Three Fundamental Elements of 21 CFR Part 11 and Annex 11

Along with providing monitoring and validation systems, we frequently delve into issues that arise for our customers once they are interpreting regulations and guidance. We receive many questions on 21 CFR Part 11 and Annex 11. during this article, we provide some background and a quick overview of three focal points of both of the "Elevens" including System Controls, Validation and Archiving.

 

It's important to notice that Part 11 may be a requirement within the US, whereas Annex 11, which applies to the EU, may be a guidance document only.

The "Elevens": Some Background

 

Computerized systems — crucial to pharmaceutical, medical device, and biotechnology manufacturing and distribution operations — differ from paper-based systems and manual systems traditionally used for creating and archiving records are getting rare.

 

This is (partly) why the FDA and EMA created 21 CFR Part 11and Annex 11. But the important basis of "the elevens" is to make sure that the standard and safety of medicine and biologicals don't suffer as a results of computerized systems replacing a manual system.

 

Annex 11 states:

"Where a computerized system replaces a manual operation, there should be no resultant decrease in product quality, process control or quality assurance. There should be no increase within the overall risk of the method ."

 

The FDA similarly says that the aim of Part 11 is to form sure electronic records are:

 

"...trustworthy, reliable, and usually like paper records."

 

The FDA's statement entails the very fact that for generations, paper records were all we had to depend on to make sure that processes and conditions that preserved the security and quality of medicine were performed properly.

 

Both Part 11 and Annex 11 remind us of the importance of safety and address the necessity to line up standards to form ink and electronic or digital signatures equivalent in their effect.

One glimpse at the list shows that every is in some part a way for controlling the function and outputs of a system.

 

In 21 CFR Part 11 "Controls for Closed Systems" states:

(b) "The ability to get accurate and complete copies of records in both human readable and electronic form suitable for inspection, review, and copying by the agency."

 

The fact that there's a selected regulation regarding human-readable copies demonstrates how far technology has evolved. it might be hard today to imagine a user-friendly system that didn't leave the printing of documents and data.

 

For most monitoring systems, the records of interest are the particular historical monitoring values. And creating a human-readable copy likely means historical data and event logs could also be printed call at a secure format.

"Use of secure, computer-generated, time-stamped audit trails to independently record the date and time of operator entries and actions that make , modify, or delete electronic records. Record changes shall not obscure previously recorded information. Such audit trail documentation shall be retained for a period a minimum of as long as that required for the topic electronic records and shall be available for agency review and copying."

 

In terms of your environmental monitoring applications, this simply means , so as for your records to comply, the electronic records (data and events) can't be manually modifiable or deletable.

 

In addition, the Audit Trail of your system must capture any changes to metadata (schedules and report templates) and configuration data without obscuring earlier entries. If your system doesn’t allow any changes to values once recorded, it complies with those sections of both Part 11 and Annex 11.

 

As a closed system, your monitoring system must limit access to only "authorized individuals." That's item (d) in Section 11.10 of Part 11. Typically this suggests that each one who have access to the system have a definite username and secure password. Often a system will integrate together with your OS authentication to leverage commonly used, pre-existing password management tools.

 

Validation: Prove it Works & Document your proof

With reference to validation, Part 11 lays out the necessity for validation within the first item of Section 11.10: "Controls for Closed Systems":