7/25/2019 21 cfr part 11_1997_2003

1/38

P a g e | 1

21 CFR part 11_1997

PART 11ELECTRONIC RECORDS &ELECTRONIC SIGNATURES

Subpart AGeneral Provisions Subpart Ele!troni! Re!or"s Subpart CEle!troni! Si#natures

11.1 Scope. 11.10 Controls for closed systems 11.100 General requirements

11.2 Implementation. 11.0 Controls for open systems 11.200 !lectronic si"nature components andcontrols.

11. #efinitions 11.$0 Si"nature manifestations 11.00 Controls for identification codes%pass&ords

11.70 Si"nature%record lin'in".

(a) *+e re"ulations in t+is part set fort+ t+e criteria, under &+ic+ t+e a"ency considers electronic records, electronicsi"natures, and +and&ritten si"natures e-ecuted to electronic records to e trust&ort+y, reliale, and "enerally equi/alent topaper records and +and&ritten si"natures e-ecuted on paper.

$b%111 S!ope *+is part applies to records inelectronic form t+at are1. Created,2. modified, (CR*)

. aintained, rc+i/ed,$. Retrie/ed, or transmitted.

*+is part does not apply to paper records t+at are, or +a/e een, transmitted y electronic means.c) 3+ere electronic si"natures and t+eir associated electronic records meet t+e requirements of t+is part, t+e a"ency &illconsider t+e electronic si"natures to e equi/alent to full +and&ritten si"natures, initials, and ot+er "eneral si"nin"s asrequired y a"ency re"ulations, unless specifically e-cepted y re"ulation(s) effecti/e on or after u"ust 20, 1997.

d) !lectronic records t+at meet t+e requirements of t+is part may e used in lieu of paper records, in accordance &it+ 4 11.2,unless paper records are specifically required.

(e) Computer systems (includin" +ard&are and soft&are), controls, and attendant documentation maintained under t+is parts+all e readily a/ailale for, and su5ect to, F# inspection.

' 11( I)ple)entation

(a) For records required to e maintained ut not sumitted to t+e a"ency, persons may use electronic records in lieuof paper records or electronic si"natures in lieu of traditional si"natures, in &+ole or in part, pro/ided t+at t+erequirements of t+is part are met.

() For records sumitted to t+e a"ency, persons may use electronic records in lieu of paper records or electronicsi"natures in lieu of traditional si"natures, in &+ole or in part, pro/ided t+at6

(1) *+e requirements of t+is part are met and

(2) *+e document or parts of a document to e sumitted +a/e een identified in pulic doc'et 8o. 92S 02$1 as ein" t+etype of sumission t+e a"ency accepts in electronic form. *+is doc'et &ill identify specifically &+at types of documents or

parts of documents are acceptale for sumission in electronic form &it+out paper records and t+e a"ency recei/in" unit(s)(e."., specific center, office, di/ision, ranc+) to &+ic+ suc+ sumissions may e made. #ocuments to a"ency recei/in"unit(s) not specified in t+e pulic doc'et &ill not e considered as official if t+ey are sumitted in electronic form paperforms of suc+ documents &ill e considered as official and must accompany any electronic records. :ersons are e-pected toconsult &it+ t+e intended a"ency recei/in" unit for details on +o& (e."., met+od of transmission, media, file formats, andtec+nical protocols) and &+et+er to proceed &it+ t+e electronic sumission.

(e) Computer systems (includin" +ard&are and soft&are), controls, and attendant documentation maintained under t+is parts+all e readily a/ailale, for, and su5ect to, F# inspection.

' 11* De+initions

()Biometrics means a met+od of /erifyin" an indi/idual;s identity ased on measurement of t+e indi/idual;s p+ysicalfeature(s) or repeatale action(s) &+ere t+ose features and%or actions are ot+ unique to t+at indi/idual andmeasurale.

7/25/2019 21 cfr part 11_1997_2003

2/38

P a g e | 2

() Closed system means an en/ironment in &+ic+ system access is controlled y persons &+o are responsile for t+econtent of electronic records t+at are on t+e system.

($)Digital signature means an electronic si"nature ased upon crypto"rap+ic met+ods of ori"inator aut+entication,computed y usin" a set of rules and a set of parameters suc+ t+at t+e identity of t+e si"ner and t+e inte"rity of t+e datacan e /erified.

(

7/25/2019 21 cfr part 11_1997_2003

3/38

P a g e | 3

' 11*, Controls +or open s-ste)s

:ersons &+o use open systems to create, modify, maintain, or transmit electronic records s+all employ procedures andcontrols desi"ned to ensure t+e aut+enticity, inte"rity, and, as appropriate, t+e confidentiality of electronic records from t+epoint of t+eir creation to t+e point of t+eir receipt. Suc+ procedures and controls s+all include t+ose identified in 4 11.10,as appropriate, and additional measures suc+ as document encryption and use of appropriate di"ital si"nature standards toensure, as necessary under t+e circumstances, record aut+enticity, inte"rity, and confidentiality.

' 11., Si#nature )ani+estations

(a) Si"ned electronic records s+all contain informationassociated &it+ t+e si"nin" t+at clearly indicates allof t+e follo&in"6

(1) *+e printed name of t+e si"ner(2) *+e date and time &+en t+e si"nature &as e-ecuted

and() *+e meanin" (suc+ as re/ie&, appro/al,

responsiility, or aut+ors+ip) associated &it+ t+esi"nature.

() *+e items identified in para"rap+s (a)(1), (a)(2), and (a)()of t+is section s+all e su5ect to t+e same controls as forelectronic records and s+all e included as part of any +umanreadale form of t+e electronic record (suc+ as electronicdisplay or printout).

' 11/, Si#nature0re!or" linin#

!lectronic si"natures and +and&ritten si"natures e-ecuted to electronic records s+all e lin'ed to t+eir respecti/e electronicrecords to ensure t+at t+e si"natures cannot e e-cised, copied, or ot+er&ise transferred to falsify an electronic record yordinary means.

Subpart CEle!troni! Si#natures

' 111,, General re2uire)ents

(a) !ac+ electronic si"nature s+all e unique to one indi/idual and s+all not e reused y, or reassi"ned to, anyoneelse.() efore an or"ani=ation estalis+es, assi"ns, certifies, or ot+er&ise sanctions an indi/idual;s electronic si"nature, or

any element of suc+ electronic si"nature, t+e or"ani=ation s+all /erify t+e identity of t+e indi/idual.

(c) :ersons usin" electronic si"natures s+all, prior to or at t+e time of suc+ use, certify to t+e a"ency t+at t+e electronicSi"natures in t+eir system, used on or after u"ust 20, 1997, are intended to e t+e le"ally indin" equi/alent of traditional+and&ritten si"natures.(1) *+e certification s+all e sumitted in paper form and si"ned &it+ a traditional +and&ritten si"nature, to t+e Dffice ofRe"ional Dperations (EFC100), $

7/25/2019 21 cfr part 11_1997_2003

4/38

P a g e | 4

11.300 Controls for identification codes/ passwords.

:ersons &+o use electronic si"natures ased upon use of identification codes in comination &it+ pass&ords s+all employcontrols to ensure t+eir security and inte"rity. Suc+ controls s+all include6

(a) aintainin" t+e uniqueness of eac+ comined identification code and pass&ord, suc+ t+at no t&o indi/iduals +a/e t+esame comination of Identification code and pass&ord.

() !nsurin" t+at identification code and pass&ord issuances are periodically c+ec'ed, recalled, or re/ised (e."., to co/ersuc+ e/ents as pass&ord a"in").

(c) Follo&in" loss mana"ement procedures to electronically deaut+ori=e lost, stolen, missin", or ot+er&ise potentiallycompromised to'ens, cards, and ot+er de/ices t+at ear or "enerate identification code or pass&ord information, and toissue temporary or permanent replacements usin" suitale, ri"orous controls.

(d) Ase of transaction safe"uards to pre/ent unaut+ori=ed use of pass&ords and%or identification codes, and to detect andreport in an immediate and ur"ent manner any attempts at t+eirAnaut+ori=ed use to t+e system security unit, and, as appropriate, to or"ani=ational mana"ement.

(e) Initial and periodic testin" of de/ices, suc+ as to'ens or cards, t+at ear or "enerate identification code or pass&ordinformation to ensure t+at t+ey function properly and +a/e not een altered in an unaut+ori=ed manner.

Guidance for Industry Part 11 Electronic !ecords" Electronic #ignatures $ #cope and %pplication 2003

1&I'(!)*+C(I)'.

F# is reBe-aminin" part 11 as itapplies to all F# re"ulatedproducts.

3&*I#C+##I)'

%. ),erall %pproac- to Part 11 !euirements

2&%CG!)+'* . *etails of %pproac- #cope of Part 11

1. Narrow Interpretation of Scope 2. Definition of art 11 !ecords.

C. %pproac- to #pecific Part 11 !euirements % 4 C !5

1. "alidation 2. #udit $rail %. &egacy Systems '. Copies of !ecords (. !ecord

!etention

%. ),erall %pproac- to Part 11 !euirements.

1. @imitin" system access to aut+ori=ed indi/iduals2 use of operational system c+ec's uses of aut+ority c+ec's uses of de/ice c+ec's$ #etermination t+at persons, &+o de/elop, maintain, or use electronic systems +a/e t+e education,trainin", and e-perience to perform t+eir assi"ned tas's.< !stalis+ment of and ad+erence to &ritten policies t+at +old indi/iduals accountale for actionsinitiated under t+eir electronic si"natures.7.ppropriate controls o/er systems documentation.>. Controls for open systems correspondin" to controls for closed systems ulleted ao/e (11.0)9. Requirements related to electronic si"natures (e."., 44 11.$0, 11.70, 11.100, 11.200, and 11.00)

. *etails of %pproac- #cope of Part 11

1. Narrow Interpretation of Scope) *e understand t+at t+ere is some confusiona,out t+e

scope of part 11. Some +a-e understood t+e scope of part 11 to ,e -ery ,road. *e ,elie-e t+at some of

t+ose ,road interpretations could lead to unnecessary controls and costs and could discourage

inno-ation and tec+nological ad-ances wit+out pro-iding added ,enefit to t+e pu,lic +ealt+. #s a

result we want to clarify t+at t+e #gency intends to interpret t+e scope of part 11 narrowly.

