Skip to main content

GxP Data Integrity Self-Check: Part 11, Annex 11 and ALCOA+

A self-check for people who work with GxP records and systems: QA, validation, MES and Salesforce Life Sciences teams. Step 1 asks whether FDA's 21 CFR Part 11 likely applies to a record or system. Step 2 is a checklist of 32 data-integrity points from Part 11, EU GMP Annex 11 and ALCOA+, each with the reason and where it comes from. Your answers stay in this browser; nothing is sent anywhere.

This is a self-check, not regulatory advice. It does not replace your own QA and regulatory review. See the disclaimer.

Step 1: Does Part 11 likely apply?

Answer these questions for one record type or one system. They follow FDA's 2003 Part 11 guidance. The result is only a first indication.

Does an FDA rule require you to keep this record, or to submit it to FDA?

FDA calls these rules 'predicate rules'. They are requirements in the FD&C Act, the PHS Act, or FDA regulations other than Part 11. Examples: GMP, GLP or GCP record rules.FDA Part 11 Guidance (2003), Section I and III.B.2; 21 CFR 11.1(b)

Is the electronic version the one you keep, or the one people use to do the regulated work?

Answer yes if there is no paper. Also answer yes if people review, approve or release on screen, even when a printout exists. Answer no only if a complete paper printout meets the rule and people really work from the paper.FDA Part 11 Guidance (2003), III.B.1 and III.B.2 (first and second bullets)

Do you send this record to FDA in electronic form?

Part 11 also covers electronic records submitted to FDA, even if no regulation names them. A record that only helps you prepare a submission is not a Part 11 record, unless a rule requires you to keep it and you keep it electronically.21 CFR 11.1(b); FDA Part 11 Guidance (2003), III.B.2 (third bullet)

Do you use electronic signatures instead of handwritten signatures or initials that a rule requires (for example: approved, reviewed, verified)?

Electronic signatures meant to be equal to a handwritten signature are Part 11 signatures.FDA Part 11 Guidance (2003), III.B.2 (fourth bullet); 21 CFR 11.1(c), 11.3(b)(7)

Answer the four questions to see the result.

Part 11 likely applies. This is a required record that you keep or rely on in electronic form. FDA Part 11 Guidance (2003), III.B.1, III.B.2

Part 11 likely applies. The record is submitted to FDA in electronic form. 21 CFR 11.1(b); FDA Part 11 Guidance (2003), III.B.2

Part 11 signature rules likely apply to these signatures (21 CFR 11.50, 11.70 and Subpart C, 11.100 to 11.300). FDA Part 11 Guidance (2003), III.B.2; 21 CFR 11.1(c)

Part 11 is likely not triggered. Paper is the official record, it meets the rule, and people rely on it. The computer only helps to make it. The predicate rule still applies. FDA recommends that you write this decision down, for example in an SOP. FDA Part 11 Guidance (2003), III.B.1, III.B.2 (second bullet)

This is likely not a Part 11 record. FDA says records that no predicate rule requires are not Part 11 records, even if you keep them electronically. Document the decision. Other rules, such as EU Annex 11, may still apply. FDA Part 11 Guidance (2003), III.B.2 (first bullet)

More about when Part 11 applies, and the EU

Even when Part 11 applies, FDA said in 2003 that it intends to use enforcement discretion for some Part 11 requirements: validation (11.10(a)), audit trails (11.10(e), (k)(2)), legacy systems (in use before 20 August 1997, if set criteria are met), copies of records (11.10(b)) and record retention (11.10(c)), plus the matching parts of 11.30. Part 11 stays in effect. Predicate rules still apply in full. FDA still gives recommendations for these areas, mostly based on a documented risk assessment. FDA Part 11 Guidance (2003), Introduction, III.A, III.C.1 to III.C.5

FDA said it will keep enforcing: limiting system access to authorized people; operational, authority and device checks; training and experience of people; written accountability policies for e-signatures; controls over systems documentation; open-system controls (11.30); and the e-signature rules (11.50, 11.70, 11.100, 11.200, 11.300). FDA Part 11 Guidance (2003), III.A

An 'open system' is one where system access is not controlled by the people responsible for the record content. For open systems, Part 11 expects the closed-system controls of 11.10 as appropriate, plus extra measures such as document encryption and digital signature standards where needed. 21 CFR 11.3(b)(9), 11.30

In the EU there is no predicate-rule test. EU GMP Annex 11 applies to all forms of computerised systems used as part of GMP-regulated activities. The application should be validated and IT infrastructure qualified. When a system replaces a manual process, product quality, process control and quality assurance should not get worse, and overall process risk should not increase. EU GMP Annex 11 (2011), Principle

A revised Annex 11 was published as a draft for consultation in 2025. Check whether a final version is in force before you publish. Clause numbers here are from the 2011 version.

