What ALCOA+ Actually Means — and Why It Matters for OT Engineers

ALCOA+ is an acronym: Attributable, Legible, Contemporaneous, Original, Accurate, plus Complete, Consistent, Enduring, and Available. These nine principles define what a trustworthy GMP record looks like. Regulators use them as the lens through which they assess data integrity during inspections — and in practice, the most common reason a GMP site receives a data integrity observation is not that they were trying to falsify records. It is that their systems were not designed with these principles built in.

For an automation engineer, the important insight is that ALCOA+ is not something QA retrofits into a validated system after the fact. It is a design requirement. Every principle has a corresponding engineering implementation. If you are building a SCADA system and you have not thought about what "Contemporaneous" means for your historian's data buffering strategy, you have a gap that will either be caught during OQ or — worse — by an inspector during a site audit.

The QLean VP-SYS-001 Validation Plan requires that every ALCOA+ principle has a corresponding URS requirement and an OQ test case, linked through the Traceability Matrix. This is the right approach — ALCOA+ is not a section you write in one document, it is a thread that runs from design through testing.

ALCOA+ — NINE PRINCIPLES MAPPED TO THE OT SYSTEM LIFECYCLE CORE ALCOA A Attributable L Legible C Contemporaneous O Original A Accurate PLUS (+) Complete Consistent Enduring Available Every principle requires a URS requirement, a design implementation, and an OQ test case
FIGURE 1 — The nine ALCOA+ principles. The original five (core ALCOA) address individual record attributes. The four plus principles (Complete, Consistent, Enduring, Available) address the integrity of the record set over time and across the system.

Attributable — Every Action Must Be Traceable to a Named Individual

A — Attributable
Who did it, and when — with no ambiguity
Attributable means every GMP record entry, parameter change, alarm acknowledgement, and electronic signature can be unambiguously linked to a specific named individual. Not a role. Not a shared account. A person. The audit trail entry for every action must include a unique user ID that maps to a real employee, with no possibility of dispute about who performed the action.
OT Implementation
  • Unique individual user accounts for every person who interacts with the system — no shared logins, no generic accounts like "OPERATOR1"
  • Automatic audit trail capture of user ID for every GMP-relevant action — setpoint changes, batch record approvals, alarm acknowledgements
  • Accounts disabled but not deleted when staff leave — the historical audit trail attribution must remain intact
  • OQ test: change a setpoint with a named user account; verify the audit trail entry shows that user's ID, not a generic identifier

Legible — Records Must Be Readable for Their Entire Retention Period

L — Legible
Readable now, readable in seven years
Legible means the record is human-readable — not raw binary data, not a proprietary format that requires a specific software version to open. In practice, this means GMP records must be exportable to a format that can be read without the originating application. An audit trail that can only be viewed inside a specific SCADA client version is a legibility risk: if that software version is no longer supported in five years, the records become inaccessible.
OT Implementation
  • All GMP records exportable to PDF or CSV with engineering-unit labels, not raw tag values or binary codes
  • Export includes all relevant fields: timestamp, user ID, parameter name with units, old value, new value, reason for change
  • Report format documented and version-controlled — if the export format changes, a CCR and re-verification are required
  • OQ test: export a batch of audit trail records; verify every field is present and human-readable in the exported file

Contemporaneous — Data Must Be Recorded at the Time of the Activity

C — Contemporaneous
The timestamp is the evidence — it must be trustworthy
Contemporaneous means the record timestamp reflects when the action actually occurred. This is the principle most directly threatened by clock drift, manual time changes, and data buffering failures. A historian record timestamped at 14:32 when the actual event occurred at 14:27 is not contemporaneous — and if an inspector cross-references that record against a paper log entry, the discrepancy is a data integrity finding. NTP synchronisation is the technical implementation of this principle, and any manual time change must itself be captured in the audit trail.
OT Implementation
  • NTP time synchronisation to a validated server — all clocks on the OT network synchronised within ±30 seconds
  • Any manual time change generates an audit trail entry and an alarm — and requires a documented justification
  • PLC data buffering: if the historian connection is lost, process data is buffered locally in non-volatile memory and synchronised on restoration with original timestamps preserved — not re-timestamped on upload
  • OQ test: simulate NTP server failure; verify an alarm is generated and the time deviation is logged
The Most Common Contemporaneous Failure

The most frequently cited contemporaneous violation in OT systems is not a malicious clock change — it is data buffering that re-timestamps records on upload rather than preserving the original capture timestamp. If your SCADA loses historian connectivity for 20 minutes and buffers 20 minutes of data, that data must be uploaded with its original timestamps. A record showing a temperature exceedance at 14:27 cannot arrive in the historian stamped 14:47 — that is a data integrity gap regardless of whether it was intentional.

