Written and maintained by CASRAI Editorial Board
Last updated
Good documentation practices (GDP) is the set of expectations, grounded in Good Clinical Practice (GCP), for how clinical trial records and source documents must be created, corrected, and maintained so that a trial’s data can be trusted, reconstructed, and inspected. In clinical research the term is almost always shorthand for applying the ALCOA or ALCOA+ data-integrity principles to every record a trial generates — from a subject’s source chart entry to an electronic case report form (eCRF) to the trial master file itself. GDP is not a single regulation with its own number; it is a practical discipline that sits underneath ICH GCP and the data-integrity expectations of FDA, EMA, and other regulators, and it is one of the things a monitor checks on every visit and an inspector checks on every audit.
What “good documentation practices” means in a clinical trial
At its core, GDP asks a simple question of every record a trial produces: if a regulator, sponsor, or auditor had to reconstruct exactly what happened to a participant and when, could they do it from the documentation alone, without asking anyone to remember? ICH E6 requires that trial conduct and results be documented and reported in a way that allows accurate reporting, interpretation, and verification — and that requirement only works if the underlying records meet a consistent quality bar. That bar is what GDP describes.
GDP applies to two overlapping categories of records:
- Source documents and source data — the original records where a clinical finding, observation, or activity is first recorded: hospital charts, laboratory notes, a subject’s diary, pharmacy dispensing logs, instrument printouts, and certified copies of any of these. ICH E6 defines source data as all the information in original records (and certified copies of original records) that is necessary for the reconstruction and evaluation of the trial.
- Essential documents — the records that individually and collectively permit the conduct of a trial and the quality of the resulting data to be evaluated, organized into the trial master file (TMF). ICH E6 sets out a minimum list (protocol and amendments, investigator’s brochure, informed consent forms, IRB/ethics committee approvals, monitoring visit reports, delegation logs, and more), while noting the list is not exhaustive.
Case report forms (whether paper or captured in an EDC system) sit between these two categories: they transcribe source data into the format a sponsor needs for analysis, and GDP governs both the accuracy of that transcription and the traceability back to the original source.
The ALCOA and ALCOA+ principles
ALCOA is the acronym most commonly used to operationalize data integrity across GxP fields, including GCP. It originated in FDA’s data-integrity thinking and was formalized in FDA’s guidance on data integrity and CGMP compliance, then adopted by extension across other GxP domains including clinical research. The UK’s MHRA published its own detailed “GXP” Data Integrity Guidance in 2018 that extended the five original elements with four more, giving the field the now-common “ALCOA+” version. The letters describe attributes every trial record should have:
- Attributable — it is clear who created or changed the record, and when. A note in a subject’s chart or an eCRF entry should be traceable to a specific, identifiable individual, not left anonymous.
- Legible — the record can actually be read and understood, for the life of the record, not just at the moment it was written. Illegible handwriting or a scan too degraded to read fails this on its own.
- Contemporaneous — the record is made at the time the activity or observation occurred, not reconstructed from memory days or weeks later.
- Original — the record is the first place the data was captured (or a verified, certified copy of that first capture), not a re-transcription with no traceable link back to the source.
- Accurate — the record correctly reflects what actually happened, with no rounding, no unexplained edits, and no discrepancy between the source and any downstream transcription.
The “+” extensions, as set out in MHRA’s guidance and widely adopted across the industry, add:
- Complete — all data, including any repeated or reanalyzed measurements, are present; nothing relevant has been discarded.
- Consistent — dates, times, and sequencing across related records line up with each other and reflect the actual chronology of events.
- Enduring — the record survives, unaltered in substance, for the entire required retention period (paper that fades or media that becomes unreadable fails this).
- Available — the record can be retrieved and reviewed by those with a legitimate need (a monitor, auditor, or inspector) throughout the retention period.
