inspection focus areas for the FDA and EMA in recent years. Observations related to incomplete, altered or non-auditable data have resulted in warning letters, import alerts and multi-million dollar penalties for pharmaceutical companies worldwide.

ALCOA+ is the universally accepted framework for assessing data integrity in GxP environments. Its principles — Attributable, Legible, Contemporaneous, Original and Accurate, plus Complete, Consistent, Enduring and Available — define the minimum standard that all GxP records must meet, whether on paper or in electronic format.

When is a data integrity assessment needed?

• Before a regulatory inspection or customer audit.
• After receiving data integrity observations in a previous inspection.
• When implementing new systems that manage GxP data (LIMS, ERP, MES, laboratory equipment).
• During merger or acquisition processes with regulatory due diligence review.
• As part of a proactive quality risk management programme.

Our assessment process

1. Initial assessment (ALCOA+ Gap Analysis)

We conduct a thorough evaluation of existing controls in your systems and processes to identify gaps against ALCOA+ requirements. We analyse:

• Access controls and authentication.
• Audit trail management: existence, integrity and periodic review.
• Backup configuration and disaster recovery.
• Error handling and data reprocessing procedures.
• Manual recording practices and use of spreadsheets.

2. Risk analysis

We classify each finding according to its potential impact on product quality and patient safety, prioritising remediation actions proportionally to the real risk.

3. Remediation plan

We develop a detailed action plan with owners, deadlines and success criteria. The plan may include procedural changes, system configuration, training or validation projects.

4. Implementation and verification

We support the team during the implementation of corrective actions and verify the effectiveness of changes through documented evidence.

5. Team training

Data integrity is not just a technical matter: it is a cultural one. We deliver specific training so the team understands the requirements and applies them in their daily work.

Applicable regulations and guidelines

• FDA 21 CFR Part 211 (pharmaceutical records)
• FDA 21 CFR Part 11 (electronic records and electronic signatures)
• EMA Annex 11 (computerised systems)
• MHRA GXP Data Integrity Guidance (de facto international reference)
• WHO TRS 1010, Annex 5 (data integrity guidelines)
• PIC/S PI 041 (good data integrity practices)

Why act now?

FDA and EMA inspections have increased in depth and rigour in their evaluation of data integrity. Inspectors have learned to detect patterns of data manipulation, deletion and disabled audit trails. Identifying and remediating gaps before an inspection is always cheaper and less risky than doing so in response to formal observations.