FDA Inspections: Is Your Organization 21 CFR Part 11 Compliant?

Inspections are often stressful events. Certainly, during past FDA inspections, a lot of anxiety has surrounded 21 CFR Part 11, partly due to differing understandings between industry and FDA of what was needed to comply with Part 11. Confusion continued to mount until drastic action was taken by FDA to clarify the situation: the removal of several draft guidances and the publication of a final guidance document on September 3, 2003.

Background

The original intention of Part 11 was to establish criteria under which electronic records and electronic signatures would be accepted in lieu of their traditional counterparts and to create a framework that would allow for technological innovations while safeguarding public health. However, when FDA released the final regulations in March of 1997, there were concerns from industry that Part 11 would actually have the opposite effect, limiting the use of electronic records and signatures due to the estimated high cost of compliance. While some of Part 11 was relatively easy to implement when the regulation became effective (August 1997), some of the difficult parts — areas involving validation, audit trails, record retention, record copying, and legacy systems — continued to be major concerns.

To help alleviate some concerns and clarify Part 11 itself, the agency discussed Part 11 at numerous conferences and solicited feedback on the regulation. FDA also published a compliance guide, "CPG 7153.17: Enforcement Policy: 21 CFR Part 11; Electronic Records, Electronic Signatures" on July 21, 1999 in the Federal Register. A number of draft guidance documents followed.

To the surprise of many, on February 4, 2003 the agency announced in the Federal Register that it was withdrawing the draft guidance document released November 12, 2002 pertaining to electronic copies of electronic records (21 CFR Part 11; Electronic Records, Electronic Signatures, Electronic Copies of Electronic Records). Shortly afterwards, on February 25, 2003, the agency announced it was withdrawing Part 11 draft guidance documents on validation, glossary of terms, time stamps, and maintenance of electronic records, as well as the compliance guide, CPG 7153.17. On the same day, the agency issued a new draft guidance titled, "Guidance for Industry: Part 11, Electronic Records; Electronic Signatures — Scope and Application." In the new draft guidance, FDA explained that it withdrew the CPG and previously issued draft guidances because its own relatively new risk-based initiative brought about a re-examination of Part 11. (1) The new draft guidance also informed industry that during the re-examination of Part 11, FDA plans to take a narrow interpretation of Part 11 and will exercise discretion in the enforcement of certain aspects of Part 11.

Refinements to the Guidance Document

The final guidance document on the scope and application of Part 11 (released September 3, 2003) clarified several issues. For example, the preamble to Part 11 originally stated that when a system spans different time zones, "the agency advises that the signer's local time is the one to be recorded." Later, when the draft guidance on time stamps was issued, the agency stated, "You should implement time stamps with a clear understanding of what time zone reference you use. Systems documentation should explain time zone references as well as zone acronyms or other naming conventions." When the agency withdrew the draft guidance on time stamps, there was no clear direction on the matter from FDA — until FDA released the final guidance document. Here, FDA reiterates that it does not expect a system spread across various time zones to use the signer's local time. Instead, it expects time stamps to incorporate a clear understanding of the time zone used. For example, all records could reference Greenwich Mean Time's descendant, the Universal Time Coordinate (UTC), or records could be synchronized to the time where the time stamp clock is located.

Additionally, the agency presented specific details in the final guidance document concerning when Part 11 applies to a legacy system. The specific requirements are outlined below. Also, in the final guidance document FDA states that it does not intend to reissue the withdrawn Part 11 documents.

What to Expect During an Inspection

To reinforce the fact that 21 CFR Part 11 is still in effect, Janet Woodcock, the Director of CDER, recently stated:

"It's clear we need a rule on electronic records. But we need to clarify the scope of our record-keeping requirements. The regulation won't go away. However, while we won't rescind it, we may revise it. Businesses need direction on how to reliably, safely send documentation to the FDA. They also need more direction on how to maintain that documentation electronically. We just don't want the guidance to be as complicated as it has been." (2)

Woodcock's statement mirrors the final draft guidance's statement that FDA is undergoing a re-examination of Part 11. The expected outcome is a change to the rule that will be clearer and easier to follow. Until Part 11 is either revised or rewritten, the industry must look to the final guidance document for direction.

