www.ijapbc.com IJAPBC Vol.
1(3), Jul- Sep, 2012 ISSN: 2277 - 4688
INTERNATIONAL JOURNAL OF ADVANCES IN PHARMACY,
BIOLOGY AND CHEMISTRY
Review Article
Introduction to 21 CFR 11 - Good Electronic Records
Management
Pal Tapas Kumar* and Maity Subhasis
NSHM Knowledge Campus, Kolkata - group of Institutions, 124 (60), B.L. Saha Road, Kolkata,
West Bengal, India.
ABSTRACT
Pharmaceutical stake holders such as drugs manufacturers, medical device manufacturers, biotechnology
companies and biologics developers regulated by the FDA need to be aware of the requirements for CFR 21
Part 11 compliance. Part 11 was developed in response to the soaring costs associated with managing the
distribution, storage, and retrieval of paper records used in conjunction with the FDA. Further, FDA-
regulated companies are very familiar with a variety of validation processes ranging from full process and
facilities validation to that of qualifying individual utilities, equipment, instruments and everything in
between. When it comes to 21 CFR Part 11 and computer systems validation, the use of vendor-supplied off-
the-shelf configurable software offers many challenges to validation, including supplier audits. FDAs
interpretation of 21 CFR Part 11 for inspections of computer systems and computer validation has been
refocused through the Scope and Application Guidance to emphasize predicate regulation record
requirements and shift the emphasis to documented risk assessment. Compliance will remain a part of routine
FDA inspections based on predicate regulations, including validation. FDA insists that Software and
Computer System Life Cycle principles in a GxP setting should be supported by a Corporate Computer
Systems Validation Policy with supporting global SOPs for the System Development Life Cycle, Validation,
Supplier Assessment and Audits, Change Control, and Revalidation along with local SOPs for specific systems
containing strict guidelines with concept, user and functional requirements and design phases, followed by the
implementation and testing with qualification protocols.
Keywords: FDA, 21 CFR 11, GAMP, Predicate Rule, Electronic signature.
INTRODUCTION should be part of any good development and
In todays world, Records - whether it is a automated manufacturing practice (GAMP).
document, an e-mail, instant message or a
transaction - can prove innocence or lack of intent. OBJECTIVES
In the event of a dispute, Good electronic records Presently, the FDA actively encourages that all
management practices offset what could be New Drug Applications (NDAs) and equivalent
considerable costs for legal discovery and audits by license applications for medical devices and
making relevant business records readily available. biologics be submitted to the agency in electronic
The difference could be millions of dollars. form. Given this mandate, the need for compliance
Customized Integrated Computer system are more to 21 CFR Part 11 will only intensify. 21 CFR Part
and more widely used during the phases of 11 was developed initially as a response by the
development, Clinical Trial, automated FDA to allow Life Science Organizations use of
manufacturing and testing of drugs and medical electronic signatures in electronic batch records. It
devices for generating data & records, which is applicable to records identified in predicate rules,
should be available, traceable & auditable for such as Good Clinical Practices (GCP), Good
inspection to Regulatory authorities like FDA. Laboratory Practices (GLP), and Good
Proper functioning and performance of software Manufacturing Practices (GMP). The purpose of
and integrated computer systems play a major role the regulations is to ensure both the accuracy and
in obtaining consistency, reliability and accuracy of trustworthiness of information and data as it is
data. Therefore, computer system validation (CSV) handled and traced to establish the reliability of
260
www.ijapbc.com IJAPBC Vol. 1(3), Jul- Sep, 2012 ISSN: 2277 - 4688
data submitted to the agency for drug or device Control of system documentation, security &
approval process. archiving.
Accurate & raw data generation & protection
Title 21 in the Code of Federal Regulations of data integrity
regulates the Food and Drugs in United States of Electronic audit trail
America. Part 11 within this Code of Federal Requirements related to electronic signatures
Regulations is related to FDA guidelines about & binding signatures with records-
electronic records and electronic signatures. The handwritten, electronic (Biometric)
regulations in this part set forth the criteria under Digital signatures for open systems
which the FDA considers electronic records, Accountability for electronic signatures
electronic signatures, and handwritten signatures
Accountability of maintaining authentic
executed to electronic records to be trustworthy,
records
reliable, and generally equivalent to paper records
Accurate and complete copies
and handwritten signatures executed on paper. 21
Instant retrieval of data and meta data for FDA
CFR Part 11, states the requirements for procedures
access
for creating, modifying, maintaining, archiving,
retrieving, and transmitting electronic records and Use of operational system checks, Use of
electronic signatures (Biometric signatures authority checks, Use of device checks
preferable) by virtue of which they can be Training/qualification of people &
considered or rendered to be trustworthy, reliable establishment of written policies of
and equivalent to paper records. CFR 21 Part 11 responsibility.
requires that a drug manufacturer, medical device
manufacturer and biologics developers and all The computerized records that the firm keeps to
other industries regulated by FDA to implement make it easier to sort or find certain information
controls for their electronic system, like audits, would not necessarily have to comply with Part 11
documentation for software, system validations, regulations. According to the old interpretation the
audit trails, electronic signatures both Digital & mere existence of electronic data in or around a
Biometric, and for systems which are handling the product or plant was considered to be an electronic
electronic data which is required to be maintained record of the rule. For example: If a firm has a
by the FDA predicate rules or the systems which database for product complaints history and follow
process data used for demonstration of compliance up, but still records everything on paper (and the
of a requirement or a rule. printed paper copy is the official record), the
In Laboratory situations, this includes any database would not have to comply with Part 11.
laboratory results used to determine quality, However, if the database is the only record, the
safety, strength, efficacy or purity (GLP). database would have to comply with Part 11.
