Clinical trial data can be scientifically valuable and still become difficult to defend if its origin, timing, corrections, or history cannot be reconstructed. Effective clinical data management therefore needs to address more than database cleanliness: it needs to support data integrity across the full data life cycle.

ALCOA++ offers a practical framework for turning that objective into decisions about data capture, review, correction, access, transfer, and retention. The challenge for clinical operations and data management teams is to make those principles operational in the systems and workflows used every day.

Data quality and data integrity are closely connected, but they are not interchangeable. A data point may appear plausible and still raise an integrity concern if it is unclear who recorded it, when it was recorded, where it originated, or how it changed.

The European Medicines Agency’s guideline on computerised systems and electronic data defines data integrity through the ALCOA++ principles: attributable, legible, contemporaneous, original, accurate, complete, consistent, enduring, available when needed, and traceable. The guideline also places data integrity within the wider context of data governance, quality management, and risk management. [1] For a closer look at each principle, see ALCOA++ data integrity principles for cleaner clinical trial data.

Although this EMA guideline specifically addresses clinical trials of investigational medicinal products, EMA states that it describes some generally applicable principles and definitions of key concepts. Those principles can therefore provide useful context for clinical research data management more broadly, while applicability should still be assessed against the relevant study type and regulatory framework.

That becomes especially important as studies combine electronic case report forms (eCRFs), laboratory data, imaging, electronic clinical outcome assessments (eCOA), electronic patient-reported outcomes (ePRO), devices, and external data sources. Each transfer or transformation introduces another point where metadata and context need appropriate control.

ALCOA++ becomes useful when each principle is translated into a practical question about the data workflow. It should influence system configuration, responsibilities, review procedures, and data governance rather than remain only a statement in a data management plan.

• Attributable: Can an entry or change be linked to the individual or system responsible for it?
• Legible: Can the information and its context continue to be read and interpreted?
• Contemporaneous: Is the timing of data capture or entry documented in relation to the underlying activity?
• Original: Is the original record, or an appropriate certified copy, identifiable?
• Accurate: Are controls in place to identify incorrect or inconsistent data according to the study’s requirements?
• Complete: Are relevant records, metadata, changes, and repeat observations maintained as required?
• Consistent: Are chronology, formats, units, and related data coherent?
• Enduring: Are records maintained in an appropriate durable form?
• Available when needed: Can authorized users retrieve relevant information throughout the required period?
• Traceable: Can the history of the data and relevant changes be reconstructed?

The practical question is therefore not simply whether an electronic data capture system has an audit trail. Teams also need to consider whether the entire workflow preserves enough context to understand what happened to important study data from initial capture through review, correction, transfer, finalization, and retention.

Consider a hypothetical multi-site trial in which a clinical measurement is first recorded in a local source record and later transcribed into an eCRF. The EDC may document the person and time associated with the electronic entry, but the study still needs clear source definitions, appropriate transcription procedures, and controls proportionate to the criticality of that data.

Strong clinical database management starts before the first participant record is entered. Protocol requirements, database specifications, eCRF design, edit checks, user access, external data transfers, and review procedures should work together around the information that matters most for participant safety and reliable trial results.

The EMA guideline addresses validation checks, audit trails, user management, access controls, timestamps, data transfer, backup, migration, and archiving as parts of the electronic data life cycle. It also describes an audit trail as a secure, computer-generated, time-stamped electronic record that supports reconstruction of events relating to the creation, modification, or deletion of an electronic record. [1]

ICH E6(R3), adopted at Step 4 on 6 January 2025, also places greater emphasis on data governance across the data life cycle. It states that acquired data from any source, including data directly captured in a computerised system, should be accompanied by relevant metadata. [2]

In practice, a risk-based data management approach may include:

• role-based access aligned with assigned study responsibilities
• validation rules focused on meaningful data errors and inconsistencies
• documented procedures for corrections and query resolution
• risk-based review of relevant audit trails and metadata
• reconciliation between relevant systems and external data sources
• controlled processes for database freeze and lock
• documented data transfer, migration, export, retention, and archival activities

The goal is not to maximize the number of checks. Controls should be proportionate to the importance of the data and the risks that could affect participant protection or the reliability of trial results.

A digital workflow is not automatically a controlled workflow. The value of an EDC depends partly on how electronic functions are configured and integrated into the study’s wider data management processes. Disconnected tools add their own risk, as covered in the hidden cost of clinical trial system fragmentation.

The practical takeaway is not that manual processes are inherently unacceptable or that electronic processes are automatically compliant. The appropriate question is whether the selected approach is fit for purpose, appropriately controlled, and capable of preserving the integrity and traceability required for the data concerned.

Consider another hypothetical study receiving laboratory results from an external vendor. Automating the transfer may reduce manual transcription steps, but the study still needs defined specifications, appropriate controls, reconciliation where needed, and traceability of the transferred data and relevant metadata.

An EDC is most useful when its system controls support the data governance model defined for the study. If you are still comparing platforms, see how to choose an EDC system with confidence.

Catchtrial EDC+ is designed for the electronic management of clinical and patient data within a study protocol, with configurable data integrity controls such as allowed ranges, system messages, and warnings. Its CRF module maintains a detailed audit log of modifications to patient information and system login attempts; audit entries include the username, date/time, affected area, and a description of the action taken.

