Data integrity training: ALCOA+ and 21 CFR Part 11 for GxP records

Opens with a self-check: could you show all the raw data behind your last batch release, and do you recall a data integrity finding from an inspection or audit? Then four recent FDA warning letters. The first, from January 2025, went to a contract testing laboratory in China with headerless records, missing second-person reviews, old data on external drives and a shared administrator login. The others cover a contract laboratory in India in March 2026, a US drug manufacturer in April 2026, personal diaries, deleted data and records in shred bins, each turned into a question to ask. Explains data integrity as complete, consistent and accurate data held to ALCOA+ across the life cycle. Introduces RST Pharma Ltd., a generic tablet maker in Mumbai, with a testing laboratory in Hong Kong and a device maker in Toronto. Closes with a recap and how the thirteen modules work.

What you will be able to do

• Explain what data integrity means for GxP records
• Recognise data integrity failures named in recent FDA warning letters
• Ask the right question of your own records after each case

Why it matters

An inspector may ask for every result and every change behind a release; knowing what goes wrong helps you show it.

Practice: Practice: Why data integrity matters · 3 questions

Starts with an analyst at RST Pharma who types a wrong sample weight into the LIMS: quietly retyped in a closed culture, reported and corrected with a reason in an open one, so a confusing screen is fixed for everyone. Draws on PIC/S guidance on open and closed cultures. Covers the rules: the drug CGMP record rules in 21 CFR Part 211 as predicate rules, Part 11 for electronic records and signatures, FDA's 2018 guidance, and the WHO guideline and PIC/S guidance from 2021, with Annex 11 and MHRA. Shows the record rules FDA cites most, then how RST Pharma puts governance in place: a policy, named roles, a system inventory, risk assessment, matched controls and regular review. Covers what an inspector would ask to see, the common mistake, how RST knows governance works, and a recap: data integrity starts at the top.

What you will be able to do

• Identify the main regulations and guidance on data integrity
• Describe the parts of a data governance system
• Explain how an open culture prevents hidden data changes

Why it matters

Regulators look first to senior management and culture; knowing what they expect helps you build governance that works.

Practice: Practice: Regulators' expectations and data governance · 3 questions

Opens at the balance in RST Pharma's laboratory, where a weight jotted on scrap paper and typed in an hour later has no original and no time, against a balance printout attached straight to the record. Explains the five qualities as FDA's 2018 guidance names them and PIC/S explains them, and how FDA links each to the CGMP regulations. Covers one login per person and accurate time stamps, readable records, the first capture kept, such as HPLC data files in the chromatography data system, and accuracy built from calibration, validation and checks, such as specification limits in the LIMS. Applies all five to one weighing entry on a worksheet, with a shared login on a dissolution tester in Hong Kong and charts signed next morning in Toronto. Ends with the common mistake, four quick checks and a recap.

What you will be able to do

• Explain each of the five ALCOA principles with a lab example
• Check a weighing record for attributability and timing
• Recognise shared logins and late sign-offs as ALCOA failures

Why it matters

A number can be right and still unacceptable as a GMP record; ALCOA makes it something you can defend.

Practice: Practice: ALCOA: the five core principles · 3 questions

Begins with twenty numbered dissolution worksheets at RST Pharma: if nobody counts them back, a failed run goes unreviewed; when the count is made, the missing sheet is traced the same day. Reads the four plus principles in plain words as PIC/S explains them: complete with metadata, consistent formats such as dates and units, enduring for the whole retention period, and available for review. Shows a date written day first or month first turning the fourth of May into the fifth of April, and stability data needed for years. Covers paper records with unique, controlled forms issued through QA's issue log and reconciled, and no scraps or diaries. Then hybrid systems, with one record followed from start to finish, every transcription controlled and both halves reviewed together. Ends with the evidence, four quarterly checks and a recap.

What you will be able to do

• Explain the four plus principles of ALCOA+
• Reconcile issued paper forms so nothing goes missing
• Review the paper and electronic parts of a hybrid record together

Why it matters

Every entry can be accurate while the data set is incomplete; ALCOA+ shows that nothing is missing and that it will last.