Treat the GCP-domain application of ALCOA/ALCOA+ as established industry convention rather than the literal text of any single GCP regulation: the acronym’s regulatory origin is FDA’s CGMP-context data-integrity guidance, and its detailed elaboration is MHRA’s cross-GxP guidance, but both are applied in clinical trial monitoring, audit, and inspection practice as the working definition of what “good documentation” means for GCP purposes.
Applying GDP to the documents a trial actually generates
Source documents and source data verification
Monitors perform source data verification (SDV) — comparing what is entered on the CRF against the underlying source document — specifically to catch ALCOA failures: a transcription that doesn’t match the chart, a value entered before the visit actually occurred, an entry with no identifiable author. Sites are expected to designate, in advance, what counts as the source for each data point (a “source document location” or “source data location” list is a common tool for this), because if the CRF is the first place a value is recorded, the CRF itself becomes the source and must meet the same ALCOA standard as any paper chart.
Corrections to paper records
GDP has a well-established convention for correcting a paper entry, precisely because “Original” and “Attributable” both have to survive a correction: draw a single line through the incorrect entry (so the original is still legible underneath, never obliterated with correction fluid or a heavy scribble), write the correct value beside it, and date and initial the change. A correction with no explanation, no date, or no identifiable author breaks the audit trail the same way an outright fabrication would, even if the corrected value itself is accurate.
Electronic records and audit trails
Where source records or CRFs are electronic, GDP is enforced through the system rather than a pen: 21 CFR Part 11 sets the U.S. framework for when an electronic record and electronic signature are considered as trustworthy as their paper equivalents, requiring validated systems, access controls, and a secure, computer-generated audit trail that captures who changed what, when, and (for a substantive change) why. A well-configured EDC or eCRF platform effectively bakes several ALCOA+ elements — Attributable, Contemporaneous, Consistent — directly into the system rather than leaving them to individual discipline. For the broader systems and standards layer this sits inside, see CASRAI’s guide to clinical data management.
Essential documents and the trial master file
The same principles apply at the file level, not just the entry level: an essential document that is missing, out of date (an old protocol version left in place after an amendment), or unsigned fails GDP just as surely as an unattributed chart note does. TMF quality — completeness, timeliness of filing, and version control — is one of the most common findings in both sponsor audits and regulatory inspections, because a disorganized TMF is often the first visible sign of weaker documentation discipline throughout a trial.
Why GDP matters beyond the paperwork
Documentation quality is not a purely administrative concern: FDA’s Bioresearch Monitoring (BIMO) inspection program and equivalent programs at other regulators exist specifically to verify that a trial’s records support its reported results, and documentation deficiencies are a recurring category of inspection findings, including on Form 483s issued after FDA site inspections. A trial with unreliable source documentation creates genuine uncertainty about whether the underlying data can be trusted for a regulatory submission, independent of whether the clinical outcome itself was accurately observed. GDP is the discipline that keeps that uncertainty from arising in the first place, and it is why training on source documentation and ALCOA principles is a standard part of site initiation for coordinators and investigators.
GDP vs. related terms
- GDP vs. GCP — GCP (see CASRAI’s guide to GCP certification) is the overarching ethical and quality standard for how a trial is designed, conducted, and reported. GDP is the specific documentation discipline that supports GCP compliance; it is a component of GCP, not a separate standard alongside it.
- GDP vs. GCDMP — the Society for Clinical Data Management’s Good Clinical Data Management Practices document covers the data-management function specifically (database design, data cleaning, query management). GDP is broader and applies to any trial record, not only data managed within a clinical database.
- GDP vs. GMP — “good documentation practices” as a phrase and the ALCOA framework both originate in the manufacturing/quality (GMP) side of FDA guidance and are applied by extension to GCP; the underlying principles are the same, but GMP documentation governs manufacturing batch records rather than clinical trial conduct records.
Where each ALCOA letter is actually written down
ALCOA and ALCOA+ are a framework articulated by regulators, not a codified rule with clause numbers. There is no provision anywhere in 21 CFR, EudraLex Volume 4 or ICH E6 titled “ALCOA,” and none titled “good documentation practices” either. That matters in an inspection: a finding is never written against “ALCOA,” it is written against the binding provision the attribute stands in for. Knowing which provision that is, for each letter, is the difference between arguing about a poster and answering the question actually being asked.
