Case Studies

Part 11 Implementation

Revision 2.00
October 2009
These are case studies for Part 11 Implementation. They are proposals and starting
points only. The type and extent of documentation depends on the process environment.
The proposed examples should be adapted accordingly and should be based on
individual situations. There is no guarantee that the case studies will pass a regulatory
inspection.

Publication from
www.labcompliance.com
Global on-line resource for validation and compliance
Copyright by Labcompliance. This document may only be saved and viewed or printed
for personal use. Users may not transmit or duplicate this document in whole or in part,
in any medium. Additional copies and licenses for department, site or corporate use can
be ordered from www.labcompliance.com/solutions.
While every effort has been made to ensure the accuracy of information contained in
this document, Labcompliance accepts no responsibility for errors or omissions. No
liability can be accepted in any way.
Labcompliance offers books, master plans, complete Quality Packages with validation
procedures, scripts and examples, SOPs, publications, training and presentation
material, user club membership with more than 500 downloads and audio/web
seminars. For more information and ordering, visit www.labcompliance.com/solutions.

Case Studies
Document Number: E-411 Version 1.xx
Part 11 Implementation

Page 2 of 47
April 1, 2012

Table of Contents
1. PURPOSE.....................................................................................................................4
2. SCOPE..........................................................................................................................4
3. REFERENCES..............................................................................................................4
4. GLOSSARY..................................................................................................................5
5. EXAMPLES..................................................................................................................7
5.1 QA/QC Client/Server Based Analysis System........................................................7
5.1.1 Application and Use.................................................................................................7
5.1.2 System Summary and Business Process...................................................................7
5.1.3 Recommendations and Documentation....................................................................8
5.2 HPLC System for Stability Testing.........................................................................10
5.2.1 Application and Use...............................................................................................10
5.2.2 System Summary and Business Process.................................................................10
5.2.3 Recommendations and Documentation..................................................................11
5.3 Recording Oven Temperature for Stability Testing................................................13
5.3.1 Application and Use...............................................................................................13
5.3.2 System Summary and Business Process.................................................................13
5.3.3 Recommendations and Documentation..................................................................14
5.4 System for Laboratory Equipment Qualification....................................................16
5.4.1 Application and Use...............................................................................................16
5.4.2 System Summary and Business Process.................................................................16
5.4.3 Recommendations and Documentation..................................................................16
5.5 Batch Recording and Printing - No Storage of E-Records....................................19
5.5.1 Application and Use...............................................................................................19
5.5.2 System Summary and Business Process.................................................................19
5.5.3 Recommendations and Documentation..................................................................19
5.6 Oven with Card Reader.........................................................................................22
5.6.1 Application and Use...............................................................................................22
5.6.2 System Summary and Business Process.................................................................22
5.6.3 Recommendations and Documentation..................................................................22
5.7 Washer with Handheld Controller..........................................................................25
5.7.1 Application and Use...............................................................................................25
5.7.2 System Summary and Business Process.................................................................25
5.7.3 Recommendations and Documentation..................................................................25
www.labcompliance.com (Replace with your companys name)
USE

FOR INTERNAL

Case Studies
Page 3 of 47
Document Number: E-411 Version 1.xx
April 1, 2012
Part 11 Implementation
5.8 Using a Database for Searching and Sorting Complaint Records........................28
5.8.1 Application and Use...............................................................................................28
5.8.2 System Summary and Business Process.................................................................28
5.8.3 Recommendations and Documentation..................................................................28
5.9 Using an Excel Template as a Calculator..............................................................29
5.9.1 Application and Use...............................................................................................29
5.9.2 System Summary and Business Process.................................................................29
5.9.3 Recommendations and Documentation..................................................................29
5.10

Using Excel for Data Evaluation and E-Signing..............................................32

5.10.1 Application and Use...........................................................................................32
5.10.2 System Summary and Business Process.............................................................32
5.10.3 Recommendations and Documentation..............................................................32

5.11

Using MS Access as a Database for Training Records...................................35

5.11.1 Application and Use...........................................................................................35
5.11.2 System Summary and Business Process.............................................................35
5.11.3 Recommendations and Documentation..............................................................35

5.12

Using a Word Processor for Paper SOPs........................................................36

5.12.1 Application and Use...........................................................................................36
5.12.2 System Summary and Business Process.............................................................36
5.12.3 Recommendations and Documentation..............................................................37

5.13

Using a Word Processor for Electronic SOPs.................................................39

5.13.1 Application and Use...........................................................................................39
5.13.2 System Summary and Business Process.............................................................39
5.13.3 Recommendations and Documentation..............................................................39

5.14

Paper Scanning for Electronic Archiving..........................................................42

