Good documentation practices under FDA 21 CFR are the recordkeeping rules that pharmaceutical and medical device manufacturers must follow when creating, correcting, signing, and retaining records that show a product was made and tested correctly. The requirements sit across several parts of Title 21: Part 211 for drug production and laboratory records, Part 820 for medical device records, and Part 11 for electronic records and signatures. The core principle across all of them is that a record must be trustworthy on its face, and if it wasn’t documented properly, from the FDA’s perspective it didn’t happen.
The ALCOA+ Data Integrity Standard
FDA investigators evaluate records against the ALCOA+ framework, which the agency ties to its Data Integrity Guidance and to specific regulations including 21 CFR 211.68(b) and 211.180(c).1Food and Drug Administration. Quality Essentials: Inspectional Coverage of QMS and Data Integrity Each element maps to a concrete recordkeeping expectation:
- Attributable. Every entry identifies who recorded it, whether by initials next to a paper entry or a user ID logged by an electronic system.
- Legible. Handwriting is readable, and entries are permanent rather than in pencil or erasable ink.
- Contemporaneous. Data is recorded at the moment the action happens, not reconstructed later.
- Original. The first-captured version is what counts, such as a raw chromatogram, an instrument printout, or a signed logbook page. Certified true copies are acceptable when originals aren’t practical to retain.
- Accurate. The recorded value reflects what was actually observed or measured, without selective rounding or omission.
The “+” adds four supplementary elements. Records must be Complete, with no missing fields, blanks, or absent units. They must be Consistent, so dates, times, and sequences across related documents line up. They must be Enduring for the full retention period, and Available for retrieval whenever an inspector or auditor asks.1Food and Drug Administration. Quality Essentials: Inspectional Coverage of QMS and Data Integrity
Rules for Paper Records and Corrections
Handwritten entries must use permanent, indelible ink. Pencils, correction fluid, and anything that could obscure an original entry are prohibited.2U.S. Food and Drug Administration. Good Documentation Practices
When you make a mistake, draw a single thin line through the error so the original entry remains fully readable. Write the correct value next to it, then add your initials, the date, and a reason for the change. The reason can appear beside the correction or as a coded footnote referencing a separate explanation. Writing over an entry, covering it with an adhesive label, or tearing out a page is never acceptable.
Production and Laboratory Records for Drug Products
Part 211 splits drug manufacturing documentation into two tiers: master records that define how a product should be made, and batch records that prove each specific lot was actually made that way.
Master Production Records
A master production record must be prepared, dated, and signed by one person, then independently checked, dated, and signed by a second person. The dual signature exists because an error in the master would carry into every batch made from it.3eCFR. 21 CFR 211.186 – Master Production and Control Records
The record must include the product name and strength, the weight or measure of each active ingredient, a full list of components, theoretical yield ranges, a description of containers and packaging materials, and complete manufacturing instructions including sampling and testing procedures.4eCFR. 21 CFR 211.186 – Master Production and Control Records
Batch Production Records
Each batch gets its own record, which starts as an accurate reproduction of the master and then captures what actually happened during manufacturing. The batch record must document the date of each significant step, the major equipment and production lines used, the specific lot number of each component, actual weights and measures, in-process test results, and actual yield compared to theoretical yield.5eCFR. 21 CFR 211.188 – Batch Production and Control Records
The record must also identify the person who performed each significant step and the person who supervised or checked it. Where automated equipment handles a step, the record identifies whoever verified the equipment’s output.5eCFR. 21 CFR 211.188 – Batch Production and Control Records
Laboratory Records
Every test performed on a drug product must generate a record that describes the sample (source, quantity received, lot number, dates taken and received), the testing method used, the amount of sample used, all raw data including instrument printouts and spectra, any calculations performed, and a comparison of the result against established standards.6eCFR. 21 CFR 211.194 – Laboratory Records
The analyst who runs the test signs and dates the record, and a second qualified person independently reviews the original records for accuracy, completeness, and compliance with standards.6eCFR. 21 CFR 211.194 – Laboratory Records
Batch Release Review
Before a batch can be released or distributed, the quality control unit must review and approve all production and control records, including packaging and labeling records, to confirm the batch complied with every established written procedure.7eCFR. 21 CFR 211.192 – Production Record Review A batch with incomplete or contradictory documentation cannot be released, regardless of whether the product itself is physically acceptable.
Electronic Records Under 21 CFR Part 11
Part 11 sets the conditions under which electronic records and electronic signatures are treated as trustworthy and equivalent to paper. It focuses on closed systems where access is controlled by the organization that owns the records, which covers most pharmaceutical and device manufacturing environments.8eCFR. 21 CFR 11.10 – Controls for Closed Systems
Validation and Access Controls
Any computer system used to create, modify, or store regulated records must be validated to ensure it performs accurately and reliably and can detect invalid or altered records. Validation must be revisited after upgrades, patches, or configuration changes.8eCFR. 21 CFR 11.10 – Controls for Closed Systems
Access is limited to authorized individuals through unique credentials. Part 11 also requires authority checks that go beyond login: the system must ensure that only specific people can sign a record, alter data, or access particular input and output functions. Terminal-level checks can verify the validity of a data source or an operational instruction.8eCFR. 21 CFR 11.10 – Controls for Closed Systems
Audit Trails
Part 11 requires secure, computer-generated, time-stamped audit trails that independently record the date and time of every action creating, modifying, or deleting an electronic record. Changes cannot obscure the previously recorded information. The audit trail must be retained for at least as long as the underlying record and must be available for FDA review.8eCFR. 21 CFR 11.10 – Controls for Closed Systems This is the electronic counterpart of the single-line correction rule for paper.