/nder t+e narrow interpretation of t+e scope of part 11 wit+ respect to records re0uired to ,e

maintained under predicate rules or su,mitted to D# w+en persons c+oose to use records in

7/25/2019 21 cfr part 11_1997_2003

5/38

P a g e | 5

electronic format in place of paper format part 11 would apply. On t+e ot+er +and w+en persons use

computers to generate paper printouts of electronic records and t+ose paper records meet all t+e

re0uirements of t+e applica,le predicate rules and persons rely on t+e paper records to perform t+eir

regulated acti-ities D# would generally not consider persons to ,e using electronic records in lieu

of paper records under 33 11.24a5 and 11.24,5. In t+ese instances t+e use of computer systems in t+e

generation of paper records would not trigger part 11.

2. Definition of art 11 !ecords

!ecords t+at are re0uired to ,e maintained under predicate rule re0uirements and t+at are

maintained in electronic format in place of paper format. On t+e ot+er +and records 4and any

associated signatures5 t+at are not re0uired to ,e retained under predicate rules ,ut t+at are

nonet+eless maintained in electronic format are not part 11 records.

*e recommend t+at you determine ,ased on t+e predicate rules w+et+er specific records are

part 11 records. *e recommend t+at you document suc+ decisions.

!ecords t+at are re0uired to ,e maintained under predicate rules t+at are maintained in

electronic format in addition to paper format and t+at are relied on to perform regulated

acti-ities.

In some cases actual ,usiness practices may dictate w+et+er you are using electronic records

instead of paper records under 3 11.24a5. or e6ample if a record is re0uired to ,e maintained

under a predicate rule and you use a computer to generate a paper printout of t+e electronic

records ,ut you nonet+eless rely on t+e electronic record to perform regulated acti-ities t+e

#gency may consider you to ,e using t+e electronic record instead of t+e paper record. $+at is

t+e #gency may ta7e your ,usiness practices into account in determining w+et+er part 11

applies.

#ccordingly we recommend t+at for eac+ record re0uired to ,e maintained under predicate

rules you determine in ad-ance w+et+er you plan to rely on t+e electronic record or paper

record to perform regulated acti-ities. *e recommend t+at you document t+is decision 4e.g. in a

Standard Operating rocedure 4SO5 or specification document5.

!ecords su,mitted to D# under predicate rules 4e-en if suc+ records are not specifically

identified in #gency regulations5 in electronic format 4assuming t+e records +a-e ,een identified

in doc7et num,er 82S9:2(1 as t+e types of su,missions t+e #gency accepts in electronic format5.

Howe-er a record t+at is not itself su,mitted ,ut is used in generating a su,mission is not a

part 11 record unless it is ot+erwise re0uired to ,e maintained under a predicate rule and it is

maintained in electronic format.Electronic signatures t+at are intended to ,e t+e e0ui-alent of +andwritten signatures initials

and ot+er general signings re0uired ,y predicate rules. art 11 signatures include electronic

signatures t+at are used for e6ample to document t+e fact t+at certain e-ents or actions

occurred in accordance wit+ t+e predicate rule 4e.g. appro-ed re-iewed and -erified5.

C. %pproac- to #pecific Part 11 !euirements

1. "alidation?alidation of computeri=ed systems (4 11.10(a) and correspondin" requirements in 4 11.0).lt+ou"+ persons must still comply &it+ all applicale predicate rule requirements for /alidation

(e."., 21 CFR >20.70(i)), eet predicate rule. ou s+ould also consider t+e impact t+ose systems mi"+t +a/e on t+e accuracy,reliaility,inte"rity, a/ailaility, and aut+enticity of required records and si"natures. !/en if t+ere is no

predicate rule requirement to /alidate a system, in some instances it may still e important to

/alidate t+e system.

3e recommend t+at you ase your approac+ on a 5ustified and documented ris' assessment and a

determination of t+e potential of t+e system to affect product quality and safety, and record

7/25/2019 21 cfr part 11_1997_2003

6/38

P a g e | 6

inte"rity. For instance, /alidation &ould not e important for a &ord processor used only to

"enerate SD:s

2. #udit $rail6 computerB"enerated, timeBstamped audit trails (4 11.10 (e), (')(2) and anycorrespondin" requirement in 411.0). date (e."., 4 $>.10(e)), time, or sequencin" of e/ents as

&ell as any requirements for ensurin" t+at c+an"es to records do not oscure pre/ious entries.

3e recommend t+at you ase your decision on &+et+er to apply audit trails, or ot+er appropriate

measures, on t+e need to comply &it+ predicate rule requirements, a 5ustified and documented ris' assessment,

and a determination of t+e potential effect on product quality and safety and record inte"rity.

3e su""est t+at you apply appropriate controls ased on suc+ an assessment. udit trails can e particularly

appropriate &+en users are e-pected to create, modify, or delete re"ulated records durin" normal operation.

%. &egacy Systems) Existing system whose validation does not necessarily meetcurrent compliance requirements.

*+e "ency intends to e-ercise enforcement discretion &it+ respect to all part 11 requirements for systems t+atot+er&ise &ere operational prior to u"ust 20, 1997, t+e effecti/e date of part 11, under t+e circumstancesspecified elo&.*+is means t+at t+e "ency does not intend to ta'e enforcement action to enforce compliance &it+ any part 11requirements if all t+e follo&in" criteria are met for a specific system6

t+e system &as operational efore t+e effecti/e date.t+e system met all applicale predicate rule requirements efore t+e effecti/e date.t+e system currently meets all applicale predicate rule requirements.you +a/e documented e/idence and 5ustification t+at t+e system is fit for its intended use (includin" +a/in" an

acceptale le/el of record security and inte"rity, if applicale).

If a system +as een c+an"ed since u"ust 20, 1997, and if t+e c+an"es &ould pre/ent t+e system from meetin"predicate rule requirements, :art 11 controls s+ould e applied to :art 11 records and si"natures pursuant to t+e

enforcement policy e-pressed in t+is "uidance.

'. Copies of !ecords)*+e "ency intends to e-ercise enforcement discretion &it+ re"ard to specific part 11 requirementsfor "eneratin" copies of records (4 11.10 () and any correspondin" requirement in 411.0). ous+ould pro/ide an in/esti"ator &it+ reasonale and useful access to records durin" an inspection.ll records +eld y you are su5ect to inspection in accordance &it+ predicate rules (e."., 44211.1>0(c), (d), and 10>.$(c) () (ii)).

3e recommend t+at you supply copies of electronic records y6

H :roducin" copies of records +eld in common portale formats &+en records are maintained in t+ese

formats.

Asin" estalis+ed automated con/ersion or e-port met+ods, &+ere a/ailale, to ma'e copies in a more

common format (e-amples of suc+ formats include, ut are not limited to, :#F, @, or SG@)

In eac+ case, &e recommend t+at t+e copyin" process used produces copies t+at preser/e t+e content

and meanin" of t+e record. If you +a/e t+e aility to searc+, sort, or trend part 11 records, copies "i/en

to t+e "ency s+ould pro/ide t+e same capaility if it is reasonale and tec+nically feasile. ou

s+ould allo& inspection, re/ie&, and copyin" of records in a +uman readale form at your site usin"

your +ard&are and follo&in" your estalis+ed procedures and tec+niques for accessin" records.

$. !ecord !etention

7/25/2019 21 cfr part 11_1997_2003

7/38

P a g e | 7

*+e "ency intends to e-ercise enforcement discretion &it+ re"ard to t+e part 11 requirements fort+e protection of records to enale t+eir accurate and ready retrie/al t+rou"+out t+e recordsretention period (4 11.10 (c) and any correspondin" requirement in 411.0). :ersons must stillcomply &it+ all applicale predicate rule requirements for record retention and a/ailaility (e.". 44211.1>0(c),(d), 10>.2$("), and 10>.$(+)).

3e su""est t+at your decision on +o& to maintain records e ased on predicate rule requirementsand t+at you ase your decision on a 5ustified and documented ris' assessment and a determination

of t+e /alue of t+e records o/er time.

F# does not intend to o5ect if you decide to arc+i/e required records in electronic format to

nonelectronic media suc+ as microfilm, microfic+e, and paper, or to a standard electronic file

format (e-amples of suc+ formats include, ut are not limited to, :#F, @, or SG@). :ersons

must still comply &it+ all predicate rule requirements, and t+e records t+emsel/es and any copies

of t+e required records s+ould preser/e t+eir content and meanin". s lon" as predicate rule

requirements are fully satisfied and t+e content and meanin" of t+e records are preser/ed and

arc+i/ed, you can delete t+e electronic /ersion of t+e records. In addition, paper and electronic

record and si"nature components can coBe-ist (i.e., a +yrid> situation) as lon" as predicate rule

requirements are met and t+e content and meanin" of t+ose records are preser/ed.

!-tra

Electronic !ecords

!lectronic records (co/ered y part of t+e re"ulation) "enerated y any computeri=ed system

must e trust&ort+y and reliale t+erefore, a numer of controls e-ist in t+e re"ulation to support

t+is requirement. In summary, 'ey requirements are6

J Systems must e /alidated.

J Systems must e ale to detect altered and in/alid records.

J Dnly aut+ori=ed indi/iduals must +a/e access to a system and t+eir access le/els must reflectt+eir 5o.

J udit trails are required to monitor creation of and c+an"es to records, includin" arc+i/in" or

deletion of data.

