Data integrity in calibration records: ALCOA+ and Annex 11 in practice

Why data integrity on calibration records is central

In recent years data integrity has become one of the first areas inspected in FDA, EMA and MHRA audits. The reason is simple: if the data are not reliable, none of the conclusions drawn from the data are either. And calibration records are only seemingly second-tier data: in reality they underpin the validity of all the process data generated by the calibrated instruments.

A data integrity breach on metrological records is not just an administrative observation. It calls into question the qualification of the instrumentation, and in cascade the qualification of the processes and the validity of the released batches. It is, proportionally, one of the worst risks for a GMP site.

The ALCOA+ principles applied to calibration

The data integrity principles originate as ALCOA and have evolved into ALCOA+ with four additional requirements. Translated onto calibration records, they take this concrete form:

Attributable

Every recorded operation must be associable with a uniquely identifiable person. On paper this means a legible signature or initials with a recorded correspondence; in digital form it means a personal, non-shared account with robust identification.

Typical errors: illegible initials, a "technical" account used by several people, post-event signatures.

Legible

The record must remain legible for the entire retention period. On paper this means permanent ink, a medium that lasts over time, replacement photocopies that are not faded. In digital form it means standard, non-proprietary formats and migration policies when formats become obsolete.

Typical errors: pencil entries, faded photos, files in obsolete formats with no migration plan.

Contemporaneous

The record must be created at the moment the event takes place. Completing operations distributed over time at the end of the day is technically possible but substantially a breach of this principle.

Typical errors: all the day's signatures with the same time, reports "realigned afterwards", calibrations recorded days after they were performed.

Original

The primary data point must be retained, not just its transcription. If the calibration produces a printout from the reference instrument, the printout must be retained; if it is a file generated by the calibration software, the file must be retained. Manual transcription into another register does not replace the original.

Typical errors: lost printouts, original files replaced by "copy" PDFs, manual recalculations instead of the raw data.

Accurate

The recorded data must correspond to what was actually measured. This is not a formality: it implies verification processes (e.g. double reading, independent review) and plausibility checks.

Typical errors: incorrect transcription of numbers, wrong units of measure, undocumented rounding.

Complete

Everything that was done must be recorded, even when the result is not the expected one. Especially when the result is not the expected one. The As Found Out of Tolerance data point must be recorded even if inconvenient; interrupted calibrations must be traced; errors must be documented.

Typical errors: tests repeated until "the right result is obtained", As Found "not reported because the instrument was adjusted", failed calibrations deleted.

Consistent

The order of operations and the chronology must be coherent. Timestamps must be real and increasing. Related records must be aligned. A calibration record dated tomorrow in a system that shows today is a serious problem.

Enduring

The record must be available for the entire retention period required by the applicable regulations and internal procedures (for GMP records, at least the product life + a margin).

Available

The record must be promptly retrievable when needed (audit, investigation, impact assessment). Data that exists but cannot be found is, operationally, as if it did not exist.

The practical implications on paper

On a paper-based calibration system, ALCOA+ translates into operating rules that are often unloved but necessary:

• pre-printed forms, sequentially numbered, managed in a controlled register;
• permanent ink, a ban on pencil or correction fluid;
• corrections with a single strike-through, the corrected value alongside, a signature and date, the reason for the correction;
• empty spaces crossed out with N/A or a line, never left blank;
• signature and date for each operation, with the time where relevant;
• protected physical storage, recorded access.

On a few dozen instruments, solid paper discipline can be sustainable. As it grows it becomes burdensome.

The practical implications in digital form

If calibration records are managed on a computerized system, the requirements of the EU GMP Annex 11 are triggered and — if the site exports to the US or works for FDA customers — those of 21 CFR Part 11:

• software qualification according to GAMP5 (URS, FS, IQ, OQ, PQ proportionate to the software category);
• account management: unique identification, password policy, revocation at the end of employment, no shared accounts;
• electronic signature with two factors (user + password, or equivalent), with an explicit meaning of the signature (who performed, who verified, who approved);
• a complete audit trail, not disableable by the user, recording every creation, modification or deletion of a record, with timestamp, author, old and new value, reason for the change;
• documented and tested backup and disaster recovery;
• retention for the required period in an accessible format;
• change control on the system (every change to the software, configuration or master data follows the change control process).

A system that does not fully comply with these points is not "better than paper": it is non-compliant.

The specific pitfalls of calibration records

Three points where systems (even digital ones) stumble most frequently:

As Found vs As Left

The system must force the recording of both: the raw value before the adjustment (As Found) and the value after (As Left). Systems that record only the "good" result have deleted the most important data point for the retroactive impact assessment.

Master data edit history

The calibration parameters (range, GMP tolerance, interval, reference used) are master data that change over time. The audit trail must also cover changes to these parameters, not only the calibrations performed. Systems that modify master data without a trace make historical calculations unverifiable.

Dual signature and segregation of duties

For critical records, the signature of the person who performs must be separated from the signature of the person who reviews/approves. The system must prevent the same person from carrying out both actions. It is a segregation-of-duties control that procedures provide for but that, without a software constraint, often erodes.

The Eurosystem experience

Dimacs is qualified as a GxP system according to GAMP5 and its audit trail fully complies with the requirements of Annex 11 and 21 CFR Part 11. But the point our experience in the sites where we operate insists on is another one: data integrity is not a feature of the software, it is a feature of the system — which includes the procedures, the training, the discipline of the operators. A well-built digital system makes many breaches materially impossible (the audit trail that cannot be switched off, the signature with unique identification), but it does not replace the site's quality culture. We always say it: the software is the necessary condition, not the sufficient one.