![\"GxP](\"https://wiki.aspotomasyon.com/assets/diagrams/data-integrity-alcoa-plus-21-cfr-part-11-automation.svg\")
ALCOA+ describes the properties GxP automation data must have, and audit trails, access control, and synchronized clocks are how PLC, SCADA, and historian systems prove them.
In regulated manufacturing, the record is the evidence. If a PLC, SCADA screen, historian, or batch system produces data that supports product release or a regulatory decision, that data must be trustworthy from creation through archive. Data integrity is the term for that trustworthiness: data that is complete, consistent, and attributable, and that cannot be changed without a trace.
This is engineering guidance, not regulatory advice. Requirements depend on the product, the market, and the regulator, and the quality function owns the final interpretation. The article explains the ALCOA+ attributes, what they mean for automation systems, what audit trails and electronic signatures must do, and how to validate and supply systems on a risk basis. Related reading includes pharmaceutical automation under GMP and PAT and manufacturing data governance.
ALCOA names five attributes: data must be attributable to the person or system that acted, legible, contemporaneous (recorded when the activity happened), original or a verified true copy, and accurate. The plus adds complete, consistent, enduring, and available. The MHRA guidance notes that expectations do not change with the acronym, because governance must keep data complete, consistent, enduring, and available throughout its life.
The table translates each attribute into automation terms. Use it as a checklist when reviewing a PLC, SCADA, historian, or batch configuration.
| Attribute | Meaning | Automation example | Typical gap |
|---|---|---|---|
| Attributable | Linked to the person or system that acted | A setpoint change recorded with a user ID | A shared operator login on the HMI |
| Legible | Readable and understandable for the retention period | Historian tags with clear names and units | Cryptic tag names or missing units |
| Contemporaneous | Recorded at the time of the action | Event timestamp generated by the source system | Values typed in later from a paper log |
| Original | The first recorded version, or a verified true copy | Raw historian data kept beside reports | Exports edited with no original kept |
| Accurate | Correct within known and calibrated limits | A calibrated instrument feeding the value | A scaling error in the PLC-to-SCADA mapping |
| Complete | All required data present, including changes | Batch record keeps deleted and changed entries | Gaps during a communication loss |
| Consistent | The same sequence and values across systems | Synchronized clocks across PLC, SCADA, and historian | A time offset between systems |
| Enduring | Kept for the retention period in a readable form | An archive with a tested restore | Data on a retired drive or unsupported format |
| Available | Retrievable for review and inspection | A searchable historian with a defined export | Data held in a vendor database no one can query |
21 CFR Part 11 is the US FDA rule on electronic records and electronic signatures. Section 11.10(e) calls for secure, computer-generated, time-stamped audit trails that independently record the date and time of operator entries and actions that create, modify, or delete records. Changes must not hide earlier entries, and audit trails must be kept at least as long as the records they cover.
EU GMP Annex 11 addresses the same concern. Clause 9 asks for a risk-based decision on recording GMP-relevant changes and deletions, requires the reason for a change to be documented, and expects audit trails to be reviewed regularly. Clause 12.4 expects the identity of operators who enter, change, confirm, or delete data to be recorded with date and time.
Electronic signatures must be unique to one individual and must not be reused or reassigned (Part 11, section 11.100(a)). Annex 11 clause 14 expects signatures to carry the time and date and to stay permanently linked to their record.
FDA's guidance on Part 11 scope and application says the agency interprets the rule's scope narrowly and describes enforcement discretion for some requirements, including audit trails. The regulation text still applies, so confirm your obligations with quality and regulatory affairs.
Annex 11 expects data to be secured by physical and electronic means and checked for accessibility and readability. Clause 7.2 expects regular back-ups, with the integrity of back-up data and the ability to restore it checked during validation and monitored periodically.
FDA uses backup to mean a true copy of the original record, maintained securely through the retention period. A temporary copy made during a crash or interruption does not meet that requirement. Annex 11 clause 17 applies the same checks to archives, and expects retrieval to be tested if the system changes. The SCADA backup and disaster recovery plan covers recovery planning in detail.
A restore that has never been tested is an assumption, not a control.
Annex 11 begins with risk management. Decisions on the extent of validation and data integrity controls should rest on a justified, documented risk assessment that considers patient safety, data integrity, and product quality. ISPE's GAMP guidance applies a patient-centric, risk-based approach to computerized systems that are fit for intended use, and it promotes a life cycle view.
Supplier assessment follows the same logic. Annex 11 says a supplier's competence and reliability are key factors, and that the need for an audit should be based on a risk assessment. Review the documentation supplied with off-the-shelf products to confirm that user requirements are met.
This case shows how a shared account turns a routine change into a question nobody can answer. Batch systems carry the same obligations, as covered in batch process control for pharmaceutical manufacturing.
Follow an ASP project guide to connect the fundamentals with implementation and acceptance.
It means that automation data supporting GxP decisions must be attributable to a user or system, recorded when the event happens, kept in original form, accurate within calibrated limits, complete, consistent across systems, enduring, and available for review. In practice this drives user accounts, audit trails, synchronized clocks, calibrated input chains, and tested backups. Not every tag is GxP data, so the first step is to classify which data supports GxP decisions.
No. Part 11 covers electronic records and signatures that FDA regulations require you to keep or submit, and section 11.1 sets its scope. FDA's scope guidance says the agency interprets that scope narrowly. Whether a particular record is in scope is a decision for quality and regulatory affairs, based on the regulations that require the record and on a documented justification.
FDA's Q&A states that shared login credentials mean a unique individual cannot be identified, so actions cannot be attributed, and that this does not meet the CGMP requirements. Shared read-only accounts used only for viewing data are treated differently. For any action that changes data or settings, use unique accounts with role-based permissions, and check that every change is attributable to a person.
FDA's Q&A says audit trails should be reviewed by the personnel who review the rest of the record, as part of that review. Where regulations or procedures set a review frequency for the data, the same frequency applies to the audit trail. Where they do not, set the frequency from a documented risk assessment that considers data criticality, control mechanisms, and impact on product quality.
Browse the related technical library or follow an ASP project guide to plan the implementation sequence.
![\"A](\"https://wiki.aspotomasyon.com/assets/diagrams/process-industries-solutions-context.svg\")
Use the original specifications and product documentation for implementation details. Examples in this guide are illustrative engineering scenarios, not published project results.