1. Part 11 Public Meeting PEERS Questions & Responses The opinions expressed here belong to PEERS members and not the corporate entities with which they are affiliated.

2. 2 About PEERS Triangle PEERS (Triangle Part Eleven Electronic Records & Signatures) is an association based in Research Triangle Park, NC, whose members include representatives from over 40 organizations: – Pharmaceutical Companies – Clinical Research Organizations (CROs) – Academic Research Organizations – Validation and IT Systems Consultants – Technology Vendors

3. 3 What We Do PEERS members possess expertise in a variety of perspectives including: – Technology – Process Engineering – Quality Assurance – Regulatory Affairs – Data Collection & Management – Legal – Data Security

4. 4 Purpose PEERS members focus primarily on the practical implementation of Part 11 in the conduct of clinical trials and how Part 11 may relate to Good Clinical Practices (GCPs). With this GCP focus, the PEERS presenters intend to: – Identify problems – Recommend solutions – Suggest revised language, as appropriate

5. 5 Overview Part 11 and the GCP Challenge Revisions / Additions to Definitions Predicate Rules Security for Open Systems Investigations & Follow-Ups Collaboration Provision

6. 6 Part 11 and the GCP Challenge FDA Part 11 emphasis has been focused on Good Manufacturing Practices (GMP) and Good Laboratory Practices (GLP). GMP/GLP: – Regulations have clear record requirements. – Regulations specify when signatures, initials, and other general signings are required. – Focus on record integrity. – Operations are more equipment intensive.

7. 7 Part 11 and the GCP Challenge GCP: Open to Part 11 Interpretation – Regulations are based more on activities and responsibilities. – Regulations are less prescriptive regarding required records and signatures. – Systems are more related to data storage, analysis, and manipulation. – Frequent data movement occurs between systems, between sites, labs, CROs, and sponsors. The GCP concerns relate to continued data integrity because of conclusions reached for submissions.

8. 8 Revisions / Additions to Definitions Q & A Q (A2): Should there be revisions / additions to the definitions in Part 11? A: Yes. Please add the following definitions to Part 11: – Risk Assessment – Computer System Validation – Systems Documentation

9. 9 Revisions / Additions to Definitions Suggested Wording Risk Assessment The process of identifying, assessing, prioritizing, mitigating, and monitoring the likelihood of occurrence and impact of risks to product quality, patient safety, and record integrity. (Frequently misinterpreted to mean Risk Management)

10. 10 Revisions / Additions to Definitions Suggested Wording Computer System Validation The ongoing process of establishing documented evidence that provides a high degree of assurance that a computerized system will consistently perform according to its pre-determined specifications and quality attributes. This includes procedures, requirements and specifications, testing, and change control. (GCP Challenge: Definition is non-existent)

11. 11 Revisions / Additions to Definitions Suggested Wording Systems Documentation The collection of documents generated or compiled by the organization as evidence of validation planning and execution of validation for computerized systems. This includes procedures, requirements and specifications, testing, change control, operation and maintenance documents, and generated reports.

12. 12 Predicate Rules Q & A Q (A3, B2, and D2): Is clarification needed regarding which records are required by predicate rules [especially when] those records are not specifically identified in GCP predicate rules? A: Yes. Please clarify what records are required by the GCP regulations (and hence Part 11 applies) and what records are implied because they meet an activity required by the regulations.

13. 13 Predicate Rules For Clarification Which records and signatures are required by GCP predicate rules; Where GCP predicate regulations make no mention of records, a determination of when records are expected in support of activities required by predicate rules, that is, a clarification of the concepts of “implied records”; and Are global regulations such as ICH Harmonised Tripartite Guidelines for GCP considered the equivalent of predicate rules?

14. 14 Security for Open Systems Q & A Q (B1) : Should other areas of Part 11 incorporate the concept of risk-based approach? Q (B4) : Should Part 11 differentiate between open and closed systems? A: Yes. Maintain the distinction between open and closed systems but adopt a risk- based approach for open systems.

15. 15 Security for Open Systems Recommendations The distinction between open and closed systems should be maintained. Adopt a risk-based approach for open system security that addresses authenticity, integrity, and, as appropriate, confidentiality. Remove references to specific technology.

16. 16 Investigations & Follow-Ups Q & A Q (C) : Should Part 11 address investigations and follow-up when security breaches occur? A: No. Investigation and follow-up are already implied in 11.10(d) and 11.300(d).

17. 17 Investigations and Follow-Ups: Larger Issue Does FDA consider the security provisions in 11.300(a)-(e) applicable not only to Electronic Signatures but also to Electronic Records?

18. 18 Collaboration Provision Q & A Q (D8) : Are there provisions of Part 11 that should be augmented, modified, or deleted as a result of new technologies that have become available since Part 11 was issued? A: Yes. Collaboration provision 11.200(a)(3) should be deleted since use by the genuine owner is already addressed by 11.200(a)(2).

19. 19 Conclusion Triangle PEERS requests that the FDA revise Part 11 and/or provide guidance for the consistent application of Part 11 throughout the GCP realm. THANK YOU!