kdsaggi
17th April 2008, 01:15 AM
BACKGROUND
Effective August 20, 1997, the Food and Drug Administration (FDA) issued 21 CFR Part 11, setting forth criteria under which the agency will accept, under certain circumstances, electronic records and electronic signatures as equivalent to paper records and handwritten signatures. Part 11 allows firms to take advantage of electronic technology, and to have electronic records considered equivalent to traditional paper records.
Such systems will need to be validated to ensure accuracy, reliability, and consistency, and they will need security checks and audit trails to verify that records are accurate and that changes are recorded. Electronic signatures are subject to additional requirements, to ensure that a signature can only be used by its genuine owner, and that the act of signing a document electronically is equivalent to a traditional handwritten signature.
Calibration Management Software (CMS) is database software designed specifically to help companies meet the calibration record-keeping requirements of 21 CFR Parts 211 and 820. Many Commercial Off The Shelf (COTS) software packages are available. The features and specifications of CMS that help ensure compliance with Parts 211 and 820 will also simplify compliance with Part 11. These features include password-based
security and time-stamped audit trails. In addition, the software should include an Electronic Signature feature designed to help meet the requirements set forth in Part 11.
The cGMP’s state in numerous instances that records of calibration and maintenance information must be maintained, and these records are subject to document controls that include, among other things, signatures of the reviewing or approving party.
Record Requirements The following are just some of the instances where calibration and maintenance records are mentioned in the cGMP’s.
• Complete records shall be maintained of the periodic calibration of laboratory
instruments, apparatus, gauges, and recording devices…. [211.194(d)]
• Records shall be kept of maintenance, cleaning, sanitizing, and inspection as
specified…. [211.67(c)]
• Control of inspection, measuring, and test equipment. Each manufacturer shall ensure that all inspection, measuring, and test equipment, including mechanical, automated, or electronic inspection and test equipment, is suitable for its intended purposes and is capable of producing valid results. Each manufacturer shall establish and maintain procedures to ensure that equipment is routinely calibrated, inspected, checked, and maintained. The procedures shall include provisions for handling, preservation, and storage of equipment, so that its accuracy and fitness for use are maintained. These activities shall be documented. [820.72(a)] In light of the regulations reviewed above, and other FDA regulations, CMS should be designed so that users may electronically sign each Equipment History record, and any
changes to those records. The electronic signature must be initiated by the user logged onto the CMS.
Because the use of electronic records and electronic signatures is not required by Part 11, the software does not require the use of electronic signatures. To help users comply with the requirements of Part 11, it is recommend that you establish procedures to ensure that each Equipment History record and each change to those records is signed by the
responsible or approving party.
OVERVIEW OF CMS FEATURES FOR PART 11 COMPLIANCE
CMS software should be designed specifically to help users meet the requirements of the Current Good Manufacturing Practices set forth in Parts 211 and 820. In addition, the software should includes features designed to help users meet the requirements of Part 11, Electronic Records and Electronic Signatures. Some of these features include:
• Security
• Audit Trail
• System & Database Logs
• Equipment History Records
• Electronic Signature Button
• Electronic Signature Log
• Validation and Procedural Documentation Security
The software should feature a multiple-level, password-based security system that allows an organization to limit system, database, and record access to authorized users. System administrators can, if desired, further limit authorized users’ rights to add, edit, delete or even view records. If an organization is using multiple databases (for instance, one for production instruments and one for R & D), a user can be granted different rights to each
database.
Audit Trail The software should feature an audit trail to track changes made to the system data. The audit trail records the date and time of a change, as well as the original field value and the changed field value. When password security is used, the audit trail also records the name of the user making changes and the reason for the change. Each record has its own audit trail record. In addition to the audit trail records for each Equipment Master and Equipment History record, the software should maintain logs that reflect changes to each database and to the system as a whole. These logs are similar to audit trail records, in that they will record an activity, its date and time, and the ID and name of the user responsible for the change. History Records The CMS should record a separate history record for each activity performed on a piece of equipment. For instance, there is a record of each calibration performed on an instrument. In addition, if users track maintenance, inspections, etc., there will be a history record for each of these activities. The history record includes the date of the activity, and can include who performed the activity, comments, approvals, and measurement data. If the electronic signature feature is used, the history record will also
include the electronic signature of a user, so that each calibration (or maintenance, etc.) record will be linked to an electronic signature specific to that record.
Electronic Signature The software should offer an electronic signature mechanism. When a user selects this mechanism, an Electronic Signature dialogue box will appear, prompting the user for the User ID and a password. To electronically sign a record, the user will have to enter information into both of these fields. As indicated in Part 11, when a user signs additional records in a single, continuous period of controlled system access, the User ID field will be filled, and the user will be prompted for a password. When the User ID and password have been entered, the user will be prompted for a meaning for the signature (for instance, Review, Approval, Responsibility, or Authorship). Upon completion of a signature, a Confirmation Box will appear. Each electronic signature and its reason will be linked to a specific history record. Electronic Signature Log An electronic signature log should be made available. The electronic signature log displays the date and time that the signature was executed, as well as the User ID and User Name of the person signing the record, and the reason for the signature. This information is also recorded in the record’s audit trail.
Validation Documentation
Section 11.10 of Part 11 requires persons using closed systems (like COTS Calibration Management Software) to employ procedures and controls to ensure the authenticity, integrity, and confidentiality of electronic records and electronic signatures. One such control is the validation of systems to ensure accuracy, reliability, and consistent intended performance.
The vendor should be able to provide both validation protocol and software quality assurance documentation.
CONCLUSION
By covering the many aspects of Part 11 and proper selection, implementation and validation of the software it is possible to have a Part 11 compliant Calibration Management System.