J :eople usin" a system must e trained t+is includes all le/els of support from system

administration, to front line users and I* support staff.

J Records must e protected for t+e duration of t+e records retention period, up to 1$ to 20 years

dependin" on t+e predicate rule.

J Systems must e ale to pro/ide t+e data and associated meta data to an inspector if required.

J Si"nin" of records requires t+e name of t+e indi/idual, reason for si"nin", and t+e date and time

to e displayed at t+e time of si"nin".

J Si"natures must e lin'ed to respecti/e records so t+at t+e si"natures cannot eremoved orcopied.J :olicies must e estalis+ed +oldin" indi/iduals accountale for actions ta'en under t+eir

electronic si"natures.

J 3+ere data confidentiality is required, t+e addition of security suc+ as file encryption or di"ital

si"natures is required to ensure confidentiality. *+e system, includin" trainin" and resultant

records, must e sufficient to pre/ent repudiation of electronic si"natures as not "enuine.

Electronic signatures

:art C of t+e re"ulation +as many requirements for procedural and administrati/e controls, &it+

relati/ely fe& tec+nical requirements. 3+ile :art C of t+e rule is /oluntary, and eac+ company can

c+oose &+et+er to implement electronic si"natures, t+ere are also pertinent security requirements

7/25/2019 21 cfr part 11_1997_2003

8/38

P a g e | 8

for t+e trust&ort+iness and reliaility of electronic records for e-ample, t+e aility to detect

unaut+ori=ed access to a system in 411.00(d). *+e main requirements are6

J :eople usin" electronic si"natures must +a/e t+eir identities /erified.

J Companies must send a letter to t+e F# certifyin" t+at &+en electronic si"natures are used, t+ey

are t+e le"al equi/alent of traditional +and&ritten si"natures.

J !lectronic si"natures must e unique to an indi/idual and ne/er reused y a company.J Controls must e in place to pre/ent fraud.

J Fraud &ould require t+e collaoration of t&o or more indi/iduals.

J *+e system must e ale to detect attempts of unaut+ori=ed access and notify t+e appropriate

security%mana"ement staff.

7/25/2019 21 cfr part 11_1997_2003

9/38

P a g e | 9

Interrelations-ips of tec-nical and procedural controls:

#ome tec-nical controls do not stand on t-eir own. (-ey reuire a procedure to ensure t-at t-ey are

implemented and are effecti,e. E6amples include:7 11.300d5 (-e system must -a,e t-e a8ility to detect unaut-ori9ed use" t-is is limited to access attempts

currently. -en unaut-ori9ed access is attempted t-e software tec-nical controls portion of t-e system5

notifies administrati,e/security personnel w-o will follow a documented procedure to in,estigate t-e issue

and report on t-e outcome.

7 11.10d5 limits system access to aut-ori9ed indi,iduals and 11.10g5 reuires aut-ority c-ec;s to ensure t-at

people only -a,e access to functions appropriate to t-eir position and training. % #)P must 8e in place for

defining and implementing t-ese two reuirements and also listing t-e aut-ori9ed users and t-eir indi,idual

access le,els. e will loo; at t-is in more detail as we re,iew t-e reuirements for 21 C

%nalyst #oftware Customer: alidation and +se Case #tudy

=eff *uggan at P-armacia>s *epartment of *rug ?eta8olism at t-e #;o;ie Ill. facility P-armacia was

purc-ased 8y Pfi9er in 20035 -as 8een in,ol,ed wit- t-e ,alidation of %nalyst software ,ersion 1.2 w-en used

as a -y8rid system electronic records and -andwritten signatures on paper records5. (-e ,alidation carried

out at #;o;ie was a glo8al pro@ect underta;en 8y a ,alidation team wit- participants at two +# and one

European site ,alidating 2A networ;ed %nalyst software wor;stations. Configuring user security is an

important consideration 8efore t-e ,alidation can start. (-ere are four types of users wit-in t-e system:

administrators analysts operators and users. (-e user types in %nalyst software were lin;ed to networ;

groups rat-er t-an indi,idual users 8ecause creating a separate security data8ase on eac- indi,idual

mac-ine would -a,e made suc- a large system difficult to manage. (wo added ad,antages of t-e networ;B

resident groups for eac- user type are: 15 users are easily added to or remo,ed from t-e entire system 8y t-enetwor; I( administrator simply remo,ing or adding a user name from t-e appropriate group and 25 any

user can use %nalyst software in any location pro,ided t-at t-ey are in t-e proper networ; group.

(-e latter feature allowed glo8al company users to use systems at different geograp-ic sites if necessary.

(-is ,ersion of %nalyst software could only acuire data to t-e local -ard dri,e. (o protect t-e data t-at was

generated t-ere was an automated dis;BtoBdis; copy at :00 am e,ery day ,ia a 8ac;up to a protected ser,er.

)nce stored on t-e ser,er data are arc-i,ed wee;ly ,ia tape 8ac;up. (-e acuisition wor;station -ard dri,e

remains t-e storage site for raw data" t-erefore t-e data area of eac- acuisition station -ard dri,e is writeB

protected to pre,ent file o,erwrites or erasures. it-in t-e ser,er en,ironment file security is defined so t-at

only administrators -a,e t-e rig-t to delete data 8ut t-e a8ility to do so is controlled 8y local #)P an

e6ample of mi6ing tec-nical and procedural controls of Part 115. %dministrati,e: %dmin

controls are policies for 21

C

organi9ation and can include

a company interpretation of

t-e re ulation and -ow t-e

2. procedural:

Procedural controls

are essentially

standard operating

procedures #)Ps5 or

ot-er written

3.tec-nical :E6amples of tec-nicalcontrols are t-e security and access

control for t-e application and t-e audit

trail to monitor c-anges to t-e records

7/25/2019 21 cfr part 11_1997_2003

10/38

P a g e | 10

uestion and %nswers

.1 -at I# 21 C

What is 21 CFR Part 11?

An important driver for the "Electronic Records Electronic !ignatures" nal rule

was the pharmaceutical industry# which approached the $%A with a request to

use electronic records so that the industry could ta&e advantage of modern

technology and reduce the use of paper. $ollowing the pu'lication of a draft of

the regulation in ())*# the nal rule was pu'lished on +arch ,-# ())# and

'ecame e/ective on August ,-# ()).

0n essence# the regulation provides the 'asis for the use of electronic records in

place of paper records as well as the use of electronic signatures# rather than

handwritten ones.

1nder ,( 2$R Part ((# electronic records can 'e equivalent to the paper records

required 'y predicate regulations 3e.g.# ,( 2$R Part 45# the 6ood 7a'oratory

Regulations8. Electronic signatures can 'e considered as legal equivalents to

handwritten signatures. 9he regulation further stipulates that 'oth electronic

signatures and electronic records must 'e trustworthy and relia'le.

9he regulation impacts almost all $%A:regulated wor& 3e.g.# pharmaceuticals#medical devices# food8 thus# it impacts 'ioanalysis directly when studies are

used to support new drug applications or new formulations of existing drugs. Any

organi;ation that wishes to register products for sale in the 1!# regardless of

where the organi;ation is 'ased# must comply with the requirements of this

regulation.

-at is an #)P

Standard Dperatin" :rocedure (SD:) is a certain type of document t+at descries in a stepB

yBstep outline form +o& to perform a particular tas' or operation. !/eryone in a companymust follo& t+e same procedures to assure t+at tas's are performed consistently and correctly.ost companies +a/e a &ide /ariety of SD:s t+at descrie +o& to do different tas's. In manycompanies tec+nicians and operators are trained in +o& to follo& indi/idual SD:s and t+eirtrainin" record specifies &+ic+ SD:s t+ey are trained on and are aut+ori=ed to use.

-at is 21 C

*itle 21 CFR :art 11 of t+e Code of Federal Re"ulations deals &it+ t+e Food and #ru"dministration (F#) "uidelines on electronic records and electronic si"natures in t+eAnited States. :art 11, as it is commonly called, defines t+e criteria under &+ic+ electronic

7/25/2019 21 cfr part 11_1997_2003

11/38

P a g e | 11

records and electronic si"natures are considered to e trust&ort+y, reliale and equi/alent topaper records

-at is an #)P

Standard Dperatin" :rocedure (SD:) is a certain type of document t+at descries in a stepByBstep outline form +o& to perform a particular tas' or operation. !/eryone in a companymust follo& t+e same procedures to assure t+at tas's are performed consistently and correctly.ost companies +a/e a &ide /ariety of SD:s t+at descrie +o& to do different tas's. In manycompanies tec+nicians and operators are trained in +o& to follo& indi/idual SD:s and t+eir

trainin" record specifies &+ic+ SD:s t+ey are trained on and are aut+ori=ed to use.

-at is 21 C

*itle 21 CFR :art 11 of t+e Code of Federal Re"ulations deals &it+ t+e Food and #ru"dministration (F#) "uidelines on electronic records and electronic si"natures in t+eAnited States. :art 11, as it is commonly called, defines t+e criteria under &+ic+ electronicrecords and electronic si"natures are considered to e trust&ort+y, reliale and equi/alent to

paper records

-at are user reuirements

Aser Requirements Specification descries &+at users require from t+e System. Aserrequirement specifications are &ritten early in t+e /alidation process, typically efore t+esystem is created. It is &ritten y t+e System D&ner and !nd Asers, &it+ input from ualityssurance. Requirements outlined in t+e ARS are usually tested in t+e :erformanceualification. Aser Requirements Specifications are not intended to e a tec+nical documentreaders &it+ only a "eneral 'no&led"e of t+e system s+ould e ale to understand t+erequirements outlined in t+e ARS.

