1. 21 CFR Part 11 Compliance Webinar Stephen Gibney | Bruce Walcroft

2. Introductions Part 11 Exploring the Myths Revealing the Facts What Does the Future Hold? Validation Requirements Live Examples Questions Agenda 21 CFR Part 11 Compliance 3. Stephen Gibney (sgibney@aitalent.co.uk) Quality & Document Manager @ AITalent. Previously, Software Quality Assurance Manager at SPD, (Clearblue Product Range, Smartcheck INR), QAV Specialist in biopharmaceutical manufacturing control systems, (Enbrel/Pravner), Software Engineer in financial and telecoms software development (Personal Finance & SMSC, 3g network performance monitor systems) Please allow me to introduce myself 21 CFR Part 11 Compliance uk.linkedin.com/in/ stephengibney 4. Myth 1 Every computer system/software used in the life science industry comes under the remit of part 11. Not all software used in life science industries is Part 11 regulated. First ask, is the software used for a Quality or Production system? If not then Part 11 does not apply. e.g. Payroll software is not part 11 regulated. Part 11 What it is not - The Myths 21 CFR Part 11 Compliance 5. Myth 2 all Quality & Production systems need to be Part 11 compliant, First ask, are records retained, signed or submitted electronically?, if not then Part 11 does not apply to the system. If the master record is retained in paper format then Part 11 does not apply. Part 11 What it is not - The Myths 21 CFR Part 11 Compliance 6. Myth 3 It applies to every single piece of processing equipment/sub-system. First ask, does the system hold all of the record? If a system only generates part of a record or meta data and transmits this record part to a higher level system then the lower level system is not Part 11 and the higher level system that holds the complete record is the Part 11 system. Example Meta Data System, PLC, microcontroller, etc Part 11 What it is not - The Myths 21 CFR Part 11 Compliance 7. Myth 4 - all computerised systems that keep electronic records must be made to be part 11 compliant. If the system does keep electronic records but it is older then 1997, then it can be deemed to be a legacy system and Part 11 may not apply. FDA employs enforcement discretion for legacy systems. Example Legacy Systems Manufacturing Systems implemented prior to 1997. Careline systems implemented prior to 1997. Part 11 What it is not - The Myths 21 CFR Part 11 Compliance 8. Myth 5 Part 11 applies to Medical Device Software Medical device software, either embedded in a medical device or software that is a medical device in its own right is not Part 11. However, software that is used to calibrate, service or maintain a medical device maybe Part 11, as this software is used for a quality purpose. e.g. complaint investigation software. Part 11 What it is not - The Myths 21 CFR Part 11 Compliance 9. Myth 6 Part 11 is only about technical controls for the Computerised Systems within the Life Science Industry. There are several procedural controls within Part 11 that must be implemented by companies using Part 11 systems. Part 11 What it is not, the Myths. 21 CFR Part 11 Compliance 10. Part 11 - Revealing the Facts 21 CFR Part 11 Compliance 11. What does it mean? 21 Chapter of US Federal Law Food, Drug & Cosmetics Act circa 1906, CFR - Code of Federal Regulation US Federal Government Law, Part 11 That part of 21 CFR that deals with electronic records & electronic signatures. 21 CFR Part 11 - ???? 21 CFR Part 11 Compliance 12. U.S. Federal Regulation to ensure electronic records are trustworthy, Part 11 applies to all FDA regulated industries, where electronic record keeping, signing and submitted is used for systems with a Quality and/or Production purpose that where implemented post 1997. What is Part 11 21 CFR Part 11 Compliance 13. Paper Record Change Electronic Record Change Five score and seven years ago our fathers brought forth on this continent, a new nation, conceived in Liberty, and dedicated to the proposition that all men are created equal. Paper vs. Electronic Record Changes 21 CFR Part 11 Compliance 14. Created in 1997 due to the increasing adoption of computerised electronic keeping in life science industry and concerns with the integrity and robustness of electronic records at that time. Enforced by the Food & Drug Administration FDA. PART 11 applies to all Drug and Medical Devices manufacturers that sell into the United States and use electronic records & electronic signatures. 21 CFR Part 11 - a brief history 21 CFR Part 11 Compliance 15. The current Part 11 covers; Electronic Record Keeping any quality or production record held electronically. Electronic Signatures - any approval of a quality or production record that is committed electronically. Electronic Submissions - NDAs, 510(k)s, PMAs, etc Scope of Part 11? 