FDA 21 CFR Part 11 Explained: What It Means for Electronic Records and E-Signatures in Pharma
Definition
21 CFR Part 11 is a US FDA regulation that defines when and how electronic records and electronic signatures can be considered trustworthy, reliable, and equivalent to paper records and handwritten signatures. In practical GMP terms, Part 11 tells you what controls your computerized systems must have so the FDA can trust the data and approvals generated electronically.
Why 21 CFR Part 11 Matters in GMP
Modern pharma runs on electronic systems—LIMS, CDS (chromatography), MES, SCADA, eQMS, ERP, stability systems, training systems, and more. If those systems can be manipulated, overwritten, or accessed without traceability, then your GMP evidence is not reliable. FDA expects Part 11 compliance for applicable systems so that batch release decisions, QC results, validation evidence, and quality approvals remain defensible.
What Part 11 Applies To (Practical Scope)
Part 11 applies when electronic records and/or electronic signatures are:
- Required by FDA “predicate rules” (GMP/GLP/GCP requirements that require records/signatures), and
- Maintained or submitted in electronic form, and
- Used to make GMP decisions (release, investigation approval, change approval, validation approval, etc.)
Bottom line: If your system
Key Part 11 Requirements (What Auditors Look For)
1) System Validation (Fitness for Intended Use)
Part 11 expects systems to be validated so they perform as intended. Validation typically includes documented requirements, risk assessment, testing, and evidence that the system consistently works in the configured state.
2) Audit Trails (For Critical Data)
Audit trails are time-stamped records that track who did what and when—especially for creating, modifying, or deleting regulated data. Audit trails must be enabled, protected, and reviewed where required by risk and criticality.
3) Access Controls and Security
- Unique user IDs (no shared logins)
- Role-based permissions
- Password controls and lockouts
- Segregation of duties (e.g., analyst cannot approve own results)
4) Electronic Signatures (E-Signature Controls)
Electronic signatures must be unique to one individual and not reused by others. Systems should enforce signature meaning (e.g., “reviewed,” “approved,” “performed”), and signatures should be linked to the signed record so they can’t be copied and pasted onto different content.
5) Record Retention and Retrieval
Electronic records must be retained for the required period, protected from loss or corruption, and retrievable in a human-readable form. Backup and disaster recovery controls matter here.
6) Copying / Exporting Records
If records are exported (PDFs, prints, reports), you need controls to ensure the exported output is a reliable representation of the electronic record and that the original raw data remains available and traceable.
Part 11 and Data Integrity (How It Links to ALCOA)
Part 11 controls support data integrity principles like ALCOA and ALCOA+. For example:
- Attributable: unique user IDs + audit trails
- Contemporaneous: time-stamped entries and approvals
- Original: raw electronic data retained with metadata
- Accurate/Complete: controlled changes with traceability and review
Mini Example: Part 11 Issues in a Chromatography Data System (CDS)
Scenario: analysts can re-integrate peaks multiple times, print the “best” chromatogram, and there is no audit trail review. Even if final results pass, auditors may conclude you are “testing into compliance” because the system allows uncontrolled data processing. A Part 11-aligned control approach would include:
- Audit trail enabled for integration changes
- Defined processing methods and controlled integration rules
- Second-person review of audit trail for critical results
- Procedures defining when reprocessing is allowed and how it is documented
Common Part 11 Compliance Gaps (Audit Traps)
- Shared logins: destroys attributable control immediately
- Audit trails disabled or not reviewed: major red flag for critical systems
- “Validation” is missing or outdated: system changed but validation didn’t
- Users have excessive privileges: analysts can delete/modify results without controls
- Weak backup/restore evidence: no proof you can restore regulated data reliably
- Uncontrolled spreadsheets: regulated calculations without protection, versioning, or auditability
Audit-Ready Talking Points
- Show your Part 11 assessment (system inventory and applicability rationale)
- Provide validation evidence (URS/FRS, risk assessment, test scripts, summary report)
- Demonstrate access control governance (user provisioning, periodic review, leavers process)
- Explain audit trail review: which systems, which events, how often, and evidence
- Show e-signature meaning and how signature authority is controlled and trained
Quick 21 CFR Part 11 Checklist (Practical)
- System validated for intended use with documented evidence
- Unique user IDs and role-based access are enforced
- Audit trails enabled, protected, and reviewed where required
- E-signatures are unique, linked to records, and include meaning
- Records are retained, backed up, and retrievable for required period
- Procedures define data processing, rework, and exception handling
FAQs
What is 21 CFR Part 11 in simple words?
It is the FDA rule that says electronic records and electronic signatures must have specific controls so they can be trusted like paper records and handwritten signatures.
Does Part 11 apply to all software?
No. It applies to systems that create, modify, maintain, archive, retrieve, or transmit regulated electronic records/signatures required by FDA rules. The scope should be justified through a documented assessment.
Is validation mandatory for Part 11 systems?
Yes—systems must be validated for intended use, and changes must be controlled to maintain the validated state.
Are audit trails always required?
For critical records, audit trails are a core expectation. The extent of audit trail review and which events are reviewed should be risk-based and documented.
What is the most common Part 11 failure in audits?
Shared user accounts and weak audit trail controls (disabled or not reviewed) are among the most frequent and serious failures.