Data Integrity Guidance Compared: FDA, EMA, MHRA, PIC/S, WHO

Why five documents describe one problem

Data integrity, in regulated medicines work, is the property that a record can be trusted to show what actually happened, now and years later. A global quality organisation meets guidance on it from five bodies: the US Food and Drug Administration (FDA), the UK Medicines and Healthcare products Regulatory Agency (MHRA), the Pharmaceutical Inspection Co-operation Scheme (PIC/S, a network of inspectorates), the World Health Organization (WHO), and the European Union, where the European Medicines Agency (EMA) and the European Commission publish the relevant texts. The documents overlap heavily; the MHRA calls its guidance "a UK companion document to PIC/S, WHO, OECD … and EMA guidelines" ^[1]. They still differ in scope, in the attributes they list, in how precisely they state when audit trails must be reviewed, and in what they say about retention.

This article sets six texts side by side (one each from FDA, MHRA, PIC/S and WHO, two from the EU), checked against the documents on 28 October 2026. Where a document says nothing on a point, the table says "silent". GxP is the umbrella term for the "good practice" regimes (manufacturing, clinical, laboratory, distribution, pharmacovigilance). An audit trail is metadata that records the creation, change or deletion of a record so the history can be reconstructed (see the audit trail glossary entry). This is an educational comparison across jurisdictions (United States, United Kingdom, European Union, and the international PIC/S and WHO frameworks). It is not legal or regulatory advice.

FDA: Data Integrity and Compliance With Drug CGMP, Questions and Answers (United States)

FDA issued this final guidance in December 2018 (docket FDA-2018-D-3984); on 28 October 2026 its page still showed "content current as of 12/13/2018" with no notice that it had been superseded ^[2]. It covers current good manufacturing practice (CGMP) for drugs, including biologics, under 21 CFR parts 210, 211 and 212. Like all FDA guidance, it is nonbinding: "should" means recommended, not required, unless a regulation is cited ^[3].

Q1 defines data integrity as "the completeness, consistency, and accuracy of data", and says that such data should be attributable, legible, contemporaneously recorded, original or a true copy, and accurate (ALCOA). Q1 also defines an audit trail as "a secure, computer-generated, time-stamped electronic record" that allows the course of events to be reconstructed, and gives an HPLC run as its example ^[3]. The Q&A is the most precise of the six on review frequency. Q8 says that where a CGMP regulation sets the review frequency for the underlying data, the audit trail is reviewed at the same frequency. The examples are review after each significant manufacturing step under § 211.188(b) and data review before batch release under § 211.22. Where no frequency is set, the firm decides using risk assessment. Q7 assigns audit-trail review to the people who review the rest of the record, and compares it to checking cross-outs on paper ^[3].

MHRA: GxP Data Integrity Guidance and Definitions (United Kingdom)

The MHRA published "Revision 1: March 2018" on 9 March 2018. The GOV.UK page was last updated on 27 September 2021, when a section on good laboratory practice was added ^[4]. Its scope is the widest: GLP, GCP, GMP, GDP and pharmacovigilance. It presents itself as clarifying "the UK regulatory interpretation of existing requirements" ^[1].

Section 6.4 defines data integrity as "the degree to which data are complete, consistent, accurate, trustworthy, reliable" and maintained so throughout the data lifecycle. Section 3.10 deals with the acronym question directly. The guidance uses ALCOA but says there is "no difference in expectations" from ALCOA+, because governance measures should in any case make data complete, consistent, enduring and available. Its ALCOA list in §6.1 reads "legible and permanent", which folds durability into L. On audit trails, §6.13 sets out a risk-based approach. Audit trails that risk assessment shows are needed should be switched on. Review need not cover "every system activity (e.g. user log on/off, keystrokes etc.)". Review can use an "exception report", which the guidance defines as a validated search that flags predetermined abnormal data or actions. Section 6.15 asks that a documented data review include "a positive statement regarding whether issues were found or not" ^[1].

PIC/S PI 041-1 (inspectorates)

PIC/S adopted PI 041-1, Good Practices for Data Management and Integrity in Regulated GMP/GDP Environments, on 1 June 2021, and it entered into force on 1 July 2021. It is written for GMP and GDP inspectors, covers both on-site and remote inspections, and states plainly that it "is not mandatory or enforceable under law" ^[5]. Its definition of data integrity in §2.5 is the MHRA wording, quoted with a footnote to the MHRA document. PIC/S lists the full nine attributes (ALCOA plus complete, consistent, enduring and available) in §2.3 and §7.4.

