Blog

Executive Summary

The United States Food and Drug Administration’s (FDA) modern regulatory function started with the 1906 Pure Food and Drugs Act and continues through 21 CFR Part 11, which details the criteria for reliable electronic records and signatures as used in pharmaceutical and medical device manufacturers, bio tech companies, research labs and clinical trials. Commonly referred to as Part 11, the regulation calls for controls such as system validations, audits, audit trails, documentation and electronic signatures to make certain predicate rules created for paper documentation can be applied to electronic documents as a means of ensuring the accuracy, reliability, integrity, availability, and authenticity of required records.

CIMCON Software believes that a sustainable compliance approach to Life Cycle Management of Spreadsheets should be comprised of repeatable business processes. Whether management is looking to the areas of inventory and risk assessment, validation or re-validation or deploying a Part 11 control environment there should be solutions in place that can meet these three areas of need, today, tomorrow and into the future. CIMCON Software provides tools that make this possible.

Background

21 CFR Part 11 is a component of Title 21 of the Code of Federal Regulations that outlines the criteria for reliable electronic records and electronic signatures as defined by the United States Food and Drug Administration (FDA).1

Often referred to as Part 11, this regulation became effective in August 1997. It specifies controls including system validations, audits, audit trails, documentation and electronic signatures that FDA-regulated industries such as pharmaceutical and medical device manufacturers, bio tech companies, research labs and clinical trials must implement for software and systems used in processing electronic data that FDA predicate rules require to be maintained.

“Part 11 applies to records in electronic form that are created, modified, maintained, archived, retrieved, or transmitted under any records requirements set forth in Agency regulations. Part 11 also applies to electronic records submitted to the Agency under the Federal Food, Drug, and Cosmetic Act and the Public Health Service Act, even if such records are not specifically identified in Agency.”-US Food and Drug Administration, Title 21 Code of Federal Regulations21CFR11.1(1)

What are Predicate Rules?

Predicate rules refer to any requirements stated in the Federal Food, Drug and Cosmetic Act, the Public Health Service Act, or any other FDA regulation. [1]These requirements include, for example, certain provisions of the Current Good Manufacturing Practice regulations (21 CFR Part 211), the Quality System regulation (21 CFR Part 820), and the Good Laboratory Practice for Nonclinical Laboratory Studies regulations (21 CFR Part 58).

Originally, predicate rules applied to paper records with handwritten signatures, and have been extended to include electronic records and signatures when they replace the required paper documents. A regulated company can choose to keep paper documents of all required records for compliance, however any computer system used to control processes subject to predicate rules must be validated.

Predicate rules are incorporated into GxP regulations including CGMP (Current Good Manufacturing Practices), GLP (Good Laboratory Practices), and GCP (Good Clinical Practices).

Part 11 Requirements

Part 11 calls for specific controls for electronic documents and systems used in processing electronic data that are required to be maintained by FDA predicate rules. As a matter of procedure, the FDA recommends that a company use predicate rules to determine which specific records are part 11 records and that these determinations are documented. Once the records are identified, the controls can then be applied.

Validation

In an effort to ensure “accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records” the regulation states:

“Automated processes – When computers or automated data processing systems are used as part of production or the quality system, the manufacturer shall validate computer software for its intended use according to an established protocol. All software changes shall be validated before approval and issuance. These validation activities and results shall be documented.”– US Food and Drug Administration, Code of Federal Regulations Title 21 CFR 820.70 (i)(1)

When deciding which systems should be validated, the main considerations are protecting the accuracy, reliability, integrity, availability, and authenticity of required records and signatures. The FDA recommends first discerning which systems would affect the quality and safety of the product or the integrity of records and recognizing that in some cases, validation may be important, even in the absence of a predicate rule requirement.(2)

CGMP regulations parts 210 and 211 specify that process validation is required as part of the manufacturing process and § 211.100 provides the foundation for this.

“[t]here shall be written procedures for production and process control designed to assure that the drug products have the identity, strength, quality, and purity they purport or are represented to possess…” (emphasis added). This regulation requires manufacturers to design a process, including operations and controls, which results in a product meeting these attributes.”– U.S. Department of Health and Human Services, Food and Drug Administration Guidance for Industry, Part 11, Electronic Records; Electronic Signatures —Scope and Application August 2003 (2)

Other aspects of validation such as guidelines for sampling and testing are addressed in CGMP regulations. These relate to pharmaceutical manufacturing to protect the “identity, strength, purity, and quality of a drug are as they purport or are represented to possess.”

Overall, the CGMP regulations call for manufacturing processes that are planned and controlled to give surety that in-process materials and the finished product consistently meet quality standards.(2)

Audit Trail

Predicate rules ((§ 11.10 (e), (k2) provide specifics on requirements for computer-generated, time-stamped audit trails while others detail the necessary documentation regarding date, time, sequencing of events, and record revisions to ensure that changes do not make previous entries illegible.

Audit trails should be used whenever users may alter regulated records during the course of usual business operations. A documented risk assessment related to product quality and integrity of records is helpful in determining usage.

“Use of secure, computer-generated, time-stamped audit trails to independently record the date and time of operator entries and actions that create, modify, or delete electronic records. Record changes shall not obscure previously recorded information. Such audit trail documentation shall be retained for a period at least as long as that required for the subject electronic records and shall be available for agency review and copying.”– US Food and Drug Administration, Code of Federal Regulations Title 21 CFR11.10 (e)(3)

“Use of appropriate controls over systems documentation including: . . . (2) Revision and change control procedures to maintain an audit trail that documents time-sequenced development and modification of systems documentation.”– US Food and Drug Administration, Code of Federal Regulations Title 21 CFR11.10 (k2)(3)

Records: Retention and Copies

Whether kept records are paper, electronic or a combination of both, the records are bound by many predicate rules that relate to the retention of these records, as well as the availability of reliable copies.

“Records shall be maintained for all components, drug product containers, closures, and labeling for at least one year after the expiration date or, in the case of certain OTC drug products lacking expiration dating because they meet the criteria for exemption under §211.137, three years after distribution of the last lot of drug product incorporating the component or using the container, closure, or labeling.”– 21 CFR 211.180 (b) (5)

Several predicate rules including 11.10 (c), corresponding requirements in §11.30, §§ 211.180(c),(d), 108.25(g), and 108.35(h) also call for the “accurate and ready retrieval” of records during the required time periods as necessary for inspections.

“The ability to generate accurate and complete copies of records in both human readable and electronic form suitable for inspection, review, and copying by the agency. Persons should contact the agency if there are any questions regarding the ability of the agency to perform such review and copying of the electronic records.”– 21 CFR 11.10(b)(3)

Electronic Signatures

In order for the FDA to accept electronic signatures in place of handwritten signatures or initials, their authenticity must be verified by meeting the following specific criteria as stated in Sec 11.100:

• An electronic signature must be assigned to only one person and cannot be reused or reassigned to another.
• The identity of the person assigned to a unique electronic signature must be verified prior to the assignment.
• The assigned person must certify that the electronic signatures assigned are meant to be legally binding and equivalent to handwritten signatures. This certification must be filed in paper form with a “traditional handwritten signature” and sent to the proper authorities.*

*Office of Regional Operations (HFC-100), 5600 Fishers Lane, Rockville, MD 20857

“Use of authority checks to ensure that only authorized individuals can use the system, electronically sign a record, access the operation or computer system input or output device, alter a record, or perform the operation at hand.”– Part 11.10 (g)(5)

Sustainable Compliance: Spreadsheet Life Cycle Management

Companies that use spreadsheets for various business processes that involve GCP, GLP or GMP outcomes often look to become compliant by focusing on the most immediate problem(s) at hand. Typically, this involves one or more of the following processes: (a) Is the spreadsheet free of errors? Have the calculations and other logic of the spreadsheet been checked and verified for accuracy? (b) Is the logic of the spreadsheet been validated? and (c) does the spreadsheet comply with Predicate rules and Part 11 requirements for security, audit trails and e-signatures? All three processes are important and play a critical role in the proper use of spreadsheets in labs, clinical trials, research or manufacturing.

