Source: https://www.mastercontrol.com/gxp-lifeline/annex-11-21-cfr-part-11-comparison/
Timestamp: 2019-09-19 19:46:26
Document Index: 14133421

Matched Legal Cases: ['art 11', 'art 11', 'art 11', 'art 11', 'art 11', 'art 11', 'art 11']

31 January, 2012 Orlando Lopez, Independent Consultant
Annex 11 and 21 CFR Part 11: Comparisons for International Compliance.
be permanently linked to their respective record(s) (11.70); and
include the time and date of signature (11.50(a)(2).
Validation (11.10(a))
Validation is the "formal assessment and reporting of quality and performance measures for all the lifecycle stages of software and system development, its implementation, qualification and acceptance, operation, modification, re-qualification, maintenance and retirement. This should enable both the regulated user, and competent authority to have a high level of confidence in the integrity of both the processes executed within the controlling computer system(s) and in those processes controlled by and/or linked to the computer system(s), within the prescribed operating environment(s)." The FDA has maintained the requirement for validation because the agency believes that it is necessary that software be validated to the extent possible to adequately ensure performance.
The correct validation implementation program on computer systems "ensures accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records."
In the EU Annex 11, validation of computer systems is an element of the project phase and takes center stage. The validation phase has been extensively expanded in the updated Annex 11 to cover the complete computer system life cycle. One of the main principles of this Annex states that: "The application should be validated; IT infrastructure should be qualified."
A significant and essential activity at the beginning of a computer system's life cycle is to establish the intended use and proper performance of computer systems. The intended use is one of the factors to account to determine the granular level of the computer systems validation.
The phrase "proper performance" relates to the general principle of validation . Planned and expected performance is based upon predetermined design specifications, consequently, "intended use."
All computer systems automating any regulated function must be validated for its intended use. This requirement applies to any computer system automating the design, testing, raw material or component acceptance, manufacturing, labeling, packaging, distribution, complaint handling, or to automate any other aspect of the quality system.
In addition, computer systems creating, modifying, and maintaining electronic records and managing electronic signatures are also subject to the validation requirements. Such computer systems must be validated to ensure accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records.
Appropriate installation and operational qualifications should demonstrate the suitability of computer hardware and software to perform assigned tasks.
The ability to generate accurate, complete copies of records (11.10(b))
According to this requirement, also contained as well in Annex 11-5 documentation, it must be possible to obtain clear printed copies of electronically stored e-records. When generating an electronic copy of an electronic record, any file conversions must be qualified.
Protection of records (11.10(c) and (d))
Computer systems electronic records must be controlled including records retention, backup and security.
The data collected in a computer system should be secured by both physical and electronic means against damage. The access to data should be ensured throughout the retention period.
One of many activities supporting this requirement is backups. Backups must be performed on electronic copies of electronic records and stored separately from the primary electronic records. The objective of the backup is to guarantee the availability of the stored data and, in case of loss of data, to reconstruct all GMP-relevant documentation.
According to 11-7.2 and similarly to an electronic file, the integrity and accuracy of backup data and the ability to restore the data should be verified during validation and periodically (Annex 11-7.1). The frequency and extent of backup should be based on the effort involved to recreate the data. This should be defined in the backup procedure.
Measures must be taken, however, to ensure that backup data are exact and complete and that they are secure from alteration, inadvertent erasure, and loss.
Security is an issue covered in all regulations. The basic principle in Annex 11 is that computer systems must have adequate controls to prevent unauthorized access or changes to data, inadvertent erasures, or loss (Annex 11-7.1)
Use of computer-generated, time-stamped audit trails (11.10(e), (k)(2) and associated requirements in 11.30).
One of the first references on the use of audit trails in FDA guidelines is from the 1978 current good manufacturing practices (cGMP) preamble. The comment on paragraph 186 states: "If a computer system has the capability, however, to verify its output, such as with audit trails, this could be considered as a check for accuracy."
As in Annex 11-9, the system-generated audit trail referenced in 11.10(e) or other physical, logical, or procedural security measures must be in place to ensure the trustworthiness and reliability of the records. The appropriate measures should be based on a risk assessment. For change or deletion of cGMP-relevant data the reason should be documented.
This is one requirement where, since 2003, the FDA has exercised enforcement discretion. Regulated firms must still comply with all applicable predicate rule requirements related to documentation of date, time or sequencing of events, as well as any requirements for ensuring that changes to records do not obscure previous entries.
Audit trails are appropriate when the regulated user is expected to create, modify or delete regulated records during normal operation.
Use of appropriate controls over systems documentation.
Computer system documentation means records that relate to system operation and maintenance, from high-level design documents to end-user manuals. All regulatory provisions applicable to software are also applicable to its documentation.
Computer system documents are generated/updated during the implementation/maintenance project, correspondingly. These documents may be either printed material or electronic records, such as computer files, storage media or film. Storing a large number of documents increases the cost of document management because of the increasing difficulty of keeping the documents consistent with the computer system. Computer system documents must be available if needed for review. Obsolete information must be archived or destroyed in accordance with a written record retention plan.
Even Annex 11 provides guidance on documentation; there is no explicit guidance on controls over computer systems documentation. The applicable controls on documentation can be found in the new version of Chapter 4 ("Documentation") of the EU Guideline to GMP. Chapter 4 can be used as a guidance to implement 11.10(k).
System access be limited to authorized individuals (11.10(d), (g) and (h))
Security is a key issue in computer systems, including the use of authority checks (21 CFR 11.10(g)) to ensure that only authorized individuals can use the system and alter records.
Part 11 security requirements listed in 11.10(d), (g) and (h), are covered in Annex 11-7.1 and 11-12. In addition, Annex 11-4.3 calls for "An up-to-date listing of all relevant systems and their GMP functionality (inventory) should be available...and security measures should be available."
A determination that persons who develop, maintain or use electronic records and signature systems have the education, training, and experience to perform their assigned tasks.
Annex 11-2 covers this Part 11 requirement.
The revised Annex 11 lists in a comprehensive manner 11.10 requirements.
In the context of the content of Part 11 and Annex 11, the main difference between the two is that Part 11 is a regulation. The nature of a regulation restricts the granularity of the guidance that a regulator may provide. The regulated user will get less guidance in Part 11 than in the Annex 11. The guidance by the regulator on Part 11 can be found in the preamble of this regulation and in the 2003 guidance document.
General Manufacturing 13 Medical Device 244 Nutraceuticals 16 Pharma 215 Quality 212