Introduction:
Data Integrity at CDMOs: ALCOA+ and 21 CFR Part 11 is the foundation of trustworthy outsourced development and manufacturing, because every release decision, stability claim and regulatory filing rests on the data a contract partner generates. When a sponsor hands analytical work to a CDMO, it also hands over a share of its regulatory risk.
Regulators have made their expectations clear. The FDA’s guidance on data integrity and CGMP compliance, together with the MHRA, WHO and PIC/S guidance documents, expects data to be reliable at every step. Inspection findings such as missing audit trails, shared logins and unreported failing results continue to appear in warning letters, including at contract organizations.
CDMOs generate and manage large volumes of regulated information, including analytical chromatograms, laboratory notebooks, instrument data, batch manufacturing records, stability results, calibration records, deviation investigations and quality-control documentation. Any unauthorized change, missing record or undocumented activity can compromise scientific conclusions and regulatory submissions.
For sponsors selecting a CDMO, data integrity is not simply a documentation requirement. It is part of supplier qualification, quality oversight, regulatory compliance and protection of the product lifecycle.
This guide explains what data integrity means in a CDMO setting, how the ALCOA+ principles work in daily laboratory practice, what 21 CFR Part 11 requires, and how ResolveMass Laboratories Inc. approaches these obligations as a Canadian analytical CRO/CDMO.
Summary:
- Data integrity means that data is complete, consistent and accurate across its whole lifecycle, from raw instrument output to the final report.
- ALCOA+ is the standard framework: Attributable, Legible, Contemporaneous, Original, Accurate, plus Complete, Consistent, Enduring and Available.
- 21 CFR Part 11 sets the FDA’s requirements for electronic records and electronic signatures, including validated systems, access controls, audit trails and signature linking.
- Why it matters at CDMOs: sponsors rely on a CDMO’s data for regulatory submissions, so weak controls can delay approvals or trigger warning letters.
- What to look for: validated systems, secure audit trails, trained analysts, routine data review and a documented quality culture.
- ResolveMass Laboratories Inc. applies these principles across its analytical work in biosimilar characterization, mass spectrometry, PLGA-based drug delivery and nitrosamine testing.
1: What Is Data Integrity at CDMOs?
Data integrity at a CDMO is the assurance that every record the organization generates is complete, consistent and accurate throughout its lifecycle, so a sponsor and a regulator can trust it without re-testing. It covers paper records, electronic records and the hybrid systems that combine both.
Why CDMOs Face Higher Scrutiny
A CDMO works on behalf of many sponsors, often on shared instruments, shared software and shared staff. That raises the stakes in three ways:
- Shared responsibility: the sponsor remains accountable for the product, so it must be able to rely on the CDMO’s records.
- Complex workflows: method development, validation and release testing produce large volumes of data across multiple systems.
- Regulatory exposure: a data integrity failure at a CDMO can affect several sponsors and their submissions at once.
This is why quality agreements, audits and data review expectations are central to CDMO relationships.
Why Is Data Integrity Important in Pharmaceutical Outsourcing?
Data integrity matters in outsourcing because sponsors rely on CDMO-generated information to make development, manufacturing, quality and regulatory decisions. Key reasons include:
- Patient safety: reliable analytical and manufacturing data help establish that products meet their intended quality requirements.
- Regulatory compliance: complete records support inspections, investigations and regulatory submissions.
- Scientific reliability: accurate results support method validation, impurity characterization, stability assessments and product development.
- Product quality: traceable records help identify deviations, unexpected results and potential manufacturing problems.
- Sponsor confidence: transparent documentation lets sponsors verify that outsourced activities meet agreed quality standards.
- Operational continuity: accessible, protected records support investigations, technology transfer and long-term lifecycle management.
For example, if a laboratory reports an impurity result without retaining the original chromatographic data, processing parameters, integration history and relevant audit trails, reviewers cannot confirm that the result is scientifically justified. The same logic applies to leachables work, where data integrity in extractables and leachables testing depends on traceable raw data and documented processing decisions.
