Compliance to 21 CFR Part 11 - Where to start??

[Calico]

We do have all employees that are affected by an SOP sign off on a training verification form that is then placed in their training file.

Would it then be required to keep a list or record of all employees signatures to verify that it was in fact that employee who signed off on the training or SOP?

I track training and personally don't compare their signature on a training document to their documented signature to ensure that it wasn't forged.

The only time I use the signature log is to figure out if someone has initialed something, who that person is by checking the initials and the signature.

Thanks Again,
Callie

 

[gar4guv]

We do have all employees that are affected by an SOP sign off on a training verification form that is then placed in their training file.

Would it then be required to keep a list or record of all employees signatures to verify that it was in fact that employee who signed off on the training or SOP?

in that case, the extra log with all employee signatures is not really needed, it's just redundant information. a signature list isn't required either. while they may be convenient, the regs don't require them.

that being said, if your SOPs say you have to keep them, then you have to keep em. but nothing says you can't change the SOPs.

 

[Calico]

Perfect,

Just the answer I was hoping for! I figured that was the case but wanted to get some confirmation from others with more experience.

As I said, it doesn't hurt anything but I need to educate management that just because someone put something in an SOP does not mean that it is a "requirement".. folks seem to think that it is one and the same thing around here.

I think we have documented ourselves into a corner and am trying to get rid of some of the "fluff".

Again,
Thanks for your help.

Callie

 

[alex.Kennedy]

Part 11 has to be complied with when FDA predicate rule data is stored electronically. It does not apply to data store in hard copy format.

It was extensively reviewed last year a synopsis of this reviewed format is given below.

Under the narrow interpretation of the scope of 21 CFR Part 11, with respect to records required to be maintained under predicate rules or submitted to FDA, when persons choose to use records in electronic format in place of paper format, part 11 would apply. On the other hand, when persons use computers to generate paper printouts of electronic records, and those paper records meet all the requirements of the applicable predicate rules and persons rely on the paper records to perform their regulated activities, FDA has stated that it would generally not consider persons to be "using electronic records in lieu of paper records" under §§ 11.2(a) and 11.2(b). In these instances, the use of computer systems in the generation of paper records would not trigger part 11.

Alex Kennedy

 

[v9991]

if the signature is taken limitd set of people to whom the SOP s distributed... then here is an suggestion, there is one more aspect these sinatures could signify... i.e., a evidence/traceability/retrieal controlled-copies of SOP.

if the purpose of traceability is already served through separate procedures... then it can be concluded that its an redundant requirment.

hope that helps.
valiveti.

 

[sagai]

21CFR11 conformance is used mostly in my practice during the validation of SOUPs. Based on the given SOUP G(L/M/x)P relevance u shall provide evidence of its conformance with 21CFR11 in order to use it as part of your QMS or any part of your QMS automation by a supporting software.
I am a medical software guy, maybe it influence other area differently.
I have not come across such thing like 21CFR11 SOP, its always part of a broader scope SOP in my practice.
br
Szabolcs

 

[sueliu - 2012]

Can you please elaborate a bit more how you relate the validation of SOUP with the compliance of 21CFR 11? I am also working for a medical device company. I am very puzzled about the 21 CFR compliance at this moment. Thanks.

21CFR11 conformance is used mostly in my practice during the validation of SOUPs. Based on the given SOUP G(L/M/x)P relevance u shall provide evidence of its conformance with 21CFR11 in order to use it as part of your QMS or any part of your QMS automation by a supporting software.
I am a medical software guy, maybe it influence other area differently.
I have not come across such thing like 21CFR11 SOP, its always part of a broader scope SOP in my practice.
br
Szabolcs

 

[sagai]

Hi Sueliu!

I use the "SOUP" terminology not only for referencing product related "SOUP" software, but software subject to 21CFR820.70(i) and 21CFR820.72 and can be classified as "SOUP".

99% of OTS are SOUP, but not all SOUP are OTS.

When we should validate non product related SOUP, ultimately we should evaluate the need of part11 compliance and if there is, we should do the part11 assessment.


One more clarification,
the software that maintains for example complaint records and developed only for this purpose by a subcontracted development firm is not an OTS, but a SOUP should be part11 compliant.

I hope i had a better explanation now.

Regards
Sz.

 

[sueliu - 2012]

Sagai,

Thanks a lot for your clarification. I have a bit more questions about validation of product related SOUP, e.g. issue tracking system. What type of validation you have done for this type of SOUP? Validation based on FDA's guidance on OTS validation, assessment on Part 11 compliance, or a combination of both?

I have a feeling that our ISO notified body does not care Part 11 compliance. What is your understanding? Thanks again.

 

[sagai]

Hi Sueliu!

Issue tracking system is not a product related soup, its a non product SOUP (but it also could not be a SOUP in case you inhouse developed under the same SDLC as you have for the MD) in my understanding.
But we can move away from the dinner table and simple say product SW or non product SW.

What type of validation you have done for this type of SOUP?

For issue tracking system GAMP is a good guide and it also has been referenced in the ISO/TR14969:2004 (for ISO13485:2003) in chapter 7.5.2.1.3.
It is important to know, for ISO13485 certification there is no defined expectation about the extent of the validation of softwares subject to validation, only in FDA world we have and those are much more coming from process validation principles.
Moreover in ISO13485 only SWs are subject to 7.5.2.1 and 7.6 should be validated (almost anyhow )

In case you subject to Food Drug and Cosmetic Act (like my firm does) than you should comply with the requirements given for software validation by FDA, including several guidance and (of course if applicable) the requirements set forth in part11.

For issue tracking system we have clearquest, its a customizable OTS and as such it is around category 4 as long as I can recall in GAMP4, requires user and system level requirements and verification including IQ/OQ/PQ categorization and in case there is no paper based register (we do not), part11 should be applied.

Validation based on FDA's guidance on OTS validation, assessment on Part 11 compliance, or a combination of both?

Okay
The FDA guidance for OTS,
this:
http://www.fda.gov/MedicalDevices/DeviceRegulationandGuidance/GuidanceDocuments/ucm073778.htm
,
is not applicable to issue tracking system, because it is not part of the medical device, it is part of the automation of the QMS system and part of the automation of the process defined in 21CFR820.

What are directly applicable are the followings:

General Principles of Software Validation; Final Guidance for Industry and FDA Staff
http://www.fda.gov/MedicalDevices/DeviceRegulationandGuidance/GuidanceDocuments/ucm085281.htm

820.70(i)
http://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfcfr/CFRSearch.cfm?fr=820.70

part11
http://www.accessdata.fda.gov/scripts/cdrh/cfdocs/cfcfr/CFRSearch.cfm?CFRPart=11&showFR=1

Part 11, Electronic Records; Electronic Signatures — Scope and Application
http://www.fda.gov/RegulatoryInformation/Guidances/ucm125067.htm

I have a feeling that our ISO notified body does not care Part 11 compliance.

ISO notified bodies are simple not caring about part11, because it is for FDA, not for EU registration.

We may closer than far

Regards
Sz.