Good Documentation Practices are the rules that govern how data is recorded, corrected, and stored in regulated industries such as pharmaceuticals, medical devices, and laboratory research. Every entry in a batch record, lab notebook, or electronic system must be traceable to a specific person, made at the time the work happens, and preserved in a form that regulators can review years later. The FDA, the European Medicines Agency, and the World Health Organization all enforce these requirements, and falling short can shut down a manufacturing line or trigger criminal prosecution.
The ALCOA+ Principles
ALCOA is the acronym behind virtually every data integrity discussion in regulated industries. Each letter names a requirement that every recorded piece of data must meet.
- Attributable. Every entry must identify who made it, through a signature, initials, or an electronic login.
- Legible. Anyone reviewing the record must be able to read it clearly, not only at the time of entry but years later during an audit.
- Contemporaneous. Data is recorded at the moment the observation is made, not from memory at the end of a shift.
- Original. The first capture of the information is what carries weight. A transcription introduces the possibility of error.
- Accurate. Recorded values must reflect the true observation from a properly calibrated instrument, free from selective reporting or rounding that changes meaning.
ALCOA+ adds four more. Data must be complete, with nothing omitted or selectively excluded. It must be consistent, so timestamps and event sequences follow a logical order against a common time source. It must be enduring, recorded on approved media rather than sticky notes or thermal paper that fades. And it must be available, meaning regulators can access and review it throughout the entire retention period, even if technology changes along the way.1World Health Organization. Guideline on Data Integrity – TRS 1033 Annex 4
Selective reporting deserves special attention because it catches people who think they are being accurate. Recording only the results that pass while discarding the ones that fail is falsification under ALCOA+, even if each individual result you kept was measured correctly.
How to Record on Paper
Paper documentation in regulated environments must be written in permanent ink, typically blue or black. Blue or black ink provides high contrast, reproduces clearly on photocopies, and is easily distinguished from printed text. Pencils, erasable pens, markers, and temperature-sensitive inks are all prohibited because they either fade or allow changes that leave no trace.1World Health Organization. Guideline on Data Integrity – TRS 1033 Annex 4
Every entry needs a signature or initials and a date, recorded at the time the work is performed. Dates should use an alphanumeric format like 12-OCT-2025 rather than a purely numerical format. The reason is simple: 07/12 means July 12th in the United States but December 7th in most of Europe. International and multi-site studies live and die by this distinction.
Data must be recorded directly onto the approved form, logbook, or data capture system at the moment of observation. Writing values on a scrap of paper or a glove and transferring them later is one of the most common violations inspectors find. The FDA’s guidance states that raw data shall be “recorded directly, promptly, and legibly in ink.”2U.S. Food and Drug Administration. Good Documentation Practices
Blank fields create their own problem. If a field on a form doesn’t apply, mark it “N/A” and initial it rather than leaving it empty. An empty field creates ambiguity about whether data was collected and lost, was never recorded, or simply didn’t apply. Inspectors have no way to distinguish an intentional skip from a careless omission, and they will assume the worst.
How to Correct a Paper Error
GDP doesn’t demand perfection in every initial entry. It demands transparency about every correction. When you find an error in a paper record, draw a single line through the incorrect text so the original remains visible. Then write the correct value nearby, add your initials, the current date, and a brief reason for the change.1World Health Organization. Guideline on Data Integrity – TRS 1033 Annex 4
The reason doesn’t need to be elaborate. “Transcription error,” “wrong unit,” or “misread instrument” all work. What matters is that a reviewer can see what was originally written, who changed it, when they changed it, and why. That is the paper equivalent of an electronic audit trail.
White-out, correction tape, heavy scribbling, and any other technique that hides the original entry is forbidden. Inspectors treat obscured entries as presumptive evidence of tampering. Even if the change was completely innocent, the method signals either poor training or something worse. The same applies to writing over characters so thickly that the original is unreadable, or squeezing corrections into margins without attribution.