5.14.1 Application and Use...........................................................................................42
5.14.2 System Summary and Business Process.............................................................42
5.14.3 Recommendations and Documentation..............................................................42

5.15

Clinical Study Reporting over the Public Internet............................................45

5.15.1 Application and Use...........................................................................................45
5.15.2 System Summary and Business Process.............................................................45
5.15.3 Recommendations and Documentation..............................................................45

www.labcompliance.com (Replace with your companys name)

USE

FOR INTERNAL

Case Studies
Document Number: E-411 Version 1.xx
Part 11 Implementation

Page 4 of 47
April 1, 2012

1. PURPOSE
In March 1997 the FDA issued final Part 11 regulations that provide criteria for
acceptance by the FDA, under certain circumstances, of electronic records,
electronic signatures and handwritten signatures executed to electronic records as
equivalent to paper records and handwritten signatures executed on paper (Ref.
1.1). After Part 11 became effective in August 1997, significant discussions ensued
amongst industry, contractors and the Agency concerning the interpretation and
implementation of the regulations. While initial FDA guidance documents indicated
a very broad scope with significant problems to fully implement Part 11, in 2003 the
FDA released a new guidance promoting a more narrow scope (Ref. 1.2). The FDA
intends to publish a revision of Part 11 in 2007/8 which will be very much in line
with the guidance as published in 2003. Whether a system or record needs to
comply with Part 11 depends on business practices and the risk a system or record
has on product quality and patient safety. Using practical examples, these case
studies should help to implement Part 11 requirements according to the new
interpretation in the most cost-effective way.

2. SCOPE
Computer systems used in FDA and equivalent international regulated
environments.

3. REFERENCES
1111 Code of Federal Regulations, Title 21, Food and Drugs, Part 11 Electronic
Records; Electronic Signatures; Final Rule; Federal Register 62 (54), 1342913466.
1111 FDA Guidance for Industry Part 11, Electronic Records; Electronic Signatures;
Scope and Applications (Final version August 2003).
1111 SOP S-137: Part 11 Scope and Controls.
Available through www.labcompliance.com/solutions/sops.
1111 SOP S-134: Risk Assessment for Systems Used in GxP Environments.
Available through www.labcompliance.com/solutions/sops.

www.labcompliance.com (Replace with your companys name)

USE

FOR INTERNAL

Case Studies
Page 5 of 47
Document Number: E-411 Version 1.xx
April 1, 2012
Part 11 Implementation
1111 SOP S-271: Validation of Commercial Off-the-Shelf (COTS) Computer
Systems.
Available through www.labcompliance.com/solutions/sops.
1111 SOP S-264: Validation of Spreadsheet Applications.
Available through www.labcompliance.com/solutions/sops.
1111 SOP S-270: Validation of Electronic Document Management Systems.
Available through www.labcompliance.com/solutions/sops.
1111 SOP S-252: Risk-Based Validation of Computer Systems.
Available through www.labcompliance.com/solutions/sops.
1111 SOP S-125:Training for GxP, 21 CFR Part 11 and Computer Validation.
Available through www.labcompliance.com/solutions/sops.
11111 SOP S-259: Configuration Management and Version Control of Software.
Available through www.labcompliance.com/solutions/sops.
11111 SOP S-262: Change Control of Software and Computer Systems.
Available through www.labcompliance.com/solutions/sops.
11111 SOP S-105: Document Management and Control.
11111 SOP S-316: Scanning of Paper Records for GxP Compliant Archiving.
Available through www.labcompliance.com/solutions/sops.
11111 SOP S-916: Qualification of Manufacturing Equipment.
Available through www.labcompliance.com/solutions/sops.

4. GLOSSARY
Item

Explanation

GxP

Good x Practices where x can stand for

L=Laboratories, M=Manufacturing, C=Clinical

Electronic
Record

Any combination of text, graphics, data, audio, pictorial or other

information representation in digital form that is created,
modified, maintained, archived, retrieved or distributed by a
computer system.

Electronic

A computer data compilation of any symbol or series of symbols

www.labcompliance.com (Replace with your companys name)

USE

FOR INTERNAL

Case Studies
Document Number: E-411 Version 1.xx
Part 11 Implementation
Signature

executed, adopted or authorized by an individual to be the

legally binding equivalent of the individual's handwritten
signature.

Handwritten
Signature

The scripted name or legal mark of an individual handwritten by

that individual and executed or adopted with the present
intention to authenticate a writing in a permanent form. The act
of signing with a writing or marking instrument such as a pen or
stylus is preserved. The scripted name or legal mark, while
conventionally applied to paper, may also be applied to other
devices that capture the name or mark.

GxP Record

Record required to be maintained by predicate rules or

submitted to the FDA under the predicate rules.

