ALCOA principles: ALCOA and ALCOA+ explained with FDA Form 483 data

The ALCOA principles are a set of data integrity attributes that require every GMP record to be Attributable, Legible, Contemporaneous, Original and Accurate. ALCOA+ adds four more: Complete, Consistent, Enduring and Available. FDA, MHRA, PIC/S and WHO use them to judge whether a record shows what happened.

Below, we map each attribute to the 21 CFR section FDA writes on a Form 483 when a record fails it, with citation rates from the Atlas Form 483 directory (release of August 15, 2026, pulled November 6, 2026).

Key facts:

• FDA's December 2018 guidance, Data Integrity and Compliance With Drug CGMP: Questions and Answers, uses the five ALCOA attributes and defines data integrity as the completeness, consistency and accuracy of data.
• MHRA's March 2018 GXP guidance, PIC/S PI 041-1 (July 2021) and WHO TRS 1033, Annex 4 (2021) define ALCOA+.
• ALCOA++ adds Traceable and comes from EMA's 2023 guideline on computerised systems in clinical trials, a GCP text.
• In 779 human drug Form 483s citing 21 CFR Part 211 from January 2025 to July 2026, 24.6% cited 211.68(b) or 211.194(a), the two main data integrity sections.
• 21 CFR 211.68(b) appeared on 16.6% of those forms, and 211.194(a) rose from 9.0% in 2025 to 14.9% in January to July 2026.
• None of the structured citations on 1,059 human drug 483s in the same period named 21 CFR Part 11.

What does ALCOA stand for?

ALCOA stands for Attributable, Legible, Contemporaneous, Original and Accurate. Each ALCOA letter describes one property a GMP record must have for an investigator to trust it. FDA's 2018 guidance phrases two of them more fully: "contemporaneously recorded" and "original or a true copy".

PIC/S PI 041-1 gives the same list in section 7.5 and applies it to paper and electronic systems alike; WHO TRS 1033 says the same of good documentation practice. PIC/S describes contemporaneous data as evidence of actions, events or decisions recorded as they take place.

On a paper logbook, your team needs indelible ink, no correction fluid, single-line corrections with initials, date and reason, controlled issue of blank forms, and entries written at the time of the work. An investigator holds that logbook to the same five letters as a LIMS.

ALCOA vs ALCOA+ vs ALCOA++: what is the difference?

ALCOA has five attributes, ALCOA+ has nine and ALCOA++ has ten. FDA uses the five-attribute ALCOA list. ALCOA+ keeps those five and adds Complete, Consistent, Enduring and Available, which carry the data through their whole life cycle, and ALCOA++ adds Traceable as the tenth.

MHRA's guidance (paragraph 3.10) says it uses ALCOA rather than ALCOA+ and that "there is no difference in expectations" whichever acronym a firm uses. WHO TRS 1033 defines ALCOA+ as ALCOA with extra emphasis on being complete, consistent, enduring and available "throughout the data life cycle". FDA's own definition of data integrity already names completeness and consistency, so an FDA investigator expects the "plus" attributes even though the 2018 guidance never writes ALCOA+.

ALCOA-C and ALCOA-CCEA are informal spellings of the extended list, used in training material. None of the FDA, MHRA, PIC/S, WHO or EMA texts above uses them as a defined term.

Which 21 CFR sections does FDA cite for each ALCOA principle?

FDA cites ALCOA failures mostly under 21 CFR 211.68(b), 211.194(a), 211.188, 211.180 and 211.100(b). Form 483 has no data integrity box, so the investigator writes each observation against the record-keeping section the failure breaks. Footnote 5 of the 2018 guidance ties each ALCOA attribute to those sections; the ALCOA+ rows below are our mapping. The middle column shows the observation title FDA uses in its structured 483 data, as displayed on Atlas records.

Read the legibility row with care: most 211.180(e) observations concern annual product review content, so the row overstates how often FDA cites legibility itself. None of these citations name Part 11. The predicate rules in Part 211 carry the duty to keep accurate, complete records, and investigators cite those. The full sections are on eCFR, 21 CFR Part 211.