Effective August 20, 1997, the Food and Drug Administration (FDA) issued 21 CFR Part 11, setting forth criteria under which the agency will accept, under certain circumstances, electronic records and electronic signatures as equivalent to paper records and handwritten signatures. Part 11 allows firms to take advantage of electronic technology, and to have electronic records considered equivalent to traditional paper records.
Such systems will need to be validated to ensure accuracy, reliability, and consistency, and they will need security checks and audit trails to verify that records are accurate and that changes are recorded. Electronic signatures are subject to additional requirements, to ensure that a signature can only be used by its genuine owner, and that the act of signing a document electronically is equivalent to a traditional handwritten signature.
Calibration Management Software (CMS) is database software designed specifically to help companies meet the calibration record-keeping requirements of 21 CFR Parts 211 and 820. Many Commercial Off The Shelf (COTS) software packages are available. The features and specifications of CMS that help ensure compliance with Parts 211 and 820 will also simplify compliance with Part 11. These features include password-based
security and time-stamped audit trails. In addition, the software should include an Electronic Signature feature designed to help meet the requirements set forth in Part 11.
The cGMP’s state in numerous instances that records of calibration and maintenance information must be maintained, and these records are subject to document controls that include, among other things, signatures of the reviewing or approving party.
Record Requirements The following are just some of the instances where calibration and maintenance records are mentioned in the cGMP’s.
• Complete records shall be maintained of the periodic calibration of laboratory
instruments, apparatus, gauges, and recording devices…. [211.194(d)]
• Records shall be kept of maintenance, cleaning, sanitizing, and inspection as
specified…. [211.67(c)]
• Control of inspection, measuring, and test equipment. Each manufacturer shall ensure that all inspection, measuring, and test equipment, including mechanical, automated, or electronic inspection and test equipment, is suitable for its intended purposes and is capable of producing valid results. Each manufacturer shall establish and maintain procedures to ensure that equipment is routinely calibrated, inspected, checked, and maintained. The procedures shall include provisions for handling, preservation, and storage of equipment, so that its accuracy and fitness for use are maintained. These activities shall be documented. [820.72(a)] In light of the regulations reviewed above, and other FDA regulations, CMS should be designed so that users may electronically sign each Equipment History record, and any
changes to those records. The electronic signature must be initiated by the user logged onto the CMS.
Because the use of electronic records and electronic signatures is not required by Part 11, the software does not require the use of electronic signatures. To help users comply with the requirements of Part 11, it is recommend that you establish procedures to ensure that each Equipment History record and each change to those records is signed by the
responsible or approving party.
OVERVIEW OF CMS FEATURES FOR PART 11 COMPLIANCE
CMS software should be designed specifically to help users meet the requirements of the Current Good Manufacturing Practices set forth in Parts 211 and 820. In addition, the software should includes features designed to help users meet the requirements of Part 11, Electronic Records and Electronic Signatures. Some of these features include:
• Security
• Audit Trail
• System & Database Logs
• Equipment History Records
• Electronic Signature Button
• Electronic Signature Log
• Validation and Procedural Documentation Security
The software should feature a multiple-level, password-based security system that allows an organization to limit system, database, and record access to authorized users. System administrators can, if desired, further limit authorized users’ rights to add, edit, delete or even view records. If an organization is using multiple databases (for instance, one for production instruments and one for R & D), a user can be granted different rights to each
database.
Audit Trail The software should feature an audit trail to track changes made to the system data. The audit trail records the date and time of a change, as well as the original field value and the changed field value. When password security is used, the audit trail also records the name of the user making changes and the reason for the change. Each record has its own audit trail record. In addition to the audit trail records for each Equipment Master and Equipment History record, the software should maintain logs that reflect changes to each database and to the system as a whole. These logs are similar to audit trail records, in that they will record an activity, its date and time, and the ID and name of the user responsible for the change. History Records The CMS should record a separate history record for each activity performed on a piece of equipment. For instance, there is a record of each calibration performed on an instrument. In addition, if users track maintenance, inspections, etc., there will be a history record for each of these activities. The history record includes the date of the activity, and can include who performed the activity, comments, approvals, and measurement data. If the electronic signature feature is used, the history record will also
include the electronic signature of a user, so that each calibration (or maintenance, etc.) record will be linked to an electronic signature specific to that record.
Electronic Signature The software should offer an electronic signature mechanism. When a user selects this mechanism, an Electronic Signature dialogue box will appear, prompting the user for the User ID and a password. To electronically sign a record, the user will have to enter information into both of these fields. As indicated in Part 11, when a user signs additional records in a single, continuous period of controlled system access, the User ID field will be filled, and the user will be prompted for a password. When the User ID and password have been entered, the user will be prompted for a meaning for the signature (for instance, Review, Approval, Responsibility, or Authorship). Upon completion of a signature, a Confirmation Box will appear. Each electronic signature and its reason will be linked to a specific history record. Electronic Signature Log An electronic signature log should be made available. The electronic signature log displays the date and time that the signature was executed, as well as the User ID and User Name of the person signing the record, and the reason for the signature. This information is also recorded in the record’s audit trail.
Validation Documentation
Section 11.10 of Part 11 requires persons using closed systems (like COTS Calibration Management Software) to employ procedures and controls to ensure the authenticity, integrity, and confidentiality of electronic records and electronic signatures. One such control is the validation of systems to ensure accuracy, reliability, and consistent intended performance.
The vendor should be able to provide both validation protocol and software quality assurance documentation.
CONCLUSION
By covering the many aspects of Part 11 and proper selection, implementation and validation of the software it is possible to have a Part 11 compliant Calibration Management System.
