Electronic Record, Electronic Signature 21 CFR Part 11

1. 21 CFR Part 11
Electronic Records & Electronic
Signatures
Roshan H. Khetade
SKB college of Pharmacy, Kamptee.

2. Contents
• 21CFR11 history
• The important aspects of 21CFR11
• Equivalent requirements in EU legislation
• The Novo Nordisk 21 CFR11 compliance project
• Examples
• Experiences learned
Slide No. 2 • QS
CRS Quality
Services / Svend
Martin Fransen •
03.Oct.2002

3. Contents
• 21CFR11 history
• The important aspects of 21CFR11
• Equivalent requirements in EU legislation
• The Novo Nordisk 21 CFR11 compliance project
• Examples
• Experiences learned
Slide No. 3 • QS
CRS Quality
Services / Svend
Martin Fransen •
03.Oct.2002

4. Slide No. 4 • QS
CRS Quality
Services / Svend
Martin Fransen •
03.Oct.2002
It has gradually becomecommon knowledge that knowledge is the most
important resource in the business ofthe future.
It is the ability to createnewknowledge and the ability to utilize and organize
existing knowledge that will bethe primary source for obtaining lasting
competitive advantages.
PeterHoldtChristensen:”Videnom” –ledelse, videnogvirksomheden
Why do we have computers?

5. What is 21CFR11?
• 21CFR = FDA, Code of Federal Regulations
• 21CFR58 = GLP
• 21CFR210 = GMP, Drugs (General)
• 21CFR211 = GMP, Drugs (Finished Pharmaceuticals)
• 21CFR312 = Inv. New drug Application (GCP)
• 21CFR314 = FDA Approval of new drug (GCP)
• 21CFR6xx = GMP, biologics
• 21CFR820 = GMP, Devices
• 21CFR…… = Food, nutrients and cosmetics
• 21CFR11 = Electronic Records; Electronic Signatures
Slide No. 5 • QS
CRS Quality
Services / Svend
Martin Fransen •
03.Oct.2002

6. Historic overview
• A wish from the Industry (use of ES)
• FDA:
• Final Draft i 1994
• Final Rule 20.March.1997, effective from 20.Aug.1997
• 4 draft guidelines, ’Glossary of Terms’, ’Validation’, ’Time
stamps’ and ’Maintenance of ER’
• GAMP Part 11 guide, published Nov. 2001 (part 2)
• PDA ”GERM” guide, published Sep. 2002 (part 1)
• PDA ”GERM” guide ’Models’, expected 2003 (part 3)Slide No. 6 • QS
CRS Quality
Services / Svend
Martin Fransen •
03.Oct.2002

7. 21CFR11, Overview
• Substantive rule from 20 August 1997
• Applies to any e-record in any FDA regulated work including
legacy systems
• Criteria for e-records and e-signatures:
• Trustworthy and reliable
• E-signatures = hand-written signatures
• Minimum requirements / fraud prevention
Slide No. 7 • QS
CRS Quality
Services / Svend
Martin Fransen •
03.Oct.2002

8. Slide No. 8 • QS
CRS Quality
Services / Svend
Martin Fransen •
03.Oct.2002
Systems not Applications
• Alldefinitionsandclauses
in21 CFR11refer to
systems
• Applicationisnot
mentioned
• ITpart oftheGXP
environment.
• Do they know?
Working environment
Computer based system
Computer system
Application
-software
Platform
- hardware
- system SW
Controlled function
Instructions,
Manuals, etc.
Equipment
COMPUTER RELATED SYSTEM

9. Slide No. 9 • QS
CRS Quality
Services / Svend
Martin Fransen •
03.Oct.2002
21 CFR Part 11, Basics
• Electronic records equivalent with paper records
• Storage, retrieval and copyingin full retention period
• Submitting to FDA
• Protection of electronic records
• Security (physical and logical)
• Validation
• Audit trail (who did what, when includingreason wherereq.)
• Permission to useof electronic signature
• Equivalent with handwritten signatures
• Name,date and meaning
• Linking of signature to record
• Uniquefor an individual

10. ORA, Compliance Policy Guide CPG
7153.17 (May 1999)
• Acknowledging ‘not all older systems fully compliant by
Aug 20, 1997’
• ‘firms must take steps to achieve full compliance’
• ‘Regulatory actions based on case by case evaluation’
• ‘FDA auditors should intensify their scrutiny of e-recs’
• Calls for firms to
• have a ‘reasonable timetable’
• ‘promptly modify’ any system not in compliance
• ‘be able to demonstrate progress’
• ‘have procedural controls in place by now’
Slide No. 10 • QS
CRS Quality
Services / Svend
Martin Fransen •
03.Oct.2002