-at is a ,alidation plan

?alidation :lans define t+e scope and "oals of a /alidation pro5ect. ?alidation plans are&ritten efore a /alidation pro5ect and are specific to a sin"le /alidation pro5ect. ?alidation:lans can include6

#eli/erales (#ocuments) to e "enerated durin" t+e /alidation process

Resources%#epartments%:ersonnel to participate in t+e /alidation pro5ect

*imeB@ine for completin" t+e /alidation pro5ect

-at is an I document

http://futurethoughtsllc.com/ValidationInterviewFAQ.aspxhttp://futurethoughtsllc.com/ValidationInterviewFAQ.aspx

7/25/2019 21 cfr part 11_1997_2003

12/38

P a g e | 12

Installation ualifications are a collection of test cases used to /erify t+e proper installationof a System. *+e requirement to properly install t+e system &as defined in t+e #esi"nSpecification. Installation ualifications must e performed efore completin" Dperationalualification or :erformance ualification.

-at is an ) *ocument

Dperational ualifications are a collection of test cases used to /erify t+e proper functionin"of a System. *+e operational qualification tests requirements defined in t+e FunctionalRequirements. Dperational ualifications are usually performed efore t+e system is releasedfor use.

-at is a P *ocument

:erformance ualifications are a collection of test cases used to /erify t+at a System

performs as e-pected under simulated realB&orld conditions. *+e performance qualificationtests requirements t+at &ere defined in t+e Aser Requirement Specification (or possily t+eFunctional Requirements). #ue to t+e nature of performancequalifications, t+ese tests aresometime conducted &it+ po&er users as t+e system is ein" released.

-at is a alidation #ummary !eport

?alidation Summary Reports pro/ide an o/er/ie& of t+e entire /alidation pro5ect. 3+enre"ulatory auditors re/ie& /alidation pro5ects, t+ey typically e"in y re/ie&in" t+e summaryreport. *+e /alidation summary report s+ould include6

description of t+e /alidation pro5ect

ll test cases performed, includin" if t+ose test cases passed &it+out issue

ll de/iations reported, includin" +o& t+ose de/iations &ere resol/ed

-at is a C-ange !euest

C+an"e Control is a "eneral term descriin" t+e process of mana"in" +o& c+an"es areintroduced into a controlled System. In /alidation, t+is means +o& c+an"es are made to t+e/alidated system. C+an"e control is required to demonstrate to re"ulatory aut+orities t+at/alidated systems remain under control after system c+an"es. C+an"e Control systems are afa/orite tar"et of re"ulatory auditors ecause t+ey /i/idly demonstrate an or"ani=ationcapacity to control its systems.

Fow to assess clinical la8oratories for GCP complianceis one of t+e more difficult issuesfacin" G-: professionals. Is C@I t+e "old standardP Eo& do t+e "ood laoratory practice(G@:) re"ulations impact clinical lasP Isn;t t+ere a +andy c+ec'list out t+ere some&+ereP3+at do people mean y GC@:PT I +a/e een dealin" &it+ t+is issue a lot of late and peopleare really all o/er t+e map. Eere are some of t+e approac+es I ta'e, alon" &it+ a +andyBdandy

reference list at t+e ottom of t+e post.

http://futurethoughtsllc.com/ValidationInterviewFAQ.aspxhttp://futurethoughtsllc.com/ValidationInterviewFAQ.aspxhttp://futurethoughtsllc.com/ValidationInterviewFAQ.aspx

7/25/2019 21 cfr part 11_1997_2003

13/38

P a g e | 13

First, let;s loo' at t+e easy part. *+e primary re"ulation dealin" &it+ clinical laoratories ist+e Clinical 4a8oratory Impro,ement %mendments C4I%5.3o&, t+at;s simple.Eo&e/er, C@I specifically states t+at it does not +a/e 5urisdiction o/er researc+. C@Ico/ers t+e dayBtoBday laoratory tests t+at your doctor orders to c+ec' up on your c+olesterolor +ematocrit. For t+ese routine tests, F# reco"ni=es C@I certification as an acceptale

standard. F# also reco"ni=es ot+er certifications suc+ as from t+e College of %mericanPat-ologists(C:). Eo&e/er, F# does not +a/e its o&n laoratory pro"ram. 'o t-e G4Pregulations Part 55ust don;t apply +ere. y ad/ice is to 'eep t+em on t+e s+elf.

Fowe,er t-ings can get more comple6. 8ot all laoratory tests are C@I certified, t+ere isa &+ole lot of researc+ "oin" on out t+ere. Researc+ met+ods are ein" de/eloped e/ery day.*o ma'e matters &orse, 5ust ecause a la is C@I or C: certified, it does not mean t+att+ey +a/e clinical trial e-perience and 'no&led"e of 'it uildin" or lindin" procedures. ouneed to "o to t+eir laoratory and see if t+ey are equipped to perform t+e tas's in yourstatement of &or'. ou need to perform a c+ainBofBcustody tour to determine t+at your

samples &ill e +andled and analy=ed in an appropriate manner, if t+ere is quality control ateac+ sta"e of data +andlin"T (ICE !< Section $.1.).

Dne document t+at &ill come in +andy is t+e

7/25/2019 21 cfr part 11_1997_2003

14/38

P a g e | 14

important references for clinical las and GC:. Feel free to ma'e additions to t+is list in t+eCommentssection elo&.

G6P %udit (ec-niues J Etiuette

ay 29, 2011

G-: udit *ec+niques and !tiquette

%uditing for uality assurancepurposes or for an independent quality assessment +asecome a necessity for G-: :rofessionals in t+e +i"+ly re"ulated life sciences industry. anycompanies +a/e +i"+ly de/eloped SD:s for auditors ut t+ere is no consensus on t+e asic

e+a/iors of auditors. In t+is Guest Commentary/eteran G-: Consultants !mma ars'yand @en Grunaum offer t+eir perspecti/es on +o& auditors s+ould e+a/e &+en conductin"audits t+at can easily impact people;s 5os and reputations. I firmly elie/e t+at auditorss+ould ta'e t+eir approac+ /ery seriously. Recent e-periences of my o&n indicate it is a topic&ell &ort+ re/ie&.

UUUG6P Perspecti,es &ill e ta'in" a rea' for a fe& &ee's. !/eryone s+ould ta'e a rea' no&and t+en.UUU

Guest Commentary 8y Emma ars;y J 4en Grun8aum

s consultants in t+e life science industry, &e often ser/e in t+e capacity of audit +osts for

companies and, as suc+, +a/e a "reater e-posure t+an most to /arious audit e+a/iors. 3et+erefore are rarely surprised y inappropriate audit conduct.

http://gxpperspectives.com/2011/05/29/gxp-audit-techniques-etiquette/http://gxpperspectives.com/2011/05/29/gxp-audit-techniques-etiquette/

7/25/2019 21 cfr part 11_1997_2003

15/38

P a g e | 15

QI put t-ree peoplein @ail.Q

ut e,en our eye8rows were raised&+en a t+irdBparty auditor, &+o &as representin" acompany doin" usiness &it+ our client, started t+e audit &it+, I put t+ree people in 5ail.T

3as s+e s+o&in" off and 5ustifyin" +er credentialsP 3as s+e tryin" to intimidate our clientand usP ot+P *+e result &as t+at no one in t+e room &as impressed or made ner/ous ysuc+ an introduction. If anyt+in", +er attitude pro/ided t+e inspiration for t+is lo" GuestCommentary.

In lig-t of -a,ing to conform to tec-nical and et-ical standardsof one;s profession, anauditor represents +imself%+erself and "roup%department +e%s+e elon"s to for sure. oreimportantly, +o&e/er, t+e auditor also represents +is%+er company as a &+ole, e/en ifrepresentin" t+e auditin" company in t+e role of a consultant. Gi/en t+at t+e auditor is often/ie&ed as t+e company;s due dili"ence eyes and ears,T e/ery &ord and e/ery mo/e t+at t+eauditor ma'es is a reflection on t+e company +e%s+e represents and on t+e employees of t+at

company.

So &+at s+ould one consider &+en it comes to t+e audit preparation, conduct and follo&BupPased on our e-perience (ot+ "ood and ad), t+e follo&in" tips re"ardin" audit etiquette, if

put into practice, &ill usually lea/e t+e auditee &it+ positi/e impressions re"ardin" t+eauditor and t+e company +e%s+e represents, irrespecti/e of t+e audit;s outcome6

J e prepared learn as muc+ as you can in ad/ance aout t+e company you &ill eauditin". t a minimum, t+is can e accomplis+ed t+rou"+6

1) readin" aout t+e company on its &esite,2) +a/in" a discussion &it+ t+ose "roups and%or indi/iduals &+o intend to use t+e company to

e audited,) doin" an internet searc+ to see if t+ere is anyt+in" of interest re"ardin" t+e company to eaudited (e."., &arnin" letters, le"al actions), and) re/ie&in" pre/ious audit reports if applicale and a/ailale.

Preparation:

Qn audit a"enda is t+e first document t+e auditee &ill seeQ

J #tay focused de/elop an audit a"enda t+at &ill center on t+e usiness reason(s) for t+eaudit (e."., qualification%due dili"ence audit, for causeT audit, follo&Bup of a pre/ious audit,in/esti"ation). n audit a"enda is t+e first document t+at t+e auditee &ill see, and from t+is&ill form an opinion re"ardin" t+e auditor. *+erefore, it is est to +a/e a detailed a"enda t+atis customi=ed in terms of t+e asis for t+e audit. *+is &ill6

7/25/2019 21 cfr part 11_1997_2003

16/38

P a g e | 16

1) demonstrate t+e auditor;s understandin" of t+e nature of t+e auditee;s actual and%orpotential support as it relates to t+e auditor;s company,2) e indicati/e of t+e fact t+at t+ere is no +idden a"enda on t+e part of t+e auditor, and) set t+e tone for t+e auditor;s o&n e-pectations re"ardin" t+orou"+ness of t+e auditee;s

preparation for t+e audit.

