ALCOA+ describes the properties GxP automation data must have, and audit trails, access control, and synchronized clocks are how PLC, SCADA, and historian systems prove them.
In regulated manufacturing, the record is the evidence. If a PLC, SCADA screen, historian, or batch system produces data that supports product release or a regulatory decision, that data must be trustworthy from creation through archive. Data integrity is the term for that trustworthiness: data that is complete, consistent, and attributable, and that cannot be changed without a trace.
This is engineering guidance, not regulatory advice. Requirements depend on the product, the market, and the regulator, and the quality function owns the final interpretation. The article explains the ALCOA+ attributes, what they mean for automation systems, what audit trails and electronic signatures must do, and how to validate and supply systems on a risk basis. Related reading includes pharmaceutical automation under GMP and PAT and manufacturing data governance.
ALCOA+ in plain terms
ALCOA names five attributes: data must be attributable to the person or system that acted, legible, contemporaneous (recorded when the activity happened), original or a verified true copy, and accurate. The plus adds complete, consistent, enduring, and available. The MHRA guidance notes that expectations do not change with the acronym, because governance must keep data complete, consistent, enduring, and available throughout its life.
The table translates each attribute into automation terms. Use it as a checklist when reviewing a PLC, SCADA, historian, or batch configuration.
| Attribute | Meaning | Automation example | Typical gap |
|---|---|---|---|
| Attributable | Linked to the person or system that acted | A setpoint change recorded with a user ID | A shared operator login on the HMI |
| Legible | Readable and understandable for the retention period | Historian tags with clear names and units | Cryptic tag names or missing units |
| Contemporaneous | Recorded at the time of the action | Event timestamp generated by the source system | Values typed in later from a paper log |
| Original | The first recorded version, or a verified true copy | Raw historian data kept beside reports | Exports edited with no original kept |
| Accurate | Correct within known and calibrated limits | A calibrated instrument feeding the value | A scaling error in the PLC-to-SCADA mapping |
| Complete | All required data present, including changes | Batch record keeps deleted and changed entries | Gaps during a communication loss |
| Consistent | The same sequence and values across systems | Synchronized clocks across PLC, SCADA, and historian | A time offset between systems |
| Enduring | Kept for the retention period in a readable form | An archive with a tested restore | Data on a retired drive or unsupported format |
| Available | Retrievable for review and inspection | A searchable historian with a defined export | Data held in a vendor database no one can query |
Audit trails and electronic signatures
21 CFR Part 11 is the US FDA rule on electronic records and electronic signatures. Section 11.10(e) calls for secure, computer-generated, time-stamped audit trails that independently record the date and time of operator entries and actions that create, modify, or delete records. Changes must not hide earlier entries, and audit trails must be kept at least as long as the records they cover.
EU GMP Annex 11 addresses the same concern. Clause 9 asks for a risk-based decision on recording GMP-relevant changes and deletions, requires the reason for a change to be documented, and expects audit trails to be reviewed regularly. Clause 12.4 expects the identity of operators who enter, change, confirm, or delete data to be recorded with date and time.
Electronic signatures must be unique to one individual and must not be reused or reassigned (Part 11, section 11.100(a)). Annex 11 clause 14 expects signatures to carry the time and date and to stay permanently linked to their record.
FDA's guidance on Part 11 scope and application says the agency interprets the rule's scope narrowly and describes enforcement discretion for some requirements, including audit trails. The regulation text still applies, so confirm your obligations with quality and regulatory affairs.
Shared accounts, access control, and clocks
- Shared accounts. FDA's data integrity Q&A says shared login credentials prevent identifying a unique individual, so actions cannot be attributed. Shared read-only accounts used only for viewing are treated differently.
- Access control. Annex 11 clause 12.1 expects controls that restrict system access to authorized persons. Clause 12.3 expects the creation, change, and cancellation of access rights to be recorded.
- Audit trail protection. Under MHRA guidance, users should not be able to amend or switch off an audit trail, and an administrator who does so should leave a record of that action.
- Clocks. MHRA guidance refers to controlled, synchronized clocks at the point of use, with the time zone stated where data cross sites. The industrial time synchronization plan covers the network side.
- Review. FDA's Q&A says audit trails should be reviewed by the personnel who review the rest of the record, at the frequency that applies to that record, or at a frequency set by documented risk assessment.
Backup, archive, and restore
Annex 11 expects data to be secured by physical and electronic means and checked for accessibility and readability. Clause 7.2 expects regular back-ups, with the integrity of back-up data and the ability to restore it checked during validation and monitored periodically.
