Data Integrity in a COA: Can the Raw Data Be Produced?

A certificate of analysis is one page. Behind it sit a balance printout, a dilution scheme, a chromatographic sequence, an integration review and an audit trail. When a buyer accepts the page and never asks about the rest, the acceptance rests on the assumption that the rest exists and agrees with it. Most of the time the assumption is correct. The reason to test it occasionally is that the exceptions are expensive.

Data integrity is not a separate quality topic bolted onto the certificate. It is the question of whether the number on the page can be traced back to an observation, by a named person, at a recorded time, without gaps.

What raw data means in a chemistry laboratory

The term covers more than buyers expect. For a chromatographic assay it includes the injection sequence, the raw detector signal, the integration parameters, the calibration curve and the system suitability record. For a titration it includes the weighed masses, the burette readings, the electrode calibration and the calculated result with its formula. For a loss-on-drying test it includes the balance printout and the oven record.

None of these is exotic. All of them are generated routinely. The question is whether they are retained in a form that can be produced, or whether they are overwritten, exported to a summary and discarded.

Four requests that test the trail

You do not need an audit to form a view. Four requests, made once at qualification, will tell you most of what an inspection would find.

Request	What a good answer shows	What a weak answer reveals
The chromatograms for the assay and the impurity test	Full traces with integration marks and peak tables	A summary table, or a re-plotted image without integration
The sequence file for that batch	Injection list matching the report, including any failed injections	Only the passing injections, with no explanation for the others
The audit trail for the analysis date	Continuous record from sample login to approval	A trail that starts at the review step
The calculation for one result	Weights, dilutions, purity of the standard, the formula used	A result with no arithmetic behind it

Each request is small. Together they establish whether the laboratory works from records or from memory.

ALCOA in ordinary language

The acronym is often recited and rarely applied. Stripped of the formalism, it asks five things. Who did it. Can it be read. Was it written when the work happened. Is it the first record rather than a later reconstruction. And does it match what actually occurred.

The extended version adds that records should be complete, consistent, enduring and available. In practice the failures cluster on the last three. A record that is complete today but deleted after the batch is released was never enduring. A record that exists on one analyst's laptop was never available.

Why the PDF is the weakest object in the file

A PDF certificate is a rendering. It carries no audit trail, no sequence and no integration. It can be produced accurately from a controlled system, and it can be produced just as convincingly from a spreadsheet typed by hand.

That is why the certificate is the right object for routine release and the wrong object for qualification. At qualification you are not checking a number, you are checking whether the organisation that produced the number can reproduce its own work.

The distinction buyers confuse: poor data versus poor process

A batch can be perfectly good and its documentation poor. A batch can also be poor and its documentation impeccable. These are different risks and they need different responses.

Poor documentation with good material is a systems problem, correctable, and often correctable quickly. Poor material with good documentation is a much worse signal, because it means the records were produced independently of the work. The second is rare and it is the reason due diligence exists.

What to ask for at qualification, and what to ask for later

At qualification, ask for the four items above for a single batch. Once. It is a bounded request and a serious supplier can meet it.

At routine release, ask for nothing beyond the certificate. Repeatedly requesting raw data signals distrust and consumes goodwill that is better spent on the one occasion when you need cooperation quickly.

During an investigation, ask for everything relevant and set a date. That is the moment when access matters, and a supplier that has already demonstrated the trail once will find the second request easy.

Red flags worth remembering

Integration parameters in the report that do not match the chromatogram. A sequence with more injections than the report accounts for. An audit trail that begins at the review step. A calculation whose standard purity differs from the one on the standard's own certificate. A result reported to four decimal places from a balance that reads to four places.

None of these proves misconduct. Each of them indicates that the record was assembled rather than generated, and assembly is where errors enter.

Why this matters more for a small buyer

A large buyer can send an auditor. A small buyer cannot, and is therefore more dependent on documents than on inspection. That asymmetry is exactly why the four requests are worth making at least once, on the batch that establishes the relationship.

