How do I complete this pharmaceutical inspection checklist?

Start by filling in the header fields (date, inspector name, location). Then work through each of the 6 sections, marking Yes/No for each inspection point. Add notes for any issues found. Finally, complete the footer section with your signature. The entire process takes approximately 45-60 minutes.

What happens if I find issues during the pharmaceutical inspection?

Document any issues in the notes field, take photos as evidence, and assign corrective actions. POPProbe's mobile app allows you to instantly assign tasks to team members and track resolution. Critical issues should be escalated immediately per your organization's procedures.

Can I use this checklist on my phone or tablet?

Yes, with POPProbe's mobile app you can complete this checklist on any smartphone or tablet. The app works offline, captures GPS location, allows photo attachments, and automatically syncs when connected. Perfect for field inspections and frontline teams.

How do I customize this pharmaceutical checklist for my organization?

With POPProbe, you can easily customize this Pharmaceutical Data Integrity and ALCOA Plus Compliance Checklist to match your organization's specific requirements. Add or remove inspection points, modify section names, adjust scoring criteria, and include your company branding. You can also set up automated scheduling to ensure the checklist is completed quarterly and assign it to specific team members or locations.

What are common mistakes to avoid when completing pharmaceutical inspections?

Common mistakes include: rushing through items without proper verification, failing to document issues with photos or detailed notes, skipping sections that seem repetitive, not following up on previously identified problems, and completing inspections inconsistently. To avoid these, use a digital tool like POPProbe that enforces completion of all 29 fields, requires photo evidence, and tracks corrective actions automatically.

Pharmaceutical Data Integrity and ALCOA Plus Compliance Checklist

Data integrity in pharmaceutical manufacturing means that data is Attributable, Legible, Contemporaneous, Original, and Accurate (ALCOA), with the extensions Complete, Consistent, Enduring, and Available (ALCOA+). The FDA Guidance for Industry: Data Integrity and Compliance with Drug CGMP (December 2018) sets out FDA's expectation that data integrity controls are built into the quality system rather than detected through periodic auditing. MHRA, WHO, and EMA have issued parallel guidances that c

Industry: Pharmaceutical
Frequency: Quarterly
Estimated Time: 45-60 minutes
Role: QA Manager / IT Compliance Manager
Total Items: 21
Compliance: FDA Guidance for Industry - Data Integrity and Compliance with Drug CGMP (December 2018), MHRA GMP Data Integrity Definitions and Guidance (March 2018), WHO Technical Report Series No. 1010 Annex 4 Data Integrity Guidelines, EU GMP Annex 11 Computerised Systems

ALCOA+ Core Principles -- Attributability and Contemporaneous Recording (FDA DI Guidance 2018 / MHRA 2018)

Verify that each data entry in both paper and electronic systems is attributable to the person who performed the action, recorded at the time of performance, and cannot be altered without leaving a visible audit trail. Attributability and contemporaneous recording are the two ALCOA principles most frequently cited in FDA 483 observations.

Is every data entry in paper records made by the person who performed the action, in ink, signed with a handwritten signature or initials, with the date and time recorded at the time of the action -- not reconstructed afterward from working notes?
Are all corrections to paper records made by a single line through the error (leaving the original legible), initialed, dated, and with the reason for the correction noted, with no use of correction fluid, erasure, or overwriting?
Are shared login credentials (shared usernames/passwords for laboratory instruments, LIMS, or ERP systems) eliminated or, where a technical limitation prevents individual accounts, is a secondary control (paper log with witnessed attribution) in place?
Are laboratory electronic system user accounts configured so that each individual analyst has a unique, non-transferable login, and is the administrator account used only for system administration (never for data entry)?
Are all paper and electronic records stored in a manner that prevents unauthorized access, undetected alteration, or loss, including protection from physical damage (fire, flood, magnetic field) for the required retention period?

Audit Trail -- Configuration, Review, and Integrity (EU GMP Annex 11 §9 / FDA DI Guidance)

Verify that audit trails are enabled on all GxP computerised systems, that they capture the required events (original entry, modifications, deletions, and who performed each action with timestamps), and that audit trails are reviewed regularly as part of the quality process. A disabled or unreviewed audit trail is the most common electronic data integrity finding.

Are audit trails enabled on all GxP computerised systems (LIMS, ERP, chromatography data systems, MES, and laboratory instrument systems) and configured to capture: original data entry, any modification, the identity of the person who made the change, and a date/time stamp that cannot be modified by the user?
Are audit trails reviewed as part of the quality oversight process -- specifically, are integration reprocessing events in chromatography data systems reviewed and justified before the result is reported?
Are audit trail review records documented (when reviewed, by whom, which records covered, and findings) and is the audit trail review frequency defined in a procedure aligned with the risk of the process?
Are all audit trail records protected from modification or deletion by any user, including system administrators, and is there a separate, write-protected backup of the audit trail that could be used to detect tampering?

Access Controls and Privilege Management (EU GMP Annex 11 §12-13 / 21 CFR Part 11 §11.10(d))

Inspect user access provisioning, privilege levels, and periodic access reviews per EU GMP Annex 11 §12 and 21 CFR Part 11 §11.10(d). Access controls prevent unauthorized data creation, modification, and deletion. Privilege creep (users accumulating access rights beyond their current role) is a common finding.