Step 2: The checklist

Answer each point for one system: Yes, Partly, No, or N/A when it does not apply. Points answered No or Partly are your gaps; the summary at the end counts them by group.

Validation

The system is validated, and you can show the validation records.

The regulation expects validation for accuracy, reliability, consistent performance and the ability to detect invalid or altered records. FDA (2003, III.C.1) uses enforcement discretion on 11.10(a) itself, but predicate-rule validation requirements still apply.21 CFR 11.10(a); Annex 11 Principle, §4.1

The depth of validation and data-integrity controls is based on a written, justified risk assessment.

Both Annex 11 and FDA link the extent of validation to documented risk to patient safety, product quality and record integrity.Annex 11 §1; FDA Part 11 Guidance (2003) III.C.1

Written user requirements exist, are traceable through the life cycle, and tests cover limits and error handling.

Annex 11 expects risk-based user requirements and test evidence for parameter limits, data limits and error handling.Annex 11 §4.4, §4.7

Changes, including configuration changes, follow a defined procedure, and the system is reviewed periodically to confirm it stays valid.

Uncontrolled changes can break a validated system, so Annex 11 expects controlled changes and periodic evaluation.Annex 11 §10, §11

Access & security

Only authorized people can access the system, and granting, changing or removing access is recorded.

The regulation expects access limited to authorized individuals, and Annex 11 expects access changes to be recorded.21 CFR 11.10(d); Annex 11 §12.1, §12.3

User roles control who can sign, change a record, or perform each operation.

Authority checks make sure only authorized people can sign, alter records or do the operation at hand.21 CFR 11.10(g); Annex 11 §2

Every user has a personal login; no shared accounts are used to create, change or approve GxP data.

With a shared login you cannot tell which person did an action, so the data is not attributable.FDA Data Integrity Q&A (2018); Annex 11 §12.4

Audit trail

A secure, computer-generated, time-stamped audit trail records who created, changed or deleted GxP data, and when.

The audit trail lets you rebuild what happened to a record. Annex 11 asks you to decide on audit trails based on risk. FDA (2003) uses enforcement discretion on 11.10(e) but says audit trails are 'particularly appropriate' when users create, modify or delete regulated records in normal operation.21 CFR 11.10(e); Annex 11 §9, §12.4; FDA Part 11 Guidance (2003) III.C.2

Changes never hide the old value, and a reason is recorded when GMP-relevant data is changed or deleted.

Reviewers and inspectors need to see the first value and why it changed. 'Do not obscure previous information' is in Part 11. 'Document the reason' comes from Annex 11.21 CFR 11.10(e); Annex 11 §9

Audit trails are reviewed regularly, by the people who review the record, at a risk-based frequency.

An audit trail that nobody reads does not find problems.Annex 11 §9; FDA Data Integrity Q&A (2018)

Audit trails are kept as long as the records they cover and can be shown in a readable form.

The regulation expects audit trails to be retained with the record and available for agency review and copying.21 CFR 11.10(e); Annex 11 §9

Electronic signatures

Each e-signature belongs to one person only, is never reused or reassigned, and identity is verified first.

A signature only has meaning if it belongs to one known person.21 CFR 11.100(a), (b)

Signed records show the signer's printed name, date and time, and meaning (e.g., review, approval) on screen and printouts.

Anyone reading the record must see who signed, when, and why.21 CFR 11.50(a), (b); Annex 11 §14

E-signatures are linked to their records, so they cannot be removed, copied or moved to falsify another record.

Linking stops a signature from appearing on a record the person never signed.21 CFR 11.70; Annex 11 §14

Non-biometric e-signatures use two parts (e.g., ID and password); passwords are revised periodically and misuse attempts are reported.

Two parts and good password controls make it hard for someone else to sign as you. In one continuous session, the first signing uses all parts; later signings need at least one part that only the signer can use (11.200(a)(1)(i)). Signings outside such a session use all parts (11.200(a)(1)(ii)).21 CFR 11.200(a)(1); 11.300(b), (d)

For FDA, your company has certified that its e-signatures are intended to be legally binding, like handwritten signatures.

Part 11 expects this certification to FDA before or at the time e-signatures are used.21 CFR 11.100(c)

Records, copies & review

For each required record, you documented if it is a Part 11 record and if paper or electronic is relied on.

FDA recommends deciding this in advance, for example in an SOP, because real business practice decides whether Part 11 applies.FDA Part 11 Guidance (2003) III.B.2

You can give inspectors accurate, complete copies, in readable and electronic form, that keep the record's content and meaning.