How often do ALCOA failures appear on FDA Form 483s?

ALCOA failures appear on about one in four CGMP drug Form 483s. In the Atlas Form 483 directory (release of August 15, 2026), 192 of 779 human drug 483s citing Part 211 from January 2025 to July 2026 (24.6%) cited 211.68(b) or 211.194(a). Our analysis of data integrity citations on Form 483s has the full method and the US and foreign split.

Accuracy leads because 211.68(b) packs access control, change control over master records, input and output checks and backups into one paragraph. Counting observation titles across all 1,078 human drug 483s in the same window (pulled November 6, 2026), 108 forms carry "Computer control of master formula records", 11 carry "input/output verification" and 10 carry a backup title. Attribution failures written as "Second person sign off" appear on 17 forms.

Laboratory data citations grew fastest. 21 CFR 211.194(a) appeared on 9.0% of Part 211 drug 483s in 2025 and on 14.9% in January to July 2026. Foreign facilities drew 211.68(b) more often than US facilities, 21.4% against 15.2%.

Form 483s with a data integrity section averaged 5.7 observations, against 3.2 for forms without one. When an investigator finds weak records in one department, the same inspection usually turns up problems in others.

Before your next inspection, check whether the investigator assigned to your facility has written 211.68(b) or 211.194(a) observations at other firms.

Atlas

See what the FDA knows about your next investigator.

30 minutes with the founder. No pitch deck.

See it live

What is an example of an ALCOA data integrity failure?

One example is the Form 483 FDA issued to Pace Analytical Life Sciences in Oakdale on May 29, 2026. Both observations on it cite data integrity sections: 211.194(a) for complete test data and 211.68(b) for input/output verification. The Atlas records below carry similar citations in their public observation detail. Each page lists the CFR sections, the investigators and the facility's history.

At the Eurofins SF Analytical site in Horsham, FDA cited 211.194(a) in 2022 and again in 2026, then sent warning letter 320-27-05 dated October 6, 2026 for microbiology counts left out of the record, as our Eurofins warning letter analysis details.

The Reliance Life Sciences facility in Navi Mumbai is the clearest 2026 case of a contemporaneous and original failure. FDA's warning letter of August 18, 2026 (320-26-117) cites 211.194(a) for environmental monitoring samples logged as collected and incubated that analysts never collected. Our Reliance Life Sciences warning letter breakdown covers the recall and import alert that came first. To find more records like these, search the FDA Form 483 database by company or facility.

How do you apply ALCOA principles in a self-inspection?

A quality team applies the ALCOA principles by testing each attribute against live records instead of the SOP. Pick one recent batch and one laboratory run, then walk them through these five checks.

1. Attributable: pull the user list for each GMP system. Every person who can create or change data has a unique login, and second-person reviews carry the reviewer's own signature under 211.194(a)(8).
2. Contemporaneous: compare timestamps on the batch record with equipment logs and audit trails. An investigator will read entries made hours after the step, or a system clock users can change, as backdating.
3. Original and complete: for one HPLC sequence, count every injection in the audit trail and match it to the reported results. Failing, aborted and reprocessed runs stay in the record under 211.194(a).
4. Accurate and consistent: confirm audit trails are switched on and reviewed before batch release, and that calculations and data transfers carry input and output checks under 211.68(b).
5. Legible, enduring and available: restore one backup and confirm it is an exact, complete copy. Then time how long it takes to produce a three-year-old record and its audit trail.

Audit trail controls need their own test plan; our guide to OQ audit trail tests for computerized system validation lists them. Our article on how ALCOA+ is changing with AI and digital systems covers what AI tools and cloud systems change in these checks.

A check that fails on your own records would fail in front of an investigator too. The digest below tracks new 483s and warning letters with data integrity citations as they post.

Atlas

FDA Inspection Intelligence Digest

We track every 483, EIR, and warning letter the moment it happens. Get the signals before they hit the FDA website.

Subscribe