What is 21 CFR Part 11?

Technical requirements include

• Unique identification of all users in the system. Each user needs his/her own account and password to log in
• Automatic audit trail created for all entries and changes of data in the system
• Audit trail includes date, time and ID
• Old versions of data are never overwritten, but given an "old" status
• How valid electronic signatures are created
• Procedural requirements include
• Validation of the system
• Large number of topics to be included in SOPs
• Proof that the SOPs are used accordingly

Who needs to comply with Part 11?

All data created that has an impact on the quality of pharmaceutical products sold in the US shall be in compliance with 21 CFR Part 11. This is not only the pharmaceutical industry itself, but also its suppliers of raw materials, and also all testing and other work performed during outsourcing, if it affects the quality. 21 CFR Part 11 will be a requirement for all industries supplying the US market in the future.

21 CFR Part 11 training

There are a number of training possibilities by various training centers catering to the pharmaceutical industry. Segalstad Consulting may also give training on request. 

How do you get compliant systems?

Provided the company is affected, each computer system needs to be assessed for compliance, and brought into compliance. Read more about case studies of Part 11 projects.

It might be wise first to create an inventory of the systems in the company, and create a checklist of items required in 21 CFR Part 11. Most companies probably have an inventory list from Y2K, and this can form a basis for your Part 11 inventory.

1. Assess if the system itself needs to be in compliance

Does it handle GxP data? GxP systems include data that affects the quality of the products.

2. Check each system according to the checklist

Create an overview of where the problems are.

3. Create an action plan for each system

Some problems can be solved internally, others need help from the vendor. Sometimes it is not possible to solve the problems with the system. In that case an other system may take over the job for this system, or a completely new system must replace the existing. In that case, create a URS.

Solutions may include:

• Writing to the vendor and hope that he can help you with the technical non-compliance in the system. This may be incorporated in the next version.

• Create or change SOPs to include all procedural requirements in 21 CFR Part 11. This should be done without delay.

• Validate all technical requirements set forth in Part 11. Chances are that even if your system was validated, some of these issues were missing during the testing. Validation activites should be done without delay.

4. Create an overall action plan for your systems

It is probably not possible to fix all problems quickly, as there are usually limited resources to do so. In that case, make a priority list of the systems to be worked on. Priorities are based risks: How important each system is for the company and how much it is used. Start with the top system and work down the list. 

Want to know more?

Publications:

Segalstad: The WWW (Who-Why-What) of 21 CFR Part 11 Electronic Records and Electronic Signatures, European Pharmaceutical Review Vol. 5 Issue 2 (2000) 69-74. Also published in American Pharmaceutical Review Vol.3 Issue 4 Winter 2000-2001 (84-87)

Segalstad: Elektroniske data og elektronisk signatur, (electronic data and electronic signatures) Kjemi, April 2001 (9-12)

Segalstad: Testplans according to 21 CFR Part 11, International Validation Technology (in press, probably in fall 2003 issue)

Classes:

Classes are offered on request, tailored to needs for in-house training in your company.

Websites:

21 CFR Part 11: www.fda.gov/ora

Go to Index