GMP News No. 294
26 February 2003
Withdraws All Part 11 Guides
Even on 4 February, FDA withdrew the guide that had been published last, i.e. Guidance for industry, 21 CFR Part 11; Electronic Records; Electronic Signatures, Electronic Copies of Electronic Records 79" (see our GMP News of 14 February).
What was withdrawn were the Part 11 Guides, not the Rule (i.e. 21 CFR Part 11) itself.
Of course, one wonders why FDA has taken this quite radical step. What is sure is that the new cGMP Initiative has triggered off this action (see our GMP News of 4 September 2002). By means of this initiative, FDA intends to adopt a risk-based approach to all regulatory and inspection requirements. Apart from this, FDA sees 3 reasons that have led to the withdrawal. The requirements mentioned in the Guides could bring about the following negative effects:
FDA announces to exercise enforcement discretion during inspections with regard to the requirements on validation, audit trails, record retention, record copying and the requirements on legacy systems. This "special handling" of the requirements will be practised until the rule Part 11 has been re-evaluated/revised. FDA emphasises that all other requirements have to be implemented as before. The text says:
It is important to note that FDA's exercise of enforcement discretion as described in this guidance is limited to the specified part 11 requirements. We intend to enforce all other provisions of part 11 including, but not limited to, certain controls for closed systems in § 11.10, the corresponding controls for open systems (§ 11.30), and requirements related to electronic signatures (e.g., §§ 11.50, 11.70, 11.100, 11.200, and 11.300). We expect continued compliance with these provisions, and we will continue to enforce them.
With the above-mentioned explanations for the withdrawal of the different Part 11 Guides, a new Guide was published containing FDA's current thinking on electronic records and electronic signatures. It is titled: Part 11, Electronic Records; Electronic Signatures Scope and Application.
The text starts by giving the reasons for the creation of this Guidance, the content being identical with what has been said in the above-mentioned explanation in the Federal Register. The actual content of the document takes up only 4 of the 9 text pages.
Already in the chapter "Narrow Interpretation of Scope", the reader finds a far-reaching statement on the handling of electronic records. Here, FDA says that, in case a paper printout is maintained, it is not necessary any more to archive the electronic record.
Point 2 "Definition of Part 11 Records" goes a bit more into the details of this item. FDA recommends among others that one should pre-define which records will be maintained in paper format and which ones in electronic format. This can best be done in the form of an SOP.
In chapter C, FDA deals with those fields in which they intend to exercise enforcement discretion. Here, the focus is put especially on risk assessment. This key word is the central theme of the Guidance. By means of a risk assessment one has to find out to what extent a specific system can influence the product quality, safety, and record integrity. If the result indicates a high risk, the requirements, e.g. on validation, have to be implemented. If the risk proves to be low, this is not necessary. In this context, FDA gives an example on which there have been controversial discussions at numerous conferences at which FDA officials were present. FDA says: For instance, a word processor used only to generate SOPs would most likely not need to be validated. If one develops this thought further, a text file containing an SOP (low risk for product quality) would no longer have to be handled according to the Part 11 requirements either. But how is the situation for more complex records, e.g. an excel sheet with calculations that are used for a release decision? According to the approach described above, all of the requirements of Part 11, i.e. validation, audit trail etc., would again have to be observed.
In analogy to this, there is also a change for audit trails. FDA recommends a risk-based approach here, too. At the same time, FDA emphasises that:
Audit trails are particularly important where the users are expected to create, modify, or delete regulated records during normal operation.
Next to risk assessment, another point is of importance: "All records held by you are subject to inspection in accordance with predicate rules". For the decision about the scope of measures to be implemented for certain electronic records, it will therefore be crucial which requirements are defined in the underlying GMP legislation (e.g. 21 CFR 210/211).
It will be interesting to know to what extent FDA will change the rule Part 11, i.e. the law on which the Guidances are based.
On the whole, one can say that FDA has made concessions to many of the demands expressed by the industry. It may be difficult to assess how far the enforcement discretion will go. In which areas can one really ignore the requirements of Part 11? How can one define that a specific record resulting from the GMP requirements represents a comparably low risk for the product quality and is thus exempted from the Part 11 requirements (also in case the record is created and archived by means of an electronic system)?
You can download the new Draft via this link:
The following link leads you to the
announcement in the Federal Register (withdrawal of the Part 11
The following ECA events deal especially with computer validation: