Justification and documentation of Part 11 compliance
As explained previously, the implementation of some Part 11 controls should be based on criteria such as:
- where the record is required by predicate rule;
- whether a regulated activity depends on the record;
- a company's business practice;
- effect of operator interaction on data integrity and product quality.
If Part 11 controls are not implemented, FDA must review a documented justification that explains why not. Every company is
advised to prepare such documentation.
An example of such documentation is shown in Figure 2. A computerized analytical system used in a pharmaceutical quality control
laboratory is reviewed as an example.
Figure 2: Documentation of Part 11 controls (2). (a) A computerized analytical system is represented graphically. The legend
indicates who has access to the data on which computer and what data can be changed. (b) Our decisions and justifications.
(c) The criticality of the record, if the record is required by a predicate rule, and if the a regulated activity depends
on the record. (d) The lower part lists business practices. HPLC is high-performance liquid chromatography and PC is personal
In the example, a sample is injected into a computer-controlled liquid chromatograph. The signal is acquired by the client's
system (computer 1) and the original data are stored on the computer as digital data. Data are automatically processed on
this computer and the results are transferred with the evaluation parameters to a second system with a database (computer
2) for storage and printout. The operator reviews the printout and, depending on the findings, may decide to manually reevaluate
the data. Lastly, the records are maintained in electronic form because the company may need to reprocess the data for business
reasons at a later date.
Both computers 1 and 2 must be validated in accordance with the high risk categories. The systems should have built-in electronic
audit trails because operators have access to the records and could change records. Audit trails are required by the predicate
rules and regulated activities depend on the type of records. We also keep the records in both print and electronic forms
because they may be needed to demonstrate compliance with the predicate rule. Further examples of manufacturing, analytical
laboratories, and office applications are explained elsewhere (2).
During the initial stages of Part 11 implementation, the industry asked whether a specific computer system should comply with
Part 11. Today, several questions are routinely asked such as which records are generated by the system, whether they are
required by a predicate rule, what will be the effect on product quality, and how operators can affect record integrity. The
answers to these questions will determine the type and level of Part 11 controls that should be justified and documented for
FDA and for your management, if funding for Part 11 implementation is required.
Ludwig Huber, PhD, is the compliance program manager at Agilent Technologies, Waldbronn, PO Box 1280, D-76337, Waldbronn, Germany, Ludwig_Huber@agilent.com
1. Code of Federal Regulations, Title 21, Food and Drugs, Part 11, "Electronic Records; Electronic Signatures, Final Rule," Fed. Regist. 62 (54), 13429–13466.
2. "21 CFR Part 11–Electronic Records and Electronic Signatures," (Labcompliance, Oberkirch, Germany, 2005), available at http://