Laboratory Documentation Standards: GLP, ALCOA+ and Why Records Matter

Why documentation decides whether a result can be trusted#

A laboratory result is a claim about a sample, made at a particular time, by a particular person, with a particular instrument and method. If those details cannot be reconstructed, the number on the page has no context, and a reader has no way to tell a careful measurement from a careless or altered one. Documentation is what turns an observation into evidence.

Regulators describe this as data integrity. FDA's 2018 guidance on drug manufacturing defines it as the completeness, consistency and accuracy of data,^[1] and the UK Medicines and Healthcare products Regulatory Agency (MHRA) describes it as the degree to which data are complete, consistent, accurate, trustworthy and reliable throughout the data lifecycle.^[2] Both documents make the same practical point: a result is only as good as the record that supports it.

Two related terms come up constantly. Raw data are the original records of observations and activities, or verified copies of them; the OECD Principles of Good Laboratory Practice and FDA's GLP regulations both define the term in this way.^[3][4] Metadata are the contextual information needed to understand data, such as date and time stamps, user identities and instrument identifiers.^[1]

ALCOA+ explained, one principle at a time#

ALCOA is a mnemonic for the qualities a trustworthy record should have. FDA's guidance lists them as attributable, legible, contemporaneously recorded, original or a true copy, and accurate.^[1] The MHRA guidance adds four further attributes (complete, consistent, enduring and available), giving ALCOA+, and states that there is no difference in expectations whichever acronym is used.^[2]

FDA's guidance also gives a concrete example of why completeness matters. It describes sampling and testing with the goal of achieving a specific result, sometimes called "testing into compliance," as prohibited, and calls it a violative practice to use an actual sample in trial or equilibration runs as a way of disguising this.^[1] A record set that silently omits repeat runs fails the "complete" test even if every value shown is real.

GLP vs GMP vs ISO 17025: what each covers#

These three frameworks are often mentioned together, but they answer different questions and apply in different settings.

Good Laboratory Practice (GLP)#

The OECD Principles of Good Laboratory Practice describe GLP as a quality system concerned with how non-clinical safety studies are planned, performed, monitored, recorded, archived and reported.^[3] They require a quality assurance programme whose personnel are independent of study conduct, documented standard operating procedures, archives for study plans, raw data and reports, and a rule that changes to raw data must not obscure the previous entry, must state a reason and must be dated and signed.^[3] In the United States, 21 CFR Part 58 sets GLP requirements for nonclinical laboratory studies that support applications for FDA-regulated products; its definition of a nonclinical study excludes basic exploratory studies of a test article's physical or chemical characteristics.^[4]

Good Manufacturing Practice (GMP)#

GMP governs how products are manufactured and controlled, including the batch records and laboratory records that accompany each batch. For drug products in the United States this is CGMP under 21 CFR Parts 210 and 211; internationally, ICH Q7 sets out GMP for active pharmaceutical ingredients, including expectations that laboratory control records include complete data from all tests conducted.^[7] For how batch records connect to individual containers, see batch traceability.

ISO/IEC 17025#

ISO/IEC 17025:2017 sets requirements for the competence, impartiality and consistent operation of testing and calibration laboratories of any size, and accreditation bodies use it as the basis for assessing laboratories.^[6] Unlike GLP, which is organized around studies, ISO/IEC 17025 is organized around a laboratory's ability to produce valid results. Accreditation applies to a defined scope, so the relevant question is whether a specific test falls within it.

Electronic records and audit trails#

Most analytical data today are born electronic, in chromatography data systems and instrument software. FDA's guidance states that paper-based and electronic record-keeping systems are subject to the same requirements.^[1] For electronic records within its scope, 21 CFR Part 11 requires closed systems to be validated, access to be limited to authorized individuals, and the system to produce accurate and complete copies of records.^[5]

The central control is the audit trail: a secure, computer-generated, time-stamped record that allows the course of events relating to an electronic record to be reconstructed.^[1] Part 11 requires audit trails to record operator entries and actions that create, modify or delete records, to leave previously recorded information visible, and to be retained at least as long as the records themselves.^[5] FDA's guidance adds that people responsible for record review should review the audit trails that capture changes to data, and that shared login credentials defeat attribution because no unique individual can be identified.^[1]

An audit trail only helps if someone reads it. A printed chromatogram with a final purity value shows the outcome of processing; the audit trail shows whether integration settings were changed, whether earlier runs were deleted, and who made those decisions.

Applying it to supplier documents#

The same principles give a reader a practical checklist for certificates of analysis (COAs) and batch records. ICH Q7 expects authentic certificates to be issued for each batch and to be dated and signed by authorized quality personnel.^[7] Read with ALCOA+ in mind, a supplier document can be examined for:

• Attribution: a named laboratory, an identifiable signatory and an issue date
• Originality: whether the document is the laboratory's own report or a transcription of it, and whether the underlying data (for example, chromatograms and spectra) are available
• Completeness: test methods, acceptance criteria and results for every listed test, not only the favorable ones
• Consistency: lot numbers and dates that agree across the COA, the batch record and the container label
• Availability: whether the supplier can produce supporting records on request

Our guide on how to read a certificate of analysis walks through the sections of a typical COA in more detail. A mention of GLP, GMP or ISO/IEC 17025 on a supplier document is a claim to be checked, not evidence in itself: it should name the facility and, for accreditation, a scope and accrediting body that can be verified independently.

Evidence and limitations: standards describe process, not outcomes#

Documentation standards specify how work should be recorded and controlled. They do not establish that any individual result is correct. A well-documented analysis with an unsuitable method still produces an unsuitable answer, and a laboratory can follow a quality system on paper while its practice drifts. What good records offer is the ability to check: to reconstruct what was done, see what was changed, and judge for yourself whether the conclusion follows.

It is also worth keeping scope in mind. The regulations and guidance discussed here apply to defined regulated activities, and the MHRA guidance asks for effort commensurate with the risk and impact of a data integrity failure.^[2] Outside those settings they serve as reference points for good practice rather than binding rules. For interpreting the results themselves, see understanding peptide purity.