ALCOA: The Nine Words That Decide Whether a Laboratory Record Counts

Every number on a certificate of analysis was once a record somebody made. An integration was accepted, a weight was written down, a file was saved. By the time it reaches you it has been copied, summarised and formatted, and all you can see is the summary. Three regulators independently settled on the same nine words for what the records underneath have to be, and the list is short enough to be worth knowing.

Quick answer

What is ALCOA? It is an acronym for the attributes a regulated record must have. The UK Medicines and Healthcare products Regulatory Agency, in its GXP Data Integrity Guidance and Definitions of March 2018, sets them out as: A — attributable to the person generating the data; L — legible and permanent; C — contemporaneous; O — original record (or certified true copy); A — accurate.

Four more are usually appended, giving ALCOA+: Complete — the data must be whole, a complete set; Consistent — the data must be self-consistent; Enduring — durable, lasting throughout the data lifecycle; Available — readily available for review or inspection purposes.

The two acronyms are the same requirement

You will see both forms used, sometimes in the same document, and it is easy to assume one is a stricter standard. The MHRA addresses this directly. Its guidance, it says, refers to the acronym ALCOA rather than ALCOA+, with the plus referring to complete, consistent, enduring and available — and then states that there is no difference in expectations regardless of which acronym is used, since data governance measures should ensure that data is complete, consistent, enduring and available throughout the data lifecycle.

The plus was added, in the agency's account, to emphasise requirements that were already there. Nobody is holding a laboratory to a higher bar by writing a plus sign.

Who says so, and how closely they agree

The convergence here is unusual and worth noticing. The MHRA defines data integrity as the degree to which data are complete, consistent, accurate, trustworthy, reliable and that these characteristics of the data are maintained throughout the data life cycle.

The PIC/S guidance Good Practices for Data Management and Integrity in Regulated GMP/GDP Environments (PI 041-1), adopted by the PIC/S Committee on 1 June 2021 and in force from 1 July 2021, uses that definition word for word — and footnotes it to the MHRA document. It then lists the attributes itself: good data management practices should ensure that data is attributable, legible, contemporaneous, original, accurate, complete, consistent, enduring, and available.

The US Food and Drug Administration, in Data Integrity and Compliance With Drug CGMP: Questions and Answers (December 2018), says data integrity refers to the completeness, consistency, and accuracy of data, and that complete, consistent, and accurate data should be attributable, legible, contemporaneously recorded, original or a true copy, and accurate — citing ALCOA by name.

Three jurisdictions, one list. That is rare enough in regulatory text that when a laboratory describes its records as ALCOA-compliant, the phrase has a reasonably fixed meaning.

The nine words, one at a time

Metadata is not an optional extra

The attribute most often misunderstood is complete, because a result looks complete when it is a number with a unit. Both agencies attack this with almost the same example.

The MHRA writes that metadata are data that describe the attributes of other data and provide context and meaning, that they form an integral part of the original record, and that without the context provided by metadata the data has no meaning. Its illustration is the bare figure 3.5, which becomes a record only once the context is attached: sodium chloride batch 1234, 3.5 mg, J Smith, 1 July 2014.

The FDA makes the same move with a different number. Metadata is the contextual information required to understand data, it says, and the number 23 is meaningless without metadata, such as an indication of the unit mg. It then lists what metadata for a piece of laboratory data might include: a date and time stamp for when the data were acquired, the user ID of the person who conducted the test, the instrument ID used, material status data, the material identification number, and audit trails.

That last item matters more than it looks, and it is the subject of what an audit trail review actually involves. The audit trail is metadata. Dropping it does not tidy a record; it removes part of it.

Contemporaneous is a design problem, not a discipline problem

It is tempting to read contemporaneous as an instruction to be diligent. Both guidances treat it instead as something the laboratory has to build for.

The MHRA's list of enablers for the right environment includes having access at the point of use to appropriately controlled and synchronised clocks for recording timed events, and specifying the time zone where data is used across multiple sites. It also calls for accessibility of records at the locations where activities take place, so that informal data recording and later transcription to official records does not occur. And it asks for a work environment — adequate space, sufficient time for tasks, properly functioning equipment — that permits tasks to be performed and data recorded as required.

The FDA is blunter about the failure mode. It is not acceptable, it states, to record data on pieces of paper that will be discarded after the data are transcribed to a permanent laboratory notebook. Similarly, it says, it is not acceptable to store electronic records in a manner that allows for manipulation without creating a permanent record.

Neither of those is a lapse of character. They are what happens when the notebook is in a different room from the balance.

Where this touches a buyer: integrity is not quality

There is a distinction in the MHRA guidance that is easy to read past and changes what a compliance claim is worth. The document states that it primarily addresses data integrity and not data quality, because the controls required for integrity do not necessarily guarantee the quality of the data generated. Its glossary defines data quality as the assurance that data produced is exactly what was intended to be produced and fit for its intended purpose — and notes that this incorporates ALCOA.