PI 041-1 is the most operational of the six on audit trails. Under §9.6, audit-trail functions should be "enabled and locked at all times". Critical audit trails should be reviewed with the other records of an operation before that operation is closed out, for example before batch release, by the originating department and verified by the quality unit where needed. Non-critical audit trails can be reviewed "at a pre-defined frequency" during system reviews. Under §9.8, the frequency, roles and responsibilities of review follow a risk assessment, and a detailed SOP (standard operating procedure) should say what reviewers look for. The quality unit should also run a programme of audit-trail reviews within self-inspection, with selection that is both "random" and "targeted" ^[5].

WHO TRS 1033, Annex 4: Guideline on data integrity

WHO published the guideline as Annex 4 to Technical Report Series No. 1033 (2021). It replaces the 2016 guidance on good data and record management practices (TRS 996, Annex 5), covers GxP for medical products, and applies to paper, electronic and hybrid systems ^[6].

The WHO glossary has no separate entry for "data integrity". It defines ALCOA+, data governance and data integrity risk assessment instead. Its definition of data governance also differs from PIC/S in one word: the arrangements provide assurance of data quality, where PIC/S says integrity. The audit-trail definition matches the MHRA's word for word, including the "who, what, when and why" of an action. WHO adds two expectations stated less clearly elsewhere. Audit trails should be enabled when software is installed, with "periodic verification" that they stay enabled (§11.11). Backups should be periodically restored and checked for completeness (§11.19). On review frequency, §12.3 names the factors (system criticality and category of audit-trail information, such as batch-specific, administrative or system activity) but sets no interval ^[6].

EMA and EU GMP: Annex 11 and the clinical-trial guideline (European Union)

In the European Union, two documents serve different regimes.

EudraLex Volume 4, Annex 11 (Computerised Systems) is revision 1, which came into operation on 30 June 2011. It is a GMP text for computerised systems, not a data integrity guideline, with no definition of data integrity and no ALCOA list. On audit trails, §9 is brief. Building in an audit trail of "all GMP-relevant changes and deletions" is to be considered "based on a risk assessment"; a reason must be recorded for changes; and audit trails "need to be available … and regularly reviewed". On retention, §7.1 requires that access to data be ensured throughout the retention period ^[7]. The retention periods themselves are in Chapter 4. Batch documentation is kept for one year after the batch expires or at least five years after certification by the Qualified Person, whichever is longer, and critical raw data supporting the marketing authorisation is kept while the authorisation remains in force ^[8].

EMA Guideline on computerised systems and electronic data in clinical trials (EMA/INS/GCP/112288/2023) is dated 9 March 2023. The GCP Inspectors Working Group adopted it on 7 March 2023, and it took effect six months after publication ^[9]. Its attribute list is the longest of the six: ALCOA++, which is ALCOA+ with "available when needed" and "traceable" added. Section 4.1 says data integrity "is achieved when" data are collected, accessed and maintained securely so as to fulfil those ALCOA++ attributes. Its audit-trail definition is close to the FDA's. Section 6.2.1 asks for audit trails visible at data-point level and exportable "as a dynamic data file". Section 6.2.2 expects proactive, ongoing, risk-based review "unless justified", focused on critical data, and allows technology to help review large datasets ^[9]. On archiving, §6.11 asks for an inventory of essential data with retention periods, and asks that those periods respect the data-protection principle of storage limitation. The governing period is set by law: Regulation (EU) No 536/2014, Article 58, requires the trial master file to be archived for at least 25 years after the end of the trial ^[10].

Revision status as of 28 October 2026. On 7 July 2025 the European Commission opened a consultation on three drafts: a revised Chapter 4, a revised Annex 11, and a new Annex 22 on artificial intelligence. The EMA GMDP Inspectors Working Group drafted them with PIC/S, and the consultation closed on 7 October 2025 ^[11]. On 28 October 2026, the EudraLex Volume 4 page still listed Annex 11 as "revision January 2011" and Chapter 4 as "January 2011", and it listed no Annex 22 ^[12]. The 2011 texts therefore remain the published versions, and the drafts are not yet in force.