Closed
System

An environment in which system access is controlled by

persons who are responsible for the content of electronic
records that are on the system.

Open System

An environment in which system access is not controlled by

persons who are responsible for the content of electronic
records that are on the system.

Regulated
Activity

Any activity required by a predicate rule.

Original
Record

Electronic records originally captured by the computer system.

This can be a manual data entry or a record captured from an
automated system. When records are converted to a standard
format, e.g., an original Word document to PDF format, these
are no longer original formats.

www.labcompliance.com (Replace with your companys name)

USE

Page 6 of 47
April 1, 2012

FOR INTERNAL

Case Studies
Document Number: E-411 Version 1.xx
Part 11 Implementation

Page 7 of 47
April 1, 2012

5. EXAMPLES
QA/QC Client/Server Based Analysis System
5.1.1

Application and Use

The system is a client/server based chromatographic data system used in a

QC laboratory for analysis of finished product testing. The client PC controls
HPLC equipment, acquires data, integrates peaks and calculates sample
amounts. Results together with original records and integration parameters
are transferred to a server with applications for database searching and
archiving.
5.1.2

System Summary and Business Process

5.1.3

Recommendations and Documentation

System Category

Configurable Off-the-Shelf Computer System

Records required by

yes

no

www.labcompliance.com (Replace with your companys name)

USE

FOR INTERNAL

Case Studies
Document Number: E-411 Version 1.xx
Part 11 Implementation
predicate rule?

Page 8 of 47
April 1, 2012

Explanation:
Laboratory test results are required to be maintained by GMP
21 CFR Part 211.

Impact on product
quality?

high

medium low

Explanation:
Laboratory test results obtained in pharmaceutical QC labs
typically are high risk records because they are used as
criterion for batch release.

Have users access to

the system?

yes

no

Explanation:
Users have access to both the client and server computers.

Can users change

records?

yes

no

Explanation:
Users can interactively change processing parameters and
reprocess, e.g., reintegrate data.

If users can change

records, how is the
change documented?

electronic audit trail others

Explanation:
Relevant software applications on the client and server PC have
built-in electronic audit trail.

Is validation required,
and if yes, what are
the key deliverables?

yes

no

Explanation:
System is validated following the SOPs in Ref. 1.5: Validation
of Commercial Off-the-Shelf (COTS) Computer Systems and in
Ref. 1.8: Risk-Based Validation of Computer Systems.
Key deliverables are:

Validation plan.
Requirement specifications.
Vendor assessment.
Installation qualification.
Operational qualification with testing of key parameters that
can be influenced by the users environment.
Performance qualification.
Validation summary report.
How is authenticity
ensured?

computer recording handwritten signatures

e-signatures digital signatures
Explanation:
The computer identifies and records people through user ID.

www.labcompliance.com (Replace with your companys name)

USE

FOR INTERNAL

Case Studies
Document Number: E-411 Version 1.xx
Part 11 Implementation

Page 9 of 47
April 1, 2012

Users sign paper records.

How is confidentiality
ensured?

controlled access to data encryption

Explanation:
Controlled limited access to system and data to authorized
individuals through adequate policies and system functionality.
Users can enter the system and applications only after entering
a password and user ID.

How are records

archived?

paper PDF/TIF

original electronic records

Explanation:
Records that require a signature are printed and signed. Copies
of original records, meta data and processed records are
maintained in original electronic form and are available for
inspections for as long as the data in the laboratory are
available for reprocessing. This includes records of electronic
audit trails.
Justification:

The records provide a high value and are available to the

department for further evaluation or reevaluation and paper
printouts.

Copying a process to other formats does not fully preserve

the original content.

Comment: Retention of electronic records after the results have

been approved would not be necessary if users would not have
the possibility to reevaluate and print data and if all content and
meaning of the electronic records to demonstrate compliance
with regulations could be printed.
Other Controls
Authority checks

The system checks if users are authorized to perform allowed

tasks.

People qualification

Persons who develop, maintain or use electronic systems have

the education, training and experience to perform their
assigned tasks. This is ensured through the SOP in Ref. 1.9:
Training for GxP, 21 CFR Part 11 and Computer Validation.

Requirements for
electronic signatures
System
documentation

Not Applicable

Configuration
management and
change control

Initial configuration and changes are managed through the

SOPs in Ref. 1.10: Configuration Management and Version
Control of Software and Ref. 1.11: Change Control of
Software and Computer Systems.

