Learn how to protect pharmaceutical data integrity through ALCOA principles, access controls, audit trails, review, backup and controlled corrections.
1. Purpose
The purpose of this SOP is to establish controls that protect the reliability, completeness, accuracy and traceability of data generated, processed, reviewed, reported and retained during pharmaceutical activities.
2. Scope
This SOP applies to GMP-relevant data generated or maintained by Production, Quality Assurance, Quality Control, Microbiology, Engineering, Warehouse, Validation, Regulatory Affairs, R&D where applicable, computerized systems, laboratory instruments and manufacturing systems.
3. Responsibilities
| Role | Responsibility |
|---|---|
| Data Originator | Generate and record data accurately and contemporaneously. |
| Reviewer | Review records and data for completeness, accuracy and compliance. |
| Department Head | Ensure appropriate controls and resources. |
| QA | Provide quality oversight and assess significant data-integrity issues. |
| QC | Protect laboratory data and ensure appropriate analytical review. |
| IT/System Administrator | Maintain technical access, backup and system controls. |
| Validation | Ensure applicable computerized systems are appropriately validated. |
| Management | Provide resources and oversight. |
4. Definitions and Abbreviations
| Term | Definition |
|---|---|
| Data Integrity | Maintenance of data in a complete, consistent, accurate and reliable state throughout its lifecycle. |
| ALCOA | Attributable, Legible, Contemporaneous, Original and Accurate. |
| Audit Trail | Computer-generated information recording specified activities or changes associated with electronic data. |
| Raw Data | Original data or information required to reconstruct an activity. |
| Metadata | Information describing the context, structure or characteristics of data. |
| Electronic Signature | An electronic mechanism used to identify and authenticate an individual associated with a record or action. |
| User Access | Authorized ability to interact with a system based on assigned privileges. |
5. Materials, Equipment and Documents
- Approved computerized systems
- Laboratory instruments
- Manufacturing systems
- Electronic records
- Paper records
- Audit trails
- User-access records
- Backup systems
- Data-review procedures
- Computerized-system validation documents
- Data-integrity risk assessments
- Training records
- Deviation and investigation forms
- CAPA records
- Change-control records
6. Procedure
6.1 Data-Integrity Principles
- Generate and maintain data in a manner that preserves reliability throughout its lifecycle.
- Apply the ALCOA principles: Attributable, Legible, Contemporaneous, Original and Accurate.
- Apply additional data characteristics such as completeness, consistency, persistence and availability where applicable.
6.2 Data Generation
- Generate data using approved procedures and systems.
- Perform activities using individual assigned identities.
- Record data when the activity is performed.
- Preserve original data.
- Do not intentionally omit, manipulate or falsify data.
6.3 Paper Records
- Complete records according to approved GDP requirements.
- Ensure corrections preserve original information.
- Protect original records against unauthorized alteration.
- Maintain traceability when information is transferred into electronic systems.
6.4 Electronic Data
- Use approved computerized systems.
- Assign individual user accounts.
- Do not share passwords.
- Do not use another person’s credentials.
- Review access privileges according to site procedures.
- Prevent unauthorized modification or deletion.
6.5 Audit Trails
- Maintain audit trails where applicable.
- Review audit trails according to approved procedures and risk.
- Evaluate relevant changes, deletions and abnormal events.
- Escalate significant unexplained activity for investigation.
6.6 Data Review
- Completeness
- Accuracy
- Sequence of activities
- Unexpected results
- Missing information
- Repeated or invalidated results
- Corrections
- Audit-trail information
- Supporting raw data
- Electronic signatures where applicable
6.7 Computerized Systems
- Manage GMP-relevant systems according to approved procedures.
- Validate or qualify systems as required by intended use and risk.
- Manage system changes through change control.
- Provide only the access necessary for assigned responsibilities.
6.8 Backup and Recovery
- Protect critical electronic data through approved backup arrangements.
- Test or validate backup and recovery processes as required.
- Protect backup data against unauthorized modification or loss.
6.9 Data Transfer and Processing
- Maintain traceability and accuracy during data transfer.
- Control automated calculations and processing functions.
- Minimize manual transcription where practicable.
- Maintain linkage between processed data and source data.
6.10 Data Retention
- Retain original and associated data required to reconstruct activities.
- Ensure records remain accessible throughout the retention period.
- Control disposal through an authorized process.
6.11 Training
- Provide data-integrity training to applicable personnel.
- Train users on appropriate computerized-system use.
- Evaluate training effectiveness where required.
7. Precautions and Safety
- Never share passwords or electronic signatures.
- Never generate or modify data on behalf of another person.
- Do not delete original data to conceal undesirable results.
- Do not manipulate audit trails.
- Do not use unauthorized storage locations for GMP data.
- Protect confidential information.
- Report suspected data-integrity violations promptly.
8. Acceptance / Monitoring Criteria
Data-integrity monitoring may include audit-trail review, user-access review, periodic data review, backup verification, system assessments, internal audits, self-inspections and investigation trending.
9. Documentation and Records
- Data-integrity assessments
- Audit-trail reviews
- User-access review records
- Training records
- System validation documentation
- Backup and recovery records
- Data-integrity investigations
- Deviations
- CAPA records
- Change controls
10. Deviations and Exceptions
Suspected or confirmed data-integrity issues shall be documented and investigated through the approved quality system. The investigation should evaluate affected data, timing, personnel, product-quality impact, other potentially affected records and the need for CAPA.
11. References
- Applicable current GMP requirements concerning data integrity and electronic records.
- Applicable regulatory guidance concerning pharmaceutical data integrity.
- Applicable computerized-system validation requirements.
- Site-approved data-integrity policy and computerized-system procedures.
- Site-approved record-retention procedures.
12. Frequently Asked Questions
What is data integrity in the pharmaceutical industry?
Data integrity means maintaining pharmaceutical data so that it remains complete, consistent, accurate, reliable and traceable throughout its lifecycle.
What does ALCOA mean?
ALCOA refers to Attributable, Legible, Contemporaneous, Original and Accurate data characteristics.
Why are audit trails important?
Audit trails provide evidence of relevant electronic activities and changes and support reconstruction and review of data history.
Can pharmaceutical employees share computer passwords?
Individual accounts should be used because password sharing undermines accountability and data traceability.
What should happen when a data-integrity problem is discovered?
The issue should be reported and investigated through the approved quality system, including assessment of potential impact.
Should original raw data be retained?
Original data required to reconstruct and evaluate regulated activities should be retained according to applicable requirements and approved site procedures.
Disclaimer: This SOP is provided for educational and reference purposes. Pharmaceutical companies should adapt the procedure to their approved quality system, validated processes, applicable GMP requirements, pharmacopoeial requirements, equipment specifications, and site-specific procedures.
“`