IMGIAINFO

Data integrity

What
ALCOA++ means

It is the data-integrity rule that governs everything we deliver. It comes from the ALCOA+ standard — the nine attributes expected of a record in a regulated environment — which we write and apply with two plus signs, the way we write it on all our documents.

The nine attributes

A record must be able to answer on its own

AttributableWe know who wrote it, and from which machine.
LegibleThe data stays readable for its whole life.
ContemporaneousWritten when the action happens, never afterwards.
OriginalThe original data — not a copy retyped later.
AccurateThe real value, without retouching.
CompleteIncluding what failed, was refused or was cancelled.
ConsistentThe same rules everywhere, in the order of events.
EnduringThe trace outlives the machine, the software and the years.
AvailableReadable and exportable on an inspector's request.

The trace

What every entry carries

Who a named user, never a shared account
Where from the machine, identified by its key
What the action taken
Before the value that existed
After the value written
Why the reason
When a precise UTC timestamp
Result success or failure — both are written

Append-only

You add, you never erase. A previous value cannot disappear from the record.

An entry even on failure

A refused login, a rejected rule, an invalid entry: the event leaves a trace.

Chained

Every entry depends on the previous one. Editing, moving or inserting something shows.

The texts

What the four jurisdictions require

All four are technologically neutral: they state what the record must say, never the brand of the tool.

United States — FDA

21 CFR Part 11: functional requirements. A secure, computer-generated, time-stamped audit trail that does not obscure or erase the previous value. Electronic signatures unique to one individual, using two components.

China — NMPA

Records and data management, 2020 announcement No. 74: management and technical measures so that information is true, accurate, complete and traceable. An electronic record must at least equal the function of paper.

Japan — PIC/S

PI 041-1 (“Good Practices for Data Management and Integrity”, in force since 1 July 2021) and its nine attributes, plus the guideline on electronic records and signatures.

Canada — Health Canada

The Health Canada data-integrity guidelines, the same ALCOA family. Worth noting: Canada co-sponsors the CMVP with NIST, so a FIPS-type request can come from a Canadian client.

Straight talk

What we say plainly

  • A hash chain detects, it does not prove. The hash is recomputable by anyone who can write the file: change a line, recompute the chain, and the verification passes. Non-repudiation needs a signature that requires a secret. We say this rather than selling a chain as proof.
  • No approved-hardware list exists in these regulations. What exists are lists of certified cryptographic modules — FIPS 140-3 (the NIST CMVP, co-sponsored by Canada) and Common Criteria — which some quality departments like to cite. The real subject is elsewhere.
  • A SHA-1 era chip cannot be defended — not because it is absent from a list, but because SHA-1 was withdrawn from the algorithms approved for signatures. SHA-1 in an identity chain does not stand in front of an inspector.
  • An exception must be dated, justified and closed. Any list that lets a machine in without an identity is an audit finding in itself.
  • A shared account traces nobody. The administrator role stays, but it is carried by named accounts — one per employee, on the workstation as well.
Ask a question An LLM in the loop