FDA’s Data Integrity and Compliance With Drug CGMP: Questions and Answers (final guidance, December 2018) defines the term directly: “For the purposes of this guidance, data integrity refers to the completeness, consistency, and accuracy of data. Complete, consistent, and accurate data should be attributable, legible, contemporaneously recorded, original or a true copy, and accurate (ALCOA).” Note two things about that sentence. FDA states five attributes, not nine — the four “+” attributes (Complete, Consistent, Enduring, Available) come from MHRA’s “GXP” Data Integrity Guidance and Definitions, Revision 1, March 2018, not from FDA. And the guidance itself is stamped “Contains Nonbinding Recommendations” on every page, so it is FDA’s stated expectation rather than the regulation being enforced.
The regulation being enforced is named in that guidance’s own footnote, which maps each attribute onto specific binding sections. This cross-walk is the useful part, and it is the part most GDP training decks omit:
| Attribute | Binding US sections FDA points to | EU GMP equivalent |
|---|---|---|
| Attributable | 21 CFR 211.101(d), 211.122, 211.186, 211.188(b)(11), 212.50(c)(10) | Chapter 4 §4.9 (alterations signed and dated); Annex 11 §12.4 |
| Legible | 21 CFR 211.180(e), 212.110(b) | Chapter 4 §4.7 (clear, legible, indelible) |
| Contemporaneously recorded | 21 CFR 211.100(b), 211.160(a) | Chapter 4 §4.8 (made or completed at the time each action is taken) |
| Original or a true copy | 21 CFR 211.180, 211.194(a) | Chapter 4 §4.9 (alteration must permit reading of the original) |
| Accurate | 21 CFR 211.22(a), 211.68, 211.188, 212.60(g) | Annex 11 §6 (accuracy check on critical manual entry) |
On the EU side there is one further point worth knowing, because it is the closest thing to a written home for the phrase itself: EudraLex Volume 4, Chapter 4 (Documentation), revision 1, in operation since 30 June 2011, carries a subheading literally titled “Good Documentation Practices”, and the three clauses that sit under it — §§4.7, 4.8 and 4.9 — are the entire written basis for most of what is taught as GDocP. All three fit in four sentences.
What Chapter 4 actually says about corrections — and what is only convention
The three clauses, verbatim:
- §4.7 — “Handwritten entries should be made in clear, legible, indelible way.”
- §4.8 — “Records should be made or completed at the time each action is taken and in such a way that all significant activities concerning the manufacture of medicinal products are traceable.”
- §4.9 — “Any alteration made to the entry on a document should be signed and dated; the alteration should permit the reading of the original information. Where appropriate, the reason for the alteration should be recorded.”
Read §4.9 closely and the familiar correction ritual separates into two very different halves: the parts that are written down, and the parts that are shop-floor convention built on top of them. Both are worth following. Only one of them is a requirement you can be cited against, and confusing the two is how sites end up arguing the wrong point in a closing meeting.
| What GDocP training teaches | Written basis | Status |
|---|---|---|
| Do not use pencil | Chapter 4 §4.7 — entries must be “indelible” | Requirement (pencil is erasable, so it fails the clause directly) |
| No correction fluid, no obliteration, no scribbling out | Chapter 4 §4.9 — the alteration “should permit the reading of the original information” | Requirement in substance |
| Draw a single line through the error | None. §4.9 specifies the outcome (original still readable), not the method | Convention — a durable one, because a single thin line is the easiest way to prove the outcome |
| Initial and date the change | Chapter 4 §4.9 — “signed and dated” | Requirement, with initials the accepted convention for “signed” where a signature/initial log links them to a named person |
| Always write a reason for the change | Chapter 4 §4.9 — “where appropriate, the reason for the alteration should be recorded” | Convention on paper (the clause is qualified) — but see the asymmetry below |
| Record it as it happens, not at end of shift | Chapter 4 §4.8 | Requirement |
The paper/electronic asymmetry is real and is regularly got backwards. On paper, Chapter 4 §4.9 qualifies the reason-for-change with “where appropriate.” In a computerised system it is not qualified: Annex 11 (Computerised Systems), revision 1, in operation since 30 June 2011, states at §9 that “For change or deletion of GMP-relevant data the reason should be documented,” and that audit trails “need to be available and convertible to a generally intelligible form and regularly reviewed.” So the same edit, made on a form and made in a LIMS, carries a stricter written expectation in the system than on the page. Sites that configure a mandatory reason-for-change field and then run a paper process where reasons are optional have it the right way round; sites that assume paper is stricter do not.
