UNCONTROLLED COPY

ICSOP0046.02

Page 1 of 6

United States Department of Agriculture

Center for Veterinary Biologics

Standard Operating Policy/Procedure

Evaluation of Electronic Record Keeping and Compliance with 

Title 9, Code of Federal Regulations, Part 116

Date: June 23, 2017

Number: ICSOP0046.02

Supersedes: ICSOP0046.01, August 25, 2016

Contact: Daniel C. Coyle, (515) 337-6124

Approvals:

/s/Steven A. Karli Date: 05Jul17

Steven A. Karli, Director

Inspection and Compliance

Center for Veterinary Biologics

United States Department of Agriculture

Animal and Plant Health Inspection Service

P. O. Box 844

Ames, IA 50010

INTERNAL USE ONLY

Mention of trademark or proprietary product does not constitute a guarantee or warranty of the 

product by USDA and does not imply its approval to the exclusion of other products that may be 

suitable.

Entered into CVB Quality Management System

by: /s/Linda S. Snavely 05Jul17 

 Linda S. Snavely Date

 Quality Management Program Assistant
Center for Veterinary Biologics ICSOP0046.02

Standard Operating Policy/Procedure Page 2 of 6

Evaluation of Electronic Record Keeping and Compliance with

Title 9, Code of Federal Regulations, Part 116

UNCONTROLLED COPY

Table of Contents

1. Purpose and Scope

2. Procedures

3. Regulatory Actions 

4. Summary of Revisions
Center for Veterinary Biologics ICSOP0046.02

Standard Operating Policy/Procedure Page 3 of 6

Evaluation of Electronic Record Keeping and Compliance with

Title 9, Code of Federal Regulations, Part 116

UNCONTROLLED COPY

1. Purpose and Scope

The purpose of this document is to provide guidance and policy for the Center for Veterinary 

Biologics-Inspection and Compliance (CVB-IC) Biologics Specialist Inspectors concerning the 

evaluation of electronic records maintained by the Licensee or Permittee.

Title 9, Code of Federal Regulations (9 CFR), part 116, requires complete accountability of all 

activities within each establishment. The records must be detailed and must include, but are not 

limited to, items listed in 9 CFR 116. The regulations are suitable for both written and electronic 

record keeping.

This document is to be used by IC personnel to assist in determining Reliability, Authenticity, 

Integrity, and Usability of electronic recordkeeping systems, hereafter referred to as “the 

system.” 

2. Procedures

2.1 Records are maintained on licensed premises unless authorized by the 

Administrator (CVB-IC) to be maintained at an alternate location [9 CFR 116.1(c)]. 

2.1.1 The server used for storing the information, whether partial or complete,

must be maintained at the licensed or permitted site, or approved foreign 

manufacturing site in the case of imported products. 

Requests for alternative locations, or secure cloud system provider, may be 

submitted to CVB-IC, as allowed for in 9 CFR 116.1(c) as an addendum to the 

plot plan legend. Information that should be considered when systems are 

maintained off licensed premises includes controls for data integrity, reliability of 

the system, ability to retrieve needed information, and record retention. Cloud 

based solutions must meet the same security requirements for data availability, 

integrity, reliability, and authenticity. The licensee or permittee must be able to 

demonstrate how the cloud based system is compliant.

2.1.2 The locations or ownership of back up or other multiple systems used in 

the storage of the records must also be identified and comply with the 

requirements set forth in this document.

2.2 Reliability – Records adequately represent activities at the establishment [9 CFR 

116.1(a)(1)]. Controls are in place to ensure documentation is accurate and complete for 

the steps performed in the development and preparation of veterinary biological products

according to the filed Outline of Production. 
Center for Veterinary Biologics ICSOP0046.02

Standard Operating Policy/Procedure Page 4 of 6

Evaluation of Electronic Record Keeping and Compliance with

Title 9, Code of Federal Regulations, Part 116

UNCONTROLLED COPY

2.2.1 The system used for records is developed and tested in Information 

Technology environments separate from the production environment prior to 

deployment for use (production environment).

i. The system is tested and reviewed against manufacturing processes 

and regulatory documents (i.e., label approvals, license restrictions, 

outlines of production, etc.) to ensure critical steps, identification of 

material, amounts added or removed, unit of measure, date and time 

are adequately recorded.

ii. The system was approved by the Licensee or Permittee management 

prior to use of the system in the production environment.