Original — The First Capture Must Be Preserved Unaltered

O — Original
Read-only historical records — no exceptions
Original means the first recorded value of any GMP record is preserved and cannot be overwritten. Corrections are permitted — but only as separate entries that reference the original value, with the corrected value, the reason for correction, and the identity of the person making the correction. The original record remains visible. It is never deleted. This principle is implemented through the write-once audit trail and read-only historical data architecture that the QLean CP-SYS-001 specifies as a mandatory design requirement.
OT Implementation
  • Historian database configured as append-only: existing records cannot be modified or deleted by any user, including administrators
  • Administrator access to the audit trail is read-only — even the highest privilege user cannot alter historical entries
  • Data correction workflow: original value retained, correction record created with reference to original, reason mandatory, approval required
  • OQ test: attempt to modify a historical process value as an administrator; verify the attempt is blocked and the attempt itself is logged

Accurate — Records Must Correctly Reflect the Process

A — Accurate
Calibration is the foundation of accurate records
Accurate means the recorded value is a true representation of the actual process parameter at the time of recording. For OT systems, accuracy is grounded in instrument calibration. A temperature value recorded with a sensor that has drifted 2°C from its calibration certificate is not accurate regardless of how well the SCADA captures and stores it. This is why calibration management and data integrity are not separate topics — they are two aspects of the same requirement.
OT Implementation
  • All GMP-critical instruments calibrated against traceable standards before commissioning and on a defined periodic schedule
  • Calibration certificates retained as GMP records and referenced in the IQ for each instrument
  • Instrument accuracy specification stated in the URS — the system must record within that tolerance
  • OQ test: inject a known reference signal; verify the recorded value falls within the specified accuracy tolerance

The Plus Principles — Complete, Consistent, Enduring, Available

The four ALCOA+ extensions address the integrity of the record set over time, rather than individual record attributes. They are often less well understood by OT engineers because they relate more to system architecture decisions than to individual data points.

Complete means no data gaps. If the process was running, the historian was recording. A gap in the continuous process record — even a gap caused by a network outage, not human intervention — is a data integrity concern that must be explained and investigated. Data gap detection alarms and PLC buffering are the technical controls that implement this principle.

Consistent means timestamps and engineering units are consistent throughout the system. A temperature value displayed as 72.4°C on the HMI, stored as 72.4 in the historian, and exported as 72.4°C in the report — with the same timestamp in all three places — is consistent. Inconsistencies between the SCADA display and the historian record, or between historian time and report time, are Consistent violations that inspectors will identify when cross-referencing records.

Enduring means records are retained for the full required period and remain accessible throughout. For most GMP records in EU markets, this means a minimum of seven years total retention. The backup and recovery procedure must demonstrate that records can be retrieved at any point during that period, and the backup restoration test in the OQ must verify that retrieved records are complete and accurate.

Available means authorised users can access records when they need them — including during a regulatory inspection. An inspector who asks to see the audit trail for a specific batch on a specific date must be able to receive that information within a reasonable timeframe. A system where audit trail retrieval requires a specialist and takes two days is not Available in the ALCOA+ sense.

In the QLean Framework

VP-SYS-001 Section 9 provides an ALCOA+ compliance framework table mapping every principle to its system requirement, implementation approach, and verification phase. URS-SYS-001 Section 2.3 contains the corresponding data integrity requirements (URS-GEN-012 through URS-GEN-019) that translate each principle into testable URS statements. CP-SYS-001 Section 6 defines the data recording strategy, audit trail architecture, data buffering approach, and retention requirements that implement ALCOA+ at the design level.

The OQ Connection — Every Principle Needs a Test Case

Understanding ALCOA+ is necessary but not sufficient. The validation package must demonstrate that every principle is implemented — which means every principle must have at least one OQ test case that verifies it. The Traceability Matrix should show the chain from each ALCOA+ principle to its URS requirement to its OQ test case.

The test cases that inspectors look for most closely are the adversarial ones: what happens when someone tries to modify a historical record? What happens when the clock is changed manually? What happens when the network connection is lost? These are not hypothetical scenarios — they are the scenarios that distinguish a system designed for data integrity from one that has ALCOA+ written in a document but not implemented in engineering.

Principle OT System Requirement Key OQ Test Case Common Failure Mode
AttributableUnique individual user accounts; audit trail captures user IDChange setpoint; verify audit trail shows named user, not generic IDShared accounts, generic logins
LegibleGMP records exportable to PDF/CSV with labels and unitsExport audit trail; verify all fields present and human-readableProprietary binary format, raw tag values
ContemporaneousNTP sync ±30s; buffer timestamps preserved on uploadSimulate NTP failure; verify alarm and log entry generatedRe-timestamping buffered data on upload
OriginalAppend-only historian; no modification by any userAttempt to modify historical value as admin; verify blocked and loggedAdmin override capability on historian
AccurateCalibrated instruments to specification in URSInject reference signal; verify recorded value within toleranceUncalibrated instruments, no calibration traceability
CompleteData gap alarm; PLC buffering during comms lossDisconnect historian; restore; verify no data gap and no re-timestampingNo buffer, gaps accepted without investigation
ConsistentNTP sync across all nodes; consistent units HMI/historian/reportCross-reference HMI value, historian value, and exported report valueTime skew between nodes, unit conversion errors
Enduring7-year retention with tested backup restoreRestore from backup; verify record completeness and hash matchNo verified backup, retention period not tested
AvailableAudit trail searchable and exportable in under defined timeRetrieve specific batch audit trail; verify retrieval within defined timeframeNo search function, specialist required for export