Data integrity for temperature records: ALCOA+ in practice
Temperature records are GxP records. Attributable, legible, contemporaneous, original and accurate — plus complete, consistent, enduring and available.
Regulators expect temperature monitoring and mapping data to meet the same data-integrity principles as any other GxP record. PIC/S guidance summarises them as ALCOA+: attributable, legible, contemporaneous, original, accurate, complete, consistent, enduring and available.
Applied to loggers and monitoring systems
- Attributable: which logger, which location, who downloaded it, who reviewed it.
- Original: the raw export retained unchanged; derived analyses stored separately with their inputs.
- Accurate: calibration status and uncertainty known; unit confirmed.
- Complete: gaps and exclusions visible, not silently dropped.
- Enduring and available: retained for the defined period in a readable format.
Software that computes statistics from logger data should preserve the input dataset, record the version of the calculation, and keep an audit trail of review actions — which is how ValiTrac's mapping engine is structured.
| Principle | For logger and monitoring data | How it fails |
|---|---|---|
| Attributable | Which logger, which position, who downloaded it, who reviewed it | A shared login, so every audit entry names the same account |
| Legible | Readable now and in five years, in an open format | A proprietary export whose software no longer runs |
| Contemporaneous | Recorded as it happened, with a synchronised clock | A logger whose clock was never set, or a review written up a fortnight later |
| Original | The raw export kept unchanged; analyses stored separately with their inputs | A spreadsheet edited in place, with no evidence anything was ever different |
| Accurate | Calibrated sensors, correct units, verified calculations | A unit inferred from the magnitude of the numbers |
| Complete | Every reading, including the ones that failed and the gaps | A dataset quietly cleaned before the statistics ran |
| Consistent | Chronological, with timestamps that agree across systems | Sensors and alarms on different clocks, so events cannot be ordered |
| Enduring | Retained for the defined period, readable throughout | An archive nobody has tried to read since the migration |
| Available | Retrievable on request, for the whole period | Data on a laptop that left with an employee |
The two that fail most often
Original and Complete carry most of the real risk, and they fail together. A mapping dataset with a flat-lined sensor quietly removed before analysis is neither original nor complete, and the resulting report is internally consistent, plausible and unverifiable. The control is not a policy against editing; it is keeping the raw export unchanged, recording every exclusion with its reason and range, and storing the analysis separately with a pointer to its inputs.
Attributable fails almost as often, and more cheaply. A shared login makes an audit trail worthless because every entry names the same account, and it is free to fix — which is why it is such a poor finding to receive.
What software has to do
- Preserve the input dataset unchanged, and store derived analyses separately with a reference to the exact input they used.
- Record the version of the calculation code alongside every result, so a result can be tied to the code that produced it. A fixed bug in an excursion calculation immediately raises a question about every report from the previous version.
- Keep an audit trail of review and approval actions, with user, timestamp and outcome, that cannot be disabled or silently edited.
- Require the unit to be declared rather than inferred, and refuse the file rather than guess. Inferring °C from the magnitude of the numbers is how confident nonsense gets produced.
- Synchronise to one time source, and record the time zone. Cross-system ordering is impossible otherwise.
The practical reason spreadsheets are hard to defend here is Original: a cell corrected in place leaves no evidence it was ever different, and a range that silently stopped one row short of the data produces a confident, wrong mean.
Frequently asked questions
- Is a screenshot of a logger graph an acceptable record?
- Not on its own. The underlying data export is the original record; a screenshot is a derived, non-verifiable representation.
References
- [1]PIC/S PI 041-1: Good Practices for Data Management and Integrity in Regulated GMP/GDP Environments (2021)
- [2]EudraLex Volume 4, Annex 11: Computerised Systems
General technical guidance written against the cited sources. It is not regulatory or legal advice and does not replace the applicable standard, guideline or a qualified reviewer's judgement.
Have a question on this topic?
Ask ValiTrac AI and see the evidence and calculation behind the answer.
Ask ValiTrac AIFree calculator: MKT & logger data check
Paste logger readings from storage or a cargo shipment: MKT per ICH Q1A(R2), time out of range, and which figure actually governs the excursion.
Open the calculatorRelated articles
Computerised system validation for monitoring and mapping software
Software that produces GxP records must be validated for its intended use: requirements, risk assessment, testing, audit trails, access and change control.
Reviewing and retaining monitoring records
A monitoring record nobody reviews is not a control. Define the review frequency, what the reviewer checks, how it is recorded, and how long it is kept.