Source: https://www.vaisala.com/en/blog/2018-09/three-fundamental-elements-21-cfr-part-11-and-annex-11
Timestamp: 2019-01-17 21:59:43
Document Index: 681336984

Matched Legal Cases: ['art 11', 'art 11', 'art 11', 'art 11', 'art 11', 'art 11', 'art 11', 'art 11', 'art 11', 'art 11', 'art 11', 'art 11', 'art 11']

Three Fundamental Elements of 21 CFR Part 11 and Annex 11 | Vaisala
Along with providing monitoring and validation systems, we often delve into issues that arise for our customers when they are interpreting regulations and guidance. We receive many questions on 21 CFR Part 11 and Annex 11. In this article, we offer some background and a brief overview of three focal points of both of the "Elevens" including System Controls, Validation and Archiving.
It's important to note that Part 11 is a requirement in the US, whereas Annex 11, which applies to the EU, is a guidance document only.
But first, test your knowledge with a quick quiz on Part 11...
The "Elevens": Some Background
Computerized systems — crucial to pharmaceutical, medical device, and biotechnology manufacturing and distribution operations — differ from paper-based systems and manual systems traditionally used for creating and archiving records are becoming rare.
This is (partly) why the FDA and EMA created 21 CFR Part 11 and Annex 11. But the real basis of "the elevens" is to ensure that the quality and safety of drugs and biologicals do not suffer as a result of computerized systems replacing a manual system.
Annex 11 states:
The FDA's statement entails the fact that for generations, paper records were all we had to depend upon to ensure that processes and conditions that preserved the safety and quality of drugs were performed properly.
Both Part 11 and Annex 11 remind us of the importance of safety and address the need to set up standards to make ink and electronic or digital signatures equivalent in their effect.
Controls: Human Readable, Unmodifiable, Authorized
Both Part 11 and Annex 11 include the following elements:
One glimpse at the list shows that each is in some part a method for controlling the function and outputs of a system.
In 21 CFR Part 11 "Controls for Closed Systems" states:
(b) "The ability to generate accurate and complete copies of records in both human readable and electronic form suitable for inspection, review, and copying by the agency."
The fact that there is a specific regulation regarding human-readable copies demonstrates how far technology has evolved. It would be hard today to imagine a user-friendly system that did not allow for the printing of documents and data.
For most monitoring systems, the records of interest are the actual historical monitoring values. And creating a human-readable copy likely means that historical data and event logs may be printed out in a secure format.
In 21 CFR Part 11 (e) in "Section 11.10 - Controls for Closed Systems we read:
In terms of your environmental monitoring applications, this simply means that, in order for your records to comply, the electronic records (data and events) cannot be manually modifiable or deletable.
In addition, the Audit Trail of your system needs to capture any changes to metadata (schedules and report templates) and configuration data without obscuring earlier entries. If your system doesn’t allow any changes to values once recorded, it complies with those sections of both Part 11 and Annex 11.
As a closed system, your monitoring system needs to limit access to only "authorized individuals." That's item (d) in Section 11.10 of Part 11. Typically this means that all who have access to the system have a distinct username and secure password. Often a system will integrate with your OS authentication to leverage commonly used, pre-existing password management tools.
Validation: Prove it Works & Document your proof
(a) "Validation of systems to ensure accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records."
In Annex 11, the "Project Phase" section covers validation in eight fairly brief, fairly straightforward points:
Use risk assessment to justify standards, protocols, acceptance criteria, procedures and records
Use correct change control documentation practice to report deviations
Keep an Inventory of your computerized systems with descriptions, interfaces, processes, software and hardware
Use risk assessment to assess the GMP impact of User Requirements Specifications
Audit suppliers’ Quality Management Systems
Validation of computerized systems covers the entire life-cycle of the system
Validate data transfers
We see that Annex 11 is more explicit in recommendations for validation.
For Vaisala's systems, we provide an IQOQ set of protocols and, if the customer desires, we execute as well.
Archiving: Validated, Secure, Accessible
The protection and retention of records, as described in Part 11's Section 11.10 (c) means that whatever data your system produces, it may not be altered. In addition, to meet the requirement of "ready retrieval throughout the records retention period," your data needs to be archived in a way that it can be conveniently accessed – you don’t want to make an auditor wait,
If you store the data permanently within your database, the database should be designed in such a way system's performance should not degrade as the database grows over time. How you meet this requirement of 21 CFR Part 11 may have as much to do with the design of your system as it does with your system administration policies around archival.
In Annex 11 under “Data Storage,” it is recommended that data be securely stored and backed up BOTH physically and electronically and regularly checked for accessibility, readability, and accuracy. Annex 11 also mentions is the need to validation data restoration abilities of the system.
We didn't cover Electronic Signatures because that's a specialized software function. Specialty enterprise software exists for implementing Electronic Signatures within an Electronic Document Management System (EDMS). For Vaisala's monitoring solution, we use a "hybrid" system, which means it uses electronic records combined with handwritten signatures, wherein the PDF outputs can be imported into and EDMS.
Happy 80th Anniversary Vaisala!
This year is Vaisala's 8th decade of creating environmental measurement solutions. We kick off this celebratory year with a brief video on what Vaisala has done, what we are doing now,and what we hope to do in the future...
Watch Future Positive video
Please refer to our Knowledge Base for further regulatory papers and application notes.