Data integrity failures in pharmaceutical maintenance records are among the most serious compliance findings an FDA or MHRA inspector can make — because they raise questions not just about one record, but about the trustworthiness of your entire quality system. The ALCOA+ framework provides the standard by which all GMP data, including maintenance records, is evaluated. If your maintenance records cannot be demonstrated as Attributable, Legible, Contemporaneous, Original, and Accurate — plus the extended requirements — you have a data integrity gap. This checklist helps pharma quality and maintenance teams systematically audit their records against ALCOA+ using OxMaint.
COMPLIANCE CHECKLIST
ALCOA+ Maintenance Data Integrity Checklist for Pharma Teams
Use this checklist to audit your maintenance records against every ALCOA+ principle before your next FDA, MHRA, or internal QA inspection.
A
Attributable
Every data entry must be traceable to the person who created it and the time it was created.
L
Legible
Records must be readable and permanent — not subject to fading, damage, or illegible handwriting.
C
Contemporaneous
Data must be recorded at the time the activity is performed — not reconstructed from memory hours or days later.
O
Original
The first capture of data is the original record. Transcription to another system introduces risk of error and must preserve the original.
A
Accurate
Data must truthfully reflect the observation or action performed — no rounding, estimating, or filling in expected values.
ALCOA + Extended Requirements
Complete
All required fields must be filled. No blank entries, dashes, or "N/A" without justification.
Consistent
Sequences and timestamps must be internally consistent. Events must occur in logical order.
Enduring
Records must survive for the full retention period — not vulnerable to deletion, media failure, or software obsolescence.
Available
Records must be retrievable promptly during inspection — not buried in filing systems or locked in unsupported legacy software.
The ALCOA+ Maintenance Records Audit Checklist
A — Attributable
All work orders show individual user ID for every entry
Shared login credentials fail attribution. Each technician must sign in with their own credentials before entering or completing any maintenance record.
Critical
Electronic signature meaning statement is present on all completed records
Part 11 requires that the printed name, date, and meaning of the signature appear on records — not just a user ID check-box.
High
Work order delegation is documented and traceable
If a supervisor completed a work order on behalf of an absent technician, the reason and authorization must be documented — not just entered under the supervisor's credentials.
Medium
L — Legible
All records are in structured digital fields — no free-text-only entries
Unstructured free text is subject to legibility issues and cannot be searched or filtered during audit reviews. Critical data (part numbers, measurements, readings) must be in structured fields.
High
Scanned paper records attached to digital records are legible and stored in durable format
PDF scans of legacy paper records must be readable and stored in a format that will remain accessible for the full retention period without software obsolescence risk.
Medium
C — Contemporaneous
Work order completion timestamps match actual task completion time
Batch-entering work orders at end of shift for work performed throughout the day is a contemporaneous data failure. Systems should capture data at the time of activity, not retrospectively.
Critical
System clock is synchronized and cannot be manually adjusted by users
If users can change the system time, timestamp integrity is compromised. Cloud-based CMMS systems like OxMaint use server-side timestamp generation that is not user-adjustable.
Critical
O — Original
No records are manually transcribed from paper to digital without retaining the original
When converting from paper to digital, the original paper record must be retained (or scanned and attached) — the digital entry is a copy until the paper-to-digital transition is formally validated and documented.
High
Record corrections show original value alongside correction
Corrections must never overwrite the original data. The original value, the corrected value, reason for correction, and identity of the person making the correction must all be retained.
Critical
A — Accurate
Measurement and reading values are actual instrument readings — not estimated or carried forward
Pre-populated or default values in measurement fields are a significant accuracy risk. Technicians must enter actual readings, and fields should not auto-populate with previous values unless explicitly designed with controls.
Critical
Out-of-specification readings are flagged and not bypassed
When a measurement falls outside the acceptable range, the system should prevent simple closure of the work order and require QA notification or corrective action documentation before the record can be signed.
High
4,400
Monthly searches for ALCOA+ data integrity guidance
100%
OxMaint records meet all 9 ALCOA+ principles by design
12
Checklist items covered automatically by OxMaint configuration
EXPERT REVIEW
Dr. Anjali Verma
Data Integrity and QMS Consultant — 16 Years FDA and MHRA Inspection Support
ALCOA+ is not a theoretical framework — it is the lens through which every FDA investigator evaluates your maintenance records when they walk through your facility. The failures I see most frequently are not malicious falsification. They are systemic gaps: technicians backdating entries because the CMMS is slow, shared logins because individual credentials were never set up properly, and records that look complete but have auto-populated measurement fields that no one actually checked. A well-configured CMMS like OxMaint eliminates most of these risks by design — server-side timestamps, required individual authentication, no pre-population of measurement fields, and immediate escalation when out-of-spec readings are entered. ALCOA+ compliance in maintenance is largely a system configuration problem, and the right CMMS solves it.
Frequently Asked Questions
Which ALCOA+ principle is most commonly cited in FDA 483 observations for maintenance records?
Contemporaneous and Attributable are most frequently cited. Contemporaneous failures occur when technicians batch-enter work orders retrospectively rather than at the time of activity, or when system clocks can be adjusted by users. Attributable failures arise from shared login credentials, a practice that is widespread in maintenance departments where individual logins are seen as a workflow barrier. FDA investigators specifically look for batch-entry patterns (multiple completions at the same timestamp), implausibly short completion times, and evidence of shared accounts. OxMaint addresses both by enforcing individual authentication and capturing server-side timestamps. Sign up free to review how OxMaint's configuration addresses these specific risk areas.
How does OxMaint support the "Complete" and "Available" requirements in ALCOA+?
For Completeness, OxMaint allows configuration of required fields at the work order and task level — a work order cannot be closed if mandatory fields are blank, and tasks cannot be signed off if measurement readings are empty or outside defined ranges without documented justification. For Availability, OxMaint maintains all records in a cloud-based system with defined retention periods and export functionality, ensuring records remain retrievable throughout the regulatory retention period even if personnel change or the site undergoes restructuring. The system also supports role-based access so QA and auditors can retrieve records independently without requiring IT or maintenance team involvement during an inspection. Book a demo to see these controls configured live.
Can this checklist be used for a formal ALCOA+ gap assessment of our current CMMS?
Yes — this checklist is designed to function as a practical gap assessment tool. Work through each item and document whether your current system meets the requirement, partially meets it, or has a gap. For each gap, document the risk level (critical, high, medium) and the remediation action required. The assessment should be documented formally and reviewed by QA management. If your current CMMS cannot address critical gaps — particularly around timestamp integrity, attribution, and original record retention — this represents a systemic data integrity risk that should be escalated to QA leadership and addressed through a CAPA with a target remediation date. OxMaint can be configured as the remediation solution with a validated implementation timeline of 6 to 8 weeks for most pharma sites.