Read plainly: a perfectly ALCOA-compliant record can faithfully and traceably document a measurement that was not worth making. Integrity establishes that the record tells you what happened. Whether what happened was a sound measurement is the separate question that accuracy and recovery and specificity address.

Both matter, and they fail independently.

The limit of a summary report

This is the part that bears directly on anyone reading a supplier's paperwork rather than generating it.

The MHRA observes that summary reports of data are often supplied between organisations, and that it must be acknowledged that summary reports are limited and critical supporting data and metadata may not be included. Its conclusion is a direct instruction to the recipient: where summary reports are supplied by a different organisation, the organisation receiving and using the data should evaluate the data provider's data integrity controls and processes prior to using the information.

PIC/S reaches the same place from the inspector's side, noting that it is often not practical for the contract giver to review all raw data relating to reported results, and that emphasis should therefore be placed upon a robust qualification process for the outsourced supplier or contractor.

A certificate of analysis is a summary report. Nobody expects a purchaser to audit a synthesis laboratory's chromatography data system. What both guidances say is that the alternative to reviewing the data is assessing the organisation — which is the logic already behind evaluating a supplier on COAs, lot numbers and traceability and batch-specific testing.

What to ask, and what to conclude

• Treat the certificate as a summary, because that is what the guidance calls it. It reports conclusions; it is not the record of how they were reached.
• Ask whether results are lot-specific or representative. A figure carried forward from an earlier batch may be accurate and still not be a record of the vial in your hand.
• Notice what is dated and what is not. Contemporaneity is the attribute a document can quietly lack without looking wrong.
• Do not read ALCOA+ as a stricter claim than ALCOA. The MHRA says in terms that the expectations are identical.
• Separate integrity from quality in your own reading. A trustworthy record of a weak method is still a weak method.

Key takeaways

• ALCOA stands for attributable, legible, contemporaneous, original and accurate; the plus adds complete, consistent, enduring and available.
• The MHRA states there is no difference in expectations between ALCOA and ALCOA+.
• PIC/S PI 041-1, in force 1 July 2021, adopts the MHRA definition of data integrity verbatim and footnotes it to that document.
• Metadata forms an integral part of the original record — the MHRA uses the bare figure 3.5 and the FDA the bare number 23 to make the point.
• Audit trails are explicitly named by the FDA as a type of metadata, not as a separate document.
• The FDA states it is not acceptable to record data on paper that will be discarded after transcription into a notebook.
• The MHRA distinguishes data integrity from data quality: integrity controls do not guarantee the quality of the data generated.
• Both guidances say that where summary reports cross between organisations, the recipient should assess the provider's data integrity controls.

Frequently asked questions

Does any of this apply to research-grade material?

Not as a legal requirement. These are GMP and GxP documents, and research chemicals sold for laboratory use are outside their scope — the distinction set out in what research use only means. What they provide is the clearest published account of what a defensible record looks like, which is useful as a yardstick whoever is holding the pen.

Is a scanned copy of a paper record acceptable?

Under these guidances, yes, if it is a true copy: the MHRA defines that as a copy verified, by a dated signature or by generation through a validated process, to have the same information — including the data that describe context, content and structure — as the original.

What does enduring mean in practice?

That the record survives its retention period in readable form. PIC/S notes specifically that for printouts which are not permanent, such as thermal transfer paper, a verified true copy should be retained. Fading is a data integrity failure.

Why is attributable listed first?

Because without it the rest cannot be checked. The MHRA notes that metadata also permit data to be attributable to an individual, or, if automatically generated, to the original data source — which is why shared logins are treated as a structural problem rather than a minor one, as covered in access control in a working lab.

Should I ask a supplier for raw data?

Rarely useful, and both guidances explain why: it is not practical, and a dynamic chromatography file is not interpretable without the software that made it. Asking what methods were used, and on which lot, gets you further.

Sources

• Medicines and Healthcare products Regulatory Agency. GXP Data Integrity Guidance and Definitions. Revision 1, March 2018. MHRA guidance
• Pharmaceutical Inspection Co-operation Scheme. PI 041-1: Good Practices for Data Management and Integrity in Regulated GMP/GDP Environments. Adopted 1 June 2021; entry into force 1 July 2021. PIC/S guidance
• US Food and Drug Administration. Data Integrity and Compliance With Drug CGMP: Questions and Answers — Guidance for Industry. December 2018. FDA guidance

All quoted text is taken from the published guidance documents linked above.

This article describes record-keeping and documentation practice only. It contains no usage instructions, no dosing information and no protocols of any kind.

For laboratory and in-vitro research use only. Not for human or veterinary use.