Source: https://www.pharmacistspharmajournal.org/2009/08/guidance-for-industry-21-cfr-part-11.html
Timestamp: 2020-08-07 12:59:55
Document Index: 291140164

Matched Legal Cases: ['art 11', 'art 11', 'art 11', 'art 11', 'art 11', 'art 11', 'art 11', 'art 11', 'art 11', 'art 11', 'art 11', 'art 11', 'art 11', '§ 11', 'art 11', 'art 11', 'art 11', 'art 11', 'art 11', 'art 11', 'art 11', 'art 11', 'art 11', 'art 11', 'art 11', 'art 11', 'art 11', 'art 11', 'art 11', 'art 11', 'art 11', 'art 11', 'art 11', 'art 11', 'art 11', 'art 11', 'art 11', 'art 11', 'art 11', 'art 11', 'art 11', '§ 11', '§ 11', '§ 11', 'art 11', 'art 11', 'art 11', 'art 11', 'art 11', 'art 11', '§ 11', 'art 11', 'art 11', 'art 11', '§ 11', 'art 11', 'art 11', 'art 11', 'art 11', 'art 11', '§ 11', '§ 11', 'art 11', '§ 11', '§11', '§ 58', 'art 11', 'art 11', 'art 11', '§ 11', '§11', '§ 211', 'art 211', 'art 820', 'art 58']

Pharma Guidelines Novel Medical Drug Research Pharmaceutical Manufacturing Guidelines: 21 CFR Part 11 Electronic Records Electronic Signatures Scope Application
21 CFR Part 11 Electronic Records Electronic Signatures Scope Application
In advancement of technology our pharmaceutical manufacturing process too is taken care by automatic systems,
so is the docomentation in process of manufacturing of pharmaceutical , but it is mandatory with respect to 21 CFR Part 11 of US FDA regulations for Food and drugs to comply with the requirement of FDA regarding Electronic Records . US FDA has made effective in August 1997 it has discussed it in details for Pharmaceutical CGMPs
21 CFR Part 11; Electronic Records; Electronic Signatures, Validation
21 CFR Part 11; Electronic Records; Electronic Signatures, Glossary of Terms
21 CFR Part 11; Electronic Records; Electronic Signatures, Time Stamps
21 CFR Part 11; Electronic Records; Electronic Signatures, Maintenance of Electronic Records
21 CFR Part 11; Electronic Records; Electronic Signatures, Electronic Copies of Electronic Records
But looking at some difficulties in implementation and cost , and level of benifite , FDA has further issued a guidance document where it has made some points clear that , it is relaxing the law , but is mandatory , what is the must requred , for electroic records , FDA has dissued in its guidance document issued to industry in Aug 2003.
We recomend you to read follwing guidance document and as there are always advancements in the guidelines we recomend you to stay updated with the regulations.
Document starts here.
This guidance is intended to describe the Food and Drug Administration's (FDA’s) current
thinking regarding the scope and application of part 11 of Title 21 of the Code of Federal
Regulations; Electronic Records; Electronic Signatures (21 CFR Part 11).2 20
This document provides guidance to persons who, in fulfillment of a requirement in a statute or another part of FDA's regulations to maintain records or submit information to FDA,3 have chosen to maintain the records or submit designated information electronically and, as a result, have become subject to part 11. Part 11 applies to records in electronic form that are created, modified, maintained, archived, retrieved, or transmitted under any records requirements set forth in Agency regulations. Part 11 also applies to electronic records submitted to the Agency under the Federal Food, Drug, and Cosmetic Act (the Act) and the Public Health Service Act (the PHS Act), even if such records are not specifically identified in Agency regulations (§ 11.1).The underlying requirements set forth in the Act, PHS Act, and FDA regulations (other than part 11) are referred to in this guidance document as predicate rules.