11. Contents
• 21CFR11 history
• The important aspects of 21CFR11
• Equivalent requirements in EU legislation
• The Novo Nordisk 21 CFR11 compliance project
• Examples
• Experiences learned
Slide No. 11 • QS
CRS Quality
Services / Svend
Martin Fransen •
03.Oct.2002

12. EU
• Annex 11, Computerised Systems
• Personnel
• Validation
• System
• Descriptions and SOP’s
• Change control and configuration management
• Records; entry, storage, retrieval
• Audit trail
• Security and Disaster recovery
• etc.
Slide No. 12 • QS
CRS Quality
Services / Svend
Martin Fransen •
03.Oct.2002

13. PIC/S Draft Guidance
Good Practices for Computerised Systems in regulated
”GXP” environment
• Computer System Life cycle, incl.
• Electronic Records and Signatures
• Security, and
• Audit trail
• Checklists for Inspection
• Links ISO and IEEE standards, 21CFR11, APV
guides, PDA Technical Reports together Slide No. 13 • QS
CRS Quality
Services / Svend
Martin Fransen •
03.Oct.2002

14. Quote from PIC/S Guide
21. ELECTRONIC RECORDS AND ELECTRONIC
SIGNATURES
• 21.1 EC Directive 91/356 sets out the legal requirements for EU
GMP. The GMP obligations include a requirement to maintain a
system of documentation, (Article 9). The main requirements in
Article 9.1 are that documents are clear, legible and up to date, that
the system of documentation makes it possible to trace the history
of manufacture (and testing) of each batch and that the records
are retained for the required time. Article 9.2 envisages that this
documentation may be electronic, photographic or in the form of
another data processing system, rather than written. The main
requirements here being that the regulated user has validated the
system by proving that the system is able to store the data for the
required time, that the data is made readily available in legible
form and that the data is protected against loss or damage.
Slide No. 14 • QS
CRS Quality
Services / Svend
Martin Fransen •
03.Oct.2002

15. Draft Proposal for a Commission
Directive (30.Apr.2002)
• Amending Commission Directive 91/356/EEC , Laying Down
the Principles and Guidelines of Good Manufacturing Practice for
Medicinal Products for Human Use
• "When electronic, photographic or other data processing systems
are used instead of written documents, the manufacturer or
importer shall have validated the systems by proving that the data
will be appropriately stored during the anticipated period of
storage. Data stored by these systems shall be made readily
available in legible form and shall be provided on demand to the
competent authorities. For an investigational medicinal product
when electronic, photographic or other data processing systems
are used instead of written documents the manufacturer or
importer shall have validated the systems to maintain the data
during the required period of storage. Data stored by these
systems shall be readily available in legible form and shall be
provided on demand to the competent authorities."
Slide No. 15 • QS
CRS Quality
Services / Svend
Martin Fransen •
03.Oct.2002

16. 21CFR11 Compliance Project
• Purpose
• Assist the units/system owners to prioritise the activities
necessary to get in compliance over a limited period of
time.
• Scope
• All Computer Systems within Novo Nordisk that
• generate electronic records covered by regulatory
requirements from FDA,
• including the systems that utilise Electronic
Signatures Slide No. 16 • QS
CRS Quality
Services / Svend
Martin Fransen •
03.Oct.2002

17. Overview of the 21CFR11 compliance project
Slide No. 17 • QS
CRS Quality
Services / Svend
Martin Fransen •
03.Oct.2002
Product
Supply
Staffs,
Quality, RA
and other
Development
21CFR11 project
No. of systems today = 868 (PS) + 219 (Dev.) + 65 (others) = 1152 systems
(..and more to come)

18. Slide No. 18 • QS
CRS Quality
Services / Svend
Martin Fransen •
03.Oct.2002
21CFR11 ComplianceProject
• Tasks
• Secure cGxP for 21CFR11 at Novo Nordisk
• Maintain corporate policy and interpretations
• Responsible for project QAP reporting
• Participate in external groups as NN representatives
• Distribute knowledge to organisation through
• Training(short courses and Site specific)
• Knowledge and guidance database
• Project web page
• Guidelines

