ALCOA+ Data Integrity in the Analytical Laboratory

ALCOA+ requires that every record a laboratory relies on be attributable, legible, contemporaneous, original and accurate, and in addition complete, consistent, enduring and available, from the moment a value is generated until the record is destroyed under a retention schedule. The MHRA guidance defines data integrity as the degree to which data are complete, consistent, accurate, trustworthy and reliable, and the maintenance of those characteristics throughout the data life cycle 1. In practice each attribute is a control that can be tested on the laboratory floor: a named user behind every entry, an electronic record still readable in ten years, a chromatogram whose processing history can be reconstructed. This page converts the nine attributes into those controls.

The companion references on the laboratory notebook and on batch traceability describe two specific record types. This page is the framework above both: what counts as data, raw data and metadata; the attributes as paper and electronic controls; where risk-based effort goes first; the life cycle of a record; hybrid paper and electronic systems; the access and reporting culture the current guidance treats as part of integrity; which document governs which laboratory; and a self-inspection checklist. Worked examples refer to a UV assay of an invented decapeptide, AGSKLEYFVR, and to a generic chromatography data system; neither describes a real product or a real system.

Data, raw data, metadata

The guidance documents agree on three definitions, and most integrity failures trace back to a laboratory using one of the words loosely. Data are facts, figures and statistics collected together for reference or analysis, in any form. Raw data are the original records and documentation, retained in the format in which they were originally generated, paper or electronic, or as a true copy; where a basic instrument such as a balance or pH meter stores nothing and provides only a printed output, the printout constitutes the raw data 1. Metadata are data that describe the attributes of other data and give them context and meaning: structure, relationships, the identity of the user, the time stamp, the method version, and the audit trail itself 1.

The static and dynamic distinction is the one that decides most arguments about chromatography. The FDA guidance treats a chromatogram as a dynamic record because its content can still be reprocessed, and therefore a printout of it is not a complete copy of the raw data 4. A peak area reported without the integration events, the method version and the audit trail that produced it is a figure, not a record.

The nine attributes as testable controls

MHRA notes that the four additional attributes make explicit what was already implicit in the original five; PIC/S and WHO list the same nine 123. The table below gives, for each, the requirement, a paper control, an electronic control and the failure that most often appears in inspection findings.

Data criticality and data risk

The guidance does not ask a laboratory to control every record to the same degree. The effort and resource applied to assure the integrity of data should be commensurate with the risk to product quality and balanced against other quality assurance demands 1. Two factors set that effort. Data criticality is the importance of the decision the data influence: a release result ranks above a training record. Data risk is the vulnerability of the data to deliberate or inadvertent alteration, deletion or recreation, and the probability that such a change would be detected 1. PIC/S frames the same assessment around the process, the degree of automation, the complexity of the system and the consistency of the output 2.

The data life cycle

MHRA defines the life cycle as all phases in the life of the data, from generation and recording through processing, including analysis, transformation or migration, use, retention, archive and retrieval, and destruction 1. Each stage has a characteristic failure and a characteristic control. The numbered map below follows one value, the sample mass of the invented decapeptide, from balance to archive.

1. Generation. The balance prints 10.12 mg with date, time and balance identity. The printout is the raw data. Control: printer attached, print on every weighing, printout attached to the notebook page and cross-referenced.
2. Recording. The analyst writes the mass, the balance ID and the sample label in the notebook at the bench. Control: contemporaneous entry; identical value to the printout; initials and date.
3. Processing. The mass enters a locked spreadsheet that calculates the stock concentration, and the data system integrates the chromatogram against that concentration. Control: validated spreadsheet with protected formulae; integration method version-controlled; manual integration recorded with a reason.
4. Review. A second person checks the raw data, the metadata and the audit trail against the reported result before approval, not the report alone. Control: review procedure names what is examined; the audit-trail review is documented.
5. Reporting. The certificate or report states the result, the method version and the data file reference. Control: the report is traceable back to the data file and the notebook page.
6. Use. The result drives a disposition decision. Control: the decision record cites the report, not a verbal figure.
7. Retention. The notebook, printouts, data files and audit trail are kept for the retention period, accessible on request. Control: index; defined storage; backup restore tested at a set interval.
8. Archive and destruction. At the end of active use the records move to controlled archive storage; destruction follows a documented schedule, is recorded and is approved. Control: archive log; destruction record; no destruction while any investigation or request is open.

Hybrid systems: printouts and electronic originals

A hybrid system holds the original record electronically and the review, approval or signature on paper. Most small laboratories run one, whether they call it that or not: a data system whose reports are printed, signed and filed. The guidance permits hybrids but treats them as a higher-risk configuration. The whole data set must be defined, the paper and electronic parts must be linked so that one cannot be reviewed without the other, and the electronic original must be retained for as long as the paper 12.

Access control, culture and the blame-free report

Three organisational controls recur across the guidance and are cheap to implement. Individual accounts: the FDA guidance states that shared login accounts are not acceptable, because actions cannot then be attributed to a single person 4. Separation of roles: the person who acquires and processes data must not hold administrator rights that allow the audit trail to be disabled, the clock to be changed or files to be deleted; Annex 11 requires physical and logical controls restricting access to authorised persons, with the creation, change and cancellation of access authorisations recorded 5. Audit-trail review: a documented review of the audit trail for each reportable result, by someone other than the person who generated the data, before approval 45.

Which guidance governs

Six documents cover the field. They agree on the attributes and differ in scope and depth. A laboratory that is not inspected under any of them still has no other agreed definition of trustworthy data to work to, and applying the controls proportionately costs little.

For a UK analytical laboratory the MHRA text is the primary reference and PIC/S the detailed companion 12. A laboratory supporting non-clinical safety work reads the OECD advisory document alongside them 6. The FDA question-and-answer format is the quickest route to a ruling on a specific practice, and its positions on printouts, shared accounts and trial injections are consistent with the European texts 4.

Self-inspection checklist for a small laboratory

Run the list once a year, and after any change of data system, instrument or staff. Record the answer to each item, the evidence examined and the action taken. An honest 'no' with a dated action is a compliant answer; an unexamined 'yes' is not.

1. Is there a written definition of raw data for every instrument, stating whether the printout or the electronic file is the original?
2. Does every person who touches data have an individual account, and is there a signature log linking initials to names for paper records?
3. Are analysts prevented from deleting data, changing the system clock, or disabling the audit trail, and is the administrator account separate from any analytical account?
4. Is the audit trail switched on for every data system, and is its review for each reportable result documented by a second person?
5. Are all injections, including aborted, failed and repeated runs, retained and visible in the sequence record?
6. Are calculation spreadsheets protected, version-controlled and validated against a worked example, with inputs traceable to raw data?
7. Are notebook entries made at the bench, in ink, with corrections that leave the original legible and carry a reason, initials and date?
8. Has a backup been restored successfully within the last twelve months, and is the restore recorded?
9. Has every data-integrity concern raised in the period been recorded, investigated and closed, and was the person who raised it treated as having acted correctly?