FDA uses backup to mean a true copy of the original record, maintained securely through the retention period. A temporary copy made during a crash or interruption does not meet that requirement. Annex 11 clause 17 applies the same checks to archives, and expects retrieval to be tested if the system changes. The SCADA backup and disaster recovery plan covers recovery planning in detail.
A restore that has never been tested is an assumption, not a control.
Validation, risk, and supplier assessment
Annex 11 begins with risk management. Decisions on the extent of validation and data integrity controls should rest on a justified, documented risk assessment that considers patient safety, data integrity, and product quality. ISPE's GAMP guidance applies a patient-centric, risk-based approach to computerized systems that are fit for intended use, and it promotes a life cycle view.
Supplier assessment follows the same logic. Annex 11 says a supplier's competence and reliability are key factors, and that the need for an audit should be based on a risk assessment. Review the documentation supplied with off-the-shelf products to confirm that user requirements are met.
- Define the GxP functions of the system and the data it creates, changes, or stores.
- Classify each data object by its impact on product quality and patient safety, and record the reasoning.
- Write user requirements for audit trail content, access control, time synchronization, and backup and restore.
- Test those requirements, including negative tests such as unauthorized edits and deletions, and record the results.
- Schedule periodic review of audit trails and configuration, and repeat the risk assessment after significant changes.
Worked example: a changed setpoint without a trace
This case shows how a shared account turns a routine change into a question nobody can answer. Batch systems carry the same obligations, as covered in batch process control for pharmaceutical manufacturing.
Apply this to your project
- Each GxP data point has a documented source, an owner, and a retention period.
- Every operator, engineer, and technician who changes data has an individual account.
- Audit trails record who acted, what changed, old and new values, when, and why, and users cannot switch them off.
- Clocks on PLCs, SCADA servers, historians, and batch systems are synchronized, with the time zone documented.
- Backups have been restored in a test, and archived data has been checked for readability.
- The risk assessment and supplier assessment are on file before validation starts.
- Audit trail review frequency is set from risk and written into the review procedure.
Follow an ASP project guide to connect the fundamentals with implementation and acceptance.
Frequently asked questions
What does ALCOA+ mean for a PLC or SCADA system?
It means that automation data supporting GxP decisions must be attributable to a user or system, recorded when the event happens, kept in original form, accurate within calibrated limits, complete, consistent across systems, enduring, and available for review. In practice this drives user accounts, audit trails, synchronized clocks, calibrated input chains, and tested backups. Not every tag is GxP data, so the first step is to classify which data supports GxP decisions.
Does 21 CFR Part 11 apply to every electronic record in a plant?
No. Part 11 covers electronic records and signatures that FDA regulations require you to keep or submit, and section 11.1 sets its scope. FDA's scope guidance says the agency interprets that scope narrowly. Whether a particular record is in scope is a decision for quality and regulatory affairs, based on the regulations that require the record and on a documented justification.
Is a shared operator login ever acceptable?
FDA's Q&A states that shared login credentials mean a unique individual cannot be identified, so actions cannot be attributed, and that this does not meet the CGMP requirements. Shared read-only accounts used only for viewing data are treated differently. For any action that changes data or settings, use unique accounts with role-based permissions, and check that every change is attributable to a person.
Who should review audit trails, and how often?
FDA's Q&A says audit trails should be reviewed by the personnel who review the rest of the record, as part of that review. Where regulations or procedures set a review frequency for the data, the same frequency applies to the audit trail. Where they do not, set the frequency from a documented risk assessment that considers data criticality, control mechanisms, and impact on product quality.
Continue the engineering work
- Pharmaceutical Manufacturing Automation and PAT
- Batch Process Control for Pharmaceutical Manufacturing — 21 CFR Part 11 Compliance
- SCADA System Backup and Disaster Recovery Planning
- Industrial Time Synchronization: A Practical NTP and PTP Plan
- Manufacturing Data Governance: Ownership, Quality and Lineage
Browse the related technical library or follow an ASP project guide to plan the implementation sequence.
Primary references and further reading
Use the original specifications and product documentation for implementation details. Examples in this guide are illustrative engineering scenarios, not published project results.
- eCFR — 21 CFR Part 11, Electronic Records; Electronic Signatures
- FDA — Part 11, Electronic Records; Electronic Signatures: Scope and Application
- FDA — Data Integrity and Compliance With Drug CGMP: Questions and Answers
- European Commission — EudraLex Volume 4, Annex 11: Computerised Systems
- MHRA — Guidance on GxP data integrity
- ISPE — What is GAMP?