Presented by

Hitesh Wadhwa
Integrated Resources Inc.
Website: www.iricro.com


Overview of 21 CFR Part 11
Objective of presentation
Disclaimer

Introduction
Document Reference
Subpart A: General Provisions
Scope
Implementation
Definitions
Subpart B: Electronic Records (ER)
Controls for closed systems
Controls for open systems
Signature manifestations
Signature/record linking
Subpart C: Electronic Signature (ES)
General requirements
Electronic signature components and controls
Controls for identification codes/passwords
Compliance checklist for Implementation



Presentation Outline
Visit website
www.gpo.gov
Click FDsys: GPO's Federal Digital System
Click CODE OF FEDERAL REGULATIONS
Click Select 2013 > Title 21 > Part 11
Google search with keywords
CFR-2013-title21-vol1-part11.pdf




Document Reference
Scope
Defines criterias how
Electronic records & signatures Paper records & signatures
Applies to electronic records that
Are created, modified, maintained, archived, retrieved, or transmitted
Submitted to agency i.e. FDA
Does not apply to Paper records
Computer systems, controls & related documentation must be readily available for FDA
inspection
Implementation
IF ER are required to be submitted to FDA then,
It must be identified in public docket No. 92S0251
Consult with FDA on how and whether to proceed with electronic submission

Subpart A: General Provisions
Definitions
Act = Federal Food, Drug, and Cosmetic Act
Agency = FDA
Close system = environment in which system access is controlled by persons who are
responsible for the content
Open system = environment in which system access is Not controlled by persons who are
responsible for the content
Biometrics
Digital signature
Electronic record
Electronic signature
Handwritten signature
Subpart A: General Provisions
Controls for closed systems must
Ensure authenticity, integrity & confidentiality of ER
And the signer cannot repudiate the signed ER as not genuine
Controls & Procedures for closed systems;
Validation of system
Generate ER in human & machine readable
Protection of records
System access for authorized individual only
Computer generated time-stamped audit trials
Any changes to record must not obscure previous entry
Checks in place to ensure only authorized individual has access
Determine individuals using ER/ES are educated, trained & experienced
Written policies that hold individuals accountable for their ES
Adequate control & documentation for access granted, system operation & maintenance
Revision and change control procedures to maintain an audit trail

Subpart B: Electronic Records (ER)
Controls for open systems
Follow points discussed above
And document encryption & use of appropriate digital signature
Signed ER must clearly indicate
The printed name of the signer
The date and time of signature
The meaning (such as review, approval, responsibility, or authorship) of
signature
Signature/record linking
ES must be linked to respective ER

Subpart B: Electronic Records (ER)
General requirements
ES must be unique to each individual
Organization must verify the identify of individual
Persons using ES must submit agency via paper form & handwritten signature
Electronic signature components and controls
ES must at least have 2 distinct identification component identification code &
password
Signed by genuine owner only
Controls for identification codes/passwords
Ensure that combination of identification code & password are unique
Ensuring that identification code & password are periodically checked
Follow loss management procedures
Devices must be tested initially & periodically to ensure they function properly


Subpart C: Electronic Signatures (ES)
Compliance checklist for Implementation
Line No. Compliance checklist for 21 CFR Part 11 Checklist
Scope
1.
Ensure electronic record (data) you're planning to submit to FDA is identified in docket 92S0251 as
something agency would accept as electronic record

2.
Consult with FDA whether electronic records (data) needs to be submitted. If yes, discussed details how
submission must be done i.e. method of transmission, media, file formats & technical protocols

Controls & Procedures for Closed systems
1.
Ensure system is validated for consistent performance
2.
Ensure system general electronic records (data) which is human readable and in electronic format suitable
for inspection, review and copying

3.
Ensure system protects records for accurate and ready retrieval at all times

4.
System must have able to provide limited access for authorized individuals only

5.
System must have computer generated, time stamped audit trails to identify all actions, such as creation,
modification or deletion of electronic records

6.
Any changes to current record must NOT obscure previous entry

7.
Organization must have procedures to ensure only authorized persons are granted access to system

Compliance checklist for Implementation
Line No. Compliance checklist for 21 CFR Part 11 Checklist
Controls & Procedures for Closed systems
8.
Organization must verify the individuals who develop, maintain or use ER / ES, have education, training &
prior experience to perform their assigned task

9.
Organizations must have written policies to hold individuals accountable and responsible for actions
initiated under ES

10.
All computer systems generating these electronic records (data) are subject to FDA inspection. And must be
readily available for inspection by FDA

11.
Organizations must have adequate documentation about system access granted to individuals, system
operation & maintenance, any revision & change control procedures

Controls & Procedures for Open systems
1.
Follow above points

2.
Ensure additional measures like document encryption and use of appropriate digital signature standards to
ensure authenticity, integrity and confidentiality (if applicable) of electronic record

3.
Ensure signing electronic record (data) clearly indicates; The print name of signer, Date & time of Signature,
Meaning of such signature

Compliance checklist for Implementation
Line No. Compliance checklist for 21 CFR Part 11 Checklist
Signature/Record Linking
1.
Electronic signature or handwritten signature executed to electronic record must link to respective
electronic record (data)

General Requirements for Electronic Signature
1.
Unique to each individual

2.
Is never used or reassigned to anyone else

3.
Organization must verify the identify of individual who is assigned or sanctioned electronic signature

4.
Person using electronic signature must submit a copy of traditional handwritten signature on paper form to,
'The Office of Regional Operations'

5.
Electronic signature must have 2 distinct identification components i.e. identification code (or username) &
Password

Compliance checklist for Implementation
Line No. Compliance checklist for 21 CFR Part 11 Checklist
Controls for identification codes/passwords
1.
Combination of Identification code & password must be a unique i.e. No two individuals must have same
combination of identification code & password

2.
Ensure that identification code and password issuances are periodically checked, recalled or revised to
ensure it's security & integrity

3.
Follow loss management procedures to electronically deauthorize lost, stolen or compromised tokens that
generate identification code

4.
Devices that bear or generate identification code must be tested initially & periodically to ensure that they
function properly and not been compromised in any manner

Thank You !!!