FDA Docket No. 2004N-0133

Themes for Renewal of 21 CFR Part 11 Rule & Guidance

byDr. Teri Stokes, GXP International

www.GXPInternational.com

Recent “Discretionary & Narrow” Focus

Industry responses: • Good, now we can forget Part 11!

• Wow, we don’t know what is expected anymore! The Part 11 Rule says one thing and the Part 11 Guidance says another.

• Enforcement is up to investigator opinion.

Slide 2

21 CFR Part 11 Sec. 11.10 : System Controls

Management ControlValidation of systems (a)

Limit system access by authorization (d)

Training for system developers, users

& support personnel (i)

SOP for e-signature responsibility (j)

System ReliabilitySystem checks to enforce steps &

events in sequence (f)

Device checks for identity of input sources (h)

Control of system documentation & change control of system (k)

Auditable QualityCopies of records possible for inspection

& review (b)

Time-stamped audit trails (e)

No “copy & paste” for e-signatures (11.70)

Data IntegrityAbility to identify altered records (a)

Record protection & retrieval during retention periods (c)

Authority checks for user actions on the system (g)

Slide 3 Good IT Business Practices

04/19/23

Missing Link – Defined Roles

Regulated Area Manager – Manager responsible for a computerized work process subject to Predicate Rules

Regulated Area System User – Person using computerized systems in a work process subject to Predicate Rules

Application Supplier – Person developing software to be used for data entry, capture, analysis, storage, retrieval, reporting, and/or archival subject to Predicate Rules

Infrastructure Supplier – Person implementing all technology required to deliver an application to the regulated work process

Slide 4

Defined Roles & Responsibilities

04/19/23

Missing Link – Defined Roles

Contractor/Subcontractor – Person under contract to deliver any one or all of the above roles on behalf of a regulated company or its designee

Contract Initiator – Person delegating Predicate Rule-related activities associated with a computerized system

Part 11 Computerized System – Computer hardware, software, and communications configured to support a work process that consists of equipment, people, and SOPs and that is subject to a Predicate Rule

Slide 5

Defined Roles & Responsibilities

04/19/23

Missing Link – Defined Responsibilities

Regulated Area Manager – Provides business strategy and appropriate resources for Predicate Rule Risk Analysis and User Acceptance validation of systems. Provides work process personnel with training on system operations, Part 11, and change control activities.

Regulated Area System User – Attends training and uses system to approved SOPs and Work Instructions. Participates in User Acceptance validation work and change control testing.

Slide 6

Defined Roles & Responsibilities

04/19/23

Missing Link – Defined Responsibilities

Application Supplier – Uses a documented software development life cycle (SDLC) process to develop and support software. Delivers system documentation and training. Tracks and responds to bug fixing requests. Follows a documented software upgrade process.

Infrastructure Supplier – Performs installation qualification (IQ) of all supporting technology platforms prior to production use of a Part 11 and Predicate Rule regulated application.

Slide 7

Defined Roles & Responsibilities

04/19/23

Missing Link – Defined Responsibilities Contractor/Subcontractor – Performs Part 11 responsibilities

relevant to respective role(s) as delegated in contract. Contract Initiator – Designs contract to specify relevant Part

11 and Predicate Rule needs. Audits contractor/subcontractor for ability to meet needs before signing and during performance of contracted work.

Part 11 Computerized System – Performs reliably to consistently meet Part 11 standards for Predicate Rule e-records and e-signatures. Has validation documentation to show that it is reliable and under management change control in the regulated work process.

Slide 8

Defined Roles & Responsibilities

04/19/23

Themes for a Renewed Part 11 Rule

• Reinforce same/similar Good IT Practices

• Define Roles & Responsibilities for system control

• Establish parity for Part 11 resource allocation with other Predicate Rule requirements, e.g., validation of methods, equipment, and process

• Outline an enforcement strategy that is consistent with Part 11 Rule

• Separate out the Part 11 technology needs of electronic submissions from Predicate Rule practices

• Keep Part 11 generic across all Predicate Rules

Slide 9

Common Sense Computer Validation for Data Quality and Data Integrity

FDA Docket No. 2004N-0133

Thank You

FDA Regulations