Gain the latest insight (2013) into 21 CFR Part 11 Compliance from AITalent's latest Webinar. Discover: Part 11 – What it is not, the myths. Part 11 – What it is, the facts. Part 11 – What does the future hold? Find out more: www.aitalent.co.uk

1. 21 CFR Part 11 Compliance
Webinar
Stephen Gibney | Bruce Walcroft

2. • Introductions
• Part 11 –
– Exploring the Myths
– Revealing the Facts
– What Does the Future Hold?
• Validation Requirements
• Live Examples
• Questions
Agenda
21 CFR Part 11 Compliance

3. Stephen Gibney (sgibney@aitalent.co.uk)
• Quality & Document Manager @ AITalent.
• Previously,
• Software Quality Assurance Manager at SPD,
(Clearblue Product Range, Smartcheck INR),
• QAV Specialist in biopharmaceutical manufacturing
control systems, (Enbrel/Pravner),
• Software Engineer in financial and telecoms software
development (Personal Finance & SMSC, 3g network
performance monitor systems)
Please allow me to introduce myself
21 CFR Part 11 Compliance
uk.linkedin.com/in/
stephengibney

4. • Myth 1 – Every computer system/software used
in the life science industry comes under the remit
of part 11.
• Not all software used in life science industries is
Part 11 regulated.
– First ask, is the software used for a Quality or
Production system? If not then Part 11 does
not apply. e.g. Payroll software is not part 11
regulated.
Part 11 What it is not - The “Myths”
21 CFR Part 11 Compliance

5. • Myth 2 – all Quality & Production systems need
to be Part 11 compliant,
• First ask, are records retained, signed or
submitted electronically?, if not then Part 11
does not apply to the system.
• If the master record is retained in paper format
then Part 11 does not apply.
Part 11 What it is not - The “Myths”
21 CFR Part 11 Compliance

6. • Myth 3 – It applies to every single piece of
processing equipment/sub-system.
• First ask, does the system hold all of the record?
• If a system only generates part of a record or
meta data and transmits this record part to a
higher level system then the lower level system is
not Part 11 and the higher level system that holds
the complete record is the Part 11 system.
• Example Meta Data System,
• PLC, microcontroller, etc…
Part 11 What it is not - The “Myths”
21 CFR Part 11 Compliance

7. • Myth 4 - all computerised systems that keep electronic
records must be made to be part 11 compliant.
• If the system does keep electronic records but it is
older then 1997, then it can be deemed to be a legacy
system and Part 11 may not apply.
• FDA employs enforcement discretion for legacy
systems.
• Example Legacy Systems
– Manufacturing Systems implemented prior to
1997.
– Careline systems implemented prior to 1997.
Part 11 What it is not - The “Myths”
21 CFR Part 11 Compliance

8. • Myth 5 – Part 11 applies to Medical Device Software
• Medical device software, either embedded in a
medical device or software that is a medical device in
it’s own right is not Part 11.
• However, software that is used to calibrate, service or
maintain a medical device maybe Part 11, as this
software is used for a quality purpose. e.g. complaint
investigation software.
Part 11 What it is not - The “Myths”
21 CFR Part 11 Compliance

9. • Myth 6 – Part 11 is only about technical controls for
the Computerised Systems within the Life Science
Industry.
• There are several procedural controls within Part 11
that must be implemented by companies using Part 11
systems.
Part 11 What it is not, the “Myths”.
21 CFR Part 11 Compliance

10. Part 11 - Revealing the Facts
21 CFR Part 11 Compliance

11. • What does it mean?
– 21 – Chapter of US Federal Law – Food, Drug
& Cosmetics Act circa 1906,
– CFR - Code of Federal Regulation – US Federal
Government Law,
– Part 11 – That part of 21 CFR that deals with
electronic records & electronic signatures.
21 CFR Part 11 - ????
21 CFR Part 11 Compliance

12. • U.S. Federal Regulation to ensure electronic
records are trustworthy,
• Part 11 applies to all FDA regulated industries,
where electronic record keeping, signing and
submitted is used for systems with a Quality
and/or Production purpose that where
implemented post 1997.
What is Part 11
21 CFR Part 11 Compliance

13. Paper Record Change
Electronic Record Change
• Five score and seven years ago our fathers
brought forth on this continent, a new nation,
conceived in Liberty, and dedicated to the
proposition that all men are created equal.
Paper vs. Electronic Record Changes
21 CFR Part 11 Compliance

14. • Created in 1997 due to the increasing adoption of
computerised electronic keeping in life science
industry and concerns with the integrity and
robustness of electronic records at that time.
• Enforced by the Food & Drug Administration FDA.
• PART 11 applies to all Drug and Medical Devices
manufacturers that sell into the United States
and use electronic records & electronic
signatures.
21 CFR Part 11 - a brief history
21 CFR Part 11 Compliance

