Subpart B - Electronic Records

Controls for Closed Systems (11.10)

The regulation calls for a series of controls to ensure the authenticity, integrity, and confidentiality (when necessary) of electronic records in closed systems. The scope of this deployment guide is limited, in application, to closed systems. Controls for open systems (21 CFR 11.30) will not be addressed in this guide due to this scope focus.

The controls for closed systems are summarized here but addressed in greater detail within sections 3 and 4 of this guide:

• 11.10 (a): Systems must be validated (tested to verify they operate as designed)

• 11.10 (b): Records must be available for inspection in both electronic and human readable form

• 11.10 (c): Records must be protected for retrieval during the required retention period

• 11.10 (d): System access is limited to authorized individuals

• 11.10 (e): Operator entries and actions that create, modify, or delete electronic records must be tracked in a secure, computer-generated audit trail

• 11.10 (f): System checks will enforce sequencing of steps or events

• 11.10 (g): Authority checks will be used to ensure system use or electronic signatures only by authorized individuals

• 11.10 (h): Device checks will determine validity of inputs or operational instructions

• 11.10 (i): System users have the necessary education, training, and experience for their tasks

• 11.10 (j): Written policies that hold individuals accountable for actions initiated by their electronic signatures

• 11.10 (k): Controls over system documentation including access to and changes therein

Signature Manifestation (11.50)

Electronic records must include information associated with each electronic signature applied to the record. This information must be controlled to the same degree as the electronic records and all aspects of the signature will be included in the human readable form of the electronic record.

The required signature information includes:

• Printed name of the signer

• Date and time when the signature was applied

• The meaning of the signature (e.g. author, reviewer, approver)

Signature/Record Linking (11.70)

Signatures, electronic or handwritten, applied to the electronic records must be linked to the records so they cannot be removed or changed in any way that could be used to falsify records.

Note: This guide does not address the application of handwritten signatures to electronic records.