Two further Annex 11 clauses do practical work here and are worth citing by number rather than paraphrasing. §9 makes the audit trail itself risk-based — “Consideration should be given, based on a risk assessment, to building into the system the creation of a record of all GMP-relevant changes and deletions” — which is why an audit trail’s scope is a validation decision and not a given. §8.2 requires that “For records supporting batch release it should be possible to generate printouts indicating if any of the data has been changed since the original entry,” which is the clause behind the inspector’s request to see a printout with its change history rather than a clean one. And §6 requires that “For critical data entered manually, there should be an additional check on the accuracy of the data” — the written basis for second-person verification of critical transcription.
Correcting a correction, late entries, and the back-dating line
These are the situations that generate the most questions on the floor and have the least written guidance, so it is worth being explicit about which answers are anchored and which are convention.
Correcting a correction
No clause addresses this. The governing constraint is §4.9’s outcome test: after the second change, can a reader still reconstruct every value the entry has ever held, and who changed it to what, and when? The established convention that satisfies it is to treat the second correction exactly like the first — a fresh line through the now-incorrect corrected value, the new value written clear of both, separately signed and dated, with a reason recorded because at this point a reason is plainly “appropriate.” What is not acceptable is correcting the correction on top of itself, or striking the whole cluster and rewriting it clean, because both destroy the earlier states of the entry. If an entry has been corrected so many times that it is genuinely unreadable, the convention is to void the entry with a signed, dated cross-reference and make a clean new one — not to erase the history.
Late entries and retrospective entries
A late entry is not automatically a §4.8 violation, and it is a mistake to train staff as if it were, because the practical consequence of that belief is people back-dating rather than admitting lateness. §4.8 requires records be “made or completed at the time each action is taken”; an entry that was genuinely not made at the time is a deviation from that expectation, and the correct handling is to record it honestly rather than to disguise it. The convention — again, convention, not a clause — is to write the entry with the actual date and time of writing, label it explicitly as a late entry, state separately the date and time the activity actually occurred, and sign it. A late entry documented that way is a documentation deviation that a reviewer can assess. The same entry written with the earlier date and no label is something else entirely.
Back-dating is the bright line
This is the single most important distinction on the page. Recording an entry late is a deviation. Writing a date other than the date on which the entry was actually made is a misrepresentation, because the record now asserts something untrue about when it was created — which is precisely the fact §4.8 exists to establish and which Annex 11 §12.4 requires systems to capture (“record the identity of operators entering, changing, confirming or deleting data including date and time”). No volume of corrective action reframes a back-dated entry as a paperwork slip, and no signature convention rescues it. The same applies to signing a record for work you did not personally perform or witness, and to completing a form in advance of the step it documents.
Spoiled and erroneous forms
The instinct to bin a form that was started wrong and begin a fresh one is where otherwise careful sites create findings. FDA’s position is explicit and quotable: “Incomplete or erroneous forms should be kept as part of the permanent record along with written justification for their replacement,” and “All data required to recreate a CGMP activity should be maintained as part of the complete record.” Replacing the form is fine. Discarding the spoiled one is not. The same guidance recommends controlling blank forms in the first place — issuing numbered sets, reconciling them on completion, and using bound paginated notebooks stamped by document control, “because they allow easy detection of unofficial notebooks as well as any gaps in notebook pages.” Unreconciled blank forms are a finding waiting to be written, because nobody can demonstrate that the ones not returned were never used.
