Data integrity for IT: ALCOA+, audit trails and access control
What the international guidance expects for the integrity of GxP data, and which part of it the IT department implements and has to show.
What data integrity means
Data integrity is the extent to which data are complete, consistent and accurate throughout their life cycle. The PIC/S guidance on good practices for data management and integrity (PI 041-1, 2021) and the WHO guideline on data integrity (Technical Report Series 1033, Annex 4, 2021) describe the same expectations: data should be attributable, legible, contemporaneous, original and accurate (ALCOA), and also complete, consistent, enduring and available (ALCOA+). Both explain how inspectors read the existing GMP requirements; neither is a new law.
What falls to IT
Much of data integrity is built into how systems are configured and run.
- Access control: individual accounts, no shared logins for GxP records, privileges limited to the role, and administrator rights kept away from those who generate the data
- Audit trails: switched on for GxP data, protected against change, and reviewed at a frequency based on risk
- Backups and archives: true copies that keep the content and meaning of the data, including its metadata, and restores that have been tested
- Validated workflows, so that data can't be changed or deleted outside the controlled process
- Suppliers and service providers bound by agreements that cover data ownership, access and integrity
- Training, procedures and a culture where problems are reported and investigated
Where inspections find gaps
Inspection findings keep naming the same things: shared or generic accounts, audit trails switched off or never reviewed, data deleted or reprocessed without a record, backups nobody could restore. Most of them are gaps in routine IT records, not in the software.
With the GxP Validation Assistant
How the assistant helps
Access as a process
Joiners, movers and leavers, privileged and service accounts, and periodic access reviews per system, each with its record and due date.
Evidence for backups
Backup evidence, restore tests and DR tests recorded per system, with reports and reminders when the next one is due.
Incidents and CAPA
Data integrity incidents are triaged, investigated and followed up with effectiveness checks.
Its own audit trail
The assistant's records carry an audit trail sealed in a hash chain; switching it off needs a reason and is recorded.
The PIC/S and WHO texts are guidance; your inspecting authority's requirements apply. The assistant supports your data integrity program; it does not replace it.
See it with your own systems.
Watch the webinar, or install the assistant and try it for 14 days.