2.2.2 Changes to pre-defined sequence of events must have appropriate 

management approval.

2.2.3 Changes to the system/records must go through a Change Control process 

to assure appropriate steps have been taken to assure all changes are in 

accordance with regulatory and statutory requirements for preparation, and 

distribution of veterinary biological products prior to implementation in the 

production environment. 

i. Changes to programming code

ii. Changes to hardware

iii. Changes to software 

2.3 Authenticity – Records are legible and indelible, verified by initials or signature 

of the person immediately responsible for the action taken [9 CFR 116.1(a)(2)]. Controls 

to protect against unauthorized additions, deletions, alterations, and concealment are in 

place. 

2.3.1 Only one employee can use the electronic document at one time. Read 

access is acceptable for open documents, but write access should be limited to 

only the person working on the document. 

2.3.2 Data entry errors must include information on who made the correction, 

when the correction was made, and why the correction was made. 

2.3.3 Unalterable computer generated date and time stamps, independent from 

operator entries. This action documents actions such as create, modify, and delete. 

2.3.4 A written policy in place regarding acceptability of electronic signature 

and data entry.

2.4 Integrity – Records shall be completed by the licensee or foreign manufacturer

[9 CFR 116.1(a)(3)]. Controls, such as audit trails, to ensure records are complete and 

unaltered. 
Center for Veterinary Biologics ICSOP0046.02

Standard Operating Policy/Procedure Page 5 of 6

Evaluation of Electronic Record Keeping and Compliance with

Title 9, Code of Federal Regulations, Part 116

UNCONTROLLED COPY

Definition: Audit trails refer to the secure time stamped electronic record that allows 

reconstruction of the course of events relating to the creation, modification, and/or

deletion of an electronic record.

2.4.1 Security of the system must be under control.

i. The physical access to server and system must be controlled.

ii. The access to the system from outside of network must be controlled.

iii. The access from a remote location to the system must be controlled.

2.4.2 Roles are assigned in the system for specific functions as a part of Access 

Control.

i. Training must be provided to the employee on their role and process 

required to maintain system security with continuing training 

established.

ii. Certification and re-certification of employee roles must be performed

on intervals determined by the Licensee or Permittee.

iii. A process of assignment of roles and a periodic review of the roles is 

performed.

iv. Access for employees no longer employed is addressed in the system 

appropriately.

2.4.3 A structured new employee and reoccurring training on the security of the 

system, employee responsibilities and management oversight, regarding security

procedures is in place.

2.4.4 The system allows for an audit trail (including user identification, date,

and time) for all critical entries. 

2.4.5 Access to the system must be controlled through complex passwords, key 

card access, or other equivalent means.

2.4.6 There must be a process in place for periodic established review of audit 

trails by the establishment.

2.5 Usability – All records shall be retained at the licensed or foreign establishment 

or permittee’s place of business for a period of two years after expiration date of a 

product or longer as may be required by the Administrator [9 CFR 116.8]. Mechanisms 

are in place to ensure records can be located, retrieved, presented, and interpreted 

throughout the lifecycle according to the regulations.

2.5.1 Records are retrievable.

i. Archived records are complete and can be accessed and read.

ii. Audit trails must be available.
Center for Veterinary Biologics ICSOP0046.02

Standard Operating Policy/Procedure Page 6 of 6

Evaluation of Electronic Record Keeping and Compliance with

Title 9, Code of Federal Regulations, Part 116

UNCONTROLLED COPY

2.5.2 Upgrades in software versions, changes in hardware, addition of new 

equipment, and new programming codes do not inactivate or render records 

unusable.

2.5.3 Information retrieved is understandable.

3. Regulatory Actions 

3.1 The use of electronic record keeping that does not comply with the requirements 

of 9 CFR 116 may constitute a risk to the final product. 

3.2 The severity of the violation requires a risk evaluation by the Biologics Specialist

and may require CVB Management input. 

4. Summary of Revisions

Version .02

 2.1.1 and 2.1.2 – revised 

 Deleted 2.6 – no APHIS Form 2007 needed.