1. FDA 21 CFR Part 11 Overview
June 10, 2006

2. Agenda Why is Part 11 Important? Part 11 and Validation
Risk Management

3. The Dreaded 483 Failure to validate software
Missing validation documents (FR/IQ/OQ)
No written procedures
Inadequate system to authorize, grant, and rescind access
No documentation of changes to drop down lists
Current users do not have appropriate access, ids, passwords

4. Part 11 and Validation 21 CFR Part 11 defines the FDA’s:
“criteria under which the agency considers electronic records, electronic signatures, and handwritten signatures executed to electronic records to be trustworthy, reliable, and generally equivalent to paper records and handwritten signatures executed on paper.” §11.1 Scope (a)
Part 11 specifically applies to:
“records in electronic form that are created, modified, maintained, archived, retrieved, or transmitted, under any records requirements set forth in agency regulations.” §11.1 Scope (b)
The scope also includes:
“Computer systems (including hardware and software), controls, and attendant documentation maintained under this part shall be readily available for, and subject to, FDA inspection.” §11.1 Scope (e)

5. Part 11 and Validation (continued)
Guidance for Industry: Computer Systems in Clinical Trials:
“This document addresses issues pertaining to computerized systems used to create, modify, maintain, archive, retrieve, or transmit clinical data intended for submission to the FDA…
It also addresses requirements of the Electronic Records/Electronic Signatures rule (21 CFR part 11)…
The principles in this guidance may be applied where source documents are created:
(1) in hardcopy and later entered into a computerized system,
(2) by direct entry by a human into a computerized system, and
(3) automatically by a computerized system.”

6. Part 11 and Validation (continued)
The Goal of Validation:
“The sponsor should ensure and document that computerized systems conform to the sponsor's established requirements for completeness, accuracy, reliability, and consistent intended performance.”
Validation Scope:
“The FDA may inspect documentation, possessed by a regulated company, that demonstrates validation of software. The study sponsor is responsible, if requested, for making such documentation available at the time of inspection at the site where software is used.”
Validation imposes efficient business and IT management methodologies.

7. Risk Management
FDA now regulates and inspects using Risk-based concepts:
1. Quality System
2. Facilities and Equipment System
3. Production System
4. Materials System
5. Lab Control Systems
6. Packaging and Labeling System
The Risk-based concept extends to Sponsors:
“With the issuance in 2003 of the guidance for industry Part 11, Electronic Records, Electronic Signatures — Scope and Application, many barriers to scientific and technological advances were removed, and the use of risk-based approaches to managing computer systems is encouraged.” 1
1 - Final Report: Pharmaceutical cGMPs for the 21st Century - A Risk-Based Approach - FDA