15. The current Part 11 covers;
– Electronic Record Keeping – any quality or
production record held electronically.
– Electronic Signatures - any approval of a quality or
production record that is committed electronically.
– Electronic Submissions -
NDAs, 510(k)s, PMAs, etc…
Scope of Part 11?
21 CFR Part 11 Compliance

16. Electronic Record,
• Any record required for a Quality or Production
purpose that is held electronically.
• e.g. Batch Records, Training Records, Customer
Complaint Records, etc…
What are Electronic Records?
21 CFR Part 11 Compliance

17. Electronic Signature,
• Comprised of two parts,
• First part - publically known identifier
• Second part - known only to the owner of the
esig,
• First part is typically a username to identify the
user uniquely and trace to their job role and
training record to verify that their authority level
and competence to sign for that job role.
• Second part is typically a Password (can be
biometric data) to ensure that it is actually the
right person signing.
What are Electronic Signatures?
21 CFR Part 11 Compliance

18. • Quality and Production paper records are legal
documents they can be and often are submitted
as evidence in legal proceedings,
• Altering/tampering with a paper record is fraud.
• Electronic Records are the equivalent of paper
records,
• Altering/tampering with an electronic record is
the same as forging a paper record, it’s fraud.
Electronic Records & the law.
21 CFR Part 11 Compliance

19. • Signing a Quality or Production paper record with
someone else’s name is fraud,
• Electronic Signatures are the equivalent of
handwritten signatures,
• Using someone’s else electronic signature to sign
an electronic record required by the FDA is the
same as forging some one else’s signature to sign
a paper record, it’s fraud.
Electronic Records & the Law.
21 CFR Part 11 Compliance

20. • FDA has over 100 years of expertise inspecting paper
records, they can easily detect fraud with paper records,
• They known what they are looking for and can tell at a
glance if a paper record has been tampered with
• It’s harder to detect fraud with an electronic record, it’s
virtually impossible at a cursory inspection.
• Computer Generated Time stamped Audit Trails are used
to give credence and providence to electronic
records/electronic signatures.
• Have to be able to provide a copy of the audit trail
associated with a particular electronic record to an FDA
Inspector either on paper/electronically the Inspectors
request.
Audit Trails
21 CFR Part 11 Compliance

21. • Closed Systems: those systems where a company can
verify the identify of all users before granting access to
an ERES system. Only electronic signatures required,
e.g. username & password combination.
• Open Systems: those systems where a company
cannot verify the identify of all users before granting
access to an ERES system. Digital signatures are
required in addition to electronic signatures, e.g.
digital certificates, HTTPS, etc…
• This is to ensure that the person is who they say they
are.
Open vs. Closed Systems
21 CFR Part 11 Compliance

22. • Onus is on the company using electronic signatures as
the equivalent of hand written signatures to write to
FDA to inform them that the company intends to use
an ERES system.
• Company using an ERES system, must verify and record
the verification of the identify of the user before
granting an signature.
• Train the user’s not to share their esignatures with
anyone else, companies quite often make this a
disciplinary offence.
Procedural requirements
21 CFR Part 11 Compliance

23. • Reading the regulatory wind.
• FDA employ enforcement discretion with the current
Part 11.
• Requirements for record keeping most likely to move
under the applicable predicate rules.
• e.g. Electronic records for Medical Device
Manufacturers would come under 21 CFR Part
820.186 Quality system record instead of 21 CFR Part
11 Subpart B--Electronic Records.
• Requirements for electronic signatures will form new
‘core’ Part 11 version.
Future
21 CFR Part 11 Compliance

24. All Part 11 systems require validation
Regulation
• CFR - Code of Federal Regulations Title 21
Guidance Documents
• Guidance for Industry - Computerized Systems Used in
Clinical Trials
• Guidance for Industry Part 11, Electronic Records;
Electronic Signatures - Scope Application
• General Principles for Software Validation
Validation of Part 11 Systems
21 CFR Part 11 Compliance

25. Live Demonstration
21 CFR Part 11 Compliance

26. • Part 11 –
– Exploring the Myths
– Revealing the Facts
– What Does the Future Hold?
• Validation Requirements
• Live Examples
Recap
21 CFR Part 11 Compliance

27. Questions
21 CFR Part 11 Compliance

28. Thank You
21 CFR Part 11 Compliance
Join our Linkedin Group
The Training Managers Network:
www.linkedin.com/groups/Training-Managers-Network-4868021
AITalent, 020 7400 0485, info@aitalent.co.uk, www.aitalent.co.uk