FDA Docket No. 2004N-0133 Themes for Renewal of 21 CFR Part 11 Rule & Guidance by Dr. Teri Stokes, GXP International

Recent “Discretionary & Narrow” Focus Industry responses: Good, now we can forget Part 11! Wow, we don’t know what is expected anymore! The Part 11 Rule says one thing and the Part 11 Guidance says another. Enforcement is up to investigator opinion. Slide 2

21 CFR Part 11 Sec : System Controls Management Control Validation of systems (a) Limit system access by authorization (d) Training for system developers, users & support personnel (i) SOP for e-signature responsibility (j) System Reliability System checks to enforce steps & events in sequence (f) Device checks for identity of input sources (h) Control of system documentation & change control of system (k) Auditable Quality Copies of records possible for inspection & review (b) Time-stamped audit trails (e) No “copy & paste” for e-signatures (11.70) Data Integrity Ability to identify altered records (a) Record protection & retrieval during retention periods (c) Authority checks for user actions on the system (g) Slide 3 Good IT Business Practices

Missing Link – Defined Roles  Regulated Area Manager – Manager responsible for a computerized work process subject to Predicate Rules  Regulated Area System User – Person using computerized systems in a work process subject to Predicate Rules  Application Supplier – Person developing software to be used for data entry, capture, analysis, storage, retrieval, reporting, and/or archival subject to Predicate Rules  Infrastructure Supplier – Person implementing all technology required to deliver an application to the regulated work process Slide 4 Defined Roles & Responsibilities

Missing Link – Defined Roles  Contractor/Subcontractor – Person under contract to deliver any one or all of the above roles on behalf of a regulated company or its designee  Contract Initiator – Person delegating Predicate Rule-related activities associated with a computerized system  Part 11 Computerized System – Computer hardware, software, and communications configured to support a work process that consists of equipment, people, and SOPs and that is subject to a Predicate Rule Slide 5 Defined Roles & Responsibilities

Missing Link – Defined Responsibilities  Regulated Area Manager – Provides business strategy and appropriate resources for Predicate Rule Risk Analysis and User Acceptance validation of systems. Provides work process personnel with training on system operations, Part 11, and change control activities.  Regulated Area System User – Attends training and uses system to approved SOPs and Work Instructions. Participates in User Acceptance validation work and change control testing. Slide 6 Defined Roles & Responsibilities

Missing Link – Defined Responsibilities  Application Supplier – Uses a documented software development life cycle (SDLC) process to develop and support software. Delivers system documentation and training. Tracks and responds to bug fixing requests. Follows a documented software upgrade process.  Infrastructure Supplier – Performs installation qualification (IQ) of all supporting technology platforms prior to production use of a Part 11 and Predicate Rule regulated application. Slide 7 Defined Roles & Responsibilities

Missing Link – Defined Responsibilities  Contractor/Subcontractor – Performs Part 11 responsibilities relevant to respective role(s) as delegated in contract.  Contract Initiator – Designs contract to specify relevant Part 11 and Predicate Rule needs. Audits contractor/subcontractor for ability to meet needs before signing and during performance of contracted work.  Part 11 Computerized System – Performs reliably to consistently meet Part 11 standards for Predicate Rule e-records and e-signatures. Has validation documentation to show that it is reliable and under management change control in the regulated work process. Slide 8 Defined Roles & Responsibilities

Themes for a Renewed Part 11 Rule Reinforce same/similar Good IT Practices Define Roles & Responsibilities for system control Establish parity for Part 11 resource allocation with other Predicate Rule requirements, e.g., validation of methods, equipment, and process Outline an enforcement strategy that is consistent with Part 11 Rule Separate out the Part 11 technology needs of electronic submissions from Predicate Rule practices Keep Part 11 generic across all Predicate Rules Slide 9

Common Sense Computer Validation for Data Quality and Data Integrity FDA Docket No. 2004N-0133 Thank You FDA Regulations