Appropriate control over system documentation is ensured

through following SOP S-105: Document Management and
Control.

www.labcompliance.com (Replace with your companys name)

USE

FOR INTERNAL

Case Studies
Document Number: E-411 Version 1.xx
Part 11 Implementation

Page 10 of 47
April 1, 2012

HPLC System for Stability Testing

5.2.1

Application and Use

The PC controls HPLC equipment, acquires data, integrates peaks and

calculates sample amounts. Chromatograms and results are printed and
signed. Results together with original records and integration parameters are
archived on DVDs.
5.2.2

System Summary and Business Process

5.2.3

Recommendations and Documentation

System Category

Configurable Off-the-Shelf Computer System

Records required by
predicate rule?

yes

no

Explanation:
Stability test results are required to be maintained by GMP 21
CFR Part 211.

www.labcompliance.com (Replace with your companys name)

USE

FOR INTERNAL

Case Studies
Document Number: E-411 Version 1.xx
Part 11 Implementation
Impact on product
quality?

high

Page 11 of 47
April 1, 2012

medium low

Explanation:
Stability test results obtained in pharmaceutical QC labs
typically are high risk records because if they are wrong,
products with not well defined impurities may go out to the
market.

Have users access to

the system?

yes

no

Explanation:
Users have access to the PC, to chromatography software, to
processing parameters and results.

Can users change

records?

yes

no

Explanation:
Users can interactively change processing parameters and
reprocess, e.g., reintegrate data.

If users can change

records, how is the
change documented?

electronic audit trail others

Explanation:
Relevant software applications on the chromatography software
have built-in electronic audit trail.

Is validation required,
and if yes, what are
the key deliverables?

yes

no

Explanation:
System is validated following the SOPs in Ref. 1.5: Validation
of Commercial Off-the-Shelf (COTS) Computer Systems and in
Ref. 1.8: Risk-Based Validation of Computer Systems.
Key deliverables are:

Validation plan.
Requirement specifications.
Vendor assessment.
Installation qualification.
Operational qualification with testing of key parameters that
can be influenced by the users environment.
Performance qualification.
Validation summary report.
How is authenticity
ensured?

computer recording handwritten signatures

e-signatures digital signatures
Explanation:
The computer identifies and records people through user ID.
Users sign paper records.

www.labcompliance.com (Replace with your companys name)

USE

FOR INTERNAL

Case Studies
Document Number: E-411 Version 1.xx
Part 11 Implementation
How is confidentiality
ensured?

Page 12 of 47
April 1, 2012

controlled access to data encryption

Explanation:
Controlled limited access to system and data to authorized
individuals through adequate policies and system functionality.
Users can enter the system and applications only after entering
a password and user ID.

How are records

archived?

paper PDF/TIF

original electronic records

Explanation:
Records that require a signature are printed and signed. Copies
of original records, meta data and processed records are
maintained in original electronic form and are available for
inspections for as long as the data in the laboratory are
available for reprocessing. This includes records of electronic
audit trails.
Justification:

The records provide a high value and are available to the

department for further evaluation or reevaluation and paper
printouts.

Copying a process to other formats does not fully preserve

the original content.

Comment: Retention of electronic records after the results have

been approved would not be necessary if users would not have
the possibility to reevaluate and print data and if all content and
meaning of the electronic records to demonstrate compliance
with regulations could be printed.
Other Controls
Authority checks

The system checks if users are authorized to perform allowed

tasks.

People qualification

Persons who develop, maintain or use electronic systems have

the education, training and experience to perform their
assigned tasks. This is ensured through the SOP in Ref. 1.9:
Training for GxP, 21 CFR Part 11 and Computer Validation.

Requirements for
electronic signatures
System
documentation

Not Applicable

Configuration
management and
change control

Initial configuration and changes are managed through the

SOPs in Ref. 1.10: Configuration Management and Version
Control of Software and Ref. 1.11: Change Control of
Software and Computer Systems.

Appropriate control over system documentation is ensured

through following SOP S-105: Document Management and
Control.

www.labcompliance.com (Replace with your companys name)

USE

FOR INTERNAL

Case Studies
Document Number: E-411 Version 1.xx
Part 11 Implementation

Page 13 of 47
April 1, 2012

Recording Oven Temperature for Stability Testing

5.3.1

Application and Use

A PC records temperatures from an oven that is used for stability studies. PC

software compares actual temperature with setpoints and triggers an alarm if
temperatures reach limits.
5.3.2

System Summary and Business Process

5.3.3

Recommendations and Documentation

System Category

Configurable Off-the-Shelf Computer System

Records required by
predicate rule?

yes

no

Explanation:
Parameters and actual values for stability testing are required

www.labcompliance.com (Replace with your companys name)

USE

FOR INTERNAL

Case Studies
Document Number: E-411 Version 1.xx
Part 11 Implementation

Page 14 of 47
April 1, 2012

by Part 211.
Impact on product
quality?

high

medium low

Explanation:
Wrong oven temperature can impact product quality.