Electronic Records Under 21 CFR Part 11
In the United States, electronic records and electronic signatures in FDA-regulated industries must comply with 21 CFR Part 11. The regulation applies to any electronic record created, modified, or maintained to satisfy an FDA requirement. Its core demands center on audit trails, access controls, and signature integrity.3eCFR. 21 CFR Part 11 – Electronic Records; Electronic Signatures
Systems must generate secure, computer-generated, time-stamped audit trails that independently record every action that creates, modifies, or deletes a record. The critical word is “independently.” The system logs these events on its own, without relying on the user to document what they did. The audit trail must be retained at least as long as the underlying records and made available for agency review.3eCFR. 21 CFR Part 11 – Electronic Records; Electronic Signatures
Each person who accesses the system needs a unique user ID and password. Shared logins destroy attribution. If three analysts use the same credentials, there is no way to determine who performed a given action, which violates the “A” in ALCOA. Electronic signatures carry the same legal weight as handwritten ones when properly implemented, meaning they must be linked to their respective records and cannot be reused, reassigned, or repudiated by the signer.
Under current good manufacturing practice regulations, computerized systems must also maintain backup files of entered data, and those backups must be exact, complete, and protected from alteration or accidental erasure.4eCFR. 21 CFR 211.68 – Automatic, Mechanical, and Electronic Equipment
EU Requirements Under Annex 11
The European Union’s equivalent framework is Annex 11 to the EU GMP Guide, which governs computerized systems used in pharmaceutical manufacturing. The principles overlap significantly with Part 11 but differ in emphasis. Annex 11 takes a more risk-based approach, stating that decisions on the extent of validation and data integrity controls should be based on a documented risk assessment.5European Commission. Annex 11 – Computerised Systems
Under Annex 11, audit trails are expected based on risk assessment rather than mandated universally the way Part 11 requires them. Electronic signatures must be permanently linked to their respective records and include the time and date of application. For critical data entered manually, a second check on accuracy is required, either by another operator or by validated electronic means.5European Commission. Annex 11 – Computerised Systems
Companies operating in both the U.S. and EU markets typically design their systems to meet the stricter of the two standards at each point of overlap, since falling short of either one creates compliance exposure.
Training, Signature Logs, and Unique Credentials
GDP only works if the people doing the documenting understand the rules. Under FDA’s CGMP regulations, every person involved in manufacturing, processing, or holding a drug product must receive training in both their specific job functions and in current good manufacturing practices. That training must be ongoing and frequent enough that employees stay current. Organizations must also keep records showing the date of each training session, who attended, and who conducted it.6eCFR. 21 CFR Part 211 – Current Good Manufacturing Practice for Finished Pharmaceuticals
Most organizations maintain a signature and initials log that links every person’s handwriting to their printed name and role. Without it, a set of initials on a batch record is meaningless. FDA guidance requires that signatures and initials be “authentic and traceable to a specific individual” and that a signature without a date is not considered valid.2U.S. Food and Drug Administration. Good Documentation Practices
For electronic systems, each user must have unique login credentials that are never shared. FDA guidance specifies that single sign-on identifiers must be documented and may not be used by multiple personnel. If someone leaves the organization, their credentials should be deactivated, not reassigned to a new hire.
Record Retention and Storage
How long records must be kept depends on the type of product and the applicable regulation. For finished pharmaceuticals in the U.S., production, control, and distribution records tied to a specific batch must be retained for at least one year after the batch’s expiration date. For over-the-counter products exempt from expiration dating, the retention period is three years after distribution.7eCFR. 21 CFR 211.180 – General Requirements
Because drug products often carry expiration dates two to five years from manufacture, the practical storage window from the date of production can stretch considerably longer than the one-year minimum suggests. Medical device records follow different timelines under 21 CFR Part 820, which now incorporates ISO 13485 requirements.8eCFR. 21 CFR Part 820 – Quality Management System Regulation
Storage conditions matter as much as duration. Physical records need protection from fire, flooding, humidity, and temperature extremes. Electronic records face format obsolescence, media degradation, and the possibility that a cloud provider goes dark. The ALCOA+ “available” requirement means organizations must plan for technology migration. Records stored in a proprietary format on a system that no longer exists are effectively lost, even if the bits are technically intact.