As an outgrowth of its current good manufacturing practice (CGMP) initiative for human and animal drugs and biologics,4 FDA is re-examining part 11 as it applies to all FDA regulated products. We anticipate initiating rulemaking to change part 11 as a result of that re- examination. This guidance explains that we will narrowly interpret the scope of part 11. While the re-examination of part 11 is under way, we intend to exercise enforcement discretion with respect to certain part 11 requirements. That is, we do not intend to take enforcement action to enforce compliance with the validation, audit trail, record retention, and record copying requirements of part 11 as explained in this guidance. However, records must still be maintained or submitted in accordance with the underlying predicate rules, and the Agency can take regulatory action for noncompliance with such predicate rules. In addition, we intend to exercise enforcement discretion and do not intend to take (or recommend) action to enforce any part 11 requirements with regard to systems that were operational before August 20, 1997, the effective date of part 11 (commonly known as legacy systems) under the circumstances described in section III.C.3 of this guidance.
Note that part 11 remains in effect and that this exercise of enforcement discretion applies only as identified in this guidance. FDA's guidance documents, including this guidance, do not establish legally enforceable responsibilities. Instead, guidances describe the Agency's current thinking on a topic and should be viewed only as recommendations, unless specific regulatory or statutory requirements are 54
cited. The use of the word should in Agency guidances means that something is suggested or recommended, but not required.
As a result of these concerns, we decided to review the part 11 documents and related issues, particularly in light of the Agency's CGMP initiative. In the Federal Register of February 4, 2003 (68 FR 5645), we announced the withdrawal of the draft guidance for industry, 21 CFR Part 11; Electronic Records; Electronic Signatures, Electronic Copies of Electronic Records.We had decided we wanted to minimize industry time spent reviewing and commenting on the draft guidance when that draft guidance may no longer represent our approach under the CGMP initiative. Then, in the Federal Register of February 25, 2003 (68 FR 8775), we announced the withdrawal of the part 11 draft guidance documents on validation, glossary of terms, time stamps,5 maintenance of electronic records, and CPG 7153.17. We received valuable public comments on these draft guidances, and we plan to use that information to help with future decision-making with respect to part 11. We do not intend to re-issue these draft guidance documents or the CPG. We are now re-examining part 11, and we anticipate initiating rulemaking to revise provisions of that regulation. To avoid unnecessary resource expenditures to comply with part 11 requirements, we are issuing this guidance to describe how we intend to exercise enforcement discretion with regard to certain part 11 requirements during the re-examination of part 11. As mentioned previously, part 11 remains in effect during this re-examination period.
• Part 11 will be interpreted narrowly; we are now clarifying that fewer records will be considered subject to part 11.
• For those records that remain subject to part 11, we intend to exercise enforcement discretion with regard to part 11 requirements for validation, audit trails, record retention,
and record copying in the manner described in this guidance and with regard to all part 11
requirements for systems that were operational before the effective date of part 11 (also known as legacy systems).
• We will enforce all predicate rule requirements, including predicate rule record and recordkeeping requirements. It is important to note that FDA's exercise of enforcement discretion as described in this guidance is limited to specified part 11 requirements (setting aside legacy systems, as to which the extent of enforcement discretion, under certain circumstances, will be more broad). We intend to enforce all other provisions of part 11 including, but not limited to, certain controls for closed systems in § 11.10. For example, we intend to enforce provisions related to the following controls and requirements:
• establishment of and adherence to written policies that hold individuals accountable for
actions initiated under their electronic signatures
• controls for open systems corresponding to controls for closed systems bulleted above (§ 11.30)
• requirements related to electronic signatures (e.g., §§ 11.50, 11.70, 11.100, 11.200, and
11.300) We expect continued compliance with these provisions, and we will continue to enforce them.
Furthermore, persons must comply with applicable predicate rules, and records that are required to be maintained or submitted must remain secure and reliable in accordance with the predicate rules.
B. Details of Approach – Scope of Part 11
We understand that there is some confusion about the scope of part 11. Some have understood the scope of part 11 to be very broad. We believe that some of those broad interpretations could lead to unnecessary controls and costs and could discourage innovation and technological advances without providing added benefit to the public health. As a result, we want to clarify that the Agency intends to interpret the scope of part 11 narrowly. Under the narrow interpretation of the scope of part 11, with respect to records required to be maintained under predicate rules or submitted to FDA, when persons choose to use records in electronic format in place of paper format, part 11 would apply. On the other hand, when persons use computers to generate paper printouts of electronic records, and those paper records meet all the requirements of the applicable predicate rules and persons rely on the paper records to perform their regulated activities, FDA would generally not consider persons to be "using electronic records in lieu of paper records" under §§ 11.2(a) and 11.2(b). In these instances, the use of computer systems in the generation of paper records would not trigger part 11.