Catchtrial EDC+ also includes standard role and user management functionality. Administrators can configure study roles and privileges, associate users with one or more study sites, assign roles and corresponding privileges, and activate or deactivate user accounts across preview and production environments.

These capabilities are designed to support controlled data management in clinical trials when they are configured appropriately and combined with study-specific procedures, governance, training, and review activities. Technology does not replace those responsibilities, but it can help teams operationalize them within the clinical database.

For teams evaluating how EDC technology fits into an ALCOA++-oriented data strategy, the Catchtrial EDC+ product page provides more information about the platform.

Audit trails are important, but they are only one part of electronic records control. In the United States, when 21 CFR Part 11 applies, section 11.10 sets controls for closed systems, including system validation, accurate and complete copies, record protection and retrieval, authorized access, and secure, computer-generated, time-stamped audit trails. Section 11.30 requires open systems to apply the section 11.10 controls, as appropriate, plus additional measures to protect record authenticity, integrity, and confidentiality. [3]

For closed systems, section 11.10 states that record changes must not obscure previously recorded information and that audit trail documentation must be retained for at least as long as the subject electronic records and remain available for agency review and copying. It also addresses operational system checks, authority checks, training, and controls over system documentation. [3]

FDA’s October 2024 final guidance on electronic systems, electronic records, and electronic signatures in clinical investigations provides additional recommendations for sponsors, clinical investigators, contract research organizations, and other relevant parties. The guidance addresses the use of electronic systems and records in the context of FDA-regulated clinical investigations. [4]

ICH E6(R3) adds an important operational perspective. It states that review of trial-specific data, audit trails, and other relevant metadata should be a planned activity, with the extent and nature of review risk-based, adapted to the individual trial, and adjusted based on experience during the trial. [2]

This means audit trail review should not be treated simply as a blanket exercise covering every recorded event. The review strategy should reflect data criticality, study risks, system use, and the information needed to identify issues that could affect the reliability of results or participant protection.

The most practical approach to clinical data management connects controls to the importance of the data and processes being protected. Teams should know where critical data originate, how they move, who can act on them, what metadata are retained, which checks are meaningful, and how records will remain accessible over time.

ALCOA++ is valuable because it turns the broad concept of data integrity into questions that can be applied throughout study design and conduct. EDC technology can support that approach, but defensible clinical data still depend on the combination of appropriate systems, thoughtful configuration, documented processes, trained users, and effective governance.

If you are planning a new clinical database or reviewing your current data management approach, request a demo to discuss how Catchtrial EDC+ can support your study’s electronic data capture and data integrity workflows.

What are the ALCOA++ principles in clinical trials?

ALCOA++ describes data as attributable, legible, contemporaneous, original, accurate, complete, consistent, enduring, available when needed, and traceable. In clinical research, these principles provide a framework for considering whether data and relevant metadata preserve sufficient context and integrity throughout capture, processing, review, correction, transfer, storage, and retention. [1]

What is the difference between ALCOA, ALCOA+ and ALCOA++?

ALCOA covers data that is attributable, legible, contemporaneous, original, and accurate. ALCOA+ adds complete, consistent, enduring, and available. ALCOA++ adds traceable, so the full history of a record, including changes and their reasons, can be reconstructed across the data life cycle.

How can an EDC support clinical data management best practices?

An EDC can support clinical data management best practices through controlled electronic data capture, access management, validation rules, audit information, and structured review workflows. The effectiveness of these controls depends on study-specific configuration and processes. Using an electronic system alone does not establish compliance or data integrity.

Does 21 CFR Part 11 require audit trails?

When electronic records fall within the scope of 21 CFR Part 11, section 11.10 includes secure, computer-generated, time-stamped audit trails among the required controls for closed systems. These audit trails must independently record the date and time of operator entries and actions that create, modify, or delete electronic records, without obscuring previously recorded information. Section 11.30 applies the section 11.10 controls, as appropriate, to open systems and adds further measures. [3]

Should every audit trail entry be reviewed?

Not necessarily. ICH E6(R3) states that review of trial-specific data, audit trails, and other relevant metadata should be a planned activity and that its extent and nature should be risk-based and adapted to the individual trial. The appropriate scope therefore depends on the study, data criticality, risks, and applicable requirements. [2]

What should a clinical data management plan cover for data integrity?

The exact content depends on the study, but a clinical data management plan may address source and data definitions, data capture, validation, review, query management, coding, external data transfers, reconciliation, access controls, corrections, metadata and audit trail review, database finalization, exports, retention, and archiving. Responsibilities and procedures should align with the study’s risk profile and applicable regulatory requirements.

1. European Medicines Agency. Guideline on computerised systems and electronic data in clinical trials, EMA/INS/GCP/112288/2023, 2023. Official EMA guideline
2. International Council for Harmonisation. ICH E6(R3) Guideline for Good Clinical Practice, final version adopted 6 January 2025. Official ICH E6(R3) guideline
3. Electronic Code of Federal Regulations. 21 CFR 11.10, Controls for closed systems, and 21 CFR 11.30, Controls for open systems. 21 CFR 11.10 | 21 CFR 11.30
4. U.S. Food and Drug Administration. Electronic Systems, Electronic Records, and Electronic Signatures in Clinical Investigations: Questions and Answers, final guidance, October 2024. Official FDA guidance