Practice: Practice: ALCOA+ on paper, hybrid and electronic · 3 questions

Opens with a proposal to RST Pharma's IT manager to export five years of HPLC results to PDF and delete the electronic data, and why archiving the data with its metadata is the better plan. Explains the data life cycle as WHO defines it, from creation through processing, review, reporting, transfer, storage and retrieval to retirement and disposal, managed in proportion to risk. Follows one assay result at RST Pharma through six stages, with every integration kept as a new version, and shows its data flow map. Covers metadata as the context that makes data meaningful, and true copies that keep the same content and meaning, so dynamic data stays dynamic. Looks at a move to a new electronic batch record system and a London research organisation migrating trial data. Ends with the common mistake, four checks, a practice exercise mapping an FTIR identity result, and a recap.

What you will be able to do

• Map the stages of a GxP data life cycle with a control for each
• Explain why metadata must stay with the data
• Tell a true copy from a static copy of a dynamic record

Why it matters

A PDF of a chromatogram cannot be reprocessed or checked; keeping data in its original form protects it for years.

Practice: Practice: The data life cycle, metadata, true copies · 3 questions

Starts with two computers in RST Pharma's quality office: a word processor whose printed, hand-signed procedures are the record, and a temperature monitoring system whose on-screen data is the record. Reads section 11.1 in plain words: the criteria under which FDA treats electronic records and signatures as trustworthy and equivalent to paper. Covers what falls in scope and the key definitions, then FDA's 2003 guidance and its narrow reading, the requirements where FDA uses discretion, true legacy systems, and the predicate rules it still enforces. Shows RST Pharma's Part 11 applicability assessment, system by system, with a Hong Kong laboratory testing for the US market and a Dubai vaccine distributor outside it. Ends with the evidence an inspector may ask for, the common mistake, four checks and a recap: Part 11 follows the record you rely on.

What you will be able to do

• Decide whether a record and system fall within Part 11
• Explain how FDA's guidance narrows the scope of Part 11
• Write down in advance whether paper or electronic records are relied on

Why it matters

Knowing exactly where Part 11 applies saves effort on systems outside it and avoids gaps on the ones inside.

Practice: Practice: 21 CFR Part 11: scope and FDA's guidance · 3 questions

Opens with RST Pharma's new chromatography data system: out of the box, one shared administrator, the audit trail off and deletion open to all; configured, named roles, a locked audit trail and blocked deletion. Reads section 11.10 on procedures and controls for authenticity, integrity and confidentiality, and the signer's inability to repudiate a record. Takes the eleven controls in three groups and shows each at RST Pharma, from validation and access to training and documentation. Compares four of them with Annex 11 of the EU GMP guide, explains the secure, time-stamped audit trail and what open systems add, such as encryption and digital signatures. Shows RST's checklist for the system, a Toronto device test station and a Hong Kong laboratory blocking self-approval. Ends with four checks, a practice exercise on a temperature monitoring system and a recap.

What you will be able to do

• List the eleven section 11.10 controls for closed systems
• Configure a system so its audit trail and access controls work
• Explain what open systems need beyond closed system controls

Why it matters

A vendor's compliance claim covers features, not your system; your configuration and procedures make Part 11 work.

Practice: Practice: Part 11 controls for closed and open systems · 3 questions

Starts in RST Pharma's QA office, where an image of the QA head's signature is pasted onto release reports by a colleague, and WHO's view that an inserted image is not adequate. Shows the better way: signing inside the system with her own user ID and password and stating the meaning. Reads the definition in section 11.3, then what a signed record must show: printed name, date and time, and meaning, and how signatures are linked so they cannot be copied or moved. Covers unique signatures issued after an identity check, certification to FDA, at least two components unless biometric, and written accountability. Shows RST's account lockout after five failed attempts, the set-up for its electronic batch record system and a signed step. Adds a London data manager approving twenty records at once and a Toronto fingerprint reader, four checks and a recap.

What you will be able to do

• Explain what a signed electronic record must show
• Describe how a signature is linked so it cannot be copied
• Apply the rules for issuing and using electronic signatures

Why it matters

Anyone can copy a signature image; a Part 11 signature is unique to you, linked to its record and controlled.

Practice: Practice: Electronic signatures under Part 11 · 3 questions

Opens with a sister site of RST Pharma whose stability data will not restore after three years of untested nightly backups, against RST's quarterly restore of a sample checked against live data. Sets out three controls from section 211.68, Part 11, Annex 11 and WHO: only authorised people can change records, backups are exact, complete and secure, and systems are validated for intended use. Shows RST's role matrix for its chromatography data system, data and audit trails backed up together away from the server room, and validation that tests role permissions and audit trail settings. Follows a user account from request to removal, recalls the shared administrator login in Module 1 and a one-login instrument in Hong Kong. Links to the April 2026 warning letter on administrator rights, and ends with four checks and a recap.