The line between an ordinary error and a data-integrity finding
Every regulated site makes documentation errors, and no inspection expects otherwise. What separates a routine error — corrected, reviewed, closed — from a data-integrity observation that appears on a Form 483 or an inspection report is not the size of the mistake or how embarrassing it is. It is whether the record still supports reconstruction, and whether it still tells the truth about who did what and when.
No regulator publishes a threshold table for this, and anyone offering you one is selling something. What the cited clauses do support is a consistent set of questions, each of which maps to a specific written requirement. This is a decision framework derived from those requirements, not a published classification scheme:
| Question | Ordinary documentation error | Data-integrity finding | Anchored in |
|---|---|---|---|
| Can the original value still be read? | Yes — struck through, still legible underneath | No — obliterated, whited out, overwritten, or erased | Chapter 4 §4.9 |
| Does the record tell the truth about when it was made? | Yes, including where it is labelled as a late entry | No — back-dated, or signed as contemporaneous when it was not | Chapter 4 §4.8; Annex 11 §12.4 |
| Does it tell the truth about who? | Yes — signed by the person who did the work | No — signed for someone else, or shared login | 21 CFR 211.101(d); Annex 11 §12.1, §12.4 |
| Was the superseded record retained? | Yes — spoiled form kept with written justification | No — discarded, or the activity rewritten clean | FDA CGMP data-integrity Q&A, blank-forms answer |
| Did your own system detect it? | Yes — caught at second-person review or audit-trail review, deviation raised | No — found only by the inspector, with no evidence anyone reviews audit trails | FDA CGMP data-integrity Q&A, audit-trail-review answers; Annex 11 §9 |
| Is it isolated or a pattern? | Isolated, or a known and trended issue with CAPA in progress | Recurring across operators, batches, or shifts — a governance failure, not an individual one | Annex 11 §13 (incident management, root cause of critical incidents) |
The most useful single sentence in FDA’s guidance connects the two halves of the discipline that most sites treat as separate topics: “Audit trail review is similar to assessing cross-outs on paper when reviewing data.” Reviewing an audit trail is not an IT activity bolted onto record review — it is record review, done on the electronic half of the record. FDA expects it at the same frequency the underlying data review is required (for example after each significant step under 21 CFR 211.188(b), and before batch release under 211.22), and where no frequency is prescribed, it expects a frequency you set from a risk assessment covering “data criticality, control mechanisms” and the potential consequence of an error. A site that reviews paper cross-outs diligently and never opens an audit trail has done half a review and will be told so.
The clearest signal that something has crossed the line is what FDA expects of the response. An ordinary error is corrected and closed. Where an actual data-integrity problem is identified, FDA expects a firm to demonstrate it “effectively remediated” the problem by “investigating to determine the problem’s scope and root causes, conducting a scientifically sound risk assessment of its potential effects (including impact on data used to support submissions to FDA), and implementing a management strategy, including a global corrective action plan that addresses the root causes.” It adds that this “may include retaining a third-party auditor and removing individuals responsible for data integrity lapses from positions where they can influence CGMP-related or drug application data.” When the proportionate response starts involving a third-party auditor and personnel decisions rather than a retraining record, the matter is no longer a documentation error — and it is worth recognising that before an inspector does. In a GCP setting the same escalation logic applies through the inspection-finding classifications regulators use (MHRA, for example, classifies GCP inspection findings as Critical, Major or Minor), and preparing for how those are raised and answered is covered separately in CASRAI’s guide to GCP inspections and responding to a 483.
How documentation practice relates to validation
GDocP is the record-keeping layer beneath validation, not a part of it, and the three are easy to conflate. Validation asks whether a system or process reliably does what it is specified to do; documentation practice asks whether the evidence it produced can be trusted and reconstructed afterwards. A perfectly validated system still fails an inspection if its users share logins and back-date entries, and an impeccably kept notebook proves nothing about an instrument nobody qualified.
