Part 11 Overview

21 CFR Part 11 Compliance Guide

Electronic records and electronic signatures compliance for FDA-regulated systems.

Table of Contents

• Part 11 Overview
• Electronic Record Requirements
• Electronic Signature Requirements
• System Controls
• Validation Requirements
• Compliance Checklist

Part 11 Overview

Scope and Applicability

21 CFR Part 11 applies to electronic records and signatures used to meet FDA predicate rule requirements.

Key Terms

Predicate Rules

Part 11 does not create new record requirements. It governs HOW records are maintained when electronic:

Electronic Record Requirements

General Requirements (§11.10)

Closed systems must implement controls including:

1. System Validation - Accuracy, reliability, consistent intended performance
2. Record Generation - Accurate and complete copies in human-readable form
3. Record Protection - Throughout retention period
4. Access Control - Limit system access to authorized individuals
5. Audit Trail - Secure, computer-generated, time-stamped record
6. Operational Checks - Enforce permitted sequencing of steps
7. Authority Checks - Restrict functions to authorized individuals
8. Device Checks - Determine validity of input/output devices
9. Training - Personnel education and experience
10. Documentation - Written policies and accountability

Audit Trail Requirements

Audit Trail Entries

Record Copy Requirements

Must be able to generate accurate and complete copies:

Electronic Signature Requirements

General Requirements (§11.50, 11.100)

Signature Components (§11.200)

Signature Manifestations (§11.50)

Electronic signatures must include:

Signature/Record Linking (§11.70)

Signature Certification

Organizations must submit certification to FDA (§11.100(c)):

SAMPLE CERTIFICATION LETTER

[Date]

Food and Drug Administration
[Appropriate Center Address]

Subject: Electronic Signature Certification

[Company Name] hereby certifies that all electronic signatures
used in our FDA-regulated systems are the legally binding
equivalent of traditional handwritten signatures.

This certification is made in accordance with 21 CFR Part 11,
Section 11.100(c).

Sincerely,
[Authorized Representative]
[Title]

System Controls

Administrative Controls

Operational Controls

Technical Controls

Password Requirements

Session Controls

Validation Requirements

Validation Approach

Validation Documentation

Testing Categories

Installation Qualification (IQ):

• System installed per specifications
• Hardware and software inventory
• Configuration documentation

Operational Qualification (OQ):

• Functions operate as specified
• Audit trail verification
• Security control testing
• Error handling verification

Performance Qualification (PQ):

• System performs in production environment
• User acceptance testing
• Integration testing
• Load/stress testing (if applicable)

Part 11 Specific Testing

Compliance Checklist

System Assessment Checklist

Administrative Controls:

• Written policies for electronic records and signatures
• Defined roles and responsibilities
• Training program documented and executed
• Periodic review schedule established
• Accountability measures in place

Access Controls:

• Unique user identification for each person
• User IDs not shared or reassigned
• Password complexity requirements enforced
• Password expiration implemented
• Account lockout after failed attempts
• Role-based access control implemented
• Access periodically reviewed

Audit Trail:

• All record creation captured
• All record modifications captured
• Previous values retained
• User identity recorded
• Date/time stamp on all entries
• Audit trail secure from modification
• Audit trail available for review

Electronic Signatures:

• Signatures unique to individual
• At least two identification components
• Signature manifestation includes name, date/time, meaning
• Signatures linked to records
• Certification letter submitted to FDA

Record Management:

• Accurate copies can be generated
• Human-readable format available
• Records protected throughout retention
• Backup and recovery tested

System Controls:

• Session timeout implemented
• Operational sequence enforcement
• Input/output device validation
• Error handling documented

Validation:

• System validated for intended use
• Validation documentation complete
• Change control procedures in place
• Periodic review conducted

Gap Assessment Template

PART 11 GAP ASSESSMENT

System: [System Name]
Assessment Date: [Date]
Assessor: [Name]

| Requirement | §11 Reference | Current State | Gap | Remediation | Priority |
|-------------|---------------|---------------|-----|-------------|----------|
| Audit trail | 11.10(e) | [Description] | [Y/N] | [Action] | [H/M/L] |
| Access control | 11.10(d) | [Description] | [Y/N] | [Action] | [H/M/L] |
| E-signatures | 11.50 | [Description] | [Y/N] | [Action] | [H/M/L] |

Summary:
- Total requirements assessed: [Number]
- Requirements met: [Number]
- Gaps identified: [Number]
- Remediation timeline: [Date]

Periodic Review Schedule

Common Deficiencies

FDA Warning Letter Themes

Remediation Priorities