FDA Inspections: Is Your Organization 21 CFR Part 11 Compliant?

Nov 01, 2003

Inspections are often stressful events. Certainly, during past FDA inspections, a lot of anxiety has surrounded 21 CFR Part 11, partly due to differing understandings between industry and FDA of what was needed to comply with Part 11. Confusion continued to mount until drastic action was taken by FDA to clarify the situation: the removal of several draft guidances and the publication of a final guidance document on September 3, 2003.

BackgroundThe original intention of Part 11 was to establish criteria under which electronic records and electronic signatures would be accepted in lieu of their traditional counterparts and to create a framework that would allow for technological innovations while safeguarding public health. However, when FDA released the final regulations in March of 1997, there were concerns from industry that Part 11 would actually have the opposite effect, limiting the use of electronic records and signatures due to the estimated high cost of compliance. While some of Part 11 was relatively easy to implement when the regulation became effective (August 1997), some of the difficult parts — areas involving validation, audit trails, record retention, record copying, and legacy systems — continued to be major concerns.

To help alleviate some concerns and clarify Part 11 itself, the agency discussed Part 11 at numerous conferences and solicited feedback on the regulation. FDA also published a compliance guide, "CPG 7153.17: Enforcement Policy: 21 CFR Part 11; Electronic Records, Electronic Signatures" on July 21, 1999 in the Federal Register. A number of draft guidance documents followed.

To the surprise of many, on February 4, 2003 the agency announced in the Federal Register that it was withdrawing the draft guidance document released November 12, 2002 pertaining to electronic copies of electronic records (21 CFR Part 11; Electronic Records, Electronic Signatures, Electronic Copies of Electronic Records). Shortly afterwards, on February 25, 2003, the agency announced it was withdrawing Part 11 draft guidance documents on validation, glossary of terms, time stamps, and maintenance of electronic records, as well as the compliance guide, CPG 7153.17. On the same day, the agency issued a new draft guidance titled, "Guidance for Industry: Part 11, Electronic Records; Electronic Signatures — Scope and Application." In the new draft guidance, FDA explained that it withdrew the CPG and previously issued draft guidances because its own relatively new risk-based initiative brought about a re-examination of Part 11. (1) The new draft guidance also informed industry that during the re-examination of Part 11, FDA plans to take a narrow interpretation of Part 11 and will exercise discretion in the enforcement of certain aspects of Part 11.

Refinements to the Guidance DocumentThe final guidance document on the scope and application of Part 11 (released September 3, 2003) clarified several issues. For example, the preamble to Part 11 originally stated that when a system spans different time zones, "the agency advises that the signer's local time is the one to be recorded." Later, when the draft guidance on time stamps was issued, the agency stated, "You should implement time stamps with a clear understanding of what time zone reference you use. Systems documentation should explain time zone references as well as zone acronyms or other naming conventions." When the agency withdrew the draft guidance on time stamps, there was no clear direction on the matter from FDA — until FDA released the final guidance document. Here, FDA reiterates that it does not expect a system spread across various time zones to use the signer's local time. Instead, it expects time stamps to incorporate a clear understanding of the time zone used. For example, all records could reference Greenwich Mean Time's descendant, the Universal Time Coordinate (UTC), or records could be synchronized to the time where the time stamp clock is located.

Additionally, the agency presented specific details in the final guidance document concerning when Part 11 applies to a legacy system. The specific requirements are outlined below. Also, in the final guidance document FDA states that it does not intend to reissue the withdrawn Part 11 documents.

What to Expect During an Inspection To reinforce the fact that 21 CFR Part 11 is still in effect, Janet Woodcock, the Director of CDER, recently stated:

"It's clear we need a rule on electronic records. But we need to clarify the scope of our record-keeping requirements. The regulation won't go away. However, while we won't rescind it, we may revise it. Businesses need direction on how to reliably, safely send documentation to the FDA. They also need more direction on how to maintain that documentation electronically. We just don't want the guidance to be as complicated as it has been." (2)

Woodcock's statement mirrors the final draft guidance's statement that FDA is undergoing a re-examination of Part 11. The expected outcome is a change to the rule that will be clearer and easier to follow. Until Part 11 is either revised or rewritten, the industry must look to the final guidance document for direction.

The guidance contains some useful information on preparing for an inspection with regard to Part 11. For example, the guidance specifically states:

"We intend to enforce all other provisions of Part 11 including, but not limited to, certain controls for closed systems in § 11.10. For example, we intend to enforce provisions related to the following controls and requirements:

  • limiting system access to authorized individuals
  • use of operational system checks
  • use of authority checks
  • use of device checks
  • determination that persons who develop, maintain, or use electronic systems have the education, training, and experience to perform their assigned tasks
  • establishment of and adherence to written policies that hold individuals accountable for actions initiated under their electronic signatures
  • appropriate controls over systems documentation
  • controls for open systems corresponding to controls for closed systems bulleted above (§ 11.30)
  • requirements related to electronic signatures (e.g., §§ 11.50, 11.70, 11.100, 11.200, and 11.300)"

Three points are reiterated throughout the final guidance document that should guide your assessment of Part 11 compliance for an FDA inspection: a narrow interpretation of Part 11, enforcement discretion regarding Part 11, and enforcement of all predicate rule requirements. While the first two elements indicate a new approach, the latter point is directly in line with FDA's previous expectations.

Narrow Interpretation. A narrow interpretation means a reduced number of records will be subjected to the authority of Part 11. Everyone would like to know exactly which records will and will not be held accountable to the standards of Part 11 before an inspection. The guidance document specifically states when records that must be maintained under predicate rules or submitted to FDA are maintained in electronic format, Part 11 applies. On the other hand, when computers are used in the generation of a permanent paper record, Part 11 does not apply. This is also known as the 'typewriter clause' because just as a typewriter would not be subject to inspection, the computer that generated a document will not be inspected as long as the document itself is the true and official record.

Hybrid systems — systems in which records exist in electronic form as well as in traditional paper format — may or may not be subject to Part 11. If you use the electronic portion of the system for any GxP function, then the electronic system would fall under Part 11's jurisdiction. However, if you are keeping records in both formats, but use the paper form as sole means for making any regulated decisions, then Part 11 does not apply. Before an inspection, it makes sense to decide whether Part 11 applies to specific records and to have this decision fully justified and documented. An inspector may accept your reasoning if you show — in writing — that you have thought it through ahead of time versus spontaneously explaining your thoughts on why Part 11 does not apply to a given system during an inspection.

lorem ipsum