Items to Consider in Evaluating Electronic Records and Digital Data 

ICWI0146.01 Page 1 of 3 

Author: Daniel C. Coyle 

Issue Date: 01Dec17 

Source Document: ICSOP0046, Evaluation of Electronic Record Keeping and Compliance with title 9,

Code of Federal Regulations, part 116; Veterinary Services Memorandum No. 800.122 

This information is to be used as a tool in evaluating electronic records and digital data to 

ensure compliance with title 9, Code of Federal Regulations (9 CFR), part 116. The 

information was compiled from multiple sources into one document to provide an easy 

accessible tool to use on inspections or when reviewing firm submissions. 

Utilize Veterinary Services Memorandum No. 800.122 (Memo 800.122) as guidance 

as well as ICSOP0046, Evaluation of Electronic Record Keeping and Compliance with 

title 9, Code of Federal Regulations, part 116. Sections of the Memo 800.122 are 

referenced below. Violations to be referenced are listed if noncompliance found. 

Any system that is used to document any aspect of a veterinary biological product falls 

under these requirements. Some of the systems may be procurement, Select Agent 

Program (SAP), NCAH Portal, and distribution. 

I. ITEMS TO AUDIT

a. Proceed through each section and determine if the firm has complied or not.

Yes = complied, No = Not compliant

b. If not compliant, a violation of the referenced 9 CFR section may be

appropriate.

a) Memo 800.122 Section III. A. Location/ownership of server(s) where

information stored.

a. Is the server at an alternate (unlicensed) location?

i. If yes, has the firm requested the alternate location?

ii. Has the vendor been recently audited?

b. Is the information filed in the facility documents? 

Violation: 9 CFR 116.1(c) 

b) Memo 800.122 Section III. B. (1). Is the system reliable (Reliability)?

a. Was the system tested and testing documented prior to deployment?

b. Did the Management/appropriate official approve the final use of the

product and is it documented?

c. Do the records conform to the Outline of Production?

d. Is date, time, user identified?

e. Is the unit of measure identified?

f. Is there a change control process and are changes documented?

g. Is there documentation to substantiate a change to the data through change

control?

Violation: 9 CFR 116.1(a)(1) 
Items to Consider in Evaluating Electronic Records and Digital Data 

ICWI0146.01 Page 2 of 3 

Author: Daniel C. Coyle 

Issue Date: 01Dec17 

Source Document: ICSOP0046, Evaluation of Electronic Record Keeping and Compliance with title 9,

Code of Federal Regulations, part 116; Veterinary Services Memorandum No. 800.122 

c) Memo 800.122 Section III. B. (2). Is the system authentic? (Authenticity)

a. Is access controlled by a means that allows the tracking of entries to a

specific person, at a specific date, and time?

b. Does the system have unalterable computer generated date and time

stamps, independent from operator entries? This action documents actions

such as create, modify, and delete and is not altered without

documentation to substantiate and describe the change.

c. If electronic signatures are used, is there a written policy concerning use

and acceptance?

d. Is access allowed only for those that need access?

e. Is there is a written protocol or procedure for access process?

Violation: 9 CFR 116.1(a)(2) 

d) Memo 800.122 Section III. B. (3 and 4). (Integrity)

a. Is the server(s) secure and limited to physical access? (This may be in

vendor audit by firm.)

b. Is the system controlled through complex passwords, key card access, or

other equivalent means?

c. Is there an audit trail that allows reconstruction of the course of events

relating to the creation, modification, and/or deletion of the electronic

records?

d. Are roles assigned/deleted and documented in the system for specific

functions as a part of Access Control?

e. Is training provided to the employee on their role and system security

process with continuing training established and documented (i.e., do not

share passwords/login)?

f. Are certification and re-certification approvals of employee roles

performed on intervals determined by the firm?

g. Is the system audited periodically for compliance by in house personnel or

by a vendor?

Violation: 9 CFR 116.1(a)(3) 

e) Memo 800.122 Section III. B. (5). (Usability)

a. Are all electronic records retained for a period of two years after

expiration date of a product?

b. Are all records retrievable and are readable?

c. Are older versions of software readable? 

Violation: 9 CFR 116.8 
Items to Consider in Evaluating Electronic Records and Digital Data

ICWI0146.01 Page 3 of 3

Author: Daniel C. Coyle

Issue Date: 01Dec17 

Source Document: ICSOP0046, Evaluation of Electronic Record Keeping and Compliance with title 9,

Code of Federal Regulations, part 116; Veterinary Services Memorandum No. 800.122

II. Regulatory Actions

a. Any violation that reveals that the Outline of Production was not followed or 

cannot substantiate that the Outline of Production was followed is a serious 

violation.

b. See ICSOP0105, Compliance Policy for Issuing Regulatory Actions.