The governing document that scopes which systems get validated at all, and on what re-qualification cycle, is covered in CASRAI’s guide to the validation master plan for a regulated laboratory; the mechanics of qualifying a computerised system — GAMP 5 categories, IQ/OQ/PQ, user requirement specifications — are covered in the guide to computer system validation. For how the documentation expectations differ across the GxP disciplines rather than within one of them, see GxP compliance. This page deliberately does not restate any of those; it covers the layer they all sit on top of.
Frequently asked questions
Is “good documentation practices” a formal regulatory requirement?
There is no single regulation titled “Good Documentation Practices.” It is an industry-standard way of describing how to meet the documentation and data-integrity expectations embedded in ICH E6 GCP, FDA’s data-integrity guidance, and (for electronic records) 21 CFR Part 11. Inspectors and auditors assess GDP compliance by checking specific records against the ALCOA/ALCOA+ attributes, not against a “GDP regulation” as such.
What is the difference between ALCOA and ALCOA+?
ALCOA covers five attributes — Attributable, Legible, Contemporaneous, Original, Accurate. ALCOA+ adds four more — Complete, Consistent, Enduring, Available — as elaborated in MHRA’s 2018 GxP data integrity guidance. Both describe the same underlying goal; ALCOA+ simply makes several attributes explicit that were previously treated as implied by the original five.
Can a correction ever be made without dating and initialing it?
No. An undated or unattributed correction breaks the Attributable and Contemporaneous attributes even if the corrected value is accurate, and is a routine finding in monitoring visit reports and audits.
Does GDP apply to electronic records the same way it applies to paper?
Yes, with the mechanism shifted from handwriting conventions to system controls: a validated system with role-based access, time-stamped entries, and a locked audit trail (per 21 CFR Part 11 in the U.S.) is how ALCOA+ is enforced electronically instead of through a single-line-and-initial correction.
Is a reason required for every correction, or only sometimes?
It depends on the medium, and the two are commonly got backwards. On paper, EU GMP Chapter 4 §4.9 requires an alteration to be signed and dated and to leave the original readable, but qualifies the reason: “Where appropriate, the reason for the alteration should be recorded.” In a computerised system the expectation is unqualified — Annex 11 §9 states that “For change or deletion of GMP-relevant data the reason should be documented.” Recording a reason every time on paper is good practice and costs nothing; assuming paper is the stricter of the two is wrong.
What is the difference between a late entry and back-dating?
A late entry records honestly that it was written after the fact: it carries the actual date and time of writing, is labelled as a late entry, and states separately when the activity occurred. That is a documentation deviation a reviewer can assess and close. Back-dating writes an earlier date so the entry appears contemporaneous. The first is an error in following Chapter 4 §4.8; the second is a false statement about when the record was created, and it is treated as a data-integrity issue rather than a paperwork one. Training that says “never make a late entry” reliably produces back-dating instead.
Can I throw away a form I started filling in incorrectly?
No. FDA’s CGMP data-integrity guidance states that “Incomplete or erroneous forms should be kept as part of the permanent record along with written justification for their replacement.” Starting a fresh form is fine; the spoiled one is part of the record and must be retained with the reason it was replaced. The same guidance recommends issuing blank forms in numbered sets and reconciling them on completion, precisely so that a missing form is detectable.
When does a documentation error become a data-integrity finding?
When the record stops supporting reconstruction or stops telling the truth. The practical tests: can the original value still be read after the correction (Chapter 4 §4.9); does the record accurately state when it was made (§4.8) and by whom; was the superseded record retained; did your own review or audit-trail review detect it rather than the inspector; and is it isolated or a pattern across operators and batches. A useful secondary signal is the response the situation demands — FDA’s expectations for a genuine data-integrity problem run to scope-and-root-cause investigation, a risk assessment of the effect on submitted data, a global corrective action plan, and potentially a third-party auditor and personnel changes. If a retraining record clearly will not close it, it is not an ordinary error.