J e timely if possile (e."., you are not conductin" a for causeT audit or an in/esti"ation),send t+e audit a"enda to t+e auditee at least t&o (2) &ee's in ad/ance of t+e audit. 3+ile acompany s+ould e prepared for an audit at all times, a timely a"enda6

1) allo&s t+e auditee time to "at+er correct and complete information in ad/ance of t+e audit,2) permits t+e auditee to identify and sc+edule t+e appropriate indi/iduals &+o &ill pro/ideinformation durin" t+e audit, and) estalis+es t+e auditor;s o&n standard re"ardin" timeliness for t+e auditee to pro/iderequested information.

J *ress appropriately &+ile many companies +a/e a casual dress code, &e elie/e t+at anauditor s+ould al&ays e dressed in a suit ecause t+is is a si"n of respect and

professionalism e/en in today;s less t+an formalT &or' en/ironment.

%,oid #urprises

J %,oid surprises information re"ardin" t+e numer of people attendin" t+e audit s+ould ecommunicated to t+e auditee as far in ad/ance as possile. ore t+an once, &e +a/e seeninstances &+ere more people t+an e-pected s+o&ed up for an audit &it+out &arnin". !/en ift+e numer of people to e +osted c+an"es at t+e last second, it is t+e auditor;s responsiilityto let t+e auditee 'no& aout it. nyt+in" less t+an t+at is /ie&ed as unprofessional.

J e sensiti,e reco"ni=e t+e fact t+at audits are stressful in t+at t+ey ta'e a&ay from t+eauditee;s aility to do illale &or'. *+erefore, to ma-imi=e on your o&n effort &+ile ein"conscious of t+e auditee;s a/ailaility, +a/e all of your questions prepared in ad/ance ofinter/ie&s (e."., after readin" SD:s or ot+er documents so t+e questions can e detailed andspecific) to minimi=e t+e inter/ie& time and e fle-ile if t+e times for t+e inter/ie&s +a/e to

e c+an"ed on t+e spot.

J e fair sometimes issues are /ery complicated and o/erlap multiple processes and%oror"ani=ational "roups. *+us it is only fair to split t+e responsiility formisunderstandin"s%miscommunication and acti/ities "oin" amissT et&een t+e auditee and

t+e company on e+alf of &+ic+ t+e audit is ein" performed.

7/25/2019 21 cfr part 11_1997_2003

17/38

P a g e | 17

e

7/25/2019 21 cfr part 11_1997_2003

18/38

P a g e | 18

Q*ransparency t+rou"+out t+e auditQ

*ransparency t+rou"+out t+e audit &ill "i/e t+e auditee a c+ance to present additionaldocumentation, pro/ide clarifications and collect supplementary e/idence efore t+e end oft+e audit. 8ot only &ill suc+ an approac+ pre/ent t+e auditee from feelin" c+eatedT orlindBsided,T ut it &ill also "i/e you, t+e auditor, a muc+ etter idea re"ardin" &+ere t+eauditee really stands.

J e sensi8le unli'e many seem to elie/e, minimal or no oser/ationsT is not necessarilya reflection on your competency. So don;t e afraid to &al' out of t+e audit &it+ nofindin"sT &+ere findin"s are not &arranted. Rememer t+at e/en t+e F# itself iscomfortale to closeBout its inspections &it+ no F#B>s. Furt+ermore, t+ere s+ould also ea clear difference et&een auditor;s preferences (e."., recommendations) and findin"s t+at

present de/iations from t+e re"ulations and +a/e a potential impact on t+e quality of t+eproduct and%or process(es).

J e factual &+en &ritin" oser/ations, pro/ide enou"+ facts and details to sustantiateyour findin"s. It is est to stay a&ay from ami"uities and "eneralities &+en descriin" anissue ecause not+in" frustrates an auditee more t+an allBencompassin" statements t+at ma'e

t+e issue loo' &orse t+an it really is.

!e,iew udit Findin"sin a *imely anner

J e responsi,e 5ust li'e you e-pect t+e auditee to respond &it+in t+irty (0) calendar days(or usiness days, dependin" on t+e indi/idual company;s requirements) to t+e audit findin"s,t+e auditee is also e-pectin" reasonaly prompt feedac' from you re"ardin" t+e auditfindin"s and feedac' to t+e respecti/e auditee;s responses. *+erefore, t+e audit findin"s,audit responses and any follo&Bups s+ould e sent out and%or re/ie&ed in a timely fas+ion.

8ot lettin" t+e auditee 'no& &+at t+e audit status is, e/en if responses are acceptale, is not

an option ecause contracts often depend on t+e auditee successfully passin" t+e audit.

7/25/2019 21 cfr part 11_1997_2003

19/38

P a g e | 19

(-e Hmorale of t-e story is t-at t-e auditor -as a 8ig responsi8ility to&ards t+ecompany +e%s+e represents and to&ards t+e company +e%s+e is auditin". In our opinion, t+e

i""est compliment and /alidation t+at t+e auditor can "et is for t+e auditee to say you &erefair,T findin"s not&it+standin". In t+is case, e/eryone &ins.

!mma ars'y@en Grunaum:artners(-e Practical #olutions Group 44C

%C!P ?eets in #eattle for 2011 Glo8al Conference

pril 29, 2011

CR: eets in Seattle for 2011 Gloal Conference

#eattle % plays -ost to t-e %ssociation of Clinical !esearc- ProfessionalsK (CR:)annual Gloal Conference. CR: is one of t+e lar"er professional or"ani=ations focusin" onclinical trials and e-pects 2,000 participants. It &ill e t+e first time I +a/e attended t+eirGloal Conference and I am loo'in" for&ard to it. *+ere &ill e sessions on Introduction toIma"in" in Clinical *rialsT and on #istanceBased @earnin" for Forei"n StudyCoordinators.T G-: :erspecti/es &ill e t+ere for t+e entire conference (t+e preBconference&or's+ops +a/e already e"un) and amon" t+e sessions I loo' for&ard to is Comparati/e!ffecti/eness *rials.T I am "oin" to try to lo" at least t&ice durin" t+e conference on issues It+in' are of concern to G6P Perspecti,esreaders. If I am super industrious maye I &ill lo"from t+e CR: Gloal Conference e/ery day.

Fere is a new feature t-at %C!P is offering:#C! is pleased to announce t+at for t+efirst time e-er two li-e9feed lenary Sessions from t+e #C! ;lo,al Conference ay 1 for t+e !egulatory #ffairsu,lic orum featuring representati-es from glo,al regulatory agencies addressing issues

facing clinical trials. =oin us >ay 2 for Inno-ation < ;lo,al Healt+ a discussion ,y $ac+i

?amada >D resident ;lo,al Healt+ rogram Bill and >elinda ;ates oundation.T

For more information /isit t+e %C!P e8site on t-e Plenary #essions

http://www.practicalsolutionsnj.com/http://gxpperspectives.com/2011/04/29/acrp-meets-in-seattle-for-2011-global-conference/http://www.acrpnet.org/GC2011Livehttp://www.practicalsolutionsnj.com/http://gxpperspectives.com/2011/04/29/acrp-meets-in-seattle-for-2011-global-conference/http://www.acrpnet.org/GC2011Live

7/25/2019 21 cfr part 11_1997_2003

20/38

P a g e | 20

#o ou Ea/e a Guest Commentary forG-: :erspecti/esP

not+er +i"+li"+t &ill e t+e ay 1st session on our Site #oesn;t 8eed

7/25/2019 21 cfr part 11_1997_2003

21/38

P a g e | 21

re"ulations usually +a/e a section for definitions.T *a'e some time to read t+em. It &ill +elpyou understand t+e &ay F# interprets inspections and &+en to see' enforcement actions.

n !arly F# Inspection6 Railroad 3aterin" :oints

I'(E!#(%(E C)??E!CE:Dne of t+e principal functions of t+e Anited States"o/ernment is to re"ulate interstate commerce. Railroads &ere t+e principal means ofinterstate transportation &+en F# &as founded and an important area of F# concern. nd

5ust try to document medical o-y"en in interstate commerce. I once +ad a promotion delayedfor t+ree mont+s ecause as a ioresearc+ onitorin" in/esti"ator, I &as dealin" &it+ t+e

iop+armaceutical and medical de/ice industries &+ere interstate commerce is asicallyassumed. So I +ad to "o out to a couple of medical "as repac'ers and collect*)C #amples(a #DC sample consists of paper&or', not a product) to estalis+ t+at I could documentinterstate commerce. (See 3arnin" @etter elo& for Interstate Con/eyance Sanitation.)

3+at is t+e ?iolationP

I)4%(I)'6 *+ere s+ould e a clear and significantT /iolation of t+e re"ulations to putsomet+in" on a > or 3arnin" letter. If t+e laoratory normal ran"e for t+einclusion%e-clusion criteria for lood "lucose is >0B120 "%#@ and t+e result is 121 t+at is aclear /iolation. Is it si"nificantP I t+in' not. #eterminin" si"nificance is not an easy tas'. It issomet+in" t+at may need discussion durin" an F# inspection. :atient, professionaldiscussion of t+e issue is usually t+e est approac+. our F# field in/esti"ator may not +a/ee-perience in t+e specific t+erapeutic area or tec+nical issues of t+e inspection. It isn;t al&ayseasy conductin" an F# inspection and estalis+in" t+e four elements of proof and t+esi"nificance of t+e /iolation. nd rememer, ou cannot determine t+e root cause of a

prolem if you don;t 'no& &+at t+e /iolation is. -at is t-e iolationL

7/25/2019 21 cfr part 11_1997_2003

22/38

P a g e | 22

!E#P)'#II4I(M:Re"ulations assi"n responsiility. In clinical trials t+ey are assi"ned tosponsors, in/esti"ators, and IRs. In G:s and postmar'et acti/ities responsiilities areassi"ned to t+e applicantT and t+e manufacturer of a re"ulated product. In t+e G@:re"ulations, responsiility is assi"ned to t+e testin" facility. !esponsi8ility is a ig *ealtoan F# in/esti"ator. It is 5ust as important to as', 3+ose re"ulatory responsiility is itPT as

it is to as', 3+at is t+e ?iolationPT 3it+out re"ulatory responsiility you cannot determine&+o s+ould recommend t+e actions necessary to correct a re"ulatory error.