21 CFR Part 11 Compliance 16. Electronic Record, Any record required for a Quality or Production purpose that is held electronically. e.g. Batch Records, Training Records, Customer Complaint Records, etc What are Electronic Records? 21 CFR Part 11 Compliance 17. Electronic Signature, Comprised of two parts, First part - publically known identifier Second part - known only to the owner of the esig, First part is typically a username to identify the user uniquely and trace to their job role and training record to verify that their authority level and competence to sign for that job role. Second part is typically a Password (can be biometric data) to ensure that it is actually the right person signing. What are Electronic Signatures? 21 CFR Part 11 Compliance 18. Quality and Production paper records are legal documents they can be and often are submitted as evidence in legal proceedings, Altering/tampering with a paper record is fraud. Electronic Records are the equivalent of paper records, Altering/tampering with an electronic record is the same as forging a paper record, its fraud. Electronic Records & the law. 21 CFR Part 11 Compliance 19. Signing a Quality or Production paper record with someone elses name is fraud, Electronic Signatures are the equivalent of handwritten signatures, Using someones else electronic signature to sign an electronic record required by the FDA is the same as forging some one elses signature to sign a paper record, its fraud. Electronic Records & the Law. 21 CFR Part 11 Compliance 20. FDA has over 100 years of expertise inspecting paper records, they can easily detect fraud with paper records, They known what they are looking for and can tell at a glance if a paper record has been tampered with Its harder to detect fraud with an electronic record, its virtually impossible at a cursory inspection. Computer Generated Time stamped Audit Trails are used to give credence and providence to electronic records/electronic signatures. Have to be able to provide a copy of the audit trail associated with a particular electronic record to an FDA Inspector either on paper/electronically the Inspectors request. Audit Trails 21 CFR Part 11 Compliance 21. Closed Systems: those systems where a company can verify the identify of all users before granting access to an ERES system. Only electronic signatures required, e.g. username & password combination. Open Systems: those systems where a company cannot verify the identify of all users before granting access to an ERES system. Digital signatures are required in addition to electronic signatures, e.g. digital certificates, HTTPS, etc This is to ensure that the person is who they say they are. Open vs. Closed Systems 21 CFR Part 11 Compliance 22. Onus is on the company using electronic signatures as the equivalent of hand written signatures to write to FDA to inform them that the company intends to use an ERES system. Company using an ERES system, must verify and record the verification of the identify of the user before granting an signature. Train the users not to share their esignatures with anyone else, companies quite often make this a disciplinary offence. Procedural requirements 21 CFR Part 11 Compliance 23. Reading the regulatory wind. FDA employ enforcement discretion with the current Part 11. Requirements for record keeping most likely to move under the applicable predicate rules. e.g. Electronic records for Medical Device Manufacturers would come under 21 CFR Part 820.186 Quality system record instead of 21 CFR Part 11 Subpart B--Electronic Records. Requirements for electronic signatures will form new core Part 11 version. Future 21 CFR Part 11 Compliance 24. All Part 11 systems require validation Regulation CFR - Code of Federal Regulations Title 21 Guidance Documents Guidance for Industry - Computerized Systems Used in Clinical Trials Guidance for Industry Part 11, Electronic Records; Electronic Signatures - Scope Application General Principles for Software Validation Validation of Part 11 Systems 21 CFR Part 11 Compliance 25. Live Demonstration 21 CFR Part 11 Compliance 26. Part 11 Exploring the Myths Revealing the Facts What Does the Future Hold? Validation Requirements Live Examples Recap 21 CFR Part 11 Compliance 27. Questions 21 CFR Part 11 Compliance 28. Thank You 21 CFR Part 11 Compliance Join our Linkedin Group The Training Managers Network: www.linkedin.com/groups/Training-Managers-Network-4868021 AITalent, 020 7400 0485, info@aitalent.co.uk, www.aitalent.co.uk