The guidance document states that "actual business practices may dictate whether you are using electronic records instead of paper records under 11.2 (a)." For example, a sales and distribution database will probably not fall under the scope of Part 11. However, a word of caution is necessary here: Part 11 would apply if any of that database or those records were used for a product recall. In this instance, the business practice of using your sales database to track recall information triggers the oversight of Part 11 for the system in question.

Enforcement Discretion. During or after an inspection is the wrong time to learn what FDA means by enforcement discretion. To avoid this situation, numerous companies and other stakeholders in Part 11 requested in writing (after the draft guidance was released) that FDA define it. Unfortunately, FDA did not clarify its intent in using the term. A clear, unambiguous definition would have been to everyone's benefit, especially since the term is used in regards to validation, audit trails, legacy systems, copies of records, and record retention.

It reasonably can be inferred that enforcement discretion means that the agency would not act unless there was serious potential threat to the public's safety. However, without a concrete definition, this is only an assumption. It is important to keep in mind that the guidance documents are not legally binding, whereas, the regulation is law — with all the obligations and consequences associated with it.

Predicate Rules. The agency intends to enforce all predicate rules under the authority of Part 11. Predicate rules are those requirements for records and signature found in the Federal Food, Drug, and Cosmetic Act, the Public Health Service Act, and other regulations — including those that are not specifically mentioned in Part 11 — that are codified in the federal registry. FDA specifically states that "persons must comply with applicable predicate rule." There is no enforcement discretion with predicate rules, and it is almost certain that if a record or signature falls under a predicate rule and that record or signature is kept electronically, an inspector will check to see that it complies with Part 11.

What the Inspectors Will ExamineValidation. FDA states in the guidance that even though there may be no predicate rule requiring validation, validation may still be necessary to ensure the accuracy and reliability of electronic records. The following is a very basic outline of the process: determine which systems should be validated by following the predicate rules and/or documented risk assessment, perform a GAP analysis on the systems that need validation, prioritize and plan a validation strategy.

There are several good sources to consult for computer validation such as the agency's own General Principles of Software Validation (4) and The Good Automated Manufacturing Practice (GAMP) Guide for Validation of Automated Systems, GAMP 4. (5) The inspectors will be looking for any recent validation to meet these standards.

Audit Trail. Again, the agency intends to exercise enforcement discretion for computer generated audit trails. Expect an inspector to check if any electronic records required by a predicate rule require recording of the date, time, or sequencing of events. Even if no predicate rule exists for such records, the agency has stated that an audit trail may be important to ensure accuracy and reliability.

Legacy Systems. Legacy systems have often been the most complicated element of Part 11. Fortunately, FDA has stated that it does not intend to take action to enforce Part 11 compliance for systems that meet the following conditions:

• The system was operational before the effective date
• The system met all applicable predicate rule requirements before the effective date
• The system currently meets all applicable predicate rule requirements
• There is documented evidence and justification that the system is fit for its intended use and has an acceptable level of record security and integrity.

Since most applications and software systems typically have a five-to-seven year life cycle, and the rule went into effect in 1997, expect inspectors to scrutinize any system you claim to be a legacy system.

Copies of Records. The agency intends to exercise enforcement discretion for generating copies of records. The guidance suggests supplying copies of electronic records in common portable formats, for example a Microsoft Word or Excel file, or using a standard conversion format such as a PDF file. Also, if you can search, sort, or trend Part 11 records, inspectors will require the same functionality of the files you give them.

An inspector will expect to be able to review, inspect, and copy any records that are subject to Part 11 at your site using your hardware and following your established procedures and techniques for accessing records. Several firms have pointed out that, while they have no objection to providing an electronic copy of a record, the inspection and review has the potential to conflict with section 527.4 of FDA’s own Investigations Operations Manual, which states that investigators "should not use the audited firm’s equipment or personnel to perform extensive queries or manipulation of the audited firm’s own computerized data." While it may still be unclear what FDA intends, be prepared to justify your decision to deny an inspector any type of access to records that fall under the domain of Part 11. In most cases, the benefit of allowing an inspector access far outweighs the cost of a prolonged inspection.

Record Retention. Finally, FDA intends to exercise enforcement discretion regarding record retention to ensure that electronic records are safe, accurate, and reliable throughout the record retention period. Once again, electronic records must comply with all predicate rules during the record maintenance time span. An inspector should not object if electronic records are archived to nonelectronic format such as microfilm, microfiche, paper, or standard electronic file formats such as PDF.

Hybrid systems are allowed, but expect an inspector to investigate their compliance with all predicate rules. All electronic records retained must preserve their original content and meaning.

What Else to Know or DoSo what is a firm to do now that a final guidance document has been issued? Three options are readily apparent. The first is to expend additional resources to be fully confident that every system is Part 11 compliant, however, I know of no company that is willing to incur additional costs when it is not warranted.

The second choice is to stay the course — continue on with your remediation plan or continue to implement systems that are Part 11 compliant when they need to be.

A third choice is to re-examine your efforts and adjust your resources accordingly. If you opt for this strategy, be sure to conduct a risk assessment for those requirements of Part 11 that the guidance suggest you meet. Finally, be prepared to show an inspector the documented risk analysis that justifies your decision.

The major factor leading to a favorable inspection outcome is preparation. Part 11 is still in effect, and your inspection preparation efforts should take this into account. By using the final guidance on the scope and application of Part 11 to direct your efforts, paying particular attention to predicate rules, legacy systems, and documenting your justifications, you will be well on your way to a successful inspection.

References(1) U.S. Food and Drug Administration. Pharmaceutical current good manufacturing practices (cGMP) for the 21st century: a risk based approach. Washington, DC: U.S. Government Printing Office, 2002.

(2) Heinemann J L. The Part 11 challenge. Contract Pharma 2003; 5(7):68-73.

(3) Immel BK. Part 11 update: the FDA changes course. BioProcess International 2003; 1(7):22-28.

(4) U.S. Food and Drug Administration. General principles of software validation: final guidance for industry and FDA staff. Washington, DC: U.S. Government Printing Office, 2002.

(5) ISPE. The good automated manufacturing practices (GAMP) guide for validation of automated systems in pharmaceutical manufacture, GAMP 4. Tampa: ISPE, 2001.

Internet Resources for 21 CFR Part 11Published text of the rule: www.fda.gov/ora/compliance_ref/part11

www.21part11.com: features Email updates

Bardon Data Systems: www.bardon/com/wp_part11.htm

CimWorks UK: www.cimworks.co.uk

Document Control Systems: www.mastercontrol.com/Solutions/21cfrpart11.html

Immel Resources: www.immel.com

Institute of Validation Technology: www.ivthome.com/free

ISPE: www.ispe.org

Valimation: www.valimation.com/21_cfr_part_11.html BPI