*+ere you +a/e it. *+e four elements of proof. *+e asic requirements for F# enforcement.

3+en S+ould uality e"inP

-en s-ould ualitypreparation e"in for a pi/otal p+ase III clinical trialP out once a

mont+ I "et a call as'in" for +elp for a clinical trial ecause its time to "et ready for F#inspections. I as' 3+en &ill t+e application e filedPT *+e responseP Soon, /ery soon.T

It is a "ood t+in" to prepare for an F# inspection. It is e/en etter to prepare at t+ee"innin", re/ie&in" t+e quality considerations necessary to do t+e 5o ri"+t y frontloadin"quality.T Eere are some t+in"s I t+in' you s+ould consider.4lease ta7e t+e sur-ey at t+eend5

P-ase III Considerations for Compliance wit- t-e

7/25/2019 21 cfr part 11_1997_2003

23/38

P a g e | 23

*+ere are t&o types of GC: inspections t+at are of concern for sponsors. *+e first type is t+einspection of clinical in/esti"ators at t+e sites &+ere researc+ is conducted. *+e ma5ority ofF# inspections are of t+e in/esti"ators. *+e second type is t+e inspection of t+e sponsor orcontract researc+ or"ani=ation. *+is is a routine inspection for medical de/ice sponsors and is

ecomin" more common at dru" sponsors. lt+ou"+ most inspections are at clinical sites, in

t+e e/ent t+at serious deficiencies are documented, t+ere can e directed inspections ofsponsors t+at can result in serious re"ulatory action.

for t+e #ata @ifecycle

:rior to e"innin" a pi/otal study t+e sponsor s+ould estalis+ a system of clinical qualityassurance. *+is is a recommendation, not a requirement, of F#. !< defines qualityassurance () as6 #ll t+ose planned and systematic actions t+at are esta,lis+ed to ensuret+at t+e trial is performed and t+e data are generated documented 4recorded5 and reported

in compliance wit+ ;C and applica,le regulatory re0uirement4s5.@ mon" t+e mostimportant acti/ities are t+e follo&in"6

Clinical trial materials.*+ey s+ould e produced in compliance &it+ "ood manufacturin"practice (G:) re"ulations and qualified y an onsite audit.

Increased !nforcement of:art 11

Computeri9ed systemsincludin" eCRFs. *+ere are many for&ard loo'in" systems a/ailalefor electronic case report forms (CRFs) includin" systems t+at are internet ased. *+ese/endors are not re"ulated y F# and do not recei/e re"ulatory inspections. *+e urden is ont+e sponsor to determine if t+e /endor pro/ides GC: compliant ser/ices. ll s+ould equalified y an onsite audit.F# +as started loo'in" a lot closer at eCRF systems.

#ite management organi9ations #?)s5.*+ese are unre"ulated or"ani=ations t+at pro/idesupport for clinical in/esti"ators and recruit study su5ects. F# inspections of sites usin" anSD +a/e frequently een cited for noncompliance &it+ GC:s. SDs s+ould also recei/eonsite audits.

7/25/2019 21 cfr part 11_1997_2003

24/38

P a g e | 24

Central I!s. *+ese commercial institutional re/ie& oards +a/e a etter record t+anSDs. Eo&e/er, t+e protection of +uman participants in researc+ is a central F# concern.Commercial IRs s+ould e qualified y an onsite audit.

!andomi9ation ser,ices. *+is mi"+t not require an onsite audit and qualification, ut t+e

sponsor needs to critically determine t+at t+e /endor can supply t+e required ser/ices.

udits of Clinical Sites

%udits of clinical sites.ICE !< states t+at6 *+e sponsor;s audit plan and procedures for atrial audit s+ould e "uided y t+e importance of t+e trial to sumissions to re"ulatoryaut+oritiesYT *+e sponsor s+ould audit a pi/otal clinical trial t+rou"+out t+e data lifecycle.In particular t+e sponsor s+ould audit prolematic sites durin" t+e study. It is t+e sponsor;sresponsiility to secure in/esti"ator complianceT if t+e in/esti"ator is /iolatin" GC:s. *+is&as t+e first /iolation cited on t+e SanofiB/entis 3arnin" @etter and +as +istorically een ama5or /iolation cited on F# 3arnin" @etters to sponsors.

*op enrollin" sites s+ould al&ays e audited durin" t+e course of t+e study ecause of t+eirincreased importance for a successful study and t+e li'eli+ood t+at t+e site &ill recei/e an

inspection y F#. *+e sponsor s+ould also audit sites t+at may e inspected y F# at t+econclusion of t+e study includin" data outliers, sites &it+ a +istory of noncompliance, andsites t+at do not +a/e a +istory of F# inspections.

*ata8ase audits*+e sponsor;s data mana"ement acti/ities s+ould +a/e independent re/ie&. *+is s+ould include a qualification audit if data mana"ement is contracted out. ne-cellent resource for data mana"ement is t+e Society of Clinical #ata ana"ement. *+ey

pulis+ a Good Clinical #ata ana"ement :ractices Guide &+ic+ is a/ailale for purc+aseon t+eir &esite elo&.

(rial master file (?

7/25/2019 21 cfr part 11_1997_2003

25/38

P a g e | 25

GCP training:*+e sponsor s+ould +a/e a trainin" pro"ram t+at includes initial andcontinuin" trainin" on "ood clinical practice. *+e trainin" pro"ram s+ould e in &ritin" andtrainin" s+ould e documented. t least once a year staff memers s+ould attend an outsideconference, meetin", or &or's+op t+at includes clinical trial professionals t+at are not t+esponsor;s employees.:eerBtoBpeer interactions are necessary to de/elop staff

G4P audits: *+e F# conducts routine sur/eillance audits of nonclinical test facilities. nF# inspector may randomly select a study of t+e sponsor to trac' as part of t+at inspection.:rotocols and final reports are collected and sent to F# +eadquarters as part of t+einspection. *+e sponsor s+ould al&ays qualify a nonclinical laoratory used for G@: studiessumitted to t+e a"ency. *+e ne& F# Sponsor Compliance :ro"ram (see pre/ious post)"i/es instructions for loo'in" at nonclinical studies during GCP inspections at the sponsor.

#ponsor audits and moc;

7/25/2019 21 cfr part 11_1997_2003

26/38

P a g e | 26

7/25/2019 21 cfr part 11_1997_2003

27/38

P a g e | 27

(-e first stepin successfully +ostin" an F# inspection is to +a/e a quality system in placet+at monitors t+e data or product lifecycle. ou don;t &ant to start your quality process afteryou loc' your dataase[ *+en, &+en F# does s+o& up, you &ant to "i/e a positi/eimpression. ou &ant to uild trust &it+ F#. *+in' ac' to t+e last time you p+oned yourutility company or complained aout a pot+ole on your street. 3+en you finally "ot a li/e

person and t+ey told you, t+at;s not my 5o,T +o& did you feelP *+at isn;t +o& you &antF# to feel eit+er.

C%P% Plans for Clinical (rials

Feruary 22, 2011

C: :lans6 Correcti/e and :re/entati/e ctions

C%P%B correcti,e and pre,entati,e actionB re C: plans for clinical trials different t+ana C: for a G: quality systemP #o GC: re"ulations require C: plansP Is a root causeanalysis necessary to de/elop a C: planP 3+at are F#;s e-pectations for C: plansP

*+ese are some of t+e questions t+at &ere as'ed at !@ :+arma;s conference on C:s int+e clinical trial en/ironment +eld last mont+ in ?ir"inia. I t+en +ad t+e opportunity to as't+em all o/er a"ain durin" a forBcauseT GC: audit. *+e results pro/ided for some interestin"insi"+t into +o& sponsors, CRDs, and clinical in/esti"ators can in/esti"ate errors in clinicaltrials and put in place a process to pre/ent t+e errors from continuin".

First &e s+ould define our terms6

Correcti,e %ction:Immediate action to a prolem t+at +as already occurred or +as eenidentified.

Pre,entati,e %ctionU *a'en to eliminate t+e root cause of a potential prolem includin" t+edetection%identification of prolems.

!oot Cause %nalysis: class of prolem sol/in" met+ods used to identify t+e root causes ofprolems or e/ents.

*+ese definitions +old true for all G-: quality systems. Eo&e/er, t+ere are some asicdifferences t+at set GC: C:s apart from t+e manufacturin" or G@: arena6

U F# re"ulations assi"n responsiilities to In/esti"ators, Sponsors, W IRsB t+ere are 8Dre"ulatory responsiilities for +uman su5ects participatin" in clinical trials

http://gxpperspectives.com/2011/02/22/capa-plans-for-clinical-trials-2/http://gxpperspectives.com/2011/02/22/capa-plans-for-clinical-trials-2/

7/25/2019 21 cfr part 11_1997_2003

28/38

P a g e | 28

U G:s in/ol/e a manufactured productB GC:s in/ol/e a clinical in/esti"ation, ane-perimentB *+e productsT are t+e inte"rity of t+e data and t+e protection of +uman su5ectsin clinical researc+.

