21 CFR Part 11 - Requirements and New Scope - - BioPharm International


21 CFR Part 11 - Requirements and New Scope

BioPharm International

Audit Trails Procedures should be available to use secure, computer-generated, time-stamped audit trails to independently record the date and time of operator entries and actions that create, modify, or delete electronic records. Record changes cannot obscure previously recorded information. Such audit trail documentation should be retained for a period at least as long as that required for the subject electronic records and also should be available for agency review and copying.

This requirement has been the subject of many questions and discussions, especially regarding which details must be recorded. For example, what should be recorded when generating a calibration table? Should each typing error be recorded when entering a compound name, should each line be recorded when the return key is pressed, or should entries only be recorded when the session is closed? Too many confirmation steps will affect productivity.

Another concern is that, because everything analysts do can be reconstructed, their creativity could be negatively influenced, especially in the development of new processes.

Secure Electronic Signatures In order to deter record and signature falsification, written policies holding individuals accountable and responsible for actions initiated under their electronic signatures are necessary. This requirement necessitates not only the development of new procedures but also behavioral changes in the use of logon IDs and passwords. The taboo against sharing a password with a colleague is usually much lower than teaching somebody how to abuse a handwritten signature, but under Part 11 both have the same consequence.

Digital Signatures In Open Systems Persons who use open systems to create, modify, maintain, or transmit electronic records must ensure the authenticity, integrity, and, if necessary, the confidentiality of electronic records from the point of creation to the point of receipt. Such procedures and controls include those identified for closed systems, as appropriate, and additional measures such as document encryption and digital signatures.

Implementing digital signatures requires software for document encryption and may also require hardware and software for generating digital signatures. Typically, computer systems used in analytical laboratories are closed systems, which do not need digital signatures. However, record encryption and digital signatures are required in open systems, such as when analytical data generated by a contract laboratory are transmitted to the sponsor over the Internet. Technology and applications for this purpose have been described elsewhere.5

New Scope Of 21 CFR Part 11 Although Part 11 has been in place for six years now (and enforced for four years), there is still confusion in industry over how to implement it. 21 CFR Part 11, as well as early draft guidance documents and FDA staff interpretations, does not distinguish between record types or criticality. Part 11 compliance was requested for all records that passed through any computer, and FDA could audit any such records at inspections. Under this very broad interpretation, full implementation turned out to be very expensive and, for some applications, impractical. In some cases, companies decided against the use of new technology due to the anticipated additional complexity and cost of implementing Part 11. However, this contradicts the original intent and spirit of the rule, which was issued to enable the use of new technology while protecting and furthering public health.

With the release of a draft guidance on the scope and applications of Part 11 in February 2003,6 FDA initiated a new, narrower approach. This approach became official with the release of the final guidance on September 3, 2003 and FDA's announcement that it would re-examine Part 11 and initiate a new rule-making process. The new approach likely will be in effect for the next few years.

The new guidance states that Part 11 applies only when the record is required by a predicate rule and when one or both of the following conditions apply:

  • Electronic records are used instead of paper.
  • Persons make printouts but still rely on the electronic records to perform regulated activities.

Figure 1: Deciding where Part 11 Applies
Figure 1 illustrates the process described by FDA's Part 11 experts for deciding where Part 11 applies. Table 1 gives examples of records subject to Part 11.

First, check if the record is required by a predicate rule (or if the record must be submitted to FDA). Next, determine if the record falls under the new, narrower scope. Is the record maintained in electronic format in place of paper, or is it maintained as both electronic and paper records, but the electronic record is used to perform regulated activities? Finally, conduct a risk assessment of the criticality of the Part 11 records and document the result. Part 11 controls are implemented based on the outcome of this process.

blog comments powered by Disqus



EMA Warns of Falsified Herceptin Vials
April 16, 2014
Mallinckrodt to Acquire Questcor Pharmaceuticals
April 16, 2014
American CryoStem and Rutgers University File Joint Patent on Stem Cell Platform
April 11, 2014
Center for Biologics Evaluation and Research Relocates
April 11, 2014
PhRMA Report Reveals Growth Trajectories and Policy Factors Affecting Biopharmaceutical Growth
April 11, 2014
Author Guidelines
Source: BioPharm International,
Click here