Have users access to

the system?

yes

no

Explanation:
Users have access to the electronic records.

Can users change

records?

yes

no

Explanation:
Read only data.

If users can change

records, how is the
change documented?

electronic audit trail others

Is validation required,
and if yes, what are
the key deliverables?

yes

Not applicable as users cannot change data.

no

Explanation:
System is validated following the SOPs in Ref. 1.5: Validation
of Commercial Off-the-Shelf (COTS) Computer Systems and in
Ref. 1.8: Risk-Based Validation of Computer Systems.
Key deliverables are:

Validation plan.
Requirement specifications.
Vendor assessment.
Installation qualification.
Operational qualification with testing of key parameters that
can be influenced by the users environment.
Performance qualification.
Validation summary report.
How is authenticity
ensured?

computer recording handwritten signatures

e-signatures digital signatures
Explanation:
The computer identifies and records people through user ID.
Users sign electronic records.

How is confidentiality
ensured?

controlled access to data encryption

Explanation:
Controlled limited access to system and data to authorized
individuals through adequate policies and system functionality.
Users can enter the system and applications only after entering

www.labcompliance.com (Replace with your companys name)

USE

FOR INTERNAL

Case Studies
Document Number: E-411 Version 1.xx
Part 11 Implementation

Page 15 of 47
April 1, 2012

a password and user ID.

How are records
archived?

paper PDF/TIF

original electronic records

Explanation:
Original records, meta data and processed records are
maintained in original electronic form and are available for
inspections for as long as the data in the laboratory are
available for reprocessing. This includes records of electronic
audit trails.
Justification:

The records provide a high value and are available to the

department for further evaluation or reevaluation and paper
printouts.

Copying a process to other formats does not fully preserve

the original content.

Other Controls
Authority checks

The system checks if users are authorized to perform allowed

tasks.

People qualification

Persons who develop, maintain or use electronic systems have

the education, training and experience to perform their
assigned tasks. This is ensured through the SOP in Ref. 1.9:
Training for GxP, 21 CFR Part 11 and Computer Validation.

Requirements for
electronic signatures
System
documentation

Part 11 requirements for electronic signatures are met.

Configuration
management and
change control

Initial configuration and changes are managed through the

SOPs in Ref. 1.10: Configuration Management and Version
Control of Software and Ref. 1.11: Change Control of
Software and Computer Systems.

Appropriate control over system documentation is ensured

through following SOP S-105: Document Management and
Control.

www.labcompliance.com (Replace with your companys name)

USE

FOR INTERNAL

Case Studies
Document Number: E-411 Version 1.xx
Part 11 Implementation

Page 16 of 47
April 1, 2012

System for Laboratory Equipment Qualification

5.4.1

Application and Use

The system is a computerized HPLC system used for automated HPLC

equipment qualification.
5.4.2

System Summary and Business Process

5.4.3

Recommendations and Documentation

System Category

Configurable Off-the-Shelf Computer System

Records required by
predicate rule?

yes

no

Explanation:
Laboratory equipment calibration and qualification records
required to be maintained by GMP 21 CFR Part 211.

Impact on product
quality?

high

medium low

www.labcompliance.com (Replace with your companys name)

USE

FOR INTERNAL

Case Studies
Document Number: E-411 Version 1.xx
Part 11 Implementation

Page 17 of 47
April 1, 2012

Explanation:
Relative product tests results qualification records are medium
risk.
Have users access to
the system?

yes

no

Explanation:
Users have access to the PC, application software and
processing parameters.

Can users change

records?

yes

no

Explanation:
Users can interactively change processing parameters and
reprocess, e.g., reintegrate data.

If users can change

records, how is the
change documented?

electronic audit trail others

Explanation:
Considering the risk level, electronic audit trail is not required.

Is validation required,
and if yes, what are
the key deliverables?

yes

no

Explanation:
System is validated following the SOPs in Ref. 1.5: Validation of
Commercial Off-the-Shelf (COTS) Computer Systems and in
Ref. 1.8: Risk-Based Validation of Computer Systems.
Key deliverables are:
Statement from the vendor that the software has been
validated during development.
Installation qualification.

How is authenticity
ensured?

computer recording handwritten signatures

e-signatures digital signatures
Explanation:
The computer identifies and records people through user ID.
Users sign paper records.

How is confidentiality
ensured?

controlled access to data encryption

Explanation:
Controlled limited access to system and data to authorized
individuals through adequate policies and system functionality.
Users can enter the system and applications only after entering
a password and user ID.

