ALCOA+ (Clinical Trial Data Integrity Principles)

ALCOA+ is the data-integrity framework FDA and the UK’s MHRA use to evaluate whether clinical-trial source data and case report form entries can be trusted to support regulatory decision-making. It extends the original five ALCOA attributes — Attributable, Legible, Contemporaneous, Original, Accurate — that FDA articulated in its CGMP-context data-integrity guidance, with four more: Complete, Consistent, Enduring, Available. MHRA formalized the full nine-attribute set in its ‘GXP’ Data Integrity Guidance and Definitions (Revision 1, March 2018), and the ALCOA+ acronym is now the industry-standard shorthand used across GCP, GMP, and GLP inspections alike — not a clinical-trial-specific invention, but a framework clinical research has adopted wholesale because trial data faces the same falsification and reconstruction risks manufacturing records do.

The nine attributes, applied to clinical trial records

• Attributable — every entry is traceable to the specific individual (or, for automated systems, the specific system) that generated it. Shared EDC logins, unattributed corrections, or entries made ‘on behalf of’ someone else without documentation all break this.
• Legible — the record is readable and stays readable, including any correction made to it, for as long as it must be retained.
• Contemporaneous — recorded at the time the activity happened. A vital-sign measurement transcribed from a paper worksheet into the EDC system days later, or reconstructed from memory at a monitoring visit, fails this attribute even if the value itself is correct.
• Original — the first capture of the data, or a verified true copy that carries the same evidentiary weight. This is why source documents and the distinction between source and transcribed data matter so much in clinical trial monitoring.
• Accurate — free from error and a true reflection of what occurred, including edit checks, validated instruments, and calibrated equipment.
• Complete — nothing selectively left out, including repeat measurements, failed assays, or results that don’t support the expected outcome.
• Consistent — internally coherent and correctly time-stamped, with a chronology that holds together across the record set.
• Enduring — retained on durable media for the full regulatory retention period, not dependent on a format or system that will become unreadable before that period ends.
• Available — retrievable for inspection, audit, or review throughout that same retention window.

Where ALCOA+ shows up in trial operations

ALCOA+ is not a document a site signs once — it is the standard checked continuously through the data lifecycle. Source Data Verification (SDV) exists specifically to confirm that what’s on the case report form matches the source document it was transcribed from, which is an ALCOA+ check in practice: it tests Accurate and Original directly, and Contemporaneous indirectly by exposing entries made long after the fact. Case Report Forms and the EDC systems that host them are built around audit trails, timestamped entries, and user-level access control precisely to make Attributable, Contemporaneous, and Enduring verifiable rather than merely claimed. In the US, 21 CFR Part 11 sets the specific electronic-records/electronic-signatures requirements (validated systems, audit trails, access controls) that make ALCOA+ enforceable for electronic clinical trial data; ICH E6(R2) and its successor ICH E6(R3) build data governance and data-integrity expectations directly into Good Clinical Practice itself, requiring sponsors to define and implement a quality management approach across the data lifecycle rather than treating data integrity as a downstream monitoring check.

Why inspectors treat ALCOA+ failures seriously

A record can be clinically plausible and still fail ALCOA+ — and regulators treat that failure as the more serious problem, because it undermines confidence in every other record from the same source, not just the one entry in question. Data-integrity findings are a recurring theme in FDA warning letters and MHRA inspection outcomes precisely because they call into question whether an entire dataset, not a single data point, can be trusted. This is why sponsors build ALCOA+ checks into site training, monitoring visit checklists, and EDC system design (validated audit trails, forced timestamping, restricted backdating) rather than treating it as an inspection-week concern.

What ALCOA+ is not

ALCOA+ is a data-quality framework, not a specific software feature or a single regulation. No EDC or CDMS platform is ‘ALCOA+ compliant’ on its own — the platform can support ALCOA+ (audit trails, access controls, timestamping) but compliance depends on how sites and sponsors actually use it. It is also broader than 21 CFR Part 11: Part 11 is the US electronic-records regulation that operationalizes several ALCOA+ attributes for electronic systems, but ALCOA+ itself applies equally to paper source documents and predates any specific electronic-records rule.