FDA Public Meeting Electronic Records; Electronic Signatures Docket No. 2004N-0133 Madeleine Kennedy & Michael Rutherford Eli Lilly and Company 11 June 2004

FDA Public Meeting on Part June 2004 Copyright © 2004 Eli Lilly and Company 3 General Comments We agree with FDA’s current thinking as expressed in the Part 11 Guidance document. We recommend that the Part 11 Regulation be updated to be consistent with the Guidance document. Given the critical role of predicate rules in determining part 11 scope, we recommend that FDA also give consideration to reviewing and, where necessary, updating the predicate rules.

FDA Public Meeting on Part June 2004 Copyright © 2004 Eli Lilly and Company 4 Ref IV.B Part 11 Subpart B - ER 1. The Guidance document recommends that a risk-based approach be taken in three specific areas, namely validation, audit trails and record retention. We recommend that the Part 11 regulation be updated to extend the risk-based approach to all electronic record controls. This would not be inconsistent with the spirit of the regulation (i.e., sections and of the Part 11 regulation states “Persons….shall employ procedures and controls designed to ensure the authenticity, integrity, and when appropriate, the confidentiality of electronic records).

FDA Public Meeting on Part June 2004 Copyright © 2004 Eli Lilly and Company 5 Ref IV.D. Additional Questions for Comment 2. The Guidance document defines records in scope to be those that are “required to be maintained under predicate rule requirements”. However, it goes on to say “even if there is no predicate rule requirement to validate a system, in some instances it may still be important to validate the system.” A similar statement is made for audit trails. In addition, in this docket, FDA implies that there are records not explicitly required in predicate rules that are nonetheless required.

FDA Public Meeting on Part June 2004 Copyright © 2004 Eli Lilly and Company 6 Ref IV.D. Additional Questions for Comment 2. (cont.) We recommend that FDA clarify the definition of records “in-scope” by distinguishing between: 1.records that are explicitly required by predicate rules 2.records that are not explicitly required, where there is an explicit predicate rule requirement for the “action” with which the record is associated. Examples will be given by the speakers.

FDA Public Meeting on Part June 2004 Copyright © 2004 Eli Lilly and Company 7 Ref IV.D. Additional Questions for Comment 5. We recommend, in keeping with other regulations, that FDA not prescribe specific risk-based approaches or tools. There is extensive literature on “risk management” including international standards (e.g., ISO 14971) and a number of tools used in certain industries such as the device and food industries (e.g., HACCP, HAZOP, FTA, FMEA and FMECA). Individual companies should select the risk management approach and tool kit most appropriate for them.