19. Guidance database -web-enabled
Slide No. 19 • QS
CRS Quality
Services / Svend
Martin Fransen •
03.Oct.2002

20. 1. Identify and register systems (overview)
2. Prioritise systems
3. Evaluate ”high-risk” systems
4. Evaluate ”medium- and low-risk” systems
5. Evaluate corrections/solutions
6. Prepare implementation plan
• ”Quick fixes”
• ”Full compliance, technical and procedural
7. Implement solutions
Slide No. 20 • QS
CRS Quality
Services / Svend
Martin Fransen •
03.Oct.2002
Activitiesin relationto Part 11

21. Prioritisation of systems
Slide No. 21 • QS
CRS Quality
Services / Svend
Martin Fransen •
03.Oct.2002
Regulatory Risk
Factor, based on: No. of records generated by the system,
no. of users, frequency of use and system complexity
High risk
Low risk
Medium risk
Medium risk
Y
X
•Non-GxP systems (17)
• Other GxP critical,systems (11)
•GxP, support systems (20)

22. Gradual achievement of compliance
Slide No. 22 • QS CRS Quality Services / Svend Martin Fransen • 03.Oct.2002
0
20
40
60
80
100
120
Initial State State 2 State 3
Interimsolutions
Technology
Procedures
20
20
20
20
50
40
60
Phase 1: Implement Site and system procedures
Phase 2: Technology based solutions, etc.
Phase
1
Phase
2

23. Deliverables from common
workgroups• Evaluation of the system (gap-analysis) for technical issues
• Evaluation of possible solutions
• Recommendations and other input from supplier(s)
• Recommended solutions, including
• Draft or example of procedures
• Description of technical solution
• Estimated costs
• Suggested implementation plan
Slide No. 23 • QS
CRS Quality
Services / Svend
Martin Fransen •
03.Oct.2002

24. Progress Follow Up
Slide No. 24 • QS
CRS Quality
Services / Svend
Martin Fransen •
03.Oct.2002
= On track = Ensure no further delay = Take action to catch up
Site
System registrationQA
approved
System evaluationon
track
Implementationplan
preparationon track
A LL K L
B LL J J
C J J J
D J J K
E J K LLL
F J K K
G J LL L
H J J J
I J J J
J J K K
K LL J K
L LL J J

25. Slide No. 25 • QS
CRS Quality
Services / Svend
Martin Fransen •
03.Oct.2002
• Kaye Validator
• SCADA (Fix32)
• Filter testing equipment (PALL)
• Instron (replacement for..)
• PE laboratory equipment (UV/VIS + ..)incl. replacements for..)
• Usifroid freezedryer
• BMS (building monitoring systems)
• ...moreto come (dueto standardisation)
Examplesof Pilotprojectsin productionarea

26. Slide No. 26 • QS
CRS Quality
Services / Svend
Martin Fransen •
03.Oct.2002
What can gowrong, will...
• HPCE (High PressureCapillaryElectrophoresis)
Scenario:ReplacementofchromatographysoftwaretoMillennium and
setting upanarchiveinstallation
• 7 yearold software
• HWrequirements to PC
• Migration of ERfrom OS/2 to Win NT
• Indexation of migrated data
• ERon tapestoredin safe
• Useofarchiveinstallation
• Trainingof users
• SOPs

27. Example for remediation
Slide No. 27 • QS
CRS Quality
Services / Svend
Martin Fransen •
03.Oct.2002
Further information: http://www.zignx.dk/
Ahardwaresolution:
• Control power supply to individual
physical entities in a PC including
keyboard and mouse
• Solution is OS independent
Useraccessiscontrolled viaSmartcard:
• Userprofiles supported by pin codeon
the ZignX keyboard.
• Logging ofaccessattempts

28. Conclusions
• Management commitment pivotal
• Expensive and complex
• Requires highly skilled project management
• Risk-based prioritisation
• FDA enforcement becomes tougher
• and EU is on it’s way (DRAFT PIC/S Guidance)
• Just do it..!
Slide No. 28 • QS
CRS Quality
Services / Svend
Martin Fransen •
03.Oct.2002

29. Problem areas
• Lack of knowledge in the organisation on
• Computer Validation
• 21 CFR Part 11
• Maintenance of computer systems
• Purchase of non-compliant systems are ongoing
• ”Part 11 compliant systems” do not exist
• Administrative controls (= Company policies)
• Procedural controls (= Company SOP’s)
• Technical controls (= Supplier SW controls)
Slide No. 29 • QS
CRS Quality
Services / Svend
Martin Fransen •
03.Oct.2002