• Records that are required to be maintained under predicate rule requirements and that are maintained in electronic format in place of paper format. On the other hand, records (and any associated signatures) that are not required to be retained under predicate rules, but that are nonetheless maintained in electronic format, are not part 11 records.
We recommend that you determine, based on the predicate rules, whether specific records
are part 11 records. We recommend that you document such decisions.
• Records that are required to be maintained under predicate rules, that are maintained in electronic format in addition to paper format, and that are relied on to perform regulated
activities. In some cases, actual business practices may dictate whether you are using electronic records instead of paper records under § 11.2(a). For example, if a record is required to be maintained under a predicate rule and you use a computer to generate a paper printout of the electronic records, but you nonetheless rely on the electronic record to perform regulated activities, the Agency may consider you to be using the electronic record instead of the paper record. That is, the Agency may take your business practices into account in determining whether part 11 applies. Accordingly, we recommend that, for each record required to be maintained under predicate rules, you determine in advance whether you plan to rely on the electronic record or paper record to perform regulated activities. We recommend that you document this decision (e.g., in a Standard Operating Procedure (SOP), or specification document).
• Records submitted to FDA, under predicate rules (even if such records are not specifically identified in Agency regulations) in electronic format (assuming the records
have been identified in docket number 92S-0251 as the types of submissions the Agency
accepts in electronic format). However, a record that is not itself submitted, but is used
in generating a submission, is not a part 11 record unless it is otherwise required to be maintained under a predicate rule and it is maintained in electronic format.
• Electronic signatures that are intended to be the equivalent of handwritten signatures, initials, and other general signings required by predicate rules. Part 11 signatures include
electronic signatures that are used, for example, to document the fact that certain events or actions occurred in accordance with the predicate rule (e.g. approved, reviewed, and verified).
C. Approach to Specific Part 11 Requirements 212
1. Validation 214
The Agency intends to exercise enforcement discretion regarding specific part 11 requirements for validation of computerized systems (§ 11.10(a) and corresponding requirements in § 11.30).
Although persons must still comply with all applicable predicate rule requirements for validation (e.g., 21 CFR 820.70(i)), this guidance should not be read to impose any additional requirements for validation. We suggest that your decision to validate computerized systems, and the extent of the validation, take into account the impact the systems have on your ability to meet predicate rule 223
requirements. You should also consider the impact those systems might have on the accuracy, reliability, integrity, availability, and authenticity of required records and signatures. Even if there is no predicate rule requirement to validate a system, in some instances it may still be important to validate the system. We recommend that you base your approach on a justified and documented risk assessment and a determination of the potential of the system to affect product quality and safety, and record integrity. For instance, validation would not be important for a word processor used only to generate SOPs. For further guidance on validation of computerized systems, see FDA’s guidance for industry and FDA staff General Principles of Software Validation and also industry guidance such as the GAMP 4 Guide (See References).
The Agency intends to exercise enforcement discretion regarding specific part 11 requirements related to computer-generated, time-stamped audit trails (§ 11.10 (e), (k)(2) and any corresponding requirement in §11.30). Persons must still comply with all applicable predicate rule requirements related to documentation of, for example, date (e.g., § 58.130(e)), time, or sequencing of events, as well as any requirements for ensuring that changes to records do not obscure previous entries. Even if there are no predicate rule requirements to document, for example, date, time, or sequence of events in a particular instance, it may nonetheless be important to have audit trails or other physical, logical, or procedural security measures in place to ensure the trustworthiness and reliability of the records.6 We recommend that you base your decision on whether to apply audit trails, or other appropriate measures, on the need to comply with predicate rule requirements, a justified and documented risk assessment, and a determination of the potential effect on product quality and safety and record integrity. We suggest that you apply appropriate controls based on such an assessment. Audit trails can be particularly appropriate when users are expected to create, modify, or delete regulated records during normal operation.