2: ALCOA+ Principles for CDMO Laboratories
ALCOA+ is a set of nine attributes that every GxP record should meet, and it is the working checklist regulators use to judge data reliability. The original ALCOA covers the first five attributes; the “plus” adds four more.
| Principle | What it means | Example in a CDMO laboratory |
|---|---|---|
| Attributable | Every entry shows who did it and when | Unique user logins on chromatography and mass spectrometry software |
| Legible | Records are readable and permanent | Clear entries, no overwritten or obscured values |
| Contemporaneous | Recorded at the time of the activity | Results captured in real time, not reconstructed later |
| Original | The first capture or a certified true copy is kept | Raw instrument files retained alongside processed results |
| Accurate | Free of errors and faithful to what happened | Calibrated instruments, verified calculations, documented corrections |
| Complete | All data is present, including repeats and failures | Every injection and re-test retained with its audit trail |
| Consistent | Chronological order and uniform formats | Synchronized time stamps and sequential records |
| Enduring | Retained for the full required period | Validated archives and backups with periodic restore checks |
| Available | Retrievable for review and inspection | Indexed records that can be produced promptly on request |
How ALCOA+ Applies in Day-to-Day Analytical Work
ALCOA+ works best when it is built into the workflow rather than checked at the end. In practice, that means analysts record observations at the bench, reviewers check raw data and audit trails rather than only summary reports, and any deviation is documented and investigated instead of quietly repeated.
During HPLC analysis, for example, the analyst should use an individual account, save the original data, document relevant processing activities, and justify and trace any reintegration or repeat analysis. The reviewer should be able to examine the original results, metadata, audit trails and final reported values. The same expectations apply to data integrity in bioanalytical studies, where sample, instrument and processing records must allow the study to be reconstructed.
In manufacturing, operators should record critical process parameters at the time of the activity, document deviations, and make corrections that preserve the original entry and identify who made the change. ALCOA+ is therefore not merely a checklist for completed records. It is a framework for designing reliable processes before data are generated.
3: 21 CFR Part 11 Expectations for Electronic Records and Signatures
21 CFR Part 11 is the FDA regulation that sets the criteria under which electronic records and electronic signatures are considered trustworthy and equivalent to paper records and handwritten signatures. For a CDMO, it applies to the computerized systems that create, modify, store or transmit regulated data.
Core Part 11 Requirements
- System validation: systems must be validated to show accuracy, reliability and consistent intended performance, including the ability to detect invalid or altered records.
- Access controls: only authorized individuals may use the system, enter data or change records, with unique user IDs and managed passwords.
- Audit trails: secure, computer-generated, time-stamped audit trails must record the creation, modification and deletion of records, without obscuring earlier entries.
- Record protection and copies: records must be protected for the retention period and be available as accurate, complete copies for inspection.
- Electronic signatures: each signature must be unique to one person, show the signer’s name, date, time and meaning (such as review or approval), and be linked to its record.
- Procedures and training: written policies hold individuals accountable for actions under their signatures, and personnel need the education and training for their tasks.
Common Misunderstandings
Part 11 compliance is not a software feature that can simply be purchased. A validated system still needs procedures, trained users and active oversight. Equally, ALCOA+ and Part 11 are not interchangeable: ALCOA+ describes the qualities of good data, while Part 11 sets controls for the electronic systems that hold it.
Are Electronic Records and Signatures Always Subject to Part 11?
No. Part 11 applicability depends on how electronic records and signatures are used and on the underlying FDA requirements, known as predicate rules, such as cGMP recordkeeping requirements. Some records fall outside its scope, while others are subject to both Part 11 and the predicate rules.
CDMOs should therefore perform a documented assessment of each system and record type to establish the applicable requirements, intended use and necessary controls. A risk-based approach must never be used to disregard requirements that legally apply.
Beyond the core controls above, CDMOs should apply authority checks, so only appropriately authorized personnel can perform regulated actions, and controls that prevent one person from using another person’s electronic signature. For a laboratory-specific view, see how GMP data integrity for extractables and leachables testing puts these controls into practice.