U G:s lar"ely in/ol/e a manufacturin" processB GC:s lar"ely in/ol/e t+e interactions of

:eople

3+at is t+e Root Cause of t+e :rolemP

, Inspectional

Dser/ations, you really need to put a C: plan into place. Eere are t&o e-amples &+y6

U F# Sponsor 3arnin" @etter, Vanuary 2011 our response is inadequate in t+at it doesnot descrie your correcti/e and pre/enti/e actions in sufficient detail.T

U F# 8I#:D! letter to Clinical In/esti"ator (potential disqualification &arnin") 20096 Y+o&e/er, you failed to in/esti"ate for additional acts of falsification &it+in t+e same clinicalin/esti"ation or in ot+er clinical in/esti"ations in &+ic+ t+e study coordinator &as in/ol/ed.T

l&ays @oo' for at @east 2 Root Causes

(-e root cause analysis of a clinical trial prolem s+ould include an in/esti"ation into &+at+appened. #ifferent prolems &ill need different le/els of in/esti"ation dependin" onsi"nificance. In addition, t+e root cause analysis &ill need to determine if a C: plan isrequired. 8ot all prolems or errors are ot+ systemic and si"nificant. ou don;t &ant to

7/25/2019 21 cfr part 11_1997_2003

29/38

P a g e | 29

institute a system of #eat+ y C:T y initiatin" a C: plan for eac+ error t+at occurs.:eople ma'e mista'es and a quality system s+ould focus on t+e errors t+at matter. Sometimesyou &ill see a C:T t+at merely restates t+e error and t+en t+e uiquitous note to filesayin" retrained study coordinator.T *+is is not an appropriate C: plan and not anappropriate correcti/e action. Eere are some points to include in a C: in/esti"ation6

U *+ere can e multiple root causesB l&ays @oo' at *&o :ossile Root Causes

U l&ays loo' at t+e ra& data.T If you are not loo'in" at ori"inal documents, t+en you aremissin" somet+in" of importance

U 3+y, &+y, &+y, &+y, &+y *+e fi/e &+y;sT of C:. #rill do&n to find t+e root cause.

U *+e root causeT is not restatin" t+e error.

U :ICCC6 :rolem, In/esti"ate, Comparison, Clues, Cause

:rolem Sol/in" in Clinical *rials

PICCC is a useful toolin a root cause analysis. 3+at does comparisonT meanP It means tocompare t+e prolem across protocols and across clinical sites. If you +a/e t+e failure tofollo& a point in t+e protocol at one site, do ot+er sites +a/e t+e same prolemP If t+at is t+ecase, t+e root cause may /ery &ell e t+at t+e protocol is poorly &ritten, it may need anamendment. *+e correcti/e action &ould not read, retrained study coordinator on t+eimportance of protocol ad+erence.T *+e C: plan &ould loo' in a different direction,to&ards t+e sponsor. *+e uiquitous note to file may not e necessary.

*+ere is a &ealt+ of resources on C:, root cause analysis, and conductin" an in/esti"ation.

I am includin" some of t+ose t+at I used for t+is post as &ell as for presentations. *+ere isstill a lot to e de/eloped on C:s for clinical trials. Eo&e/er, it is clear t+at re"ulatorya"encies &ant to 'no& &+at you +a/e done to in/esti"ate clinical prolems and &+at you aredoin" to pre/ent t+em from recurrin". In s+ort, t+ey &ant C: plans.

ar8 Immel on C%P% In,estigations

Essential Components of an Effecti,e C%P% Plan 8y =im Colyn

!oot Cause %nalysis 8y Edward *unn ?*

UUUU

http://www.xavier.edu/xlc/med-xu/documents/Immel-CAPA.pdfhttp://www.jcolynconsulting.com/Essential_Components_of_an_Effective_CAPA_System.htmlhttp://www.slidefinder.net/R/Root_Cause_Analysis_Faculty_Development_Edward_Dunn_MPH_Craig_Renner_MPH_National_Center_Patient_Safety_edward_dunn_med_gov_patientsafety_gov/2217921/p2http://www.xavier.edu/xlc/med-xu/documents/Immel-CAPA.pdfhttp://www.jcolynconsulting.com/Essential_Components_of_an_Effective_CAPA_System.htmlhttp://www.slidefinder.net/R/Root_Cause_Analysis_Faculty_Development_Edward_Dunn_MPH_Craig_Renner_MPH_National_Center_Patient_Safety_edward_dunn_med_gov_patientsafety_gov/2217921/p2

7/25/2019 21 cfr part 11_1997_2003

30/38

P a g e | 30

Mou can -elp out G6P Perspecti,esN:lease let your collea"ues and friends 'no& aout G-::erspecti/es. I also encoura"e you to "et an email suscription (on t+e sidear to your ri"+t)or 5oin t+e @in'edIn "roup (elo&).

UUUUUUU

G6P %udit J !is; ?anagement Congress:20B21 Dctoer 2011, :+iladelp+ia, :. *+isconference comines ot+ G: and GC: trac's to ma-imi=e t+e opportunity for crosstrainin", s+ared est practices, and net&or'in". *&o memers of t+e G-: :erspecti/es@in'edIn "roup, Vanice 3ilson and di @ampmann, are amon" t+e faculty. *+e conference issponsored y !-@ :+arma and G-: :erspecti/es is a media partner.UUUUUUU

#PECI%4 +P*%(E: 1?%!20116 F# +as released an updated /ersion of t+eCompliance Program Guidance ?anual A3O.10 #ponsors/Contract !esearc-

)rgani9ations/?onitors.*+ere are ne& sections on re"istration of clinical trials onClinical(rials.go,Financial #isclosure, t+e Part 11 #cope J %pplication Guidance

*ocument, and ot+er issues. If you &or' for a sponsor, a CRD, or are a contract CR you?+#(read t+is document. Re/ie& Section III, Inspectional.

UUUUUUUUUUUU)n t-e logroll:G-: :erspecti/es made t+e list for est O0 logs and tweets5 on t-e

7/25/2019 21 cfr part 11_1997_2003

31/38

P a g e | 31

(-e first is a8out a report issued earlier t-is mont- 8y t-e ritis- %cademy of ?edical

#ciences.*+e report &as commissioned y t+e ritis+ "o/ernment to try to pare ac' someof t+e ureaucracy in/ol/ed &it+ clinical trials in t+e A.X. n article on t+e report y 8ic'*aylor in )utsourcingBP-arma t+ere are some interestin" re/elations aout t+e ritis+re"ulatory a"ency, ER.I strongly recommend reading t-is article.

In addition, I &ould li'e to refer readers to last &ee';s

7/25/2019 21 cfr part 11_1997_2003

32/38

P a g e | 32

#efinin" !-pectations for uality

*o successfully implement staff ad+erence to t+e company;s quality policy, it may eeneficial for a company, in part, to tie staff memers; annual re/ie&s, promotions and%orsalary increases to t+e effecti/eness of t+e ad+erence to, and application of, "ood quality

practices. In ot+er &ords, it s+ould e made clear to t+e employees t+at e/eryone, includin"t+ose responsile for a "i/en department%operation &+ere a quality deficiency is identified,&ill e +eld tan"ily accountale.

3. Esta8lis- a ro8ust uality 8aseline

*+rou"+ performin" internal audits and assessin" C:s, t+e company;s uality function(e."., uality ssurance) s+ould identify qualityBrelated issues ased on t+e criteria re"ardin"t+e components of "ood quality practicesT outlined in item numer 2.

3+ile performin" t+e internal audits and t+rou"+ capturin" t+e findin"s in t+e C: system,t+e uality function s+ould focus on identifyin" trends and t+emes related to nonBcompliance. In order to ac+ie/e t+is o5ecti/e, t+e company;s C: system s+ould e suc+t+at it allo&s t+e company to collect information re"ardin" appropriate metrics to assess t+e

success of t+e culture of complianceT initiati/e.

@ac' of compliance s+ould e trac'ed not only on an issueByBissue asis, ut also acrossdepartments, indi/iduals and operations%processes. Collectin" information on t+ese items &ill+elp to identify t+e root cause of t+e issue, &+ic+ may stem from a lar"er issue related, utnot necessarily limited to,

1. Cumersome and, t+erefore, ineffecti/e processes2. @ac' of appropriate super/ision. :rocedures t+at lac' clarity (e."., poorly &orded documentation lac' of "uidance,contradictory information)

. @ac' of documented procedures$. @ac' of an indi/idual;s attention to detail and common sense

7/25/2019 21 cfr part 11_1997_2003

33/38

P a g e | 33

1. *+e nature and impact of t+e deficiency on data +as een properly identified2. !ffecti/e correcti/e and pre/enti/e actions +a/e een implemented. ppropriate follo&Bups +a/e een performed. *+e system is roust enou"+ to trend and trac' qualityBrelated issues accurately andcompletely

$. *+e system is roust enou"+ to identify &ea'nesses &it+ processes, documentationpractices, personnel, etc.

*+e company;s uality function s+ould in/esti"ate all instances &+ere t+e ao/e +as noteen ac+ie/ed for impro/ements &it+in t+e quality system. *+is includes t+e defined metricsof t+e C: system.

In conclusion, &e &ould li'e to emp+asi=e t+at many factors, includin" ut not limited to,ne& staff, acquisitions%mer"ers, ne& lines of usiness, staff reductions and%or ne&mana"ement +a/e an impact on t+e culture of compliance.T *+erefore, in order to esuccessful, a culture of complianceT s+ould e a li/in"T initiati/e, &+ic+ is constantly

assessed for its effecti/eness in li"+t of c+an"es t+at e/ery company e-periences durin" t+enormal course of e/ents.

!mma ars'y@en Grunaum:artners(-e Practical #olutions Group 44C

UUUUUUUUUUUUU

Read aout t+e %cademy of ?edical !esearc- !eporty 8ic' *aylor in Dutsourcin"B:+arma

A:#*!6 *+ere is a /ery interestin" Important 'otice to I!st+at is on t+e F# &esite.Sort of a Coast IR redu-.

UUUUUUUUUUUUU

Please @oin G6P Perspecti,es on 4in;edIn at:

G6P Perspecti,es 4in;edIn Group

See t+e pa"e Guest Commentaries (at t+e top of t+e lo") for t+e pre/ious article y @en W!mma on :art 11 compliance.

)n

7/25/2019 21 cfr part 11_1997_2003

34/38

P a g e | 34

-at is an adeuate response to a .

