21 CFR part 11
What it is 21 CFR part 11:
21 CFR Part 11 is a regulation issued by the U.S. Food and Drug Administration (FDA) that sets forth the criteria under which the agency considers electronic records, electronic signatures, and handwritten signatures executed to electronic records to be trustworthy, reliable, and equivalent to paper records and handwritten signatures.
Core Philosophy: Trustworthiness and Integrity
The regulation is not about specific technologies but about the principles of data integrity—often summarized by the acronym ALCOA+:
- Attributable: Who created, modified, or deleted the record and when?
- Legible: Can the data be read and understood throughout its retention period?
- Contemporaneous: Was the record created at the time of the activity?
- Original: Is this the source data or a verified copy?
- Accurate: Is the data free from errors?
- Complete: All data is present, including any repeats or re-analyses.
- Consistent: Data is recorded in a sequential, timestamped manner.
- Enduring: Lasting for the required record retention period.
- Available: Can be retrieved for review and inspection over its lifetime.
Scope and Application
Part 11 applies to records that are:
- Required by FDA predicate rules (e.g., Good Laboratory Practices (GLP), Good Clinical Practices (GCP), Good Manufacturing Practices (GMP)).
- Submitted to the FDA in electronic format, even if the predicate rule does not explicitly require the record to be maintained.
Key Conceptual Pillars:
- Electronic Signatures: Must be legally binding and equivalent to handwritten signatures. This includes unique identification, non-repudiation, and preventing falsification.
- Audit Trails: Secure, computer-generated, time-stamped electronic records that independently track the creation, modification, or deletion of electronic records.
- System Validation: Confirmation through documented evidence that a computer system consistently does what it is designed to do in a reproducible and reliable manner.
- Limited Access & Security: Ensuring that only authorized individuals can access the system or perform specific functions.
Roadmap: The Strategic Path to Part 11 Compliance
This roadmap is designed for life sciences organizations (pharma, biotech, medical device) implementing new systems or bringing existing ones into compliance.
Phase 1: Initiation & Scoping (Months 1-2)
- Objective: Define the scope and build the foundation.
- Activities:
- Governance Establishment: Form a cross-functional team (Quality, IT, Business Process Owners, Regulatory Affairs).
- System Inventory & Categorization: Identify all computerized systems that handle GxP (GCP, GLP, GMP) data. Categorize them based on risk (e.g., High – Directly impacts product quality, Medium – Supports quality processes, Low – Administrative).
- Part 11 Applicability Assessment: For each system, determine if it falls under Part 11 based on predicate rule requirements.
Gap Analysis (High-Level): Conduct a preliminary assessment against Part 11 requirements to understand the scale of the effort.
Phase 2: Planning & System Assessment (Months 2-4)
- Objective: Develop a detailed plan and understand specific gaps.
- Activities:
- Detailed Gap Analysis & Risk Assessment: Perform a deep-dive into each “in-scope” system. Use a checklist against Part 11’s subparts (A – General Provisions, B – Electronic Records, C – Electronic Signatures).
- Remediation Plan Development: Create a prioritized list of actions to address gaps. High-risk gaps (e.g., no audit trail, shared user accounts) must be addressed first.
- Validation Master Plan (VMP) / System-Specific Plan: Update or create a VMP that outlines the overall validation strategy, including Part 11 requirements.
- Policy & Procedure Development/Update: Draft or revise SOPs for System Use, Electronic Signatures, Data Backup & Recovery, Audit Trail Review, and System Security.
Phase 3: Implementation & Remediation (Months 4-12+)
- Objective: Execute the remediation plan and implement controls.
- Activities:
- System Configuration: Configure the software to enforce Part 11 controls (e.g., enable robust audit trails, enforce password policies, set up user roles and access privileges).
- Technical Remediation: Develop custom solutions if needed (e.g., building an interface to ensure data integrity, implementing a digital signature solution).
- Procedure Roll-out: Train all relevant users on the new/changed SOPs, especially regarding electronic signatures and audit trail review responsibilities.