In Clinical trials, this includes all data to be
Data integrity and fraud -another looming crisis
reported as part of the clinical research used to
However, security concerns surrounding wet ink
determine the safety, toxicity, efficacy of the
signatures surfaced as it became apparent these
trial (GCP).
signatures including the content they were attesting
In manufacturing environments, this includes
to could be easily falsified. There had been
all decisions related to product release and
incidences reported that loss of data integrity, data
product quality (GAMP, GXP & cGMP).
manipulation and fraud appears to be increasing.
CFR21 part 11 also applies to the electronic
Regulatory agencies have also noted that analytical
submissions made to FDA like ANDA, NDA.
laboratories are using electronic record system for
processing and storage of data from precision
Paper documents are still considered if a firm keeps analytical equipments like the Atomic absorption
"Hard copies" of all mandatory records; for
and HPLC instruments,
regulatory purpose the paper documents are also
Equipments are not set up to control the
considered as authoritative documents. Records
security and data integrity in that the system is
must also be maintained or submitted in accordance
not password controlled,
with all predicate rule requirements, including
predicate rule record and recordkeeping There is no systematic back-up provision, and
no trace of audit trail of the system
requirements. If electronic records are illegible,
capabilities.
inaccessible, or corrupted the manufacturers are
still subject to those requirements. The system does not appear to be designed and
controlled in compliance with the requirements
THE SALIENT REQUIREMENTS OF 21 CFR 11 of 21 CFR, Part 11, Electronic Records.
Validation Biased manipulation of data resulting in the
Limited access to systems and data acceptance of failed runs
261
www.ijapbc.com IJAPBC Vol. 1(3), Jul- Sep, 2012 ISSN: 2277 - 4688
Intentional manipulations of chromatograms Can you show me the documents and results of
by cutting & pasting chromatographic data so the validation activities?
that initial out-of-specification test results are Does the validation include: Pass/fail,
brought into specifications signature, date/time stamp; and objective
Altering weights of samples and standards in evidence - screen prints or page printouts with
analytical calculations a link to the direction that generated the
Changing chromatogram processing output.?
parameters Verification answers the question: Was the
Manipulation of operation parameters of product built right?
stability testing data changing calculations to and Validation answers the question: Was the
bring out-of-specification results within right product built right?
specifications
Placed the in-specification assay results into
the batch production and control record Paper Records /
E-Records / E-Signatures
In order to overcome the issues, changes have Handwritten Sigs
been brought down for implementing
(+) Global Sharing
narrowing the scope of 21 CFR 11. (+) Rapid Analysis and
(+) Fixed Representation
Risk based validation, record retention, (+) Durable
Search
electronic copies, e-audit trail (+) Efficient Review and
(+) Changes Very Evident
Approval
Extend risk based controls to other areas of (+) Copies Evident
(-) Changes / Copies Not
Part 11 (+) Signatures Hard to Forge
Evident
(-) Need Storage Space
Enforcement discretion replaced by risk based (-) Inefficiency of Search /
(-) Selective Data Views
approaches (-) Higher Possibility of
Sharing
Data Loss
Less prescriptive, e.g., other options for audit (-) Easy to Forge Signatures
trail
No distinction between closed and open
systems CRITICAL SUCCESS FACTORS
Validation activities in manufacturing,
FDA 21CFR11 INSPECTION: toxicology, clinical, regulatory and marketing
FREEQUENTLY ASKED QUESTIONS (label approval) will need to be better process
Who is allowed to input data? focused, requiring definition of inputs and
Who can access data? outputs with, procedural controls governing
Who is allowed to change or modify data? the process activities and standards dictating
What is the Likelihood for a change of data? the format and content of inputs and outputs
Can a change impact product quality? and well documented.
How do you know who entered and modified Configuration management, security
the data? management and periodic review and quality
How do you know which data had been management must be a continual process.
changed? Record retention and record disposal practices
When do you lock down the data input? need to be revised to reflect company
Can you do the following actions? - Show requirements to comply with new regulatory
me some data, show me you can see the requirements
history of the data, show me you control the Documentation standards and practices should
data life cycle. be created that systematize the processes for
Is the system validated and are the creating and maintaining documents.
requirements met? Planning will have to take into consideration
Can you demonstrate compliance with re-engineering, replacement, or retirement of a
predicate rules without e-records? computer system when operating costs
Will the print-outs preserve content and increase or business process changes.
meaning? Requires effective change control.
