Records Controls
Electronic Records & Electronic Signatures
Electronic records and signatures reduce transcription risk and speed review — but only when the record set, the signature meaning and the control environment have been deliberately designed.
Deciding what the official record is
Many findings begin with ambiguity: the system holds electronic data, someone prints a summary, and nobody has declared which is the official record. That declaration drives retention, review, backup, audit trail expectations and inspection readiness.
Signature controls
- Unique user identification with no shared credentials
- Two distinct identification components for signings where required
- Signature manifestation showing printed name, date/time and meaning
- Signatures linked to their records to prevent transfer or excision
- Sequential signing controls and re-authentication rules
Hybrid workflows
Hybrid systems are legitimate but need explicit rules: which portion is electronic, which is paper, how the two are reconciled, and how the complete record is assembled for review or inspection. Undocumented hybrids are where completeness quietly breaks down.
Primary references
- FDA — Process Validation: General Principles and Practices
- FDA — Computer Software Assurance for Production and Quality System Software
- FDA — 21 CFR Part 11, Electronic Records; Electronic Signatures
- FDA — Data Integrity and Compliance With Drug CGMP
- FDA — General Principles of Software Validation
Information published on ValidationEngineering.com is educational and informational. It is not legal or regulatory advice and is not a guarantee of regulatory compliance or of any inspection outcome. Organizations remain responsible for their own quality decisions.
Next step
Reviewing electronic record controls?
Ask an expert about record scope, signature design and hybrid workflow risk.