Draft Guidance For Industry; Part 11; Validation

1 Draft Guidance for industry - Not For ImplementationGuidance for Industry21 CFR Part 11; ElectronicRecords; Electronic SignaturesValidationDraft GuidanceThis Guidance document is being distributed for comment purposes and suggestions regarding this Draft document should be submittedwithin 90 days of publication in the Federal Register of the notice announcing theavailability of the Draft Guidance . Submit comments to Dockets ManagementBranch (HFA-305), Food and Drug Administration, 5630 Fishers Lane, room1061, Rockville, MD 20852. All comments should be identified with the docketnumber questions regarding this Draft document contact Paul J. Motise, Office ofEnforcement, Office of Regulatory Affairs, 301-827-0383, Department of Health and Human ServicesFood and Drug AdministrationOffice of Regulatory Affairs (ORA)Center for Biologics Evaluation and Research (CBER)Center for Drug Evaluation and Research (CDER)Center for Devices and Radiological Health (CDRH)Center for Food Safety and Applied Nutrition (CFSAN)Center for Veterinary Medicine (CVM)August 2001 Draft Guidance for industry - Not For ImplementationiiGuidance For Industry21 CFR Part 11; Electronic Records;Electronic SignaturesValidationAdditional copies of this Draft Guidance document are available from the Office ofEnforcement, HFC-200, 5600 Fishers Lane, Rockville, MD 20857.

2 Department of Health and Human ServicesFood and Drug AdministrationOffice of Regulatory Affairs (ORA)Center for Biologics Evaluation and Research (CBER)Center for Drug Evaluation and Research (CDER)Center for Devices and Radiological Health (CDRH)Center for Food Safety and Applied Nutrition (CFSAN)Center for Veterinary Medicine (CVM)August 2001 Draft Guidance for industry - Not For ImplementationiiiGuidance For Industry21 CFR Part 11; Electronic Records; Electronic SignaturesValidationTable of .. Applicability .. Audience .. and Terminology .. Requirements; What Does Part 11 Require? .. Principles .. System Requirements Specifications .. Documentation of Validation Activity .. Validation Plan .. Validation Validation Report .. Equipment Installation .. Dynamic Key Testing Considerations .. Software testing should include.

3 How test results should be expressed.. Static Verification Extent of Validation .. Independence of Review .. Change Control (Configuration Management).. Considerations .. Commercial, Off-The-Shelf End User Requirements Software Structural Functional Testing of Software .. The Internet .. Internet Validation ..13 Appendix A - Guidance for industry - Not For Implementation1 Guidance For Industry121 CFR Part 11; Electronic Records; Electronic SignaturesValidation1. Purpose The purpose of this Draft Guidance is to describe the Food and Drug Administration's(FDA s) current thinking regarding considerations in meeting the Validation requirements ofPart 11 of Title 21 of the Code of Federal Regulations; Electronic Records; ElectronicSignatures. It provides Guidance to industry , and is intended to assist persons who aresubject to the rule to comply with the regulation.

4 It may also assist FDA staff who applypart 11 to persons who are subject to the ScopeThis Draft Guidance is one of a series of guidances about part 11. We intend to provideinformation with respect to FDA's current thinking on acceptable ways of meeting part 11 1 This Draft Guidance was prepared under the aegis of the Office of Enforcement by the FDA Part 11 Compliance Committee. The committee is composed of representatives from each center within the Foodand Drug Administration, the Office of Chief Counsel and the Office of Regulatory Draft Guidance , when finalized, will represent the Food and DrugAdministration s (FDA s) current thinking on this topic. It does not create or conferany rights for or on any person and does not operate to bind FDA or the public. Analternative approach may be used if such approach satisfies the requirements ofapplicable statutes and Guidance for industry - Not For Implementation2requirements to ensure that electronic records and electronic signatures are trustworthy,reliable, and compatible with FDA's public health record and electronic signature systems consist of both manual proceduralcontrols and technical controls implemented through computer systems.

