ALCOA+

The original five

Attributable — who did it, and when. Shared logins and unattributed corrections break this first.

Legible — readable and permanent. Covers proprietary formats that become unreadable once the software is retired, not just handwriting.

Contemporaneous — recorded as it happened. Transcribing from a scrap of paper hours later fails, however accurate the number.

Original — the first capture, or a verified true copy. The instrument's raw data file is original; a printout summarising it usually is not.

Accurate — correct, and free of undocumented editing.

The four that were added

Complete — including repeats, failures and aborted runs. Deleting an inconvenient injection is the archetypal violation.

Consistent — sequenced properly, with date and time formats that cannot be ambiguous.

Enduring — durable for the full retention period.

Available — retrievable on demand throughout that period.

Why it carries so much weight

ALCOA+ is not itself a regulation. It is the reasoning framework inspectors apply when reading the regulations, and it appears across FDA, MHRA, WHO and PIC/S data integrity guidance. That is precisely what makes it powerful: it is not satisfied by a checklist. A firm can meet every technical control in 21 CFR Part 11 and still be cited if its data does not survive these nine questions.

Where it usually fails

The recurring failure mode is not fraud but workflow that makes compliance inconvenient. Analysts run "trial" injections to check the system, then run the real sequence. Operators batch their documentation to the end of the shift. Someone disables an audit trail because it clutters a report. None of these begin as deception, and all of them read as it during an inspection.