ALCOA+ Data Integrity, Applied to Procurement and Vendor Records

ALCOA+ is a set of nine attributes that regulators use to describe data you can trust: Attributable, Legible, Contemporaneous, Original and Accurate, plus Complete, Consistent, Enduring and Available. In plain words, every record should show who made it and when, be readable and permanent, be made at the time, be the original or a verified copy, be correct, and stay whole, coherent and retrievable for as long as it is needed.

For GMP equipment, purchasing records are part of that chain of evidence. The specification, the supplier assessment, the bid evaluation, the purchase order and the vendor's certificates and test reports help prove the equipment was specified, bought and qualified correctly, so the same principles apply to them.

Why this matters now

The EU's GMP rules on records and computerised systems are being rewritten. In July 2025 the European Commission and PIC/S published draft revisions of Chapter 4 on documentation and Annex 11 on computerised systems, plus a new Annex 22 on artificial intelligence; the consultation closed on 7 October 2025 [1]. The draft Annex 11 grows from 5 to 19 pages and includes a section on supplier and service management, and the draft Chapter 4 adds sections on data integrity, hybrid paper and electronic systems, and retention [2]. Check the Commission's pages for the final texts, but the direction is clear: regulators expect data integrity to reach every system that holds GMP records, including those run by suppliers.

The nine attributes in plain words

The UK MHRA's guidance defines the attributes and states that expectations are the same whichever version of the acronym is used [3]. The US FDA describes reliable data as attributable, legible, contemporaneously recorded, original or a true copy, and accurate [4], and PIC/S adds the same four "plus" attributes [5]. The WHO, the United Nations health agency, publishes its own guideline on the subject too [6].

Which purchasing records count

Not every purchasing email is a GMP record. Decide by risk: which records will be used to show that equipment meets its specification, that the supplier was assessed, and that the equipment was qualified? For a process vessel in a GMP area, that usually includes the user requirement specification, the RFQ and its technical schedules, the supplier assessment, technical queries and accepted deviations, the purchase order, and vendor documents such as material certificates, factory test reports and as built drawings that feed IQ, OQ and PQ.

Data integrity reaches into your suppliers

Both MHRA and PIC/S treat suppliers' data as your concern.

• Agreements. MHRA says contract givers should make sure data ownership, governance and access are covered in contracts or technical agreements with third parties [3]. PIC/S expects a quality agreement setting out responsibilities for data generation, transfer and integrity controls [5].
• Summary reports. Where a supplier sends summaries rather than full data, MHRA says the receiving company should first assess the supplier's data integrity controls, because summaries can leave out critical supporting data [3].
• Assessment depth. PIC/S says that judging a supplier's data integrity by desk review alone is not normally acceptable, and that an on site audit should be used where it matters to the risk [5].

That makes data integrity a natural part of supplier prequalification: ask how the supplier controls test records, calibration data and certificate copies before you rely on them.

Audit trails, copies and spreadsheets

An audit trail records who created, changed or deleted a record, what changed, when and why, without hiding the original; MHRA says users should not be able to switch it off [3]. FDA expects the people who review GMP records to review the audit trails too [4].

FDA also accepts electronic copies as true copies if they keep the content and meaning of the original, including the metadata needed to reconstruct the activity [4]. For buyers, the weak point is usually the bid evaluation spreadsheet: emailed between reviewers, edited in place, with no record of who changed a score. Lock the scoring method before prices are opened, keep every version, and record the reason for any score change.

Practical example

In this illustrative example, an inspector asks a pharmaceutical site why it chose the supplier of a new jacketed reactor. The buyer produces the purchasing file.

It holds the RFQ at revision 2, four quotes as received, 11 closed technical queries, the technical evaluation and the purchase order. Two gaps appear. One supplier's revised quote arrived in a personal mailbox and was never filed, so the file is not complete. And one technical score changed after commercial bids were opened, with no record of who changed it or why, so it is neither attributable nor consistent.

Neither gap means the choice was wrong, but both weaken the evidence. The fix is procedural: one controlled place for all quotes and correspondence, a scoring sheet that logs every change with a reason, and a rule that technical scores are frozen before prices are seen.

Where ChemCapital fits

ChemCapital's Trust Centre states that it implements all nine ALCOA+ principles, with examples such as timestamps in UTC that cannot be backdated, a SHA 256 checksum on uploaded documents, mandatory reason for change fields, and retention and legal hold controls with a seven year GxP default. Its audit log is described as tamper evident, using a hash chain on data changes; audit log export is available on all plans, with tamper evident export on Enterprise. These are ChemCapital's own statements, and your quality team should assess them against your requirements, as you would for any supplier.

Ready to keep RFQs, quotes and decisions in one traceable record? Start free with ChemCapital.