How are records

archived?

paper PDF/TIF

original electronic records

Explanation:

www.labcompliance.com (Replace with your companys name)

USE

FOR INTERNAL

Case Studies
Document Number: E-411 Version 1.xx
Part 11 Implementation

Page 18 of 47
April 1, 2012

Records are printed and signed and archived as paper.

Other Controls
Authority checks

The system checks if users are authorized to perform allowed

tasks.

People qualification

Persons who develop, maintain or use electronic systems have

the education, training and experience to perform their
assigned tasks. This is ensured through the SOP in Ref. 1.9:
Training for GxP, 21 CFR Part 11 and Computer Validation.

Requirements for
electronic signatures
System
documentation

Not Applicable

Configuration
management and
change control

Initial configuration and changes are managed through the

SOPs in Ref. 1.10: Configuration Management and Version
Control of Software and Ref. 1.11: Change Control of
Software and Computer Systems.

Appropriate control over system documentation is ensured

through following SOP S-105: Document Management and
Control.

www.labcompliance.com (Replace with your companys name)

USE

FOR INTERNAL

Case Studies
Document Number: E-411 Version 1.xx
Part 11 Implementation

Page 19 of 47
April 1, 2012

Batch Recording and Printing - No Storage of E-Records

5.5.1

Application and Use

A PLC controller is used to control, record and print process parameters and
actual conditions such as temperature and pressure of manufacturing
equipment. Batch records are printed on-line and signed on paper.
5.5.2

System Summary and Business Process

5.5.3

Recommendations and Documentation

System Category

Equipment Hardware with Local Controller and Recording

Records required by
predicate rule?

yes

no

Explanation:
Batch records are required to be maintained by GMP 21 CFR
Part 211.

Impact on product
quality?

high

medium low

Explanation:

www.labcompliance.com (Replace with your companys name)

USE

FOR INTERNAL

Case Studies
Document Number: E-411 Version 1.xx
Part 11 Implementation

Page 20 of 47
April 1, 2012

Batch parameters typically are high risk records because they

are used as criterion for batch release.
Have users access to
the system?

yes

no

Explanation:
Users have access to the system through the PLC controller.

Can users change

records?

yes

no

Explanation:
Users cannot change records.

If users can change

records, how is the
change documented?

electronic audit trail others

Is validation required,
and if yes, what are
the key deliverables?

yes

Not Applicable
no

Explanation:
Equipment hardware and the PLC controller should be qualified.
Key deliverables are:

How is authenticity
ensured?

Qualification plan.
Requirement specifications.
Vendor assessment.
Installation qualification.
Operational qualification.
Performance qualification.
Validation summary report.

computer recording handwritten signatures

e-signatures digital signatures
Explanation:
Users sign batch records. With the signature they also ensure
that they are the owners of the record.

How is confidentiality
ensured?

controlled access to data encryption

Explanation:
Access to paper printouts is controlled.

How are records

archived?

paper PDF/TIF

original electronic records

Explanation:
There are no electronic records.

Other Controls
Authority checks

Not Applicable

People qualification

Persons who use the equipment have the education, training

www.labcompliance.com (Replace with your companys name)

USE

FOR INTERNAL

Case Studies
Document Number: E-411 Version 1.xx
Part 11 Implementation

Page 21 of 47
April 1, 2012

and experience to perform their assigned tasks.

Requirements for
electronic signatures
System
documentation

Not Applicable

Configuration
management and
change control

Initial configuration and changes are managed through the

SOPs in Ref. 1.10: Configuration Management and Version
Control of Software and Ref. 1.11: Change Control of
Software and Computer Systems.

Appropriate control over system documentation is ensured

through following SOP S-105: Document Management and
Control.

www.labcompliance.com (Replace with your companys name)

USE

FOR INTERNAL

Case Studies
Document Number: E-411 Version 1.xx
Part 11 Implementation

Page 22 of 47
April 1, 2012

Oven with Card Reader

5.6.1

Application and Use

An oven is programmed through a local keyboard. Parameters and actual

conditions are stored on a card reader. The reader is transferred to a PC that
reads and prints stored information. The paper printouts are signed. The
electronic records are stored in a database for later searching, sorting etc.
5.6.2

System Summary and Business Process

5.6.3

Recommendations and Documentation

System Category

Configurable Off-the-Shelf Computer System

Records required by
predicate rule?

yes

no

Explanation:
Processing conditions are required to be maintained by GMP 21
CFR Part 211.

www.labcompliance.com (Replace with your companys name)

USE

FOR INTERNAL

Case Studies
Document Number: E-411 Version 1.xx
Part 11 Implementation
Impact on product
quality?

high

Page 23 of 47
April 1, 2012

medium low

Explanation:
Wrong oven temperature can have an impact on product quality.