Is access to GxP systems granted on the principle of least privilege (each user has only the access required for their current role), with access rights documented in a role-based access matrix and authorized in writing by a qualified person?
Are periodic access reviews conducted at a defined frequency (at least annually, or when a person changes roles or leaves the organization), with review results documented and access revoked promptly for personnel who have changed roles or departed?
Are password requirements enforced by the system (minimum complexity, maximum age, no reuse of previous passwords) and are users prohibited from sharing passwords or written on accessible surfaces?
Is electronic signature authority granted only after written attestation by the signer that they have been trained on the legal equivalence of their electronic signature to a handwritten signature per 21 CFR Part 11 §11.100?

Electronic Records -- Completeness, Integrity, and Retrieval (EU GMP Annex 11 §17 / 21 CFR 211.180)

Verify that electronic records are complete, protected against loss, and retrievable in a human-readable format for the required retention period. EU GMP Annex 11 §17 requires data migration to be validated to confirm that record integrity is maintained after migration. A backup that has never been tested for restore is not evidence of record protection.

Are backups of all GxP electronic data performed at a defined and documented frequency, stored on separate physical or logical infrastructure from the production system, and tested for successful restore on a defined schedule (at least annually)?
Can all GxP electronic records be retrieved in human-readable format throughout their required retention period, including for obsolete software -- and is there a system retirement plan that addresses continued record accessibility after software is decommissioned?
For data migration projects (legacy system to new platform), was a formal data migration validation performed with a documented protocol and summary report confirming that all migrated records are complete, accurate, and maintain audit trail continuity?

Data Integrity in Out-of-Specification and Deviation Investigations (WHO TRS 1010 Annex 4 / FDA DI Guidance)

Inspect the integrity of OOS and deviation investigation records to confirm that root cause findings are supported by original data, that invalidation of OOS results is justified with verified laboratory error as the cause, and that investigation records are not retrospectively altered.

For all OOS results that were invalidated in the past 12 months, is there documentary evidence of a verified assignable laboratory error (witnessed instrument malfunction, operator error captured in real time, or sample misidentification) as the invalidation basis?
Are all voided or deleted records (including voided sequences in laboratory systems, cancelled batch manufacturing records, and retracted deviation reports) retained in the system and accessible, with the reason for voiding documented?

Data Integrity Programme -- Self-Inspection and Remediation (WHO TRS 1010 Annex 4 §3)

Verify that a data integrity programme is established, including risk assessment of GxP data processes, self-inspection of data integrity controls, and remediation of identified gaps. A reactive data integrity programme (correcting findings only when identified by a regulator) does not satisfy the expectation of a proactive pharmaceutical quality system.

Has the site completed a data integrity risk assessment covering all GxP data processes (manufacturing, laboratory, quality management), identifying the highest-risk data flows, and implementing controls proportionate to the risk?
Does the internal audit programme include data integrity-specific audit elements (audit trail review, dual system check for data in both paper and electronic forms, check for unofficial data repositories), and have data integrity self-inspections been completed in the past 12 months?
Is there a documented process for personnel to report suspected data integrity concerns confidentially (speak-up culture), and is there evidence that reports are investigated and that reporters are protected from retaliation?

Related Pharmaceutical Life Sciences Checklists

Related Quality Systems Checklists

Why Use This Pharmaceutical Data Integrity and ALCOA Plus Compliance Checklist?

This pharmaceutical data integrity and alcoa plus compliance checklist helps pharmaceutical teams maintain compliance and operational excellence. Designed for qa manager / it compliance manager professionals, this checklist covers 21 critical inspection points across 6 sections. Recommended frequency: quarterly.

Ensures compliance with FDA Guidance for Industry - Data Integrity and Compliance with Drug CGMP (December 2018), MHRA GMP Data Integrity Definitions and Guidance (March 2018), WHO Technical Report Series No. 1010 Annex 4 Data Integrity Guidelines, EU GMP Annex 11 Computerised Systems. Regulatory-aligned for audit readiness and inspection documentation.

Frequently Asked Questions

What does the Pharmaceutical Data Integrity and ALCOA Plus Compliance Checklist cover?

This checklist covers 21 inspection items across 6 sections: ALCOA+ Core Principles -- Attributability and Contemporaneous Recording (FDA DI Guidance 2018 / MHRA 2018), Audit Trail -- Configuration, Review, and Integrity (EU GMP Annex 11 §9 / FDA DI Guidance), Access Controls and Privilege Management (EU GMP Annex 11 §12-13 / 21 CFR Part 11 §11.10(d)), Electronic Records -- Completeness, Integrity, and Retrieval (EU GMP Annex 11 §17 / 21 CFR 211.180), Data Integrity in Out-of-Specification and Deviation Investigations (WHO TRS 1010 Annex 4 / FDA DI Guidance), Data Integrity Programme -- Self-Inspection and Remediation (WHO TRS 1010 Annex 4 §3). It is designed for pharmaceutical operations and compliance.

How often should this checklist be completed?

This checklist should be completed quarterly. Each completion takes approximately 45-60 minutes.

Who should use this Pharmaceutical Data Integrity and ALCOA Plus Compliance Checklist?

This checklist is designed for QA Manager / IT Compliance Manager professionals in the pharmaceutical industry. It can be used for self-assessments, team audits, and regulatory compliance documentation.

Can I download this checklist as a PDF?

Yes, this checklist is available as a free PDF download. You can also use it digitally in the POPProbe mobile app for real-time data capture, photo documentation, and automatic reporting.