21 CFR Part 11 Compliance Checklist

21 CFR part 11 Compliance Checklist and Requirements

21 CFR Part 11 compliance checklist and requirements can be broken down into six key requirements that must be met for compliance.

• Limited Access: Limiting access only to authorized users is essential to ensure the legitimacy of the records and signatures for audit. Each user should have a unique set of login credentials that enable all of their activities to be identified. It is also vital to be able to illustrate the access controls in place.
• Audit trails: Audit trails support the access controls requirements with proof of operator access and creating a system of records. A significant factor of 21 CFR part 11 compliant software is the way electronic records are created, modified, reviewed, approved, and controlled.
• Does the system feature time to facilitate audit trails for every document and record? Does the audit trail indicate who modified the record, when was the date and time the record was modified, and what specific items in the record were modified? Is the audit trail easily restored and demonstrated?
• Does the system implement 21 CFR part 11 digital signatures? 21 CFR part 11 compliant electronic signatures attest to the creation, review, or approval by an authorized person.
• Written policies: All policies connected with operating and maintaining the hardware, software, and physical records of the organization should be clearly documented. These policies should be covered fully during training for anyone with access to the records.
• Validation testing: Regular system validation checks are conducted and logged to meet compliance requirements. FDA auditors must be able to trust the data integrity they are being presented with. Here are some checklists to assess for FDA 21 CFR part 11 validation including:
• Does the system comply with FDA 21 CFR part 11 security requirements? Does each authorized user have a unique username and password? Is the system data encrypted?
• Is there an SOP that manages how the system is used, who can use it, and for what purpose?
• Does the system maintain records within the defined record retention period for each record type?
• Digital signatures: 21 CFR Part 11 is focused on electronic records, streamlining activities, and digital signatures. For digital signatures to be compliant, they must be computed by using a set of rules and parameters such that the identity of the signer and the integrity of the data can be verified.
• Training: 21 CFR Part 11 also requires that all users with access to the system be properly trained in the protocols. Employees should be trained for their specific roles and made aware of the limitations of their access and responsibilities. All training should be completely documented so that auditors can easily review the operator audit trail and cross-reference it with the training logs.