Follow All 21 CFR Part 11 Electronic Signature Guidelines

Many best practices for reviewing and approval information can facilitate compliance with CFR Part 11’s electronic signature guidelines. This includes features like:

 

Controlled Workflow 

When a user wants to make a change to a controlled document or submit it for review in Meridian Cloud, they initiate a controlled workflow to make that change. This forces documents to move through a defined workflow that requires users to pass through pre-defined review and approval steps. This helps maintain compliance and ensure that all boxes are checked.

 

Electronic Signatures 

In Meridian Cloud for Life Sciences, electronic signatures are required when a GMP document is put into a workflow. Each person that must provide their electronic signature will receive an email letting them know that there is a document ready for their review. As each user reviews or approves the document, their electronic signature is manifested on the PDF rendition of the document in the order they signed. This not only helps ensure that the right people see the document but also simplifies document management and streamlines the audit trail.

 

Electronic Print Stamp 

Every time you view, modify or print a GMP document in Meridian Cloud for Life Sciences, a print stamp and watermark will be automatically generated by the system on each PDF rendering of the document to provide key timing information. This can help maintain consistency of work across time zones and help employees understand, at a glance, which document is the latest and most up-to-date version.

 

7. Choose The Right QMS Solution

Compliance is a complex, ongoing process – and getting it right will be much easier with the right tools in place. When it comes to your QMS software, this should be a tool -- like Meridian Cloud for Life Sciences – that is pre-validated and fully aligned with CFR part 11.

 

Food and Drug Administration CFR Title 21 Part 11

 

FDA CFR Title 21 overview

The Code of Federal Regulations (CFR) contains the rules and regulations for executive departments and agencies of the US federal government. Each of the 50 titles of the 21 cfr part 11 electronic signature addresses a different regulated area.

 

FDA CFR Title 21 regulates food and drugs manufactured or consumed in the United States, under the jurisdiction of the Food and Drug Administration (FDA), the Drug Enforcement Administration, and the Office of National Drug Control Policy. The regulations outlined in CFR Title 21 Part 11 set the ground rules for the technology systems that manage information used by organizations subject to FDA oversight. Any technology system that governs such GxP processes as Good Laboratory Practices (GLP), Good Clinical Practices (GCP), and Good Manufacturing Practices (GMP) also requires validation of its adherence to GxP.

 

CFR Title 21 Part 11 sets requirements to ensure that electronic records and signatures are trustworthy, reliable, and equivalent substitutes for paper records and handwritten signatures. It also offers guidelines to improve the security of computer systems in FDA-regulated industries. Subject companies must prove that their processes and products work as they are designed to, and if these process and products change, they must revalidate that proof. The best practices guidelines cover:

 

Standard operating procedures and controls that support electronic records and signatures such as data backup, security, and computer system validation.

Features that ensure that the computer system is secure, contains audit trails for data values, and ensures the integrity of electronic signatures.

Validation and documentation that supply evidence that the system does what is intended, and that users can detect when the system is not working as designed.

Microsoft and FDA CFR Title 21

Microsoft enterprise cloud services undergo regular independent third-party SOC 1 Type 2 and SOC 2 Type 2 audits and are certified according to ISO/IEC 27001 and ISO/IEC 27018 standards.

 

Although these regular audits and certifications do not specifically focus on FDA regulatory compliance, their purpose and objectives are similar in nature to those of CFR Title 21 Part 11, and serve to help ensure the confidentiality, integrity, and availability of data stored in Microsoft cloud services. Our qualification approach is also based on industry best practices, including the International Society for Pharmaceutical Engineering (ISPE) GAMP series of Good Practices Guides and the Pharmaceutical Inspection Cooperation Scheme (PIC/S) Good Practices for Computerized Systems in Regulated GxP Environments.

 

Customers can request access to the compliance reports, subject to nondisclosure agreement terms and conditions, through their Microsoft account representative, or through the Service Trust Portal. In addition, qualification guidelines for Microsoft Azure and Microsoft Office 365 provide a detailed explanation of how Microsoft audit controls correspond to the requirements of CFR Title 21 Part 11, guidance for implementing an FDA qualification strategy, and a description of areas of shared responsibility.