FDA Data Integrity Findings by ALCOA+ Principle

This series takes real, public FDA Warning Letters and turns their data integrity findings into something you can learn from: what FDA found, why it typically happens, what a compliant control looks like, and how you would verify it. Firms are anonymised in the text; every post links the original letter on fda.gov. The scope is US FDA drug CGMP and data integrity only.

New to the vocabulary? Start with data integrity and ALCOA+ in practice.

The principles, and where they break

Attributable — who did it. Shared logins, analysts with administrator rights, a “developer” role used for routine work, pre-filled analyst names. If you can’t tell who created or changed a record, nothing else about it can be trusted. See admin rights and shared logins.

Legible — can it be read, permanently. Rarely cited on its own; it shows up as pencil entries overwritten in ink and records that can’t be read back from a system. Covered within non-contemporaneous records.

Contemporaneous — recorded when it happened. Pre-signed forms, backdating, sticky notes, transcription days later. See backdated, pre-signed and non-contemporaneous records.

Original — the first capture. Printouts thrown away, shred bins, replaced logbook pages, trial injections that never reach the record. See discarded and shredded original records and trial injections.

Accurate — it reflects what really happened. Fabricated records, unjustified manual integration, unvalidated calculations. See fabricated records and manual integration.

Complete — nothing left out. Unreported injections, invalidated OOS results, reviews that only look at printouts. See reviewing printouts instead of electronic data and invalidating OOS results.

Consistent — the same way every time. Uncontrolled forms and templates, integration applied differently to samples and standards. See uncontrolled blank forms.

Enduring — it survives the retention period. No backups, deletable data, audit trails switched off. See deleted data and missing backups and audit trails.

Available — it can be produced when needed. Data on a laptop taken home, documents removed at the start of an inspection, records requests left unanswered. See limiting access to records.

Underneath almost all of these sits one enabler: computerised systems used for GMP decisions without validation, audit trails or access control — see unvalidated and uncontrolled laboratory systems.

Patterns across the letters

Interpretation — drawn from the letters covered in this series, which are a selection, not a statistical sample.

• Findings cluster. A letter rarely has one data integrity finding. Shared logins come with deletion rights; disabled audit trails come with unreported injections; uncontrolled forms come with backdating. Fixing one control in isolation rarely satisfies FDA.
• Laboratories dominate. Most findings in this series are in QC laboratories — chromatography, spectroscopy, microbiology — and many involve stand-alone instruments.
• Repeat findings escalate. Several letters note that the same deficiencies were raised at previous inspections. FDA reads a repeat as a failure of management oversight, not of a single procedure.
• Narrow responses fail. The most common reason FDA calls a response inadequate is scope: the firm fixed the instrument, batch or person that was found, but did not assess the rest of the site.

What FDA usually asks for

Across the letters in this series, FDA’s data integrity requests are strikingly consistent. They typically include:

1. A comprehensive investigation with a documented protocol, interviews of current and former employees (preferably by a qualified third party) and a retrospective evaluation of data.
2. A risk assessment of the impact on released product and ongoing operations.
3. A global corrective and preventive action plan addressing root causes, including whether the people involved can still influence CGMP data.
4. An independent assessment of computer system security and integrity: system inventory, user privileges, audit trails, backup and retention.
5. Annual audits by a qualified consultant for a defined period, and in many letters, a question about appointing a Chief Integrity Officer.

FDA’s own guidance describes the same approach: question 18 of Data Integrity and Compliance With Drug CGMP — Questions and Answers (December 2018) addresses how data integrity problems should be remediated. Guidance is non-binding; the regulations are.

How to use this series

• Learning the field: read one principle at a time and compare the “What FDA found” sections with the “What good looks like” sections.
• Preparing for an interview: each post’s takeaways are short answers to typical data integrity interview questions — see also CSV interview questions.
• Reviewing your own controls: use the “What good looks like” lists as a starting checklist, adapted to your own procedures and risk assessment.