Data integrity at reception
ALCOA+ and visitor records: data integrity at reception
For the QA manager at a pharmaceutical, food or cosmetics site who already thinks about records in ALCOA+ terms. Your batch records are held to those attributes, and the book at reception is usually not. Below, each attribute in the MHRA’s own words, what a paper book gives you against it, what a kiosk records, and what it does not.
Sign in on a demonstration kiosk, then open the fire roll call on your phone. Do not enter real details: everything typed is deleted within the hour.
From £150 a month plus VAT, iPad and stand included. We are not a validation consultancy.
The source
One free document, and what it covers
The MHRA’s ‘GXP’ Data Integrity Guidance and Definitions, Revision 1, March 2018, lists the attributes in section 6.1: data should be attributable, legible and permanent, contemporaneous, original or a certified true copy, and accurate, and data governance should make it complete, consistent, enduring and available. Section 3.10 says the “+” was added to emphasise the requirements, not to change them.
The honest framing
It says nothing about visitors
The guidance is for GXP data at organisations the MHRA regulates, and a visitor record is not named in it. What it gives a QA manager is a vocabulary for judging any record. A food or cosmetics site is outside its scope and may still borrow the words. This page applies them to the visitor record and claims nothing more.
Attribute by attribute
Nine attributes, and the visitor record against each
The quotation is the MHRA’s, from section 6.1 unless another section is named, read on26 September 2026. For the first five the guidance gives a word or a phrase and no further definition; the page quotes exactly what it gives.
Attributable
The guidance “attributable to the person generating the data” (6.1). 6.3 adds that metadata “permit data to be attributable to an individual (or if automatically generated, to the original data source).”
- A paper book
- A name in the visitor’s own handwriting, and sometimes a signature. Nobody checks either.
- The kiosk records
- The name, company and host the visitor entered, all three required, stored with the site and the iPad that took the sign in. Where the site has a staff list, the host is picked from it rather than typed.
- What it does not
- The kiosk records the name typed. It does not check who the person is. Photo ID, where your procedure needs it, is seen by a person at the desk.
Legible
The guidance “legible and permanent” (6.1).
- A paper book
- As legible as the handwriting and the pen. Pencil, smudges and a second line squeezed in are the usual problems.
- The kiosk records
- Typed text, stored in a database and read on screen or in an export. There is nothing to decipher.
- What it does not
- Permanent means for the retention period you set. After it the record is deleted automatically, on purpose.
Contemporaneous
The guidance The list in 6.1 gives one word, “contemporaneous”. 6.12 says: “Computer systems should be designed to ensure that the execution of critical steps is recorded contemporaneously.”
- A paper book
- Written at the time if the visitor fills it in at the door; after the fact if reception writes it up later.
- The kiosk records
- A live sign in is timed by the server’s clock at the moment it is received. A sign in taken while the Wi-Fi was down carries the iPad’s time, which is used if it is no more than seven days old and not in the future, and the server’s otherwise; the time the server received it is kept separately, so the delay is visible.
- What it does not
- The sign out time is set when the visitor signs out at the kiosk, when a member of staff signs them out on the dashboard, or by the automatic sign out at 23:59 UTC. The record does not say which of the three it was.
Original
The guidance “original record (or certified true copy)” (6.1). 6.11.1 defines the original record as “The first or source capture of data or information”.
- A paper book
- The book is the original, until a page is torn out or copied up neatly.
- The kiosk records
- The visitor’s entry at the kiosk is the first capture. The dashboard has no way to edit a visit’s name, company, host or sign in time. The wording the visitor accepted is stored by its fingerprint in a table that refuses edits.
- What it does not
- A visit can be deleted for an erasure request, which writes an audit entry without the name. The spreadsheet export is a copy, not a certified true copy.
Accurate
The guidance The list in 6.1 gives one word, “accurate”, and the guidance defines it no further.
- A paper book
- Whatever was written, including a first name only, a company abbreviated and a host misspelt.
- The kiosk records
- A fixed form: name, company and host required on every sign in, a vehicle registration if the visitor gives one. A sign in without acceptance of your wording is refused.
- What it does not
- The kiosk cannot tell a wrong name from a right one. A typing mistake stays on the record, because no one can edit it afterwards.
Complete
The guidance “the data must be whole; a complete set” (6.1).
- A paper book
- Complete if everybody signed, the pages are all there and the book was not left in the car.
- The kiosk records
- Every sign in lands in one register for the company, and every one carries its acceptance. A sign in taken while the Wi-Fi is down waits on the iPad and is sent when the connection returns.
- What it does not
- A delivery drop-off is logged separately and is not a sign in. Somebody who walks past the kiosk is not on the record at all; the kiosk records the people who use it.
Consistent
The guidance “the data must be self-consistent” (6.1).
- A paper book
- One column’s date format today, another tomorrow, and a clock that is whatever the visitor’s watch said.
- The kiosk records
- The same fields on every kiosk at every site, one clock for live sign ins, and times exported in UK time with the zone named in the column heading.