FDA expects reasonable and useful access to records during an inspection.21 CFR 11.10(b); Annex 11 §8.1; FDA Part 11 Guidance (2003) III.C.4

For batch-release records, you can print a report that shows if any data changed since first entry.

The person who releases a batch needs to see whether data was changed after it was first recorded.Annex 11 §8.2

Data passed between systems, or migrated to a new system or format, is checked so values and meaning stay the same.

Interfaces (e.g., MES to ERP, Salesforce to another system) and migrations are common places where data gets lost or changed.Annex 11 §5, §4.8

Retention & backup

Records are protected and stay accurate and easy to retrieve for the whole retention period.

A record you cannot find or read later is as bad as a lost record. FDA (2003, III.C.5) uses enforcement discretion on 11.10(c), but predicate-rule retention and availability rules still apply.21 CFR 11.10(c); Annex 11 §7.1

Regular backups of all relevant data are made, and you test that they can be restored.

A backup only helps if it is complete and you know it can be restored.Annex 11 §7.2

Archived data is checked for readability and integrity, and you test retrieval when the system or software changes.

System changes can make old data unreadable if nobody tests retrieval. FDA (2003) does not object to archiving to paper, microfilm or standard formats such as PDF or XML, if predicate rules are met and content and meaning are preserved.Annex 11 §17; FDA Part 11 Guidance (2003) III.C.5

A documented, tested fallback (e.g., a manual process) keeps critical processes running if the system fails.

A system outage should not stop critical GMP work or cause lost data.Annex 11 §16

ALCOA+ in practice

People record data at the time they do the work, not later from memory or on loose paper.

Data written down later is often wrong or incomplete.FDA Data Integrity Q&A (2018); PIC/S PI 041-1 (2021)

Original electronic data is kept with its metadata; a printout or summary alone is not treated as the original.

Printouts can lose metadata and dynamic content needed to rebuild what happened.PIC/S PI 041-1 (2021); FDA Data Integrity Q&A (2018)

Critical data typed in by hand is checked by a second person or by a validated system check.

Manual data entry is a common source of errors.Annex 11 §6

Where the order of steps matters (e.g., MES batch steps), the system enforces the permitted sequence.

Operational system checks stop steps from being skipped or done in the wrong order.21 CFR 11.10(f)

Governance & people

People who develop, maintain or use the system have the education, training and experience for their tasks.

The regulation expects qualified people with the right access and defined responsibilities. FDA Data Integrity Q&A (2018) also recommends training staff to detect data-integrity issues.21 CFR 11.10(i); Annex 11 §2

A written policy makes people accountable for everything done under their e-signature.

Clear accountability helps deter falsification of records and signatures.21 CFR 11.10(j)

Written agreements define supplier responsibilities (e.g., SaaS vendor, internal IT), and suppliers are assessed based on risk.

Annex 11 expects formal agreements and risk-based supplier assessment when third parties provide, host or support a system.Annex 11 §3.1, §3.2, §4.5

You keep an up-to-date GxP system inventory, and system documentation is controlled with a change history.

Inspectors and your own team need to know which systems exist and how each one is set up.21 CFR 11.10(k)(1), (k)(2); Annex 11 §4.3

0 of 32 answered · 0 gaps (No or Partly)

  • Validation: not started
  • Access & security: not started
  • Audit trail: not started
  • Electronic signatures: not started
  • Records, copies & review: not started
  • Retention & backup: not started
  • ALCOA+ in practice: not started
  • Governance & people: not started

ALCOA+ in plain words

ALCOA is the five original terms; the '+' adds Complete, Consistent, Enduring and Available. FDA's 2018 Q&A uses ALCOA. MHRA (2018) says expectations are the same whichever acronym is used. The plain definitions below follow the PIC/S table (PI 041-1, 2021).

TermWhat it means
AttributableYou can see who (which person or computerised system) did each task or change.
LegibleThe record can be read and understood. If the data is dynamic, you can still view and use it with a suitable application.
ContemporaneousActions, events and decisions are recorded at the time they happen.
OriginalThe first capture of the data (or a true copy) is kept. Data first captured in dynamic electronic form stays available in that form.
AccurateThe data is correct. Qualified equipment, validated systems, good procedures and trained people support this.
CompleteAll information needed to rebuild the event is there, including relevant metadata.
ConsistentGood documentation practice is used every time, in every step, and all changes to data are captured.
EnduringThe record stays intact and durable for the whole retention period.
AvailableThe record can be found and read for review, audits or inspections at any time during the retention period.

Related guides on vtfriday

Sources

The points above were written from these texts. Check the current official versions: a revised Annex 11 went to public consultation in 2025.