The guidance contains some useful information on preparing for an inspection with regard to Part 11. For example, the guidance specifically states:

"We intend to enforce all other provisions of Part 11 including, but not limited to, certain controls for closed systems in § 11.10. For example, we intend to enforce provisions related to the following controls and requirements:

• limiting system access to authorized individuals
• use of operational system checks
• use of authority checks
• use of device checks
• determination that persons who develop, maintain, or use electronic systems have the education, training, and experience to perform their assigned tasks
• establishment of and adherence to written policies that hold individuals accountable for actions initiated under their electronic signatures
• appropriate controls over systems documentation
• controls for open systems corresponding to controls for closed systems bulleted above (§ 11.30)
• requirements related to electronic signatures (e.g., §§ 11.50, 11.70, 11.100, 11.200, and 11.300)"

Three points are reiterated throughout the final guidance document that should guide your assessment of Part 11 compliance for an FDA inspection: a narrow interpretation of Part 11, enforcement discretion regarding Part 11, and enforcement of all predicate rule requirements. While the first two elements indicate a new approach, the latter point is directly in line with FDA's previous expectations.

Narrow Interpretation. A narrow interpretation means a reduced number of records will be subjected to the authority of Part 11. Everyone would like to know exactly which records will and will not be held accountable to the standards of Part 11 before an inspection. The guidance document specifically states when records that must be maintained under predicate rules or submitted to FDA are maintained in electronic format, Part 11 applies. On the other hand, when computers are used in the generation of a permanent paper record, Part 11 does not apply. This is also known as the 'typewriter clause' because just as a typewriter would not be subject to inspection, the computer that generated a document will not be inspected as long as the document itself is the true and official record.

Hybrid systems — systems in which records exist in electronic form as well as in traditional paper format — may or may not be subject to Part 11. If you use the electronic portion of the system for any GxP function, then the electronic system would fall under Part 11's jurisdiction. However, if you are keeping records in both formats, but use the paper form as sole means for making any regulated decisions, then Part 11 does not apply. Before an inspection, it makes sense to decide whether Part 11 applies to specific records and to have this decision fully justified and documented. An inspector may accept your reasoning if you show — in writing — that you have thought it through ahead of time versus spontaneously explaining your thoughts on why Part 11 does not apply to a given system during an inspection.

The guidance document states that "actual business practices may dictate whether you are using electronic records instead of paper records under 11.2 (a)." For example, a sales and distribution database will probably not fall under the scope of Part 11. However, a word of caution is necessary here: Part 11 would apply if any of that database or those records were used for a product recall. In this instance, the business practice of using your sales database to track recall information triggers the oversight of Part 11 for the system in question.

Enforcement Discretion. During or after an inspection is the wrong time to learn what FDA means by enforcement discretion. To avoid this situation, numerous companies and other stakeholders in Part 11 requested in writing (after the draft guidance was released) that FDA define it. Unfortunately, FDA did not clarify its intent in using the term. A clear, unambiguous definition would have been to everyone's benefit, especially since the term is used in regards to validation, audit trails, legacy systems, copies of records, and record retention.

It reasonably can be inferred that enforcement discretion means that the agency would not act unless there was serious potential threat to the public's safety. However, without a concrete definition, this is only an assumption. It is important to keep in mind that the guidance documents are not legally binding, whereas, the regulation is law — with all the obligations and consequences associated with it.

After the draft guidance was published, Barbara Immel, president of Immel Resources, suggested taking a conservative approach regarding GxPs until a final guidance document or a final revision to the rule was published. (3) Now, the final guidance has been published and does not differ significantly from the draft guidance. Regardless of how conservative one wants to be, the decision on how to approach Part 11 implementation should be based on a documented risk assessment. The guidance recommends doing a risk assessment for validation, audit trails, and record retention.

Predicate Rules. The agency intends to enforce all predicate rules under the authority of Part 11. Predicate rules are those requirements for records and signature found in the Federal Food, Drug, and Cosmetic Act, the Public Health Service Act, and other regulations — including those that are not specifically mentioned in Part 11 — that are codified in the federal registry. FDA specifically states that "persons must comply with applicable predicate rule." There is no enforcement discretion with predicate rules, and it is almost certain that if a record or signature falls under a predicate rule and that record or signature is kept electronically, an inspector will check to see that it complies with Part 11.

What the Inspectors Will Examine

Validation.

FDA states in the guidance that even though there may be no predicate rule requiring validation, validation may still be necessary to ensure the accuracy and reliability of electronic records. The following is a very basic outline of the process: determine which systems should be validated by following the predicate rules and/or documented risk assessment, perform a GAP analysis on the systems that need validation, prioritize and plan a validation strategy.

There are several good sources to consult for computer validation such as the agency's own General Principles of Software Validation (4) and The Good Automated Manufacturing Practice (GAMP) Guide for Validation of Automated Systems, GAMP 4. (5) The inspectors will be looking for any recent validation to meet these standards.