5 This draftguidance focuses on Validation of computer systems. It identifies key Validation principlesand addresses some frequently asked questions, but it is not intended to cover everythingthat computer systems Validation should encompass in the context of electronicrecord/electronic signature systems. You can read more information about computersystems Validation in the documents listed in Appendix A - ApplicabilityThis Draft Guidance applies to electronic records and electronic signatures that personscreate, modify, maintain, archive, retrieve, or transmit under any records or signaturerequirement set forth in the Federal Food, Drug, and Cosmetic Act (the Act), the PublicHealth Service Act (PHS Act), or any FDA regulation. Any requirements set forth in theAct, the PHS Act, or any FDA regulation, with the exception of part 11, are referred to inthis document as predicate rules.

6 Most predicate rules are contained in Title 21 of theCode of Federal Regulations. In general, predicate rules address the research, production,and control of FDA regulated articles, and fall into several broad categories. Examples ofsuch categories include, but are not limited to, manufacturing practices, laboratoryDraft Guidance for industry - Not For Implementation3practices, clinical and pre-clinical research, adverse event reporting, product tracking, andpre and post marketing submissions and AudienceWe intend this Draft Guidance to provide useful information and recommendations to: Persons subject to part 11; Persons responsible for Validation of systems used in electronic recordkeeping; Persons who develop products or services to enable implementation of part 11requirements; and,This Draft Guidance may also assist FDA staff who apply part 11 to persons subject to Definitions and Terminology Unless otherwise specified below, all terms used in this Draft Guidance are defined in FDA sdraft Guidance document, Guidance For industry , 21 CFR Part 11; Electronic Records;Electronic Signatures, Glossary of Terms, a document common to the series of guidanceson part Regulatory Requirements; What Does Part 11 Require?

7 Section requires persons to employ procedures and controls designed to ensure theauthenticity, integrity, and, when appropriate, the confidentiality of electronic records, andto ensure that the signer cannot readily repudiate the signed record as not genuine. ToDraft Guidance for industry - Not For Implementation4satisfy this requirement persons must, among other things, employ procedures and controlsthat include "[v]alidation of systems to ensure accuracy, reliability, consistent intendedperformance, and the ability to discern invalid or altered records." 5. Key PrinciplesHere are some key principles you should consider when validating electronic recordkeepingcomputer System Requirements SpecificationsRegardless of whether the computer system is developed in-house, developed by acontractor, or purchased off-the-shelf, establishing documented end user ( , a personregulated by FDA) requirements is extremely important for computer systems first establishing end user needs and intended uses, we believe it is virtuallyimpossible to confirm that the system can consistently meet them.

8 Once you haveestablished the end user s needs and intended uses, you should obtain evidence that thecomputer system implements those needs correctly and that they are traceable to systemdesign requirements and specifications. It is important that your end user requirementsspecifications take into account predicate rules, part 11, and other needs unique to yoursystem that relate to ensuring record authenticity, integrity, signer non-repudiation, and,when appropriate, confidentiality. For example, as noted above, section has ageneral requirement that persons who use closed systems to create, modify, maintain, ortransmit electronic records must employ procedures and controls designed to ensure theDraft Guidance for industry - Not For Implementation5authenticity, integrity, and, when appropriate, the confidentiality of electronic records, andto ensure that signers cannot readily repudiate signed records as not genuine.

9 In addition,section requires persons who use open systems to employ procedures and controlsidentified in section , as appropriate; persons who use open systems must alsoimplement special procedures and controls, such as document encryption and use of digitalsignature standards, as necessary under the circumstances, to ensure record authenticity,integrity, and factors not specifically addressed in part 11 may also impact on electronic recordtrustworthiness, integrity and system performance. You should consider these factors andestablish appropriate requirements specifications for them, as well. Here are someexamples: Scanning processes: where a paper record is scanned to create an electronicrecord, scanner resolution, scanning rates, color fidelity, and the type ofhardware interface may impact the accuracy and reliability of the electronicrecord as well as system performance.

10 Scalability: in a networked environment, system performance may be affectedby the number of workstations and bandwidth demands of file size and types. Operating environment: sources of electromagnetic interference, radiofrequency interference, temperature/humidity, and electrical powerfluctuations may affect system Guidance for industry - Not For Documentation of Validation ActivityWe consider thorough documentation to be extremely important to the success of yourvalidation efforts. Validation documentation should include a Validation plan, validationprocedures, and a Validation report, and should identify who in management is responsiblefor approval of the plan, the procedures and the Validation PlanThe Validation plan is a strategic document that should state what is to be done, the scopeof approach, the schedule of Validation activities, and tasks to be performed.