GxP Lifeline Feature Article
21 CFR Part 11: What?s New?
By David Ade
Questions and Answers About the Much-Awaited New Guidance on 21 CFR 11
The anticipation over a new 21 CFR Part 11 and a new companion guidance for compliance is waning because of persistent speculation within the industry that the FDA is not ready to release the documents until later this year or perhaps next year.
Ever since the agency issued a nonbinding guidance on Part 11's scope and application in 2003, the industry was rife with talk about the need for a better guidance, and perhaps a new and better regulation altogether. Four years later, there is neither a new guidance nor a new regulation in sight. In the meantime, what should life science companies do?
In a recent Institute of Validation Technology conference, several key questions surfaced during various presentations, as well as answers from industry experts and FDA representatives. Here are some of them.
1. Is 21 CFR 11 still being enforced?
In a nutshell: the answer is yes. ?Part 11 did not go away,? said George R. Smith Jr., a consumer safety officer with the FDA's Center for Drug Evaluation and Research (CDER). He said the ?scope and application? guidance issued in 2003 will remain in effect until a new final regulation and companion guidance are promulgated.
Martin Browning, former FDA investigator and vice chair of the working group that drafted 21 CFR 11, said: ?Yes, Part 11 is still in effect. Yes, Part 11 is still being enforced, especially when FDA perceives a lack of data integrity, or when the number of other violations far outweigh the Part 11 issues alone.? Browning, who is now president of EduQuest Inc., a consulting firm, reminded conference participants that 21 CFR 11 itself was not withdrawn, and so it remains in effect.
2. How is Part 11 currently enforced?
CDER's George Smith Jr. said the FDA is currently applying ?enforcement discretion? in the following areas:
- Audit trails;
- Copies of records;
- Record retention;
- All Part 11 requirements for legacy systems (prior to Aug. 8, 1997).
3. What exactly are we waiting for as far as Part 11 is concerned?
Smith listed the following ?Current/Next Step Activities? for the FDA:
- Publish proposed amended regulation along with draft companion guidance;
- Analyze comments during the comment period;
- Prepare final regulation (preamble, economic analysis, and final companion guidance);
- Promulgate final regulation and publish final companion guidance. At the same time, the agency will withdraw the current ?scope and application? guidance.
4. What are the likely changes in Part 11?
Ludwig Huber, writer and editor of labcompliance.com, said it's likely that the revised Part 11 would include the following:
- Narrower scope that would apply only to records required by predicate rules;
- Risk-based controls will be extended to other areas of Part 11;
- The FDA's enforcement discretion will be replaced by risk-based approaches;
- Less prescriptive requirements (e.g., provide other options for audit trail as opposed to the current requirement of electronic audit trail); and
- No distinction between closed and open systems.
Martin Browning said he expects the agency will ?try to fit in risk? in the new regulation. As far as computer system validation is concerned, he thinks the new Part 11 will embrace but not define a risk-based approach.
5. What should you do to prepare?
Huber suggested the following:
- Identify records required by regulations;
- Identify risks of records (e.g., high, medium, low);
- Document business practices;
- Identify Part 11 requirements; and
- Develop and implement project plans.
About the Author
David Ade, a product manager at MasterControl Inc., specializes in FDA computer validation and other software-related requirements. He has 10 years of experience in IT and quality assurance in the CRO industry.
Read more about 21 CFR 11: