Most GxP teams know ALCOA+ — the nine data integrity principles embedded in FDA, EMA, MHRA, and WHO guidance. But regulatory inspectors are increasingly citing a newer standard: ALCOA++, which adds three principles that address failure modes modern electronic systems expose. If your validation platform doesn't enforce all twelve, you have gaps you may not know about yet.
ALCOA+ ↓ ALCOA++
The Full ALCOA++ Framework
| Principle | What it requires | Version |
|---|---|---|
| Attributable | Who created or changed the record, and when | ALCOA |
| Legible | Readable now and throughout the retention period | ALCOA |
| Contemporaneous | Recorded at the time of the activity | ALCOA |
| Original | First capture or a certified true copy | ALCOA |
| Accurate | Correct and free of errors | ALCOA |
| Complete | Full record — nothing omitted | ALCOA+ |
| Consistent | Internally coherent, no contradictions | ALCOA+ |
| Enduring | Survives the full retention period without degradation | ALCOA+ |
| Available | Accessible to authorised reviewers on demand | ALCOA+ |
| Traceable | Unbroken chain from raw data to final decision | ALCOA++ |
| Understandable | Interpretable by any competent reviewer without extra context | ALCOA++ |
| Retrievable | Findable and producible within a defined timeframe | ALCOA++ |
What ALCOA++ Actually Adds
New — 01
Traceable
An unbroken chain from raw instrument output through processing, review, and final decision. A record can be attributed to a person without being traceable through the decisions that preceded it — ALCOA++ closes this gap.
New — 02
Understandable
Any competent reviewer must be able to interpret the record cold, without calling someone for context. Cryptic field codes, unexplained abbreviations, and decontextualized instrument readings all fail — even if the data is accurate.
New — 03
Retrievable
"Available" means the record exists. "Retrievable" means you can actually produce it when an inspector asks — promptly. Records that take days and three support tickets to surface are not retrievable in any meaningful sense.
These aren't theoretical additions. Investigators are already citing Traceable, Understandable, and Retrievable gaps in FDA Warning Letters and EU GMP inspection reports — in scenarios where systems fully satisfied ALCOA+ but still fell short.
What Your Validation Platform Needs to Do
Meeting ALCOA++ means your system enforces all twelve principles automatically — not as a manual process your team manages audit-by-audit.
| ALCOA++ Principle | How GoVal satisfies it |
|---|---|
| Traceable | ✓Structured, tamper-evident audit trail linking every record to preceding actions, user decisions, and system events — as a connected chain, not isolated log entries. |
| Understandable | ✓All records carry contextual metadata — field labels, deviation descriptions, signature meanings — so any reviewer can interpret them without internal knowledge. |
| Retrievable | ✓Indexed, role-based search and export. An inspector asking for all deviation records for a system across three years gets an answer in minutes, not days. |
Frequently Asked Questions
What is ALCOA++ in pharma? ＋
ALCOA++ is an extended GxP data integrity framework that adds Traceable, Understandable, and Retrievable to the nine principles defined by ALCOA and ALCOA+. It reflects the complexity of modern electronic and hybrid data environments and is increasingly cited in FDA 483 observations and EU GMP inspections as the benchmark for electronic records.
What is the difference between ALCOA+ and ALCOA++? ＋
ALCOA+ added Complete, Consistent, Enduring, and Available to the original five ALCOA principles. ALCOA++ goes further with three more: Traceable (connected chain of custody from raw data to decision), Understandable (records interpretable without extra context), and Retrievable (data findable within a defined timeframe). The ++ version addresses failure modes in hybrid electronic systems that ALCOA+ could not fully capture.
Is ALCOA++ a regulatory requirement? ＋
It is not a standalone regulation, but its principles are embedded in FDA 21 CFR Part 11, EU GMP Annex 11, MHRA GxP Data Integrity Guidance (updated 2021), WHO Technical Report Series 996 Annex 5, and PIC/S PI-041. Inspectors routinely reference ALCOA++ when citing data integrity deficiencies, and it appears in Warning Letters and import alerts.
What does "Traceable" mean in ALCOA++? ＋
Traceable means every data point carries an unbroken chain of custody — from raw instrument output through processing, analyst review, supervisor approval, and final disposition — as a connected thread. A record can be attributable to a person (satisfying ALCOA) without being traceable through the decisions that preceded it. ALCOA++ requires the full chain, not just the endpoint.
What does "Retrievable" mean in ALCOA++, and how is it different from "Available"? ＋
"Available" means the record exists and authorised users can access it. "Retrievable" means you can locate the specific record an inspector requests and produce it within a reasonable timeframe — without manual reconstruction, legacy software, or days of effort. Siloed archives, undocumented filing systems, and formats requiring obsolete tools all fail the Retrievable test even if the data technically exists.
How does validation software support ALCOA++ compliance? ＋
A purpose-built validation platform like GoVal supports ALCOA++ through structured, tamper-evident audit trails that link every record to preceding actions (Traceable), contextual metadata on every record including field labels and deviation descriptions (Understandable), and indexed role-based document retrieval with time-bounded search and export (Retrievable). All twelve ALCOA++ principles are enforced at the system level, not managed manually.
See ALCOA++ Compliance in Practice
GoVal enforces all twelve ALCOA++ principles by design — immutable audit trails, contextual records, and inspection-ready retrieval built into every workflow.
Book a Free Demo →