ALCOA+ for supplier and receiving records: data integrity basics for a small lab

Where ALCOA+ comes from

FDA's December 2018 guidance on data integrity for drug CGMP defines data integrity as the completeness, consistency and accuracy of data, and says such data should be attributable, legible, contemporaneously recorded, original or a true copy, and accurate, which it abbreviates ALCOA. [1] The UK regulator MHRA's March 2018 guidance uses ALCOA and explains that the plus refers to complete, consistent, enduring and available, adding that there is no difference in expectations whichever acronym is used. [2]

Both documents are written for regulated manufacturing and laboratory work. MHRA's publication page notes that for UK GLP facilities the OECD advisory document on data integrity takes precedence, with the MHRA guidance as a supplement. [3] A small research lab buying peptides for laboratory use is usually not inspected against either. The principles are still the cheapest way to make procurement records that stand up in a dispute with a supplier, an audit of grant spending or a question about which lot was used.

Each attribute applied to peptide procurement records

The definitions in the second column paraphrase MHRA's list, which describes data as attributable to the person generating it, legible and permanent, contemporaneous, the original record or a certified true copy, and accurate, with complete meaning whole, consistent meaning self-consistent, enduring meaning lasting throughout the data lifecycle, and available meaning readily available for review. [2]

Certificates, scans and true copies

MHRA defines a true copy as a copy, on any medium, verified by a dated signature or a validated process to contain the same information as the original, including its context and structure. A true copy can replace the original, for example a scan of a paper record, if there is a documented system to verify the copy. [2] The US GLP rule also allows records to be kept as originals or as true copies such as photocopies or other accurate reproductions. [4]

For a supplier certificate, the original you hold is the file the supplier sent. Keep that file unchanged, together with the message or download page it came from and the date, rather than a reformatted version. Do not crop, re-save or annotate the PDF; write notes in a separate record.

FDA distinguishes static records, such as paper or an image, from dynamic records that can be reprocessed, such as chromatography data or a spreadsheet that computes results. FDA says a printout or static record does not preserve the dynamic record format that is part of the complete original record. [1] This is why an HPLC trace in a PDF certificate is a summary: if you need the underlying data from an independent laboratory, ask for the raw data files as well as the report.

Shared spreadsheets and logins

Most small labs keep inventory and receiving logs in a shared spreadsheet. That is workable if each person signs in with their own account and the file keeps a version history. FDA says shared login credentials prevent identifying a unique individual, while shared read-only accounts are acceptable for viewing. [1] MHRA says shared logins or generic access should not be used where the system supports individual access, even if that means buying more licences. [2]

MHRA also expects audit trails to record who changed data, when, with time zone where relevant, and why, while keeping the previous value. [2] A cloud spreadsheet's version history gives a partial audit trail; add a column for the reason when a recorded value is corrected rather than overwriting it silently.

• One account per person; no 'lab' login for editing.
• Version history switched on and retained for the life of the record.
• Lot number, receipt date and initials columns locked against casual edits once filled.
• Corrections made as a new entry with reason, not by retyping the old value.

Paper logs and freezer records

ICH Q7, written for active ingredient manufacturing, gives a compact standard for paper entries: make them indelibly in the space provided, directly after the activity, identifying the person; date and sign corrections and leave the original entry readable. [5] That standard suits a freezer temperature log or a receiving book.

FDA recommends controlling blank forms, for example bound and paginated notebooks or numbered sets of forms reconciled when used, so that missing pages and unofficial copies can be detected. [1] For a small lab, numbered pages in a bound receiving book do the same job. MHRA lists access to synchronised clocks, with the time zone known, among the conditions that make timed records reconstructable. [2]

A ten-minute self-check

Pick one lot received in the last six months and try to reconstruct its history from records alone. Each failed step points to a fix in the table above.

• Can you find the certificate as received, with the date and source?
• Does the lot number on the certificate match the vial label and your inventory entry?
• Does every receiving and storage entry show who made it and when?
• Are any corrections visible, dated and explained?
• Are receiving photos stored somewhere the lab controls and backs up?
• Could a colleague find all of this if you were away?