4: How Data Integrity at CDMOs: ALCOA+ and 21 CFR Part 11 Work Together
ALCOA+ defines what good data looks like, and Part 11 defines the electronic controls that keep it that way. A CDMO needs both, because a compliant system can still hold poor data if people do not follow good documentation practice.
| Area | ALCOA+ focus | 21 CFR Part 11 control |
|---|---|---|
| Who did it | Attributable | Unique user IDs, access controls, signature manifestation |
| When it happened | Contemporaneous, Consistent | Secure, time-stamped audit trails |
| What was captured | Original, Accurate, Complete | System validation, protection of raw electronic records |
| How long it lasts | Enduring, Available | Record retention, accurate and complete copies |
| Who approved it | Attributable, Legible | Electronic signatures linked to records |
5: Common Data Integrity Failures and How to Prevent Them
The most frequent data integrity failures are preventable lapses in access control, audit trail review and documentation, not sophisticated fraud. Regulators repeatedly cite the same patterns, so they are a useful map of where to look.
| Common failure | Why it matters | Preventive control |
|---|---|---|
| Shared or generic logins | Actions cannot be attributed to a person | Unique credentials and role-based access |
| Audit trails disabled or not reviewed | Changes and deletions go unnoticed | Locked audit trail settings and routine review |
| Failing results repeated without a record | Data is incomplete and may be biased | Documented investigations for out-of-specification results |
| Unvalidated spreadsheets and software | Calculations may be wrong or alterable | Computerized system validation and change control |
| Records kept on uncontrolled media | Data may be lost or altered | Controlled storage, backups and archive checks |
| Late or reconstructed entries | Records are not contemporaneous | Real-time recording and reviewer checks |
6: How ResolveMass Laboratories Inc. Supports Data Integrity
ResolveMass Laboratories Inc. is a Canadian analytical CRO/CDMO whose scientists work on biosimilar characterization, mass spectrometry, PLGA-based drug delivery and nitrosamine testing, areas where defensible data is essential for regulatory success. Its approach treats data integrity as a scientific discipline shared by every analyst, reviewer and quality professional.
- Science-led oversight: experienced analytical scientists design methods, interpret results and review raw data, so records are judged on scientific merit as well as format.
- Controlled systems: instrument and data systems are managed with unique user accounts, defined roles and audit trail oversight, in line with ALCOA+ and Part 11 expectations.
- Complete, traceable records: raw data, processed results, method parameters and deviations are kept together so a study can be reconstructed end to end.
- Transparent communication: sponsors receive clear documentation, and unexpected results are reported and investigated rather than set aside.
- Continuous training: teams are trained on good documentation practice and data integrity so expectations are applied consistently.
These practices are especially relevant to complex programs such as biosimilar comparability, where thousands of data points support a single regulatory conclusion, and nitrosamine testing, where trace-level results must withstand regulatory scrutiny.
Checklist: How to Evaluate a CDMO’s Data Integrity Controls
A sponsor can judge a CDMO’s data integrity maturity by asking for evidence in six areas before signing a quality agreement. Use these questions during vendor qualification and audits:
- Are computerized systems validated, and is the validation documentation available for review?
- Does every user have a unique login with role-based permissions?
- Are audit trails enabled, protected from editing and reviewed as part of batch or study review?
- Is there a procedure for investigating out-of-specification and unexpected results?
- Are raw data, backups and archives controlled, tested and retrievable?
- Is data integrity training documented, and is there an active quality culture that encourages reporting of errors?
Conclusion:
Data Integrity at CDMOs: ALCOA+ and 21 CFR Part 11 comes down to one commitment: every record must be attributable, complete and protected by validated, well-governed systems. Sponsors that select partners on these criteria reduce regulatory risk and protect the credibility of their submissions.
Frequently Asked Questions:
ALCOA+ defines the characteristics of reliable data, whereas 21 CFR Part 11 establishes regulatory requirements for applicable electronic records and electronic signatures. Both support data integrity, but they address different aspects of pharmaceutical compliance.
CDMOs can maintain laboratory data integrity through validated computerized systems, unique user accounts, secure raw-data storage, documented audit-trail reviews, controlled data processing, appropriate staff training, and procedures for handling deviations and unexpected results.
An audit trail is a secure, computer-generated, time-stamped record of relevant activities or changes to electronic records. When properly configured and reviewed, it helps establish who performed an action, when it occurred, and what information was changed.
Common data-integrity issues include missing raw data, shared user accounts, undocumented changes, inappropriate exclusion of test results, inadequate audit-trail reviews, uncontrolled repeat testing, and insufficient backup or archival controls.
Reference
About the Author