Have users access to

the system?

yes

no

Explanation:
Users have access to oven temperature on PC.

Can users change

records?

yes

no

Explanation:
Users can interactively change temperature records on PC.

If users can change

records, how is the
change documented?

electronic audit trail others

Explanation:
Temperature changes are captured through electronic audit trail
on PC.

Is validation required,
and if yes, what are
the key deliverables?

yes

no

Explanation:
System is validated following the SOPs in Ref. 1.5: Validation
of Commercial Off-the-Shelf (COTS) Computer Systems and in
Ref. 1.8: Risk-Based Validation of Computer Systems.
Key deliverables are:

Validation plan.
Requirement specifications.
Vendor assessment.
Installation qualification.
Operational qualification with testing of key parameters that
can be influenced by the users environment.
Performance qualification.
Validation summary report.
How is authenticity
ensured?

computer recording handwritten signatures

e-signatures digital signatures
Explanation:
The computer identifies and records people through user ID.
Users sign paper records.

How is confidentiality
ensured?

controlled access to data encryption

Explanation:
Controlled limited access to system and data to authorized
individuals through adequate policies and system functionality.

www.labcompliance.com (Replace with your companys name)

USE

FOR INTERNAL

Case Studies
Document Number: E-411 Version 1.xx
Part 11 Implementation

Page 24 of 47
April 1, 2012

Users can enter the system and applications only after entering
a password and user ID.
How are records
archived?

paper PDF/TIF

original electronic records

Explanation:
Records are printed, signed and archived on paper.
Justification:

Temperature settings are copied to paper printing content

and meaning.

WARNING: There must be a way to capture the audit trail on

paper, or it must be recorded in electronic form!
Recommendation: Change software such that temperature
cannot be changed.
Other Controls
Authority checks

The system checks if users are authorized to perform allowed

tasks.

People qualification

Persons who develop, maintain or use electronic systems have

the education, training and experience to perform their
assigned tasks. This is ensured through the SOP in Ref. 1.9:
Training for GxP, 21 CFR Part 11 and Computer Validation.

Requirements for
electronic signatures
System
documentation

Not Applicable

Configuration
management and
change control

Initial configuration and changes are managed through the

SOPs in Ref. 1.10: Configuration Management and Version
Control of Software and Ref. 1.11: Change Control of
Software and Computer Systems.

Appropriate control over system documentation is ensured

through following SOP S-105: Document Management and
Control.

www.labcompliance.com (Replace with your companys name)

USE

FOR INTERNAL

Case Studies
Document Number: E-411 Version 1.xx
Part 11 Implementation

Page 25 of 47
April 1, 2012

Washer with Handheld Controller

5.7.1

Application and Use

A washer is controlled by a handheld controller. The method is programmed

on an external computer and operators load a memory chip with the preprogrammed wash cycle into the controller. Operators press start. The cycle
begins and the controller records and prints a cleaning log.
5.7.2

System Summary and Business Process

5.7.3

Recommendations and Documentation

System Category

Equipment with Local Controller

Records required by
predicate rule?

yes

no

Explanation:
Cleaning records are required to be maintained by GMP 21
CFR Part 211.

Impact on product

high

medium low

www.labcompliance.com (Replace with your companys name)

USE

FOR INTERNAL

Case Studies
Document Number: E-411 Version 1.xx
Part 11 Implementation
quality?

Page 26 of 47
April 1, 2012

Explanation:
Insufficient cleaning of glassware can have an impact on
product quality.

Have users access to

the system?

yes

no

Explanation:
Users have access to the system.

Can users change

records?

yes

no

Explanation:
Software does not allow changing cleaning records.

If users can change

records, how is the
change documented?

electronic audit trail others

Is validation required,
and if yes, what are
the key deliverables?

yes

Not Applicable
no

Explanation:
Washer with handheld controller is qualified.
Key deliverables are:

Qualification plan.
Requirement specifications.
Installation qualification.
Operational qualification with testing of key parameters that
can be influenced by the users environment.
Performance qualification.
Qualification summary report.
How is authenticity
ensured?

computer recording handwritten signatures

e-signatures digital signatures
Explanation:
Users sign cleaning records. With the signature they also
ensure that they are the owners of the record.

How is confidentiality
ensured?

controlled access to data encryption

Explanation:
Controlled limited access to system and data to authorized
individuals through adequate policies and procedures.

How are records

archived?

paper PDF/TIF

original electronic records

Explanation:
Records on paper provide content and meaning.