- What it does not
- Consistent with itself, not with anything else. The kiosk does not reconcile against your access control, your gate log or your CCTV.
Enduring
The guidance “durable; lasting throughout the data lifecycle” (6.1).
- A paper book
- As durable as the box it is stored in, and kept for as long as nobody clears the cupboard.
- The kiosk records
- Held in a database in the European Union, in Ireland, for one retention period you set for the company, from one day to two years, a year if you set nothing, then deleted automatically overnight. The stored wordings are kept until you stop being a customer.
- What it does not
- A change to the retention setting is not written to an audit trail, and nor are our other administrative actions. We operate the database, and a change made there by us would not appear in the record either.
Available
The guidance “readily available for review or inspection purposes” (6.1).
- A paper book
- Available to whoever can find the right book and the right page.
- The kiosk records
- Searched by name, company or host and filtered by date on the dashboard, exported as a spreadsheet, with the accepted wording opened per visit. Asked for a week you no longer hold, the dashboard says the records are gone rather than showing an empty week.
- What it does not
- Available while you are a customer and within the retention period. Export what you need to keep on your own terms before either ends.
Being straight with you
What this page does not claim
- The MHRA guidance is written for industry the MHRA regulates, across GMP, GDP, GLP, GCP and pharmacovigilance, and it says it does not extend to medical devices. It says nothing about visitor records. Whether a visitor record is GXP data at your site is a decision for your quality system.
- The kiosk has not been validated as a computerised system under EU GMP Annex 11, and there is no validation pack to send you.
- The guidance defines an audit trail, in 6.13, as metadata about actions “that relate to the creation, modification or deletion of GXP records”. The kiosk records when a visit was created and records an erasure. It does not record who signed a visitor out, and there is no edit to record.
- Nothing here makes a record ALCOA compliant, and nothing makes a site compliant, certified or inspection ready. This page describes what each attribute means and what is recorded; your QA function and your inspector decide the rest.
How the accepted wording is keptHosting, sub-processors and access
For your site
Where the visitor clauses are
ALCOA+ is about the record. The clauses that ask for visitor control in the first place are in your own standard, and each has a page that quotes it.
EU GMP 2.13: visitors in production areasPharmaceutical and life sciences sitesFood manufacturing sitesHow long to keep visitor records, by standardEvery standard on one page
Before you ask
Four questions a QA manager asks
What does ALCOA+ stand for?
Attributable, legible, contemporaneous, original and accurate, plus complete, consistent, enduring and available. The MHRA’s ‘GXP’ Data Integrity Guidance and Definitions, Revision 1, March 2018, section 3.10, says there is no difference in expectations whichever acronym is used. Read on gov.uk on 26 September 2026.
Does the MHRA guidance cover visitor records?
It does not mention them. It applies to GXP data at MHRA regulated organisations. A QA team may still choose to hold its visitor record to the same attributes, and this page sets out what a kiosk record gives against each one.
Can a visitor record on the kiosk be edited after it is made?
There is no edit on the dashboard for a visit’s name, company, host or sign in time. A visitor can be signed out, and a visit can be deleted for an erasure request, which is logged without the name. The accepted wording is stored in a table that refuses edits from every role.
Does the kiosk verify who the visitor is?
No. It records the name the visitor typed, the company and the host, with the time and the wording they accepted. If your procedure needs photo ID checked, a person at the desk does it.
Source: MHRA, ‘GXP’ Data Integrity Guidance and Definitions, Revision 1, March 2018, free on gov.uk, read on 26 September 2026.
Also asked of sites like yours
The other things somebody may ask you to evidence
Each of these is a page about one standard, one duty or one visitor, written the same way as this one: what it actually asks for, what an iPad at reception records towards it, and where it does not help.
- GDPR and the visitor book
- CMMC physical security
- List X visitor control
- ITAR visitor log
- Def Stan 05-138 visitor access
- ISO 27001 visitor access
- PCI DSS visitor log
- AEO visitor access control
- CTPAT visitor log
- TISAX visitor management
- TAPA FSR visitor log
- BRCGS visitor control
- BRCGS packaging visitor control
- BRCGS storage and distribution visitors
- BRCGS unannounced audit
- Visitor control non-conformity
- SALSA visitor control
- IFS Food visitor hygiene
- UFAS feed mill visitor control
- GMP visitors in production areas
- GDP wholesale visitor control
- Fire roll call
- Contractor management
- Construction work in occupied premises
- HSE inspection records
- ISO 45001 contractor control
- Visitor NDA sign in
- Visitor record retention
- What a visitor log must contain
- Standards calendar
- Sign in sheet template
- Visitor health questionnaire template
- Contractor induction template
- Permit to work template
- Hot work permit template
- Fire drill record template
Next step
Bring your data integrity questions to the call
Fifteen minutes on the phone. Tell us how your QA team judges a record, and we will tell you straight what the visitor record gives you and where it stops.
Book a 15 minute callNo site visit needed and nothing to install. If it is not a fit we will say so on the call.
Would rather email? [email protected]
Not the person who signs it off? Send them the one page business case