Electronic Records & Signatures
21 CFR Part 11
21 CFR Part 11 sets FDA requirements for electronic records and electronic signatures used to satisfy predicate rule requirements. The first analytical step is applicability — which records the rule actually reaches, and in what form they are maintained.
Applicability determination
Part 11 applies to records in electronic form that are created, modified, maintained, archived, retrieved or transmitted under predicate rule requirements, and to electronic signatures intended as the equivalent of handwritten signatures. Determining which records fall in scope, and whether the electronic copy is the official record, is the foundation of every subsequent control decision.
Technical controls to assess
- Validation of the system for intended use
- Ability to generate accurate and complete copies in human-readable and electronic form
- Record protection and retention for the required period
- Limiting system access to authorized individuals
- Secure, computer-generated, time-stamped audit trails
- Operational and authority checks; device checks where relevant
- Signature manifestations containing name, date/time and meaning
- Signature-to-record linking and non-repudiation controls
Procedural controls to assess
- Individual accountability for actions under an electronic signature
- Written policies deterring record and signature falsification
- Training and qualification of personnel
- Control of system documentation and revision history
- Identity verification and signature certification to the agency where applicable
Gap assessment and remediation
A useful Part 11 assessment produces a risk-ranked gap list with technical remediation, procedural compensating controls, or a documented and justified acceptance for each gap. Where a vendor cannot deliver a technical control, procedural controls should be specific and verifiable rather than aspirational.
Primary references
Information published on ValidationEngineering.com is educational and informational. It is not legal or regulatory advice and is not a guarantee of regulatory compliance or of any inspection outcome. Organizations remain responsible for their own quality decisions.
FAQ
Electronic Records & Signatures — common questions
- Which records fall under Part 11?
- Electronic records created, modified, maintained, archived, retrieved or transmitted under a predicate rule requirement, and electronic signatures applied to them. If no predicate rule requires the record, Part 11 does not apply.
- What are the core Part 11 technical controls?
- Validation, secure computer-generated time-stamped audit trails, operational and authority checks, unique user accounts with no sharing, record protection and retrieval throughout the retention period, and signature manifestations linked to their records.
- Are hybrid paper/electronic systems acceptable?
- They are used, but they must be defined and controlled: which record is the raw data, how the signature links to it, and how both are retained. Undefined hybrids are a frequent source of data integrity observations.
Next step
Need a Part 11 assessment?
Ask a validation expert about applicability, gaps and practical remediation for your systems.