(-e response letters recei/ed y C#RE. *+ey included a clinicalin/esti"ator &+o &as usin" an informed consent form &it+out all of t+e required elementsrequired y 21 CFR $0.2$. *+ese elements include a clear statement of researc+ alternati/e

procedures a discussion of confidentiality and ot+er important information. *+e clinicalin/esti"ator complained t+at6 ou cited us on a tec+nicality.T *+is &as a clear andsi"nificant /iolation of F# clinical trial re"ulations and t+is &as not an acceptale response.

Coc+ran "a/e an e-ample of an adequate response to an F# > for protocol /iolations. *+eresponse included a copy of a &ritten procedure de/eloped to pre/ent recurrence of t+e/iolation. *+e procedure &as presented to a seminar for study staff &it+ a si"nBin s+eet &it+t+e date of t+e seminar. It included implementation dates &it+ a re/ie& sc+eduled after t+reemont+s to determine t+e effecti/eness of t+e correcti/e action.

(-e response to an

7/25/2019 21 cfr part 11_1997_2003

35/38

P a g e | 35

J e compre+ensi/eJ ddress disa"reements &it+ t+e oser/ationsJ s a courtesy, copy t+e in/esti"ator

*+e F# > is t+e :reliminary Dser/ation of t+e F# Field In/esti"ator

ot+ Coc+ran and @i"mond restated t+e ne& F# policy for &ritten responses to an F#> if t+e response is to e considered y F# prior to issuin" a 3arnin" @etter. *+atresponse time is 1$ usiness days from t+e date t+e F# > is issued. @i"mond "a/e ane-cellent recommendation to a/oid possile disputes on F# > oser/ations. ddressmisunderstandin"s promptly, courteously, and &it+ t+e facts,T +e said. Ee discussed t+eimportance of a daily &rapBup session o clear up any disa"reements or inaccurate informationt+at may +a/e een "i/en to t+e F# field in/esti"ator.

C%P%

Correcti/e and :re/entati/e ction, or C:, &as discussed y ot+ spea'ers. @i"mond saidt+at a C: plan s+ould address prolems completely and in a timely manner. Coc+ran saidt+at a "ood C: plan s+ould assess t+e root cause of deficiencies identify t+e prolemse/aluate t+e e-tent of prolems "i/e a clear timeline, descrie t+e C: ein" ta'en andreassess t+e root cause.

Inspection preparedness&as also discussed. @i"mond said to spend eac+ day as if you &ere"oin" to e inspected y F#. *+ey stressed t+e importance of ?oc; . If t+ere is aprolem, t+en "i/e clear details on +o& t+e prolem is "oin" to e fi-ed, &it+ specifics suc+as a timeframe. If you disa"ree &it+ t+e oser/ation, t+en follo& @i"mond;s ad/ice to address

7/25/2019 21 cfr part 11_1997_2003

36/38

P a g e | 36

it &it+ t+e factsT and &it+ documentation of t+e facts. F# rarely &ill accept e-cuses suc+as I t+ou"+t my study coordinator &as "oin" to do t+at.T Eo&e/er, if t+ere is a le"itimateresponse, you s+ould ma'e it in a clear, respectful manner. *+e > responses I +a/e &or'edon al&ays included specific actions, specific dates, and a specific person or departmentacceptin" responsiility for ensurin" t+at t+e correcti/e action ta'es place. nd t+ey al&ays

include documentation of correcti/e actions.If it isnKt documented t-en itKs @ust a rumor.

Clinical (rial Compliance J C-ec;lists: (-e

!ig-t %pproac-L

Vanuary 2, 2010

+pdate:C+ec'lists and clinical trials are points to consider for clinical trial professionals. Iam includin" a lin' to some resources you may find of interest. Since I &rote t+is on Vanuary

2, 2010 t+e post +as continued to recei/e a lot of traffic so I am puttin" a lin' to some sitest+at may e of use to you after readin" my ori"inal post. Dne lin' is 8orton udits and t+ey+a/e a numer of documents you can access. *+e c+ec'list is at t+e ottom ri"+t. *+e lin'sare at t+e ottom, scroll do&n.

)riginal Post:C+ec'lists and comple- medical procedures6 Some p+ysicians ar"ue t+atc+ec'lists can reduce infection rates durin" sur"ery and +elp mana"e an increasin"ly comple-medical system. lso, t+ere is a "ro&in" use of c+ec'lists in clinical trials includin" t+e useof protocolBspecific &or's+eetsT to assist a clinical site in protocol compliance. Some specialists t+in' c+ec'lists are essential. Dt+ers as', Is t+is a "ood t+in"P re &e missin"

somet+in" in t+e c+ec'listsPT

*+e 8e& or' *imes oo' Re/ie& reports on t+e medical part of t+is discussion in a re/ie&y #r. Sandeep Vau+ar entitled Dne t+in" after anot+er,T aout t+e oo' (-e C-ec;list?anifestoy #r. tul Ga&ande (etropolitan oo's%Eenry Eolt W Company6 ]2.$0). #r.Ga&ande is a professor of sur"ery at Ear/ard edical Sc+ool and a staff &riter at t+e 8e&

or'er. *+e re/ie&er, #r. Vau+ar, is a cardiolo"ist and t+e aut+or of Intern6 #octor;sInitiation.T quic' note6 Eis re/ie& does not discuss clinical trials. Eo&e/er, I immediatelydre& a connection.

n e-ample in t+e oo' cites # fi-e9point c+ec7list implemented in 2::1 -irtuallyeradicated central line infections in t+e intensi-e care unit at =o+ns Hop7ins +ospital

pre-enting n estimated '% infetions and eig+t deat+s o-er 2 mont+s.@ $+at is a -ery

impressi-e result t+at +as ,een repeated at studies at intensi-e care units 4IC/s5 in >ic+igan

according to t+e re-iew.

In clinical trials I +a-e seen many 0uality assurance audit plans and monitoring procedures

t+at rely +ea-ily on c+ec7lists. C+ec7lists are somet+ing t+at I s+ould pro,a,ly use more. Iusually use t+e D# Clinical In-estigator Compliance rogram ;uidance >anual 4C

http://gxpperspectives.com/2010/01/24/clinical-trial-compliance-checklists-the-right-approach/http://gxpperspectives.com/2010/01/24/clinical-trial-compliance-checklists-the-right-approach/http://gxpperspectives.com/2010/01/24/clinical-trial-compliance-checklists-the-right-approach/http://gxpperspectives.com/2010/01/24/clinical-trial-compliance-checklists-the-right-approach/

7/25/2019 21 cfr part 11_1997_2003

37/38

P a g e | 37

%'.115 t+at I was trained on w+en I was at D# 4see lin7 on t+e rig+t under D#

Stuff@5. Howe-er I see a downside of c+ec7lists. #lt+oug+ t+ey +elp ma7e sure you re-iew t+e

necessary documents +ey rarely assist t+e monitor or auditor in determining significance. I

+a-e seen cases w+ere a monitor or auditor +as +ammered away a,out an item on t+eir

c+ec7list t+at really wasnAt all t+at important or may,e not e-en rele-ant for t+at specific

study.

In addition c+ec7lists are entirely dependent on w+o is writing t+e c+ec7list and if t+eir list

written in an office comple6 somew+ere is practical in t+e field w+ere clinical trials actually

are ta7ing place. $+ere can ,e some serious unintended conse0uences. I +a-e seen recent

D# *arning &etters to clinical in-estigators t+at state)

!A. "our site chose to use the sponsor#s standardi$ed forms as source documents to record

and document information related to the sub%ects# study visits. Per the standardi$ed form

your site &as to !Complete the Inclusion'E(clusion Criteria )or*sheet to evaluate for

study eligibility.+ In the F,A investigator#s revie& of - of / sub%ect records at your site

there &as no Inclusion'E(clusion Criteria )or*sheet found for any of these sub%ects.+

$+e records 7ept at a clinical site are t+e responsi,ility of t+e site of t+e clinical in-estigator

not of t+e sponsor or t+e employee t+at wrote t+em. If t+e site doesnAt fill out eac+ of t+e

wor7s+eets and per+aps sign and date t+em t+en D# will write you up in a orm D#

'% Inspectional O,ser-ations for inade0uate record7eeping and possi,ly a protocol

-iolation. In s+ort t+e c+ec7lists and wor7s+eets +a-e to ,e practical to use at t+e clinicalsite.

Dr. =au+ar does not tal7 a,out clinical trials in +is ,oo7 re-iew. But +e does gi-e concrete

e6amples of +ow c+ec7lists can ,e a pro,lem. or e6mple +e says)

!0oday insurers are re&arding doctors for using chec*lists to treat such conditions as

heart failure and pneumonia. 1ne item on the pneumonia chec*list 2 that antibiotics be

administered to patients &ithin si( hours of arrival at the hospital 2 has been especially

problematic. ,octors often cannot diagnose pneumonia that 3uic*ly. But &ith money on

the line there is pressure on doctors to treat even &hen the diagnosis isn#t firm. 4o more

and more antibiotics are being used in emergency rooms today despite the dangers ofantibiotic5resistant bacteria and antibiotic5associated infections.+

$+e ,oo7 re-iew is -ery muc+ wort+ reading. In addition t+ere is access to a podcast

featuring Dr. ;awande. ?ou can find a in7 under Interesting #rticles@ on t+e rig+t as well

$R!

7/25/2019 21 cfr part 11_1997_2003

38/38

P a g e | 38

for implementing the program. At minimum# a functional specicationshould precisely state the purpose 3e.g.# the function8 of the software.%epending on the software engineering methodology used# thefunctional specication might also provide implementation details#such as how the pro=ect is divided into modules and how the di/erent

modules interact. 0n addition# a functional specication oftendescri'es the software from the user>s perspective :: how the userinterface appears and how a user would use the program to performspecic functions.

A functional specication is often called a functional spec, or =ust spec.