- Execution of Validation Protocols: Perform Installation Qualification (IQ), Operational Qualification (OQ), and Performance Qualification (PQ) for new or significantly updated systems, with specific test cases for Part 11 functionality.
Phase 4: Verification & Monitoring (Ongoing)
- Objective: Confirm compliance and establish ongoing oversight.
- Activities:
- Internal Audits: Conduct regular audits of computerized systems and processes to ensure continued compliance.
- Periodic Review: Re-evaluate systems periodically (e.g., annually) to ensure they remain in a validated state and that processes are being followed.
- Audit Trail Review: Execute the SOP for regular (e.g., every batch, every study) review of critical data and its associated audit trails by process owners.
Phase 5: Maintenance & Continuous Improvement (Ongoing)
- Objective: Sustain compliance and adapt to changes.
- Activities:
- Change Control: Manage any changes to the system (software, hardware, configuration) through a formal change control process that includes a Part 11 impact assessment.
- Training Maintenance: Ensure new employees are trained and existing employees receive refresher training.
- Management Review: Report on the state of compliance and any data integrity issues to management.
Process: The Operational Workflow for Part 11 Compliance
This process outlines the lifecycle of an electronic record under a Part 11-compliant system.
- User Access & Authentication:
- A user requests access to a Part 11 relevant system.
- Their identity is verified, and they are granted access based on their role (separation of duties).
- The user logs in with a unique username and password (or biometrics). Passwords must be periodically changed.
- Record Creation & Modification:
- The user creates or modifies an electronic record (e.g., enters lab data, approves a batch record).
- The system automatically generates an audit trail entry capturing:
- Who (user identity)
- What (action taken, e.g., “Value changed from 5.0 to 5.1”)
- When (date and timestamp)
- Why (reason for change, if required by predicate rule)
- The record is saved with its audit trail inextricably linked.
- Electronic Signing:
- The user applies an electronic signature to signify approval, review, or authorship.
- The signature event is logged in the audit trail.
- The system clearly displays:
- The printed name of the signer.
- The date and time of the signature.
- The meaning of the signature (e.g., “reviewed,” “approved”).
- The signature is permanently linked to the signed record.
- Record Archiving & Retrieval:
- At the end of the process, the complete record (data + metadata + audit trail) is archived in a secure, access-controlled environment.
- The archiving process ensures records are protected from tampering, degradation, or loss and are readably available for the entire required retention period, even if the original software becomes obsolete.
Methodology: A Framework for Sustainable Compliance
- Risk-Based Approach:
- Method: Focus your greatest efforts on systems and data that pose the highest risk to product quality and patient safety. A spreadsheet used for tracking training has lower risk than the system controlling the sterilization of a medical device. Allocate validation and monitoring resources accordingly.
- The “V-Model” for System Validation:
- Method: Use this structured software development and testing lifecycle.
- Left Side (Specification): Define User Requirements (URS), Functional Specifications (FS), and System Design Specifications (DS).
- Bottom (Testing): Develop test protocols (IQ, OQ, PQ) that trace directly back to the specifications.
- Right Side (Execution & Reporting): Execute the protocols and document the results, proving the system meets all requirements, including Part 11 controls.
- Procedural Controls as a Foundation:
- Method: Even the best technology can be undermined by poor practices. Robust, well-implemented SOPs are as critical as technical controls. A system with a basic audit trail is still compliant if an SOP mandates and enforces a rigorous review of that audit trail.
- “Trust but Verify” through Audit Trail Review:
- Method: The audit trail is useless if no one looks at it. Institutionalize the routine review of audit trails for critical data by the people who understand the data’s context (e.g., the Principal Reviewer for a clinical trial, the Batch Release Manager for a product). This is the primary method for detecting unauthorized or anomalous changes.
- Integrated Change Management:
- Method: Ensure that any change to a validated system—whether a software patch, a new user role, or a configuration tweak—is evaluated for its potential impact on data integrity and Part 11 compliance before it is implemented. Re-validation should be performed as necessary.