In every FDA inspection, whether GCP, GMP, or GLP, the fundamental question is the same: can the organisation prove that what it says happened actually happened, in the way it says it happened, when it says it happened? That question is answered through evidence: source documents, audit trails, training records, batch records, deviation reports, and the systems that capture and protect them.
This practice test covers the ALCOA+ framework, audit trail requirements, 21 CFR Part 11, source data definitions, and advanced scenario-based questions drawn from the pattern of real FDA inspection findings. Work through each question before revealing the answer.
Section 1: Fundamentals
Question 1 | Beginner
What does the acronym ALCOA stand for in the context of GxP data integrity?
- A) Accurate, Legible, Compliant, Organised, Archived
- B) Attributable, Legible, Contemporaneous, Original, Accurate
- C) Auditable, Legible, Correctable, Organised, Accountable
- D) Attributable, Linked, Contemporaneous, Official, Accurate
Question 2 | Beginner
A clinical investigator documents a protocol deviation in the source record three weeks after it occurred, without noting that it is a late entry. Which ALCOA attribute does this most directly violate?
- A) Accurate
- B) Legible
- C) Contemporaneous
- D) Original
Question 3 | Beginner
Under GMP regulations, what does the phrase “if it isn’t documented, it didn’t happen” most accurately describe?
- A) A legal standard that allows inspectors to impose criminal penalties for missing records
- B) The regulatory expectation that actions and decisions must be proven through contemporaneous documentation
- C) An FDA policy that invalidates entire batches if any record is missing
- D) A GCP-specific rule that applies only to clinical trials
Section 2: Documentation and Records
Question 4 | Intermediate
An FDA inspector asks for documentation proving that a technician was trained on a specific SOP before performing a procedure. Which of the following constitutes acceptable evidence?
- A) The supervisor’s verbal statement that the technician completed training
- B) A training record signed and dated by both the technician and trainer, completed before the procedure date
- C) The technician’s email to the supervisor confirming they read the SOP
- D) The SOP itself, which the technician initialled on a sticky note
Question 5 | Intermediate
During an FDA GMP inspection, an inspector reviews a batch record and notices that an entry recording a critical measurement has been corrected by drawing a single line through the original entry, writing the correction next to it, and signing and dating the correction. Is this acceptable?
- A) No, corrections must always be made electronically to be valid
- B) Yes, this is the correct method for correcting a paper GMP record
- C) No, the entire page must be reprinted and re-signed
- D) Only acceptable if a supervisor also countersigns the correction
Question 6 | Intermediate
A clinical research site uses an electronic data capture (EDC) system for a clinical trial. An FDA inspector asks for the audit trail. What must the audit trail demonstrate?
- A) Only that the subject consented to the trial
- B) A chronological record of who created or changed each data entry, when, and what the original value was
- C) That all data was entered within 24 hours of each visit
- D) Only changes made after database lock
Section 3: Scenario-Based Questions
Question 7 | Advanced
During a routine monitoring visit, a clinical research associate (CRA) discovers that temperature logs for a trial medication storage unit are missing for a four-day period. The site coordinator says the logs exist but cannot locate them. What is the correct action?
- A) Accept the coordinator’s verbal assurance and document this in the monitoring report as “verbally confirmed”
- B) Document the finding as a monitoring observation, request written confirmation of the logs’ location within a defined timeframe, and escalate to the sponsor if not resolved
- C) Request that the site recreate the temperature logs from memory
- D) Close the finding if the medication was never removed from the storage unit during that period
Question 8 | Advanced
An FDA GCP inspector reviews a trial master file and finds that several serious adverse event (SAE) reports were submitted to the sponsor 20 or more days after the investigator first learned of the event, in violation of the 7- and 15-day reporting requirements. The investigator explains that the delays were due to high patient volume. How should this finding be characterised?
- A) An acceptable explanation: workload is a mitigating factor under ICH GCP
- B) A significant protocol deviation with potential for regulatory action regardless of workload explanation
- C) A minor finding if the SAEs were eventually reported with complete information
- D) Not a violation if the SAE narratives are accurate and complete
Section 4: Compliance Requirements
Question 9 | Intermediate
Under 21 CFR Part 11, what is a key requirement for electronic signatures in GxP records?
- A) Electronic signatures may only be used if the organisation has received prior FDA approval
- B) Electronic signatures must be unique to one individual and not reused by or reassigned to another person
- C) Electronic signatures require a physical token device in all cases
- D) Electronic signatures are only valid for internal documents, not submissions to FDA
Question 10 | Beginner
What does “source data” mean in the context of GCP?
- A) The original trial protocol, from which all other documents are derived
- B) All information contained in original records and certified copies used to reconstruct and evaluate a trial
- C) Only laboratory results generated during a clinical trial
- D) Electronic data only, as paper records do not qualify as source data under modern GCP
Section 5: Advanced Scenarios
Question 11 | Advanced
An FDA inspector discovers that a study site uses a shared administrator login for its EDC system, meaning multiple staff members use the same credentials to enter and modify data. How should this be characterised?
- A) No finding, as long as the shared login is documented in an SOP
- B) A minor observation that the site should resolve at the next protocol amendment
- C) A critical data integrity finding: shared logins make records non-attributable and violate 21 CFR Part 11
- D) Acceptable if the site can provide training records for each staff member who uses the shared login
Question 12 | Advanced
A company’s quality system flags a consistent pattern of deviation reports being submitted two to three weeks after the date of the deviation, across multiple product lines and departments. Each individual report is complete and accurate when submitted. What is the most appropriate characterisation of this pattern?
- A) No concern, since each individual report is complete and accurate when submitted
- B) A trend reporting concern: the systematic delay may indicate a cultural or systemic process failure that requires CAPA at the system level
- C) A minor finding limited to the departments involved
- D) Acceptable as long as deviations are reported within the same calendar month
Quick Reference: ALCOA+ Framework
Sources
- FDA, “Data Integrity and Compliance With Drug CGMP” (Guidance, 2018)
- ICH E6(R3) Good Clinical Practice Guideline (2023)
- 21 CFR Part 11: Electronic Records and Electronic Signatures
- 21 CFR 312.32: IND Safety Reporting
- FDA, “Inspection of Clinical Investigators” (Compliance Program 7348.811)
- MHRA, “GxP Data Integrity Guidance and Definitions” (2018)