The answer tells you what kind of supplier you have. The material tells you what kind of batch you have. You need both, and the certificate only gives you the second.

How to ask without triggering a refusal

Ask for a defined package for one batch, at qualification, and say why. A request framed as "we are qualifying you as a source and need to see the data trail for one batch" is answerable. A request framed as "send us your raw data" is not, because it has no boundary and reads as an audit.

Offer the same in return if you hold regulated data of your own. Reciprocity changes the tone of the exchange more than any clause does, and it costs nothing.

Three articles here support the same review. The twelve-point consistency check catches the errors that survive at summary level. Reading a certificate line by line covers what each field is supposed to mean. And what a contract laboratory can cover explains which parts of a file may sit outside the supplier's own site.

Where the expectations originate

The expectation that records be attributable, legible, contemporaneous, original and accurate is set out in the good manufacturing practice guides that inspection bodies apply. The Pharmaceutical Inspection Co-operation Scheme publishes the guides most authorities use in common. The European Medicines Agency publishes the EU position, and the US Food and Drug Administration has published guidance specifically on data integrity and on the use of electronic records.

A buyer does not need to cite any of them. It is enough to know that a request for the underlying record is a normal question with a normal answer, not an accusation.

What a reviewed record looks like

A reviewed chromatographic record carries the analyst's identity, the review date, the integration parameters actually used, and any manual integration with a reason. The audit trail runs from sample login to approval without a gap. The calculation shows the weights, the dilutions and the assigned purity of the standard.

That is a short list, and it is what distinguishes a laboratory working from records from one working from memory. The difference is not visible on any certificate, which is exactly why it is worth checking once, early, while the relationship is still cheap to end.

What to do with the answer

If the four requests are met, record what you received and move on. The file now contains evidence that the trail exists, and the next request, should one be needed, will be easier because the first one was ordinary.

If they are partly met, note which one was missing. A missing chromatogram is a different finding from a missing audit trail. The first may be a filing habit. The second is a system that does not record what happens.

If they are refused outright, the useful move is not to escalate. It is to decide whether the material is important enough to justify accepting an unverified trail, and to write that decision down with the reason. A documented acceptance of a known gap is a defensible position. An undocumented one is a surprise waiting for the person who inherits the file.

The asymmetry that makes this worth doing

Asking costs a supplier relationship some goodwill. Not asking costs a buyer the ability to distinguish between two suppliers who look identical on paper. Since the entire purpose of qualification is to distinguish, the goodwill is well spent once, at the start, on a bounded request.

Repeat it annually on a single batch and it stops being a request at all. It becomes a routine that both sides expect, and routines are cheap.

Frequently asked questions

What counts as raw data in a pharmaceutical laboratory?

Everything that records the original observation: chromatograms, sequence files, balance printouts, titration curves, instrument audit trails, and the workbook pages where weights and dilutions were written. A PDF report is a summary of these, not a substitute for them.

Can a supplier refuse to share raw data?

At routine release, yes, and reasonably so, because the data belong to the batch file and contain process information. At qualification, during an investigation, or under a quality agreement that provides for access, refusal becomes a substantive answer about the system rather than a confidentiality position.

What does ALCOA actually require?

That records are attributable to a person, legible, contemporaneous with the work, original, and accurate. The extended form adds complete, consistent, enduring and available. The four that fail most often in practice are contemporaneous, original, enduring and available.

Is an electronic signature enough?

It is enough only if the system behind it enforces attribution and prevents silent deletion. A signature applied to a spreadsheet exported as PDF proves that somebody approved a summary. It says nothing about who generated the underlying numbers or whether they were edited.

What is a typical red flag in a document trail?

Chromatograms whose integration parameters differ between the original and the report, sequence files with more injections than the report shows, and audit trails that begin after the analysis rather than at sample login. Each of these indicates a review step that happened outside the record.

Does this apply to a non-regulated grade?

The formal expectations are tied to regulated use, and a research-grade material will not carry the same file. The practical question does not change: if the number matters to your decision, you should know whether it can be traced to an observation. That is true of a research reagent and of an API alike.