What you will be able to do

• Build a role matrix with one login per person and least privilege
• Test that backups restore completely, metadata included
• Scope computer system validation to each intended use

Why it matters

A backup counts only once it has been restored; testing it now avoids losing evidence on the day it matters.

Practice: Practice: Access control, backup and validation · 3 questions

Begins with FDA's December 2024 warning letter to a drug manufacturer in India whose chromatography software logged about sixty user aborts in twenty days, with no procedure requiring review of that log. Gives FDA's definition of an audit trail as a secure, computer-generated, time-stamped record, WHO's who, what, when and why, and FDA's HPLC example. Covers who reviews audit trails: the people who review the record, with critical audit trails reviewed before the data is relied on. Shows six red flags drawn from FDA's guidance and warning letters, then how an RST Pharma reviewer checks the audit trail for one assay sample set before release. Looks at a process control system review in Singapore and a cold store review in Dubai. Ends with the common mistake, four self-inspection checks, a practice exercise and a recap.

What you will be able to do

• Explain what an audit trail must record: who, what, when and why
• Review an audit trail for red flags before data is relied on
• Record what an audit trail review found

Why it matters

An audit trail nobody reads records everything and protects nothing; a focused review is what makes it useful.

Practice: Practice: Audit trails and their review · 3 questions

Opens with the April 2026 warning letter from Module 1, where trial injections were reported when favourable and disregarded when out of specification, under a written procedure FDA called not scientifically sound. Covers FDA's five laboratory expectations: complete data from all tests, no testing into compliance, reprocessing under a written procedure, data saved as each step finishes, and second-person review, then system suitability using standards and investigation before any result is invalidated. Shows RST Pharma's limited cases for manual integration, pH meter logbooks, its rule that no analyst invalidates their own result, and how it writes these into its chromatography procedure. Then the production side: validated master records, entries saved at once, verified critical steps and data captured directly, with one dispensing step in RST's electronic batch record. Adds an older balance in Hong Kong and a hospital pharmacy in Sydney, four checks and a recap.

What you will be able to do

• Recognise trial injections and testing into compliance
• Explain when a laboratory result may be invalidated
• Check batch records for verified critical steps and direct data capture

Why it matters

A quiet look at a sample before the real test can decide which result is reported; these rules keep every result counted.

Practice: Practice: Laboratory and production records · 3 questions

Starts with a reviewer at RST Pharma finding three backdated worksheet entries: a quick retraining fix in one version, a full investigation of scope, time frame, root cause and product impact in the other. Explains a data integrity risk assessment as WHO defines it, mapping data flows and rating each kind of data for criticality and risk to set matching controls. Shows an extract of RST's risk assessment for tablet testing, then applies it to trial data typing at a London research organisation and an automated test station in Toronto. Follows RST's own investigation into the backdated entries: containment, scope, a root cause in a late shift that regularly overran, no product affected, interim and long-term corrective actions and a three-month effectiveness check. Ends with a practice exercise rating five kinds of data and a recap: look where it matters most, and fix causes, not symptoms.

What you will be able to do

• Rate GxP data for criticality and risk to choose controls
• Investigate a data integrity lapse for scope, root cause and impact
• Check that corrective actions reached every affected area

Why it matters

A quick fix leaves you not knowing how far a lapse went; a proper investigation finds out before you close it.

Practice: Practice: Data integrity risk and investigations · 3 questions

Tells RST Pharma's story from a gap check twelve months ago, which found shared logins, an audit trail switched off, uncontrolled photocopied worksheets and no risk assessment. Follows its six steps, each built on a module, starting with governance: a signed policy, the head of QA as lead with access to the board, named system owners and IT taking over administrator accounts. Shows RST listing fourteen computer systems and thirty-eight paper forms holding GxP data, and the six traps it avoided. Pictures inspection day with four requests and the evidence ready for each, such as an exception report reviewed before release. Turns the story into a road map for your own site: govern, list, assess, control, verify and respond, starting with your most critical data. Ends with key takeaways and the final exam for the Certificate of Competence, with a 60% mark.

What you will be able to do

• Follow the six steps of a data integrity programme
• Prepare the evidence an inspector is likely to request
• Use the road map to start with your most critical data

Why it matters

Nothing about the products has to change; what changes is how well you can show your data is trustworthy.

Practice: Practice: Putting it together at RST Pharma · 3 questions