GMP data integrity and good documentation practice
ALCOA+ in daily work, on paper and in systems, the way EU GMP Chapter 4, Annex 11 and PIC/S PI 041-1 expect. Free guides, findings and a self-check, plus the foundation course that teaches good documentation practice end to end.
6 modules · 1.5 hours, self-paced · verifiable certificate with a unique id
The first lesson of Module 1, in full. See how the course teaches before you join.
Start the lessonTen inspection scenarios. Find out which of your records, systems or habits would generate a finding.
Take the self-checkThe audit trail review log and the record review checklist, in a working version you can use today.
Open the templatesMapped to the regulations you are inspected against
Referenced for educational context. No regulator endorses or accredits training providers.
Documentation and data integrity deficiencies sit near the top of every deficiency table an EU national competent authority publishes, and recur in EudraGMDP non-compliance statements. It is rarely deliberate falsification. It is almost always one of these.
The instrument has one account and the password is on a sticky note. Every result it has ever produced is unattributable, and the inspector will say so in the first paragraph of the report.
Annex 11 section 9 expects audit trails to be reviewed. A review that never happened is indistinguishable, in the room, from an audit trail that was disabled.
Neat, complete, the same pen throughout, and the times do not match the equipment logs. Contemporaneous means at the time, not from memory before going home.
Sample runs aborted, reinjected, or renamed until one passes. Testing into compliance is the finding regulators write most forcefully because it changes the reported result.
An unlocked workbook on a shared drive computes assay results. No validation, no version control, no protection on the formula cells, and no way to show which version produced the certificate of analysis.
Correction fluid, overwriting, a torn-out page. The regulation is explicit that the original entry must remain legible. Once it is gone, so is the record's credibility.
Regulators treat training as part of the quality system, not a favour to staff: EU GMP Chapter 2 requires it, requires its effectiveness to be assessed, and requires the records to prove it. The evidence says the same thing in numbers. Below: what the published studies found, what it looks like on your data integrity KPIs, and the clause behind it.
41%
fewer quality defects
in the most engaged teams compared with the least engaged, across 112,000 business units. Engagement and development opportunities are measured together. [1]
26%
greater ability to deliver quality products
in organisations with a strong learning culture compared with those without. [2]
37%
higher employee productivity
in the same strong-learning-culture organisations; output per person, not hours. [2]
94%
would stay longer
of employees, at a company that invests in their learning. Retention is the quality metric nobody puts on the dashboard. [3]
The data integrity KPIs a trained team moves
These are the numbers a QA head reports at management review and an inspector asks for when the audit trail comes up. No invented percentages here: measure yours before and six months after, and you will have your own.
Audit trail review backlog
Measured as: % of scheduled reviews overdue
Lower is better
Reviewers who know what a risk-based review looks for finish it in the time allowed instead of scrolling every entry. Reviews happen on schedule; the backlog an inspector finds first stops accumulating.
Records corrected per GDocP
Measured as: % of corrections compliant on sampling
Higher is better
Single line, original legible, initialled, dated, reason given. Once everyone does it the same way, the correction itself stops being the finding.
Shared or generic account use
Measured as: count of active shared logins per system
Lower is better
People who understand why attributability matters stop lending passwords and report the shared login instead of working around it. System owners get the request to fix it before the inspector does.
Data integrity deviations
Measured as: count per quarter
Lower is better
Fewer late entries without justification, fewer unexplained reprocesses, fewer records with missing signatures. The deviations that remain are the real ones, not the avoidable ones.
Late entries with justification
Measured as: % of late entries carrying a reason and a true date
Higher is better
Contemporaneous is taught as a habit, and when it fails the entry says so honestly. A late entry with a justification is a record; a backdated one is a finding.
Retention failures found at audit
Measured as: count of records not retrievable within the retention period
Lower is better
Owners know what must be kept, for how long and in what form, including the metadata and the audit trail. Records are still there, and still readable, when the inspector asks for them.
Be first when the course opens
Leave a work email. You are notified before public launch and get the launch price. Nothing else is sent.
Record, correct, review and retain GMP data so that every entry, on paper or in a system, can be traced to a person, a time and an original observation that an inspector can trust.
Hosted on The GMP Training Academy. Launching soon. People on the waitlist are notified first and get the launch price.
What data integrity is and why inspectors lead with it
ALCOA+ on paper: recording, correcting, reviewing
Electronic records, audit trails and access control
Audit trail review and hybrid systems
Data lifecycle, retention and spreadsheets
Governance, culture and remediation
A fair comparison with the two alternatives most sites use. If the classroom course is genuinely better for you, book it. Most of the time it is not the classroom that is the problem, it is the follow-through.
| This course | Generic GMP e-learning | One-day classroom course | |
|---|---|---|---|
| Price per person | Launch price to be announced | €40 to €90 | €800 to €1,500 plus travel |
| Time away from work | 90 minutes, in your own time | 1 to 2 hours | 1 day |
| Written by | Practitioners who review audit trails | Content agency | Varies |
| Practice on real records | Yes, paper records and audit trails | No | Sometimes, on the day |
| Regulation cited by clause | Every module | Rarely | Usually |
| Templates you can use tomorrow | Audit trail review log, risk assessment, correction record | No | Sometimes |
| Assessment and certificate | Yes, verifiable ID | Completion certificate | Attendance certificate |
| Questions answered by the author | Yes | No | On the day only |
| Access period | 12 months, with updates | Varies | None after the event |
Each guide answers one question a reviewer, analyst or system owner actually asks, cites the clause, and shows the weak record next to the defensible one.
