This document discusses 21 CFR Part 11, which sets criteria for electronic records, signatures, and computer systems used in clinical trials. It covers regulatory requirements, validation concepts and processes, roles in computerized system validation, and related FDA guidance. Warning letters and common questions about 21 CFR Part 11 are also mentioned.

1. 21 CFR Part 11 & Introduction to Computerized Systems Validation Introduction 2. Regulatory Background 3. Validation Concepts, Validation Lifecycle (SOP on CSV) 4. Roles of CSV team members 5. Review of testing documents used at Cetero MIS 6. Warning letters 7. Q & A

2. Introduction Participants Presenters Learning Objectives: Regulatory requirements/expectations 21 CFR 11 others Validation CSV Alphadas CSV

3. 21 CFR 11 CSUCI GAMP Red Apple II Initiative Peach Initiative Regulatory Background

4. 21 CFR part 11 US Code of Federal Regulations, Title 21, Part 11 Electronic Records; Electronic Signatures (21 CFR 11) (ERES) Sets the criteria for when the FDA considers e-records, e-signatures and handwritten signatures on e-records to be equivalent to paper records and traditional signatures To ensure authenticity, integrity and confidentiality (where appropriate) of e-records To ensure that the signer cannot readily repudiate the signed records as not genuine Records in electronic form that are created, modified, maintained, archived, retrieved or transmitted under records requirements of predicate rules Records required to be maintained by predicate rules? Records provided to FDA have been identified to be acceptable in e-format

5. Currently in public docket 92s-0251 New drug applications (NDA) Abbreviated new drug applications (ANDA) Biologic Licensing applications (BLA) Individual postmarketing safety reports (ICSR) Drug advertising material Future candidates Investigational drug applications (IND) Drug master files (DMF) 21 CFR part 11 (cont’d)

6. 2 Types of Electronic Record Systems Closed Systems an environment where system access is controlled by persons who are responsible for the content of e-records in that system Open Systems an environment where system access is NOT controlled by persons who are responsible for the content of e-records in that system 21 CFR part 11 (cont’d)

7. 21 CFR part 11 (cont’d) Controls Required for Closed Systems: Validation ensure accuracy, reliability, consistent intended performance able to discern invalid/altered records Accurate & complete copies – readable in human & electronic forms Record protection – accurate & ready retrieval throughout retain period Limiting system access to authorized individuals Audit trails Secure, computer-generated, time-stamped Independently record date & time of operator entries & actions Record changes not to obscure previously recorded information Retained at least as long as the subject e-record Available for FDA inspection and copying

8. 21 CFR part 11 (cont’d) Controls Required for Closed Systems (cont’d): Operational system checks enforce permitted sequencing of events Authority checks User account privileges (& restrictions) Device (or terminal checks) Determine validity of source of data input/ operational command Personnel Qualification Education, training and experience adequate for assigned tasks Written policies: Deter record and signature falsification Hold persons accountable & responsible for actions under their e-signatures Systems documentation Change control

9. 21 CFR part 11 (cont’d) Controls Required for Open Systems: All Closed Systems Controls Additional Security Controls to ensure record authenticity, integrity and confidentiality Document encryption Digital signatures

10. 21 CFR part 11 (cont’d) Signatures on e-Records: Clear association with the records being signed linked; signature cannot be excised/copied/transferred (falsified) from e-records by ordinary means Required Elements: Printed name of signer Date & Time (of signature execution) Meaning of sign-off Author, Review, Approval Subject to same controls as e-Records Readable, retained, audit-trailed, qualified, policies, etc.

11. 21 CFR part 11 (cont’d) Electronic Signatures: e-signatures should be unique to a single individual not re-used by (or reassigned to) another user Organization shall verify identity of individual prior to establishing, assigning, certifying or sanction an individual’s e-signature Persons to certify to the FDA that the e-signatures on their system are intended to be the legally binding equivalent of traditional handwritten signatures Prior to (or at time of) use of e-signature Submit certification on paper signed by hand Persons to submit additional certification/information/testimony upon FDA’s request

12. 21 CFR part 11 (cont’d) e-Signature Components & Controls: Employ at least 2 distinct ID components (eg. ID code + password) Series of signings during a single continuous session 1st signing: require all signature components Subsequent: at least 1 component that is executable only by owner One or more signings no executed in a single continuous session each signing: require all signature components Used only by their genuine owners Administered & executed to ensure that attempted use by someone other than the genuine owner requires collaboration of 2 or more individuals Biometric e-signatures Should be designed such they cannot be used by anyone other than genuine owners

13. Scope & Application Guidance FDA Guidance issued August 2003 Narrowing interpretation of Scope of 21CFR11 Exercise enforcement discretion Specific points: Validation Audit Trails Legacy Systems Copies of Records Records Retention

14. Computerized Systems Used in Clinical Investigations FDA Guidance issued in May 2007 Covers: Study Protocols SOPs Source Documents & Retention Security (Internal & External Safeguards) System Controls Change Controls Personnel Training

15. Other Related Initiatives GAMP Red Apple & Red Apple II Peach

16. 21 CFR Part 11 & Introduction to Computerized Systems Validation Validation Ali