FDA 21 CFR Part 11 Overview June 10, 2006

Agenda Why is Part 11 Important? Part 11 and Validation Risk Management

The Dreaded 483 Failure to validate software Missing validation documents (FR/IQ/OQ) No written procedures Inadequate system to authorize, grant, and rescind access No documentation of changes to drop down lists Current users do not have appropriate access, ids, passwords

Part 11 and Validation 21 CFR Part 11 defines the FDA’s: “criteria under which the agency considers electronic records, electronic signatures, and handwritten signatures executed to electronic records to be trustworthy, reliable, and generally equivalent to paper records and handwritten signatures executed on paper.” §11.1 Scope (a) Part 11 specifically applies to: “records in electronic form that are created, modified, maintained, archived, retrieved, or transmitted, under any records requirements set forth in agency regulations.” §11.1 Scope (b) The scope also includes: “Computer systems (including hardware and software), controls, and attendant documentation maintained under this part shall be readily available for, and subject to, FDA inspection.” §11.1 Scope (e)

Part 11 and Validation (continued) Guidance for Industry: Computer Systems in Clinical Trials: “This document addresses issues pertaining to computerized systems used to create, modify, maintain, archive, retrieve, or transmit clinical data intended for submission to the FDA… It also addresses requirements of the Electronic Records/Electronic Signatures rule (21 CFR part 11)… The principles in this guidance may be applied where source documents are created: (1) in hardcopy and later entered into a computerized system, (2) by direct entry by a human into a computerized system, and (3) automatically by a computerized system.”

Part 11 and Validation (continued) The Goal of Validation: “The sponsor should ensure and document that computerized systems conform to the sponsor's established requirements for completeness, accuracy, reliability, and consistent intended performance.” Validation Scope: “The FDA may inspect documentation, possessed by a regulated company, that demonstrates validation of software. The study sponsor is responsible, if requested, for making such documentation available at the time of inspection at the site where software is used.” Validation imposes efficient business and IT management methodologies.

Risk Management FDA now regulates and inspects using Risk-based concepts: 1. Quality System 2. Facilities and Equipment System 3. Production System 4. Materials System 5. Lab Control Systems 6. Packaging and Labeling System The Risk-based concept extends to Sponsors: “With the issuance in 2003 of the guidance for industry Part 11, Electronic Records, Electronic Signatures — Scope and Application, many barriers to scientific and technological advances were removed, and the use of risk-based approaches to managing computer systems is encouraged.” 1 1 - Final Report: Pharmaceutical cGMPs for the 21st Century - A Risk-Based Approach - FDA