CIMCON Software believes that a sustainable compliance approach to Life Cycle Management of spreadsheets should be comprised of repeatable business processes. Whether management is looking to the areas of validation or re-validation or deploying a Part 11 control environment, there should be solutions in place that can meet these three areas of need, today, tomorrow and into the future. Everyone understands the time, effort and challenges of spreadsheet validation but is enough attention devoted to the use of automation tools that can significantly reduce this effort? By using our toolbox, these necessary processes can be addressed and managed in a way that complies with all GxP concerns while greatly reducing the effort involved.

Our Life Cycle Management Approach is one that has been developed over many years, coupling CIMCON Software’s extensive domain understanding of spreadsheets and databases along with close working relationships with Life Science companies helping them to address information, validation or control gaps in their processes. Besides the knowledge base which has grown from these relationships, there are two independent but closely aligned software applications which CIMCON Software has developed and that can be applied to these ongoing business and regulatory concerns:

• XLValidator – Error-check your spreadsheets and create validation documentation
• eInfotree Excel Module – Bring your spreadsheets under Part 11 Controls

XLValidator

Validation of the formulae, functions, constants, macros and other aspects of a spreadsheet is critical before they can be released into a GxP environment. Spreadsheet validation is a time consuming, error fraught, hard on the “eyeballs” process. XLValidator is a plug-in to the Microsoft Excel application designed to streamline both the verification process and the documentation requirements. It provides extensive logic review encompassing formula, cell and data analysis toolsets. It automatically analyses the spreadsheet for possible errors or warnings and highlights them visually right on the offending cells, creating a Heat Map of such errors. If you are re-validating a spreadsheet, you can compare the new version with the old with a side-by-side comparison, and use this comparison to justify the change impact and revalidation areas.

XLValidator also automatically generates a Design Specification and an Installation and Operational Qualification document based on re-usable Word templates. These documents can be customized to your company name, logo and formats using a one-time process.

Reducing time spent on manual verification and validation processes, and increasing the accuracy of the output is a repeatable, sustainable process with XLValidator as part of a Spreadsheet Life Cycle Management methodology.

eInfotree Excel Module

Once the validation process is complete, naturally an organization wants to secure that validated spreadsheet from any unauthorized change while meeting Part 11 regulations. This is difficult and time consuming if you are limited to normal Excel toolsets, Windows folder security and paper printouts that require “wet” signatures. eInfotree Excel Module is a plug-in to Excel that provides a 21 CFR Part 11 environment that can guarantee multi-level file security, irrevocable audit trail for change monitoring/control and e-signatures for electronic signoff. The software provides all of these aspects while minimizing any changes to the user experience. Knowing spreadsheet processes can go forward without fear of erroneous or unknown changes that could impact on deliverables is a huge benefit to QA and all that are tasked to maintain quality/compliance outcome. eInfotree becomes part of a repeatable, sustainable process for control and compliance of spreadsheets as part of a Life Cycle Management Methodology. Spreadsheets can now be used electronically in compliance with Part 11 without resorting to printouts and wet signatures or hybrid methods that reduce productivity.

Conclusion

Throughout the Life Science industry as in other business verticals there is pressure to cut costs and increase production, while keeping quality and safety high. The use of smart software toolsets can aid in your compliance initiatives, add quality enhancements to a number of business processes and provide peace of mind to management that all necessary aspects of spreadsheet/database management are being met. Furthermore, once this sound approach to a spreadsheet management strategy is understood and implemented, the outcome of any part of the process whether it is information gathering, validation or production use is more accurate, compliant and secure. This leads to a sound, repeatable sustainable compliance approach to spreadsheets that can provide a foundational business approach moving ahead.