A plain-language definition of data integrity under EU GMP Chapter 4, Annex 11 and the PIC/S and EMA guidance, each ALCOA+ attribute with the failure that breaks it, and why inspectors open with it.
Read the guideThe rules for handwritten GMP records under EU GMP 4.7 to 4.9 and 4.20: making the entry, single-line corrections, late entries, blank fields, and what a second-person check is for.
Read the guideElectronic records in plain language: unique user identities, roles and privileges, what an audit trail must capture, why it must not be switchable, and how Annex 11 section 14 and the eIDAS Regulation govern electronic signatures.
Read the guideA risk-based audit trail review that finds reprocessing, aborted runs and deletions, documents what was reviewed, and fits into batch release, plus how to control a hybrid system where a signed printout sits beside an electronic original.
Read the guideFollowing a GMP record from creation to destruction: the retention periods in EU GMP 4.11 to 4.12 and Annex 11 section 17, backup versus archive, keeping electronic records readable, and when a spreadsheet becomes a computerised system under Annex 11.
Read the guideWhy data integrity is a management responsibility under PIC/S PI 041-1 and EU GMP Chapter 1, the signals inspectors read as culture, how to assess your own data risk, and what a remediation plan regulators accept looks like.
Read the guide10 scenario questions, each with the clause behind the answer. About eight minutes. No sign-up. You get a readiness band and the modules that would close your gaps.
A QC laboratory has one login for its dissolution software, used by all five analysts, because licences are expensive. Each analyst writes their initials on the printout. Is this acceptable?
Answer and explanation in the self-check.
What the inspector wrote, why, and what would have prevented it. The fastest way to learn what gets cited.
Computerised systems: access control and attributability
The chromatography data system in the QC laboratory was accessed by all analysts using a single generic account 'QCLAB' whose password was written on the instrument bench. The account held administrator privileges, including the ability to delete data files and modify audit trail settings. It was therefore not possible to attribute any acquisition, reprocessing or deletion in the system to an individual. The firm could not demonstrate that reported results for batches released since installation were the results originally generated.
Read the breakdownComputerised systems: audit trail review
The site's procedure required 'periodic' review of audit trails for the LIMS and chromatography data system. No frequency, scope or acceptance criteria were defined. No record of any review could be produced for the preceding two years. On examination of the audit trail during the inspection, fourteen instances of result reprocessing with manual integration were identified across nine batches, none of which had been noted on the analytical report or assessed before release.
Read the breakdownLaboratory controls: complete data and unofficial testing
Audit trail review during the inspection identified 23 sample injections in the preceding six months that were aborted or not processed and were named 'SST', 'test' or 'trial'. In eleven cases the sample was subsequently reinjected under the batch name and the passing result reported. No investigation, out-of-specification record or deviation existed for any of the aborted injections. Analysts interviewed stated that this was 'normal practice to check the system'.
Read the breakdownThe course was not written from a syllabus. It was written from what regulators publish about how records fail, then worked back to the practice that would have kept them true.
EMA questions and answers on data integrity (GMP/GDP Inspectors Working Group)
The definitions of raw data, true copy and audit trail review that the course uses, framed the way EU inspectors apply Chapter 4 and Annex 11 on site, and the expectations on data governance that Module 6 is built on.
PIC/S PI 041-1 Good Practices for Data Management and Integrity
The inspector's own guidance: how data integrity is assessed on inspection, system by system, with the specific vulnerabilities inspectors are told to look for.
EudraGMDP non-compliance statements and EMA inspection findings
Published statements of non-compliance and the deficiency analyses that EU national competent authorities release. Data integrity, documentation and computerised systems are consistently among the most cited categories.
National competent authority inspection reports and ICH Q9 (R1)
Public deficiency summaries from EU national authorities citing Chapter 4 and Annex 11 sections 9 and 12, and the risk-based approach to data criticality and audit trail review that ICH Q9 (R1), adopted in the EU, underpins.
Site records reviewed in consultancy and audits
Anonymised logbooks, batch records, audit trails and spreadsheets, used to build the practice records and the weak-versus-defensible examples.
Tap a term. The full glossary has 35 terms, grouped by stage of the process.
Open the glossaryThe attributes a record must have to be trusted: attributable, legible, contemporaneous, original, accurate, plus complete, consistent, enduring and available. The regulators use it as a checklist; so should you.
PIC/S PI 041-1 s.6.2; EMA DI Q&A
Seat licences for the department or the site, a manager view of progress, and completion records exported for your training matrix. Content can be mapped to your SOP numbers on request.
If your question is not here, the contact page reaches a person, not a ticket queue.
A short breakdown of a real inspection finding, what went wrong and what would have prevented it. Unsubscribe in one click.
6 modules, real records, an audit trail review template you will use tomorrow, and a certificate your training matrix can reference. Launching soon. People on the waitlist are notified first and get the launch price.