FDA AND THE QUALITY BENCHMARK
The Food and Drug Administration (FDA) has written rules and statements in attempts to guide industry on the use of computer
technology. There is confusion in industry concerning Part 11 rules for electronic records and electronic signatures. We believe
that this confusion stems from a reading by many that FDA's position on Part 11 of a "narrow interpretation" means that
FDA has in fact 'backed-off' or relaxed its stance. This understanding is incorrect and untrue, as evidenced by FDA's own
statements that the intent of Part 11 still exists, but the number and types of systems falling under Part 11 are not abundant.1 We contend that this "narrow interpretation" of Part 11 has lulled many into believing that when Part 11 is applicable,
it should only apply to discrete systems. Discrete is not meant to solely describe a stand-alone PC. Networked systems within
the confines of the organization are also considered discrete in the context of this article.
Table 2. Compliance Attributes of a High-Level System
Part 11, although well meaning, has placed a burden on industry that has caused many organizations to lose sight of basic
quality. With the advent of a risk-based approach to Part 11, many appear to have taken the position that all computer quality
is risk-based. This is not true. The intent of the regulations has always been to require a demonstration of repeatability
of functions, and a demonstration of control and understanding of the systems at any point in time (historical or current).
Demonstration of repeatability is determined by the degree of validation, revealed through risk analysis. Demonstration of
control and understanding of the virtual stream should always be present despite the regulation.
There has been too great a focus on understanding what Part 11 is and how to apply it. This anxiety has caused many to forget
or even fail to realize that there are basic quality practices that must be in place despite Part 11. These quality control
practices should be centered on the attributes listed in Table 1.3 Principally, auditable documentation must exist to show compliance with the requirements of the law. Table 2 outlines compliance
attributes of a high-level computer system that act as a benchmark for demonstrating good faith.
DEFINING THE VIRTUAL STREAM
With the increased demand for organizations to share information externally as well as internally, it is imperative that quality
supports the entire environment. Such an environment frequently exists across all supporting business functions and regulatory
practices (i.e., GLP, GCP, GMP). We have found that common quality assurance practices focus on discrete systems of the organization
without taking into account the end uses of the information, or how it will flow to and across those discrete systems. An
organization's entire environment, consisting of technology, supporting business practices, and documentation that impacts
the quality of its data must be considered.
Table 3. Example of an Assessment Questionnaire
Over the past several years more attention has been devoted to validating network equipment, like routers. However, information
is still frequently shared within and between organizations using non-validated media (e.g., disks, CDs, email files) that
exist outside of the validated (or validateable) domain. It is common for such information to be used for important decision-making,
investigations, and submissions without regards to possible adverse consequences.
Examine all potential uses and supporting endeavors of the data and then define them as a virtual process stream. This stream
should consist of technology and business practices across GxP areas for production, manipulation, analysis, transfer, and
storage of data.
This effort will produce a thorough, documented understanding of the entire stream and will identify gaps in existing understanding
of the environment. This work will ensure that legal requirements are met and a strong quality system is in place to support
a virtual environment of technology, documentation, and supporting business practices producing GxP-related information.