Audit Trail. Again, the agency intends to exercise enforcement discretion for computer generated audit trails. Expect an inspector to check if any electronic records required by a predicate rule require recording of the date, time, or sequencing of events. Even if no predicate rule exists for such records, the agency has stated that an audit trail may be important to ensure accuracy and reliability.

Legacy Systems. Legacy systems have often been the most complicated element of Part 11. Fortunately, FDA has stated that it does not intend to take action to enforce Part 11 compliance for systems that meet the following conditions:

• The system was operational before the effective date
• The system met all applicable predicate rule requirements before the effective date
• The system currently meets all applicable predicate rule requirements
• There is documented evidence and justification that the system is fit for its intended use and has an acceptable level of record security and integrity.

Since most applications and software systems typically have a five-to-seven year life cycle, and the rule went into effect in 1997, expect inspectors to scrutinize any system you claim to be a legacy system.

Copies of Records. The agency intends to exercise enforcement discretion for generating copies of records. The guidance suggests supplying copies of electronic records in common portable formats, for example a Microsoft Word or Excel file, or using a standard conversion format such as a PDF file. Also, if you can search, sort, or trend Part 11 records, inspectors will require the same functionality of the files you give them.

An inspector will expect to be able to review, inspect, and copy any records that are subject to Part 11 at your site using your hardware and following your established procedures and techniques for accessing records. Several firms have pointed out that, while they have no objection to providing an electronic copy of a record, the inspection and review has the potential to conflict with section 527.4 of FDA’s own Investigations Operations Manual, which states that investigators "should not use the audited firm’s equipment or personnel to perform extensive queries or manipulation of the audited firm’s own computerized data." While it may still be unclear what FDA intends, be prepared to justify your decision to deny an inspector any type of access to records that fall under the domain of Part 11. In most cases, the benefit of allowing an inspector access far outweighs the cost of a prolonged inspection.

Record Retention. Finally, FDA intends to exercise enforcement discretion regarding record retention to ensure that electronic records are safe, accurate, and reliable throughout the record retention period. Once again, electronic records must comply with all predicate rules during the record maintenance time span. An inspector should not object if electronic records are archived to nonelectronic format such as microfilm, microfiche, paper, or standard electronic file formats such as PDF.

Hybrid systems are allowed, but expect an inspector to investigate their compliance with all predicate rules. All electronic records retained must preserve their original content and meaning.

What Else to Know or Do

So what is a firm to do now that a final guidance document has been issued? Three options are readily apparent. The first is to expend additional resources to be fully confident that every system is Part 11 compliant, however, I know of no company that is willing to incur additional costs when it is not warranted.

The second choice is to stay the course — continue on with your remediation plan or continue to implement systems that are Part 11 compliant when they need to be.

A third choice is to re-examine your efforts and adjust your resources accordingly. If you opt for this strategy, be sure to conduct a risk assessment for those requirements of Part 11 that the guidance suggest you meet. Finally, be prepared to show an inspector the documented risk analysis that justifies your decision.

The major factor leading to a favorable inspection outcome is preparation. Part 11 is still in effect, and your inspection preparation efforts should take this into account. By using the final guidance on the scope and application of Part 11 to direct your efforts, paying particular attention to predicate rules, legacy systems, and documenting your justifications, you will be well on your way to a successful inspection.

References

(1) U.S. Food and Drug Administration.

Pharmaceutical current good manufacturing practices (cGMP) for the 21st century: a risk based approach

. Washington, DC: U.S. Government Printing Office, 2002.

(2) Heinemann J L. The Part 11 challenge. Contract Pharma 2003; 5(7):68-73.

(3) Immel BK. Part 11 update: the FDA changes course. BioProcess International 2003; 1(7):22-28.

(4) U.S. Food and Drug Administration. General principles of software validation: final guidance for industry and FDA staff. Washington, DC: U.S. Government Printing Office, 2002.

(5) ISPE. The good automated manufacturing practices (GAMP) guide for validation of automated systems in pharmaceutical manufacture, GAMP 4. Tampa: ISPE, 2001.

Internet Resources for 21 CFR Part 11

Published text of the rule:

www.fda.gov/ora/compliance_ref/part11

www.21part11.com: features Email updates

Bardon Data Systems: www.bardon/com/wp_part11.htm

CimWorks UK: www.cimworks.co.uk

Document Control Systems: www.mastercontrol.com/Solutions/21cfrpart11.html

Immel Resources: www.immel.com

Institute of Validation Technology: www.ivthome.com/free

ISPE: www.ispe.org

Valimation: www.valimation.com/21_cfr_part_11.html BPI