Comparison table: definitions, audit trail, review, governance, retention

Column sources: FDA Q&A, MHRA guidance (§3.9 for notification), PIC/S PI 041-1 (§5, §8.10, §9.8), WHO TRS 1033 Annex 4 (§4, §11), Annex 11, EMA guideline. The US batch-record period is one year after the batch's expiration date ^[13].

Where they differ and how to build once

Four differences are substantive; the rest is wording.

1. Attribute count. Five, nine or eleven attributes look like a conflict, but the MHRA says expectations do not change with the acronym. The EMA additions are implied elsewhere by "available" and by audit-trail requirements, so one internal standard written to ALCOA++ meets every list.
2. Review timing. FDA ties audit-trail review to the regulatory review points for the underlying data. PIC/S ties critical audit-trail review to the decision the data supports, such as batch release. In practice both mean: review before the data are relied on. WHO and Annex 11 give no interval, which leaves the firm to set and justify one. The EMA's "ongoing unless justified" is the strictest default.
3. Scope of what is reviewed. The MHRA excludes routine noise such as log-ons and keystrokes. The EMA asks for review of access logs where they matter, for example in systems holding unblinded data. A risk assessment that classifies audit-trail events by category, which WHO §12.3 also suggests, settles both positions.
4. Retention periods. None of the data integrity guidelines sets a period. Each refers to the underlying regulation, and those differ: one year after expiry in the US, the longer of one year after expiry or five years after certification for EU batch records, and 25 years for an EU trial master file. The EMA guideline adds that archives must meet the periods of every region where the data may be submitted. A retention schedule keyed to record class and destination market therefore beats one keyed to site.

Worked example. Halden Therapeutics AG (a fictional pharma company) releases an oral solid product in the US, the EU and the UK. Its contract laboratory runs assay testing on an HPLC data system. Halden writes one control set that meets all six documents:

• Audit trails are enabled and locked at installation, and a quarterly check confirms they remain enabled (WHO §11.11).
• Audit-trail events are classed as critical (reintegration, method edits, deleted injections) or non-critical (log-ons, report prints).
• Critical events are reviewed through a validated exception report before the certificate of analysis is signed, which places review ahead of batch release (FDA Q8, PIC/S §9.6, MHRA §6.13).
• Non-critical events are reviewed quarterly during system review, and the quality unit samples both random and targeted runs within self-inspection.
• Every review record states whether issues were found, as the MHRA asks, and is dated and signed.
• Retention is the longest applicable period for each record class, with the dynamic chromatography files archived in a readable format.

In batch L-0417 (fictional), an analyst reintegrates a peak, citing "baseline drift". The exception report flags it; Halden's reviewer compares original and reprocessed results and records "no issue found". One review answers all six texts, because each asks the same question about the same event.

Contract-manufacturer questionnaire

Each document places responsibility on the party relying on the data. WHO says contract givers are "ultimately responsible" for data integrity at their contract acceptors. PIC/S expects quality agreements to require contract acceptors to notify the contract giver of data integrity failures. The MHRA expects data ownership, governance and accessibility to be written into contracts. Annex 11 requires formal agreements with third parties. The EMA keeps "full responsibility" with sponsors and investigators even when tasks are delegated ^{[6][5][1][7][9]}. The questions below combine the six into one supplier audit:

1. Which data integrity guidance does your quality system reference, and which version and date?
2. Is there a written data integrity policy, and who in senior management owns it?
3. For each GxP system that produces our data, is the audit trail enabled, locked, and checked periodically to confirm it stays enabled? Can administrators disable it, and is that action logged?
4. How do you classify audit-trail events as critical or non-critical, and what is the review point for each class?
5. Do you use validated exception reports? Show a recent one and the review record, including its positive statement.
6. Do individual user accounts exist on every instrument, or is there a dated plan to replace shared or legacy logins?
7. Where are the data stored, including data-centre locations, and under which retention periods for each market we supply?
8. How are dynamic records (chromatography, spectra) archived, and when were backups last restored and verified?
9. What do you send us: summary reports or raw data with metadata? How can we reach the audit trail behind a reported result?
10. How quickly will you notify us of a data integrity failure, and is that written into the quality agreement?

For the wider context of how these duties sit in regulated life sciences, see the pharma sector page.