Matrix: ALCOA+ Multi-System Data Integrity Scorecard and Remediation Register

This is a ready-to-use portfolio scorecard. It does not replace the per-system ALCOA+ self-assessment checklist, which scores one system against all nine principles in detail. This matrix takes the output of every completed self-assessment and rolls it up into one view across the whole GxP system inventory, so gaps can be risk-ranked and prioritized against each other rather than managed one binder at a time. Replace every <<FILL: ...>> placeholder with your own specifics. A worked filled specimen follows the template. Verify each cited regulation against the current source before you rely on it.

Document control header

Purpose

A single system’s ALCOA+ self-assessment tells you whether that system is trustworthy. It does not tell you whether the data integrity program as a whole is improving, which systems carry the highest residual risk, or whether the same principle keeps failing across many systems, which would point to a program-level root cause rather than a series of unrelated local ones. This scorecard closes that gap: it is the artifact a data integrity lead brings to management review to answer “where do we actually stand.”

How to use this scorecard

1. Populate one row per GxP system from its most recent completed ALCOA+ self-assessment checklist. Do not score a system here that has not been individually assessed; this matrix aggregates, it does not substitute.
2. Mark each of the nine principle columns OK (no open gap), Gap (open gap, any risk level), or N/A, matching the underlying assessment.
3. Compute the system risk rank from the highest-risk open gap on that system, not an average across principles; one high-risk gap makes the system high risk regardless of how many other principles pass.
4. Carry every open gap into the remediation register (section 2) with an owner and due date.
5. Refresh on the defined cycle and immediately whenever a new or updated per-system assessment closes.
6. Present the summary (section 3) at management review.

1. Portfolio scoring matrix

OK = no open gap. Gap = open gap (any risk level, detailed in section 2). N/A = principle does not apply to this system’s record type.

2. Remediation register

One row per open gap, sourced from the individual system assessments. This is the register that turns the matrix into action rather than a status report.

3. Management review summary

Program-level pattern check. If the same principle recurs as a gap across multiple, otherwise unrelated systems, treat it as a program-level finding, not a coincidence of several local ones. A recurring Attributable gap across three lab systems usually means the site’s account-provisioning process is the actual root cause, and the fix belongs at that level, not as three separate local CAPAs that each leave the process gap in place. Record any such pattern here and route it to a program-level CAPA.

4. Acceptance criteria

• Every system in the current GxP inventory has a row, or its absence is explained (for example, newly commissioned, assessment scheduled).
• Every Gap marked in section 1 has a corresponding entry in the remediation register with an owner, a risk rating, and a due date.
• The system risk rank reflects the highest-risk open gap on that system, not an averaged score.
• Any principle recurring as a gap across multiple systems is flagged as a program-level pattern, not left as isolated line items.
• The summary in section 3 was presented at management review within <<FILL: number>> days of the refresh.

References

21 CFR Part 211 (drug CGMP: 211.68, 211.180, 211.188, 211.194). 21 CFR Part 11 (electronic records and signatures). EU GMP Annex 11 (computerized systems). ICH Q9, Quality Risk Management (risk ranking). ICH Q10, Pharmaceutical Quality System (management review as a continuous quality system element). MHRA “GXP Data Integrity Guidance and Definitions” (March 2018). PIC/S PI 041 (good practices for data management and integrity).

Confirm the current version and clause numbers of each reference before issue.

Revision history

Approvals

Filled specimen

Illustrative rollup across three systems. Replace with your own.

Portfolio scoring matrix:

Remediation register (extract):

Management review summary:

Program-level pattern check: Attributable failed on both the CDS and the EM spreadsheet this period, both traced independently to the same root cause, no named-account provisioning step existed in the onboarding process for lab-floor instrument accounts. Rather than close G1 and part of G3 as two unrelated local fixes, a program-level CAPA was opened against the account-provisioning procedure itself, referenced from both G1 and G3.

This is the difference a rollup makes: read individually, G1 and G3’s attribution gaps look like two separate instrument problems. Read together, they point at one broken process behind both of them, and only the portfolio view surfaces that.

Common inspection findings this scorecard prevents

• A site with several completed per-system ALCOA+ assessments but no view of the portfolio, so a recurring gap across systems is never connected to its shared root cause.
• Remediation tracked informally per system, with no single register an inspector or a management review can pull to see total open risk.
• A data integrity program that can produce individual checklists but cannot answer “how many high-risk gaps are currently open across the site” without a manual count.
• Gaps closed locally that reappear on the next system because the underlying process cause was never fixed at the program level.

How to adapt this scorecard

1. Set your document number, owner, and refresh cycle in the header.
2. Populate section 1 from your actual GxP system inventory; do not hand-score a system here without a completed underlying assessment.
3. Set your own system risk-ranking rule in section 1 if you use a different scheme than “highest single gap sets the rank.”
4. Feed every remediation action into your real deviation or CAPA system in addition to the register here, so remediation is tracked to effectiveness, not just logged.
5. Confirm every regulation in the references against the current published version before issue.