ALCOA principles: the test any record has to pass

The ALCOA principles are the criteria regulators use to judge whether data can be relied on: attributable, legible, contemporaneous, original and accurate. The extended version, ALCOA+, adds complete, consistent, enduring and available. Together they are the shortest useful definition of data integrity.

They apply to any record that supports a regulated decision, not only to laboratory systems. A spreadsheet that feeds a release decision is in scope, and it is usually the weakest link in the chain because nothing about a shared file enforces any of the nine criteria.

What each of the ALCOA principles asks

• Attributable: who recorded this, and can that be proven? Shared logins destroy attribution entirely.
• Legible: can it be read, now and in twenty years? This covers formats as much as handwriting.
• Contemporaneous: was it recorded when it happened, not reconstructed later?
• Original: is this the first capture, or a copy — and if a copy, is it a certified true copy?
• Accurate: does it reflect what happened, including the inconvenient parts?
• Complete: is everything there, including repeat tests and the results nobody liked?
• Consistent: are entries in sequence, with dates and times that make sense together?
• Enduring: will it survive on a medium that lasts, rather than on a whiteboard or a sticky note?
• Available: can it be retrieved on request throughout the retention period?

Where real failures come from

Regulatory findings on data integrity are rarely about falsified results. They are about a shared account used by four analysts, a result recorded on paper and typed in later, an audit trail that was never switched on, a spreadsheet emailed between people with no way to tell which copy is current, and original instrument files that were deleted once the report was written.

The pattern is that each was convenient and none was dishonest — which is exactly why the principles are written as properties of the record rather than as rules about behaviour.

The spreadsheet is the classic weak point. It typically fails attributable (who changed this cell?), contemporaneous (when?), original (which copy?) and enduring (where does it live?) in one object. Either bring it under control — versioned, access-controlled, with change history — or move the data into a system that already is.

Making records pass by design

1. Give every person an individual account everywhere data is recorded; eliminate shared logins first, because nothing else works without attribution.
2. Capture at the point of work rather than transcribing.
3. Turn audit trails on, check they cannot be disabled locally, and review them for the systems that matter.
4. Define what the original record is for each activity, and keep it — not only the report derived from it.
5. Set retention by record type, and test retrieval before you need it.
6. Include data integrity in the internal audit checklist, sampling records rather than reading policies.

Where data genuinely belongs in a spreadsheet — reconciliations, calculations, trend tables — the fix is a spreadsheet with the properties the principles demand. Ettex Sheets keeps every change attributable and time-stamped with full version history, so a value can be traced to who entered it and when, and the current version is unambiguous. It does not turn a spreadsheet into a validated laboratory system; where the record is a regulated primary record, that distinction matters and the audit trail requirements are stricter.