• The system was operational before the effective date.
• The system met all applicable predicate rule requirements before the effective date.
• The system currently meets all applicable predicate rule requirements.
• You have documented evidence and justification that the system is fit for its intended use (including having an acceptable level of record security and integrity, if applicable). If a system has been changed since August 20, 1997, and if the changes would prevent the system from meeting predicate rule requirements, Part 11 controls should be applied to Part 11 records and signatures pursuant to the enforcement policy expressed in this guidance.
The Agency intends to exercise enforcement discretion with regard to specific part 11
requirements for generating copies of records (§ 11.10 (b) and any corresponding requirement in §11.30). You should provide an investigator with reasonable and useful access to records during an inspection. All records held by you are subject to inspection in accordance with predicate rules (e.g., §§ 211.180(c), (d), and 108.35(c)(3)(ii)).
• Using established automated conversion or export methods, where available, to make
copies in a more common format (examples of such formats include, but are not limited
to, PDF, XML, or SGML)
We suggest that your decision on how to maintain records be based on predicate rule requirements and that you base your decision on a justified and documented risk assessment and a determination of the value of the records over time. FDA does not intend to object if you decide to archive required records in electronic format to nonelectronic media such as microfilm, microfiche, and paper, or to a standard electronic file format (examples of such formats include, but are not limited to, PDF, XML, or SGML). Persons must still comply with all predicate rule requirements, and the records themselves and any copies of the required records should preserve their content and meaning. As long as predicate rule requirements are fully satisfied and the content and meaning of the records are preserved and archived, you can delete the electronic version of the records. In addition, paper and electronic record and signature components can co-exist (i.e., a hybrid8 situation) as long as predicate rule requirements are met and the content and meaning of those records are preserved.
1 This guidance has been prepared by the Office of Compliance in the Center for Drug Evaluation and Research (CDER) in consultation with the other Agency centers and the Office of Regulatory Affairs at the Food and Drug Administration.
2 62 FR 13430
3 These requirements include, for example, certain provisions of the Current Good Manufacturing Practice regulations (21 CFR Part 211), the Quality System regulation (21 CFR Part 820), and the Good Laboratory Practice for Nonclinical Laboratory Studies regulations (21 CFR Part 58).
4 See Pharmaceutical CGMPs for the 21st Century: A Risk-Based Approach; A Science and Risk-Based Approach to Product Quality Regulation Incorporating an Integrated Quality Systems Approach
5 Although we withdrew the draft guidance on time stamps, our current thinking has not changed in that when using time stamps for systems that span different time zones, we do not expect you to record the signer’s local time. When using time stamps, they should be implemented with a clear understanding of the time zone reference used. In such instances, system documentation should explain time zone references as well as zone acronyms or other naming conventions.
1. Glossary of Computerized System and Software Development Terminology (Division of Field Investigations, Office of Regional Operations, Office of Regulatory Affairs, FDA 1995) (http://www.fda.gov/ora/inspect_ref/igs/gloss.html)
(FDA, Center for Devices and Radiological Health, Center for Biologics Evaluation and
Research, 2002)
3. Guidance for Industry, FDA Reviewers, and Compliance on Off-The-Shelf Software Use in Medical Devices (FDA, Center for Devices and Radiological Health, 1999)
4. Pharmaceutical CGMPs for the 21st Century: A Risk-Based Approach; A Science and
Risk-Based Approach to Product Quality Regulation Incorporating an Integrated Quality
Systems Approach (FDA 2002)
1. The Good Automated Manufacturing Practice (GAMP) Guide for Validation of 343
Automated Systems, GAMP 4 (ISPE/GAMP Forum, 2001)
2. ISO/IEC 17799:2000 (BS 7799:2000) Information technology – Code of practice for
information security management (ISO/IEC, 2000)
3. ISO 14971:2002 Medical Devices- Application of risk management to medical devices
(ISO, 2001)
US FDA guidelines requirements of FDA compliance and GMP guidelines