# Presentation: 249783

## FDA Docket No. 2004N-0133

***FDA Docket No. 2004N-0133***

**Themes for Renewal of 21 CFR Part 11 Rule & Guidance**
***by***
***Dr. Teri Stokes, ***_***GXP***_*** International***
***www.GXPInternational.com***

**Notes:**
Thank you to the FDA Committee for the opportunity to share some practical Part 11 ideas with you today. The introduction of 21 CFR Part 11 has done much to bring the quality assurance of computerized systems and electronic data out from under the proverbial rug, but unfortunately, the job is not completed yet.

## Recent “Discretionary & Narrow” Focus

**Industry responses: **
***Good, now we can forget Part 11!***
***Wow, we don’t know what is expected anymore! The Part 11 Rule says one thing and the Part 11 Guidance says another.***
***Enforcement is up to investigator opinion.***

**Slide 2**

**Notes:**
Recent changes in guidance removed the guidance on testing which had much good advice in it and introduced enormous confusion about the relevance of Part 11 itself. Some companies interpreted this as Part 11 being over. Others were set at sea about what was applicable and what was not. Above all, the vagueness of “Discretion” and “Narrow focus” made the whole topic seem arbitrary and at the whim of the investigator. 

## 21 CFR Part 11 Sec. 11.10 : System Controls

**Management Control**
- Validation of systems (a)
- Limit system access by authorization (d)
- Training for system developers, users
- & support personnel (i)
- SOP for e-signature responsibility (j)

**System Reliability**
- System checks to enforce steps & events in sequence (f)
- Device checks for identity of input sources (h)
- Control of system documentation & change control of system (k)

**Auditable Quality**
- Copies of records possible for inspection & review (b)
- Time-stamped audit trails (e)
- No “copy & paste” for e-signatures (11.70)

**Data Integrity**
- Ability to identify altered records (a)
- Record protection & retrieval during retention periods (c)
- Authority checks for user actions on the system (g)

**Slide 3**

**Good IT Business Practices**

**Notes:**
Generally speaking, the requirements of section 11.10 for system controls are just basic good IT business practice. The regulation paragraphs (a) through (k) shown on this matrix describe system controls needed for having reliable computer systems and electronic data of good integrity in any work process. There is no need for a major rewrite here and it can be applied to all the Predicate Rule areas.

## Missing Link – Defined Roles

**Regulated Area Manager** **–** Manager responsible for a computerized work process subject to Predicate Rules
**Regulated Area System User –** Person using computerized systems in a work process subject to Predicate Rules
**Application Supplier** **–** Person developing software to be used for data entry, capture, analysis, storage, retrieval, reporting, and/or archival subject to Predicate Rules
**Infrastructure Supplier –** Person implementing all technology required to deliver an application to the regulated work process

**Slide 4**

**Defined Roles & Responsibilities**

**Notes:**
What is lacking in Part 11 is a definition of roles and responsibilities for implementing Part 11 directives. Predicate Rules such as GCP are careful to specify the roles and responsibilities for Sponsor, Medical Monitor, Investigator, IRB, etc. Part 11 needs something similar, because I have seen every form of confusion, blame, and neglect for system validation activities across the industry. But the other non-computer aspects of Predicate Rule compliance are never considered expendable. Here are the major roles as I see them.

## Missing Link – Defined Roles

**Contractor/Subcontractor** **–** Person under contract to deliver any one or all of the above roles on behalf of a regulated company or its designee
**Contract Initiator –** Person delegating Predicate Rule-related activities associated with a computerized system
**Part 11 Computerized System** **–** Computer hardware, software, and communications configured to support a work process that consists of equipment, people, and SOPs and that is subject to a Predicate Rule

**Slide 5**

**Defined Roles & Responsibilities**

**Notes:**
Outsourcing of data centers, data services, and regulated company activities is a fact of business today. Contract manufacturers, contract laboratories, and contract clinical services play an important part in today’s health care industry. Part 11 needs to address computerized systems in these settings that are performing work subject to Predicate Rule requirements. Therefore these roles need to be defined.

## Missing Link – Defined Responsibilities

**Regulated Area Manager** **–** Provides business strategy and appropriate resources for Predicate Rule Risk Analysis and User Acceptance validation of systems. Provides work process personnel with training on system operations, Part 11, and change control activities.
**Regulated Area System User –** Attends training and uses system to approved SOPs and Work Instructions. Participates in User Acceptance validation work and change control testing.

**Slide 6**

**Defined Roles & Responsibilities**

**Notes:**
In the ISO tradition, the Manager of a Regulated Area would be held responsible for a business strategy that included all quality components, including Part 11 system needs. The Manager would also be held responsible for monitoring compliance to Part 11 quality standards among system users in the area.

## Missing Link – Defined Responsibilities

**Application Supplier** **–** Uses a documented software development life cycle (SDLC) process to develop and support software. Delivers system documentation and training. Tracks and responds to bug fixing requests. Follows a documented software upgrade process.
**Infrastructure Supplier –** Performs installation qualification (IQ) of all supporting technology platforms prior to production use of a Part 11 and Predicate Rule regulated application.

**Slide 7**

**Defined Roles & Responsibilities**

**Notes:**
Both internal and external suppliers of applications and infrastructure need to be aware of and compliant to relevant Predicate Rules and Part 11 needs.

## Missing Link – Defined Responsibilities

**Contractor/Subcontractor** **–** Performs Part 11 responsibilities relevant to respective role(s) as delegated in contract.
**Contract Initiator –** Designs contract to specify relevant Part 11 and Predicate Rule needs. Audits contractor/subcontractor for ability to meet needs before signing and during performance of contracted work.
**Part 11 Computerized System** **– **Performs reliably to consistently meet Part 11 standards for Predicate Rule e-records and e-signatures. Has validation documentation to show that it is reliable and under management change control in the regulated work process.

**Slide 8**

**Defined Roles & Responsibilities**

**Notes:**
Compliance gets back to the business relationship between the parties involved. Defining roles and responsibilities in contracts and service agreements is important to clarify Predicate Rule and Part 11 needs. Hardly any contracted work today is performed without the use of computerized systems.

## Themes for a Renewed Part 11 Rule

**Reinforce** same/similar Good IT Practices
**Define** Roles & Responsibilities for system control
**Establish** parity for Part 11 resource allocation with other Predicate Rule requirements, e.g., validation of methods, equipment, and process
**Outline** an enforcement strategy that is consistent with Part 11 Rule
**Separate** out the Part 11 technology needs of electronic submissions from Predicate Rule practices
**Keep **Part 11 generic across all Predicate Rules

**Slide 9**

**Notes:**
In conclusion, I think the same basic Good IT Business Practices should be reinforced. Roles for system control and data integrity should be defined across all parties. 
Part 11 needs to promulgate “Parity” for compliance to Part 11 as another mainstream component of Predicate Rule compliance and NOT an obnoxious overhead that can be avoided as a last priority of the resource allocation process. 
Guidance should outline an enforcement strategy that is consistent with the Part 11 Rule and gives help in methods for risk assessment, system testing, and core SDLC elements.
Separate out electronic submission needs from Predicate Rule work needs for systems. Not all types of Predicate Rule records go into a Submission and some key Submission data may come from less visible Predicate Rule systems, e.g., spreadsheets.
Above all, keep Part 11 generic across all FDA Predicate Rules and not more focused on GMP.

## FDA Docket No. 2004N-0133

***FDA Docket No. 2004N-0133***

_**Thank You**_

**FDA Regulations**

**Notes:**
Thank you for your kind attention.