Other System Controls and Backups
Part 11 also requires operational system checks that enforce the correct sequence of steps in a process, written policies holding individuals accountable for actions taken under their electronic signatures, and controls over systems documentation, including version-controlled records of system changes. The system must be able to generate accurate, complete copies of records in both human-readable and electronic form for FDA inspection.8eCFR. 21 CFR 11.10 – Controls for Closed Systems
For drug products, 21 CFR 211.68 additionally requires backup files of electronically stored data. Backups must be exact and complete and protected against alteration, accidental deletion, or loss.9eCFR. 21 CFR 211.68 – Automatic, Mechanical, and Electronic Equipment
Electronic Signature Requirements
An electronic signature under Part 11 is more than a typed name in a field. Each signature must be unique to one individual and cannot be reused or reassigned. Before allowing a person to use an electronic signature, the organization must verify that person’s identity.10eCFR. 21 CFR 11.100 – General Requirements
Every signed electronic record must display three things: the signer’s printed name, the date and time the signature was executed, and the meaning of the signature, such as review, approval, responsibility, or authorship. These elements are subject to the same controls as the record itself and must appear in any human-readable version, whether on screen or printed.11eCFR. 21 CFR 11.50 – Signature Manifestations
Organizations must also formally certify to the FDA that their electronic signatures are intended to be the legally binding equivalent of handwritten signatures. The certification itself must be signed by hand and submitted in paper or electronic form.10eCFR. 21 CFR 11.100 – General Requirements An absent certification letter can itself become an inspection finding.
Record Retention Periods
Retention rules differ for drug products and medical devices, and the clocks start at different points.
Drug Products
Production, control, and distribution records tied to a specific batch must be retained for at least one year after that batch’s expiration date. For certain over-the-counter products exempt from expiration dating, the retention period is three years after distribution of the batch.12eCFR. 21 CFR 211.180 – General Requirements
Records must be readily available for inspection at the facility where the documented activities occurred. Records stored electronically or at a remote location satisfy this requirement only if they can be immediately retrieved on request.12eCFR. 21 CFR 211.180 – General Requirements If retrieving a batch record means calling a warehouse to ship a box, that does not meet the standard.
Medical Devices
All records required under Part 820 must be retained for a period equivalent to the design and expected life of the device, but never less than two years from the date the device was released for commercial distribution.13eCFR. 21 CFR 820.180 – General Requirements For implants and other devices with long service lives, that can mean a decade or more.
As of February 2, 2026, Part 820 has been substantially revised under the Quality Management System Regulation (QMSR), which incorporates ISO 13485:2016 by reference. The revised regulation keeps specific record requirements for complaints, servicing activities, and unique device identification under Section 820.35, and points to ISO 13485 for the broader quality management system framework.14U.S. Food and Drug Administration. Quality Management System Regulation (QMSR) Device manufacturers should read both the revised Part 820 text and the referenced ISO 13485 clauses to confirm their documentation systems still meet current requirements.
Personnel Qualifications and Training
Documentation only works when the people creating records understand the rules. Under 21 CFR 211.25, every person involved in drug manufacturing must have sufficient education, training, and experience to perform their assigned functions. Training must cover both the specific operations the employee performs and the current good manufacturing practice requirements relevant to their role, and must be conducted by qualified individuals on a continuing basis with enough frequency to keep employees current.15eCFR. 21 CFR 211.25 – Personnel Qualifications
Part 11 adds that anyone who develops, maintains, or uses an electronic record or signature system must have the education, training, and experience needed for their assigned tasks.8eCFR. 21 CFR 11.10 – Controls for Closed Systems System administrators, IT staff, and end users all need role-appropriate training, and that training itself must be documented.
What Happens When Documentation Fails
Documentation and data integrity deficiencies are among the most frequently cited issues in FDA inspections. When an investigator identifies a violation, it is documented on an FDA Form 483 as an inspectional observation, and the company is expected to respond with corrective actions.
If the response is inadequate, or if the violations are serious enough, the FDA can escalate to a warning letter, a public document signaling that the agency considers the company in significant violation of federal regulations. Repeated or egregious documentation failures have led to import alerts blocking products from the U.S. market, consent decrees placing manufacturing operations under court supervision, and product recalls driven not by a confirmed quality defect but by the inability to prove the product was manufactured correctly. The FDA maintains a public database of data integrity notifications for drug products.
A single instance of backdating a logbook entry or deleting an audit trail record can trigger a broader investigation that calls the integrity of every record at the facility into question.