21 CFR Part 11 Cases studies

Checklist approach

This project started with creating a Part 11 task force of about 12 persons. A rough draft checklist had been created earlier. The task force was given a one-week Part 11 class, starting with lectures, and continuing with supervised Part 11 audits, and finally Part 11 audits. After each audit the group got together to discuss problems they had encountered. The checklist was revised the last day. The conclusion after this week was that all participants had a common platform of understanding what Part 11 was all about.

Discussion items in the process

There were discussions during the week of training, but at the end of the week these were all over. The company knew it had to comply with Part 11, so the question was mainly which systems were GMP/GLP/GCP systems and which were not.

System Part 11 assessment

Each manager in the company was asked to fill in a form for each of the computer systems they used in their part of the organization. The group of trained people, now to become assessors, compiled a complete list of the company's systems, and divided the systems between them for assessment. Two assessors worked together on each system, and they booked time with the system manager for the assessment. The teams changed, and almost all assessors worked with everybody. The checklists were completed and signed off by the assessors and the system manager, and included a suggestion for following up the non-compliance findings. Acomplete Part 11 report was created when all systems were done, and it was up to the upper management to decide the priority of which system need to receive remedial actions first and which could wait.

Discussion of the projects approach and results

Differences in checklists

There were differences in the checklists created. A few examples are here, but there were also other differences.

Date and time format: One specified this as "local time in the format DD-MM-YYYY HH-MM-SS", and the other specified this as "unambigeous + requirements for definition of time zone".

Versions: One did not mentioned versions at all, and the other specified this as "Distinguished as status or version number".

Audit trail associated with record One specified this as "Shall be directly associated", and the other specified this as "Should be associated, as this is easier to maintain"

Project 1 had a great disadvantage by not selling to the US market, so it was perceived by some persons that it was an option to be Part 11 compliant. The others in the project thought this was an quick-and-easy way out of additional work. The SOPs have been created so that all systems need to do a few things like validation of computer systems, and depending on decisions on the need for Part 11 compliance, the rest of the SOPs shall be followed. Only one SOP needs to be changed to include all relevant systems in Part 11, and that is the SOP that says the it compliance may be opted out.

Project 2's task force was a major contributor to the success, as the training formed a baseline or benchmark for treating all systems in the same way. It was also an advantage to have two assessors on the teams, as even the last systems assessed gave internal discussions of whether this was OK or not. Assessing systems for Part 11 is not easy! This project did cost a lot of money as 12 persons were involved for a week during training, and some 150 systems were assessed, each for about 1/2 day with two assessors. But the result was that within 2-3 months all GxP systems had been assessed, and the rest of the systems had documentation to say why they were exempt.

Go to Index

Sub menu Case Studies: 

Part 11 cases