The guidance document states that "actual business practices may dictate whether you are using electronic records instead
of paper records under 11.2 (a)." For example, a sales and distribution database will probably not fall under the scope of
Part 11. However, a word of caution is necessary here: Part 11 would apply if any of that database or those records were used
for a product recall. In this instance, the business practice of using your sales database to track recall information triggers
the oversight of Part 11 for the system in question.
Enforcement Discretion. During or after an inspection is the wrong time to learn what FDA means by enforcement discretion. To avoid this situation,
numerous companies and other stakeholders in Part 11 requested in writing (after the draft guidance was released) that FDA
define it. Unfortunately, FDA did not clarify its intent in using the term. A clear, unambiguous definition would have been
to everyone's benefit, especially since the term is used in regards to validation, audit trails, legacy systems, copies of
records, and record retention.
It reasonably can be inferred that enforcement discretion means that the agency would not act unless there was serious potential
threat to the public's safety. However, without a concrete definition, this is only an assumption. It is important to keep
in mind that the guidance documents are not legally binding, whereas, the regulation is law — with all the obligations and
consequences associated with it.
After the draft guidance was published, Barbara Immel, president of Immel Resources, suggested taking a conservative approach
regarding GxPs until a final guidance document or a final revision to the rule was published. (3) Now, the final guidance
has been published and does not differ significantly from the draft guidance. Regardless of how conservative one wants to
be, the decision on how to approach Part 11 implementation should be based on a documented risk assessment. The guidance recommends
doing a risk assessment for validation, audit trails, and record retention.
Predicate Rules. The agency intends to enforce all predicate rules under the authority of Part 11. Predicate rules are those requirements
for records and signature found in the Federal Food, Drug, and Cosmetic Act, the Public Health Service Act, and other regulations
— including those that are not specifically mentioned in Part 11 — that are codified in the federal registry. FDA specifically
states that "persons must comply with applicable predicate rule." There is no enforcement discretion with predicate rules,
and it is almost certain that if a record or signature falls under a predicate rule and that record or signature is kept electronically,
an inspector will check to see that it complies with Part 11.
What the Inspectors Will ExamineValidation. FDA states in the guidance that even though there may be no predicate rule requiring validation, validation may still be
necessary to ensure the accuracy and reliability of electronic records. The following is a very basic outline of the process:
determine which systems should be validated by following the predicate rules and/or documented risk assessment, perform a
GAP analysis on the systems that need validation, prioritize and plan a validation strategy.
There are several good sources to consult for computer validation such as the agency's own General Principles of Software
Validation (4) and The Good Automated Manufacturing Practice (GAMP) Guide for Validation of Automated Systems, GAMP 4. (5)
The inspectors will be looking for any recent validation to meet these standards.
Audit Trail. Again, the agency intends to exercise enforcement discretion for computer generated audit trails. Expect an inspector to
check if any electronic records required by a predicate rule require recording of the date, time, or sequencing of events.
Even if no predicate rule exists for such records, the agency has stated that an audit trail may be important to ensure accuracy
Legacy Systems. Legacy systems have often been the most complicated element of Part 11. Fortunately, FDA has stated that it does not intend
to take action to enforce Part 11 compliance for systems that meet the following conditions:
- The system was operational before the effective date
- The system met all applicable predicate rule requirements before the effective date
- The system currently meets all applicable predicate rule requirements
- There is documented evidence and justification that the system is fit for its intended use and has an acceptable level of
record security and integrity.
Since most applications and software systems typically have a five-to-seven year life cycle, and the rule went into effect
in 1997, expect inspectors to scrutinize any system you claim to be a legacy system.
Copies of Records. The agency intends to exercise enforcement discretion for generating copies of records. The guidance suggests supplying copies
of electronic records in common portable formats, for example a Microsoft Word or Excel file, or using a standard conversion
format such as a PDF file. Also, if you can search, sort, or trend Part 11 records, inspectors will require the same functionality
of the files you give them.
An inspector will expect to be able to review, inspect, and copy any records that are subject to Part 11 at your site using
your hardware and following your established procedures and techniques for accessing records. Several firms have pointed out
that, while they have no objection to providing an electronic copy of a record, the inspection and review has the potential
to conflict with section 527.4 of FDA’s own Investigations Operations Manual, which states that investigators "should not
use the audited firm’s equipment or personnel to perform extensive queries or manipulation of the audited firm’s own computerized
data." While it may still be unclear what FDA intends, be prepared to justify your decision to deny an inspector any type
of access to records that fall under the domain of Part 11. In most cases, the benefit of allowing an inspector access far
outweighs the cost of a prolonged inspection.
Record Retention. Finally, FDA intends to exercise enforcement discretion regarding record retention to ensure that electronic records are
safe, accurate, and reliable throughout the record retention period. Once again, electronic records must comply with all predicate
rules during the record maintenance time span. An inspector should not object if electronic records are archived to nonelectronic
format such as microfilm, microfiche, paper, or standard electronic file formats such as PDF.
Hybrid systems are allowed, but expect an inspector to investigate their compliance with all predicate rules. All electronic
records retained must preserve their original content and meaning.
What Else to Know or DoSo what is a firm to do now that a final guidance document has been issued? Three options are readily apparent. The first
is to expend additional resources to be fully confident that every system is Part 11 compliant, however, I know of no company
that is willing to incur additional costs when it is not warranted.
The second choice is to stay the course — continue on with your remediation plan or continue to implement systems that are
Part 11 compliant when they need to be.
A third choice is to re-examine your efforts and adjust your resources accordingly. If you opt for this strategy, be sure
to conduct a risk assessment for those requirements of Part 11 that the guidance suggest you meet. Finally, be prepared to
show an inspector the documented risk analysis that justifies your decision.
The major factor leading to a favorable inspection outcome is preparation. Part 11 is still in effect, and your inspection
preparation efforts should take this into account. By using the final guidance on the scope and application of Part 11 to
direct your efforts, paying particular attention to predicate rules, legacy systems, and documenting your justifications,
you will be well on your way to a successful inspection.
References(1) U.S. Food and Drug Administration. Pharmaceutical current good manufacturing practices (cGMP) for the 21st century: a risk based approach. Washington, DC: U.S. Government Printing Office, 2002.
(2) Heinemann J L. The Part 11 challenge. Contract Pharma 2003; 5(7):68-73.
(3) Immel BK. Part 11 update: the FDA changes course. BioProcess International 2003; 1(7):22-28.
(4) U.S. Food and Drug Administration. General principles of software validation: final guidance for industry and FDA staff.
Washington, DC: U.S. Government Printing Office, 2002.
(5) ISPE. The good automated manufacturing practices (GAMP) guide for validation of automated systems in pharmaceutical manufacture,
GAMP 4. Tampa: ISPE, 2001.
Internet Resources for 21 CFR Part 11Published text of the rule: www.fda.gov/ora/compliance_ref/part11
www.21part11.com: features Email updates
Bardon Data Systems: www.bardon/com/wp_part11.htm
CimWorks UK: www.cimworks.co.uk
Document Control Systems: www.mastercontrol.com/Solutions/21cfrpart11.html
Immel Resources: www.immel.com
Institute of Validation Technology: www.ivthome.com/free
Valimation: www.valimation.com/21_cfr_part_11.html BPI