21 CFR Part 11, "enforcement discretion" - Validation, Audit Trail, Record Retention

[temujin]

Dear Forum,

I am not sure how to interpret this section taken from the foreword of the document "Guidance for Industry Part 11, Electronic Records; Electronic Signatures - Scope and Application"

This guidance explains that we will narrowly interpret the scope of part 11. While the re-examination of part 11 is under way, we intend to exercise enforcement discretion with respect to certain part 11 requirements. That is, we do not intend to take enforcement action to enforce compliance with the validation, audit trail, record retention, and record copying requirements of part 11 as explained in this guidance. However, records must still be maintained or submitted in accordance with the underlying predicate rules, and the Agency can take regulatory action for noncompliance with such predicate rules.

In addition, we intend to exercise enforcement discretion and do not intend to take (or recommend) action to enforce any part 11 requirements with regard to systems that were operational before August 20, 1997, the effective date of part 11 (commonly known as legacy systems) under the circumstances described in section III.C.3 of this guidance.

Note that part 11 remains in effect and that this exercise of enforcement discretion applies only as identified in this guidance.

Does it mean that FDA will not expect to see e.g. a validation report of a system that holds electronic records?

By the way, does anyone know for how long this "enforcement discretion" will last?

confused.
regards
t.

[BradM]

Here is the link for the complete document:

http://www.fda.gov/Cder/guidance/5667fnl.htm

I do know they have been toying with revisions of 21 CFR Part 11. I thought they have made revisions even to the above suggested guideline sheet.

In short, FDA has relaxed part 11 requirements if hard copies are being generated and submitted. So if you have a system that generates electronic records but you primary submission is through written documentation, then part 11 components would not apply. Before, any system that generated any electronic records was subject to Part 11.

Be sure and read the entirety of the document. Make sure it is being followed, and check with the proper individuals. Maybe some of the fellow Covers who are more familar with this can weigh in.

[madannc]

Does it mean that FDA will not expect to see e.g. a validation report of a system that holds electronic records?

Having just been through an FDA inspection (Feb 08), I can say that they did want to see validation records for "crittical" electronic systems and a listing of all crittical databases.

As a minimum I would suggest that you have a listing of crittical databases and a compliance plan for these.

cheers Nigel

[al in drug dev reg - 2010]

Thanks Nigel,

The "real-life' expariences are critical contributions! When you said:

"...they did want to see validation records for "crittical" electronic systems..."

Can you give any specific examples of critical systems they wanted to see val records for and non-critical they did not?

Cheers/al

[madannc]

The inspector asked to see a list of ctittical databases, from this list (which showed they had been validated to part 11) they chose:

Matrix - ECO Management System

CFR - (Customer Feedback Report), our complaint handling system

Control - Process Flow software we use to control the QMS

Where we had not yet validated some of the systems she wanted to see the compliance plan that we had for these.

After viewing these documents she asked no questions and they were not mentioned in the report (we took this to mean that all was satisfactory)

Nigel