Data Integrity in CGMP — Interactive Training

FDA 21 CFR Parts 210 / 211 / 212 & Part 11 · ALCOA+ · for lab, QC & QA personnel

Why data integrity matters

If the data can't be trusted, nothing built on it can be — not the batch release, not the product, not patient safety.

The regulator's view

FDA has increasingly cited CGMP data-integrity violations during inspections. Data integrity means data is complete, consistent and accurate — and complete, consistent, accurate data must be ALCOA: Attributable, Legible, Contemporaneous, Original, Accurate. Meeting this gives assurance the product is safe, pure and effective.

Source deck: FDA guidance "Data Integrity and Compliance With Drug CGMP" (21 CFR 210, 211, 212).

What this module does

You'll explore the ALCOA+ principles, see how audit trails and dynamic records actually behave, then make the calls yourself in two realistic lab situations — spotting violations and deciding what to do under pressure. A short quiz confirms it stuck.

The ALCOA+ principles

Click each letter to reveal what it means, plus a real example and a violation. Open all nine to complete this section.

ALCOA — the FDA core five

+ ALCOA+ — four additions (EMA/MHRA), now referenced worldwide

0 / 9 explored.

Metadata, audit trails & dynamic data

Metadata — data about data

The number 23 is meaningless alone. Metadata gives it context: units (mg), the date/time acquired, the user ID, the instrument ID, the audit trail. Without metadata, a result cannot be reconstructed or trusted.

Audit trail — the "who, what, when & why"

A secure, computer-generated, time-stamped record of every creation, modification and deletion. Run a mock HPLC sequence, then try to make a result disappear.

FDA recommends audit trails for critical data be reviewed with each record before approval.

Static vs. dynamic — why a printout isn't enough

A static record is fixed (paper, an image). A dynamic record lets the user interact — e.g. reprocess a chromatogram by moving the baseline, changing the result. Drag the baseline and watch a passing result turn into a failing one. This is why the original dynamic data (not just a printout) must be retained.

Reported result:   (spec limit ≤ 10.0 mg/L)

A static printout of one baseline hides that the result can be moved — so it does not preserve the complete original record (§ 211.180(d)).

Spot the violation

Three lab records. In each, find the data-integrity breach.

Under pressure — what do you do?

A realistic end-of-shift situation. Choose, see the consequence, and reach the compliant path.

Check your understanding

Eight questions, instant feedback.