Do regulated activities rely on electronic
records?
262
www.ijapbc.com IJAPBC Vol. 1(3), Jul- Sep, 2012 ISSN: 2277 - 4688
Advantages Challenges
Electronic Batch records can eliminate mountains of Firms planning on using electronic signatures
paper work, speed processing and allow for statistical in FDA regulated environments will be
and trend analyses. required to validate the computer related
NDAs and other submissions can be submitted systems.
electronically in place of paper submission. Design of systems must be well thought out and
Increases the speed of information exchange. tested thoroughly.
Cost savings from reduced need for storage space. Critical control points must be identified which
Manufacturing process streamlining. can be monitored through electronic audit trails.
Job creation in industries involved in electronic record Adequate testing of security.
and electronic signature technologies. Fraud Detection
STEPS FOR IMPLEMENTATION OF THE NEW APPROACH
1. Identify records required by regulations
2. Identify risks of records-e.g., high, medium, low
3. Document business practices
4. Identify Part 11 requirements
5. Define system requirements
6. Develop and implement project plans
263
www.ijapbc.com IJAPBC Vol. 1(3), Jul- Sep, 2012 ISSN: 2277 - 4688
Determine whether Records Narrow Scope -Identify Electronic
required by Predicate Rules Records that Require Part 11 compliance
Determine if Records Are Critical for
Implicit: Is the record
Explicit: Is the record Product Quality and Patient Safety
required to demonstrate
listed in the Predicate, compliance with a
(e.g., batch records listed Predicate rule (e.g.,
in 21 CFR Part 211) Risk Assessment Criteria
cGMP training records) Severity
Probability
Detectability
Document Business Practices: Batch records SOPs
Workflow and Records lifecycle Impact on product quality Product labels
Where Regulated activities are Impact on patient safety Validation plan
performed
Who has access to e-data
Who can change e-records Identify Part 11 Requirements
How records are signed -
-electronic, handwritten on paper Access control to authorized people
How records are maintained Authority check
-electronic (format), paper Document control
Training
Accountability for electronic signatures
Electronic audit trail
Record maintenance and archiving
Validation
Change control
Part 11 Records compliance
Not Part 11 compliance records
Assess Risk by Gap analysis & Risk evaluation
Evaluate level of controls appropriate to Risk
E-audit trail based on a justified & documented Risk based validation of customized off-
risk assessment and to evaluate likelihood that the-shelf integrated computer system
electronic information might be comprised Criteria:
Risk, Complexity, Level of customization
Range: from simple IQ to full OS testing
Develop SOP for risk based validation
DISCUSSION time-to-market, and increased data security.
In todays complex business environment every Inherent in 21 CFR Part 11 compliance is
company faces regulatory and business mandates validation of the system used within its current
of increasing magnitude and frequency that come at operating environment. However, everyone must
an increasingly higher cost. As a result, every still comply with all applicable predicate rule
enterprise needs to adapt - moving from a requirements for validation. A Critical approach
compliance-only, departmental, or ad hoc approach may be recommended based on a justified and
to a more enterprise-wide approach to implement documented risk assessment and a determination of
21 CFR Parts 11, as it will affect not only the risk the potential of the system to affect product quality
of non-compliance - it affects their bottom lines. and safety and record integrity through extensive
While the use of electronic records and signatures education and training programs on
brings with it a range of compliance challenges, it software/system development and validation to
will also help to assess and realize tremendous emphasize predicate regulation record
improvements in business process flows, increased requirements.
data integrity, faster regulatory response, quicker
264
www.ijapbc.com IJAPBC Vol. 1(3), Jul- Sep, 2012 ISSN: 2277 - 4688
REFERENCES
1. Code of Federal Regulations, Title 21,
Food and Drugs, Part 11 Electronic
Records; Electronic Signatures; Final
Rule; Federal Register 62 (54), 13429-
13466.
2. GAMP, Special Interest Group (21 CFR
11);
www.primetechpa.com/Download/GAMP
GuideTo21CFRPart11.pdf
3. www.biotechnicalservices.com/downloads
/21CFRpart11.pdf
4. www.wrtolbert.com/Download%20Docu
ments/21CFR11.pdf
5. www.waters.com/webassets/cms/support/
docs/empower_2_21_cfr_11_compliance_
worksheet.pdf
6. www.labcompliance.com/tutorial/part11/d
efault.aspx
7. Pharmaceutical Inspection Convention/
Pharmaceutical Inspection Co-operation
Scheme (PIC/S): Good Practices for
Computerized Systems in Regulated GxP
Environments, 2003.
8. Lab compliance, 21 CFR Part 11:
Electronic Records and Signatures,
Frequently Asked Questions;
www.labcompliance.com/books/part11
9. www.ilsdk.dk/uploads/truscan081007.pdf
265
