Time and again, rumors surface about the possible update of the 2003 guidance on the scope and application of 21 CFR Part 11. The never-ending speculation attests to the enduring interest in Part 11, not to mention the continued scrutiny of the regulation.
Asked to comment on the status of the 2003 guidance, Erica Jefferson, an FDA press officer, told GxP Lifeline: "There are currently no plans to update the guidance. We are still performing inspections per the 2003 guidance."
Jefferson, FDA Office of Public Affairs' team leader for medical products and tobacco, said the agency has been conducting "focused" inspections since 2010. "For the past year and a half, the FDA has been performing some focused inspections related to Part 11 controls in an effort to determine industry compliance and understanding," she said.
Part 11 is here to stay, and the 2003 guidance remains in place. So, what does this mean for your company? Quite simply, it means understanding Part 11 is critical, now more than ever.
Background
Part 11 took effect on Aug. 20, 1997. The FDA issued the rule to establish criteria for the use of electronic records and electronic signatures by organizations that comply with the Food, Drug, and Cosmetic Act, the Public Health Service Act, and other FDA regulations. It applies to all FDA-regulated companies, such as pharmaceutical, medical device, biotech, blood, and biologics companies, and contract research organizations. Its overall goal is to allow the use of electronic records as much as possible while ensuring public safety.
Part 11 was controversial from the start. Critics complained that it was too broad and confusing. Companies said it was too costly to implement. In response, the FDA issued two guidances on Part 11's scope and application. It released a draft guidance in 2001 (including separate guidances on validation, glossary of terms, time stamps, etc.), which was eventually withdrawn amid a maelstrom of negative reactions. The agency issued another guidance in 2003.
Key Points
The 2003 guidance ("Guidance for Industry: Part 11, Electronic Records; Electronic Signatures Scope and Application") covers the most critical aspects of Part 11 compliance—the same areas that generated a lot of attention: validation, audit trails, legacy systems, record copying, and record retention.
This article focuses on validation, audit trails and legacy systems.
Validation: The guidance recommends companies base their validation approach on "a justified and documented risk assessment and a determination of the potential of the system to affect product quality and safety and record integrity." The bottom line: Your company should be able to demonstrate that your electronic system does what it's supposed to do at all times.
Audit Trails: Audit trails are particularly appropriate when users are expected to create, modify, or delete regulated records during normal operation, according to the guidance. The FDA is looking for the trustworthiness of your records. Your audit trail should ultimately be about increased personal accountability: who created, modified, reviewed, or approved a document, when and why.
Legacy Systems: The FDA will exercise enforcement discretion with respect to all Part 11 requirements for legacy systems (systems that were operational before Part 11 took effect on Aug. 20, 1997) as long as the system meets all the necessary criteria, including documented evidence and justification that the system is fit for its intended use. "Enforcement discretion" means selective enforcement but you can bet that if your legacy system has an issue that jeopardizes public safety, the FDA will enforce the regulation despite what the guidance states. A guidance does not have the teeth of a regulation, so always base your compliance on the regulation.
The Essence of Part 11
For many life sciences companies, venturing into Part 11 and its accompanying guidance is like walking into a massive forest of requirements. But in complying with Part 11, try to remember the essence of the regulation.
Fifteen years after the introduction of Part 11, the FDA's main concern remains the same—to safeguard record integrity in order to ensure product quality. The FDA cares whether all electronic records in support of regulated activities are accurate and valid. If you keep that in mind, you are less likely to get lost in the forest.
No comments:
Post a Comment