What Inspectors Most Often Cite
FDA inspectors document their findings on Form 483, and data integrity violations have been a major focus area. The most frequently cited problems fall into a few predictable categories.
Missing or disabled audit trails top the list. Inspectors routinely find laboratory instruments running software with no audit trail functionality, or with audit trails turned off to improve system performance. Sometimes the software technically has the capability, but nobody has ever enabled it, and nobody reviews the logs even when they exist. Related to this, inspectors often find that laboratory personnel have administrator-level access to operating systems, giving them the ability to change system clocks, delete files outside the application software, or modify data in ways the audit trail cannot capture.
Data deletion and selective reporting is the finding that escalates fastest from a compliance issue to a criminal investigation. Inspectors look for patterns like repeated testing of the same sample until a passing result is obtained, with only the passing result making it into the official record. The electronic evidence is usually there in the metadata.
Shared login credentials undermine everything else. When every analyst on a shift uses the same username and password, no individual action is attributable to anyone, and the entire dataset generated under those credentials becomes suspect. This single failure can taint months of production data.
What Documentation Failures Cost
Under the Federal Food, Drug, and Cosmetic Act, failing to establish or maintain required records is a prohibited act.9Office of the Law Revision Counsel. 21 USC 331 – Prohibited Acts
A first violation is a misdemeanor punishable by up to one year in prison, a fine up to $1,000, or both. If the person has a prior conviction or acted with intent to defraud, the violation becomes a felony carrying up to three years in prison and a $10,000 fine. Under the Sentencing Reform Act, those statutory fine amounts are adjusted upward significantly. Misdemeanors can reach $100,000 for individuals and $200,000 for organizations, while felonies can reach $250,000 for individuals and $500,000 for organizations.10Office of the Law Revision Counsel. 21 USC 333 – Penalties
The most severe provision targets anyone who knowingly and intentionally adulterates a drug in a way that creates a reasonable probability of serious injury or death. That offense carries up to 20 years in prison and a fine up to $1,000,000.10Office of the Law Revision Counsel. 21 USC 333 – Penalties
Beyond criminal prosecution, the FDA can seek a consent decree, a court-ordered agreement that puts the company under ongoing supervision. A consent decree typically requires the company to halt manufacturing, hire independent consultants at its own expense, and demonstrate sustained compliance before resuming operations. For companies that export to the U.S., the FDA can issue import alerts that detain shipments at the border without physical examination, effectively blocking market access until the data integrity issues are resolved.
Practical Steps That Make Compliance Stick
The gap between knowing GDP rules and consistently following them is where most organizations struggle. A few practices make a measurable difference.
Design forms so that compliance is the path of least resistance. If a data capture form has clear fields for dates, signatures, times, and observations, with no ambiguity about what goes where, people are far more likely to fill it out correctly. The WHO guidance explicitly recommends designing formats that prompt personnel to make entries at the appropriate step.1World Health Organization. Guideline on Data Integrity – TRS 1033 Annex 4
Use bound, paginated notebooks rather than loose sheets whenever possible. Sequential page numbering makes it immediately obvious if a page has been removed, and controlled issuance of notebooks prevents unauthorized duplicates. When loose sheets are unavoidable, number them sequentially and reconcile the count when the task is complete.
For electronic systems, restrict access privileges to the minimum each person needs. Lab analysts don’t need administrator rights. Nobody needs the ability to change the system clock. These restrictions should be built into the system configuration, not left to policy alone, because policies get ignored when they’re inconvenient. Regular review of user access levels catches the slow drift toward permission creep that happens as people change roles.
Finally, treat training as skill-building rather than a compliance checkbox. The organizations with the fewest inspection findings are the ones where technicians can explain why they document the way they do, not just recite the rules. When people understand that a single-line strikethrough preserves the audit trail because inspectors need to verify what was originally observed, they are less likely to reach for the white-out.