Other Controls

www.labcompliance.com (Replace with your companys name)

USE

FOR INTERNAL

Case Studies
Document Number: E-411 Version 1.xx
Part 11 Implementation
Authority checks

Not Applicable

People qualification

Persons who operate the equipment have the education,

training and experience to perform their assigned tasks. This is
ensured through the SOP in Ref. 1.9: Training for GxP, 21
CFR Part 11 and Computer Validation.

Requirements for
electronic signatures
System
documentation

Not Applicable

Configuration
management and
change control

Initial configuration and changes are managed through the

SOPs in Ref. 1.10: Configuration Management and Version
Control of Software and Ref. 1.11: Change Control of
Software and Computer Systems.

Appropriate control over system documentation is ensured

through following SOP S-105: Document Management and
Control.

www.labcompliance.com (Replace with your companys name)

USE

Page 27 of 47
April 1, 2012

FOR INTERNAL

Case Studies
Document Number: E-411 Version 1.xx
Part 11 Implementation

Page 28 of 47
April 1, 2012

Using a Database for Searching and Sorting Complaint Records

5.8.1

Application and Use

The database is used to search and sort complaint records of a medical

device company. Data are entered manually from original paper records, e.g.,
customer letters.
5.8.2

System Summary and Business Process

5.8.3

Recommendations and Documentation

System Category

Configurable Off-the-Shelf Software

Records required by
predicate rule?

yes

no

Explanation:
Original records (raw data) are available and maintained on
paper. Complaint records are required by 21 CFR Part 820, but
if these records are readily available there is no need for
additional records.

www.labcompliance.com (Replace with your companys name)

USE

FOR INTERNAL

Case Studies
Document Number: E-411 Version 1.xx
Part 11 Implementation
Further actions

Page 29 of 47
April 1, 2012

Because electronic records are not required by predicate rules,

we can stop any further activities.

Using an Excel Template as a Calculator

5.9.1

Application and Use

An Excel spreadsheet is used as a sophisticated calculator. Data are entered

into the spreadsheet from a paper lab notebook. . Excel calculates final results
that are printed, signed and archived
5.9.2

System Summary and Business Process

5.9.3

Recommendations and Documentation

System Category

Configurable Off-the-Shelf Software

Records required by
predicate rule?

yes

no

www.labcompliance.com (Replace with your companys name)

USE

FOR INTERNAL

Case Studies
Document Number: E-411 Version 1.xx
Part 11 Implementation

Page 30 of 47
April 1, 2012

Explanation:
Laboratory records are required to be maintained by GMP 21
CFR Part 211. This includes original records (raw data,
calculations and calculated results).
Impact on product
quality?

high

medium low

Explanation:
Laboratory records typically are high risk records because they
can impact product quality.

Have users access to

the system?

yes

no

Explanation:
Users have access to the system.

Can users change

records?

yes

no

Explanation:
Users can change input data but not spreadsheets or calculated
results.

If users can change

records, how is the
change documented?

electronic audit trail others

Explanation:
Original records (raw data) are available and maintained on
paper. In case of any doubt on data integrity, users can always
go back to the original data on paper. Users cannot change
calculations or calculated results.
Spreadsheets are loaded from a write protected server. The
source location of the spreadsheet is printed together with the
results. This ensures that only the non-modified original
spreadsheet is used for the calculations.

Is validation required,
and if yes, what are
the key deliverables?

yes

no

Explanation:
We dont validate Excel. The spreadsheet application is
validated following the SOP in Ref. 1.6: Validation of
Spreadsheet Applications.
Key deliverables are:

Validation plan.
Requirement specifications.
Installation qualification.
Operational qualification with testing of security access and
correct inputs/outputs.
Performance qualification which includes regular MD5 hash
calculation to demonstrate that the spreadsheet file is
original.

www.labcompliance.com (Replace with your companys name)

USE

FOR INTERNAL

Case Studies
Document Number: E-411 Version 1.xx
Part 11 Implementation

Page 31 of 47
April 1, 2012

Validation summary report.

How is authenticity
ensured?

computer recording handwritten signatures

e-signatures digital signatures
Explanation:
The computer identifies and records people through user ID.
The user name as identified by the system is printed together
with the results.
Users sign paper records.

How is confidentiality
ensured?

controlled access to data encryption

Explanation:
Users ensure confidentiality of data on paper.

How are records

archived?

paper PDF/TIF

original electronic records

Explanation:
Original records and calculated results are archived on paper.
Spreadsheets can be stored preferably together with
corresponding MD5 hash values as electronic records.
Alternatively, all calculations should be printed and archived on
paper.

Other Controls
Authority checks

The system checks if users are authorized to perform allowed

tasks.

People qualification

Persons who develop, maintain or use electronic systems have

the education, training and experience to perform their
assigned tasks. This is ensured through the SOP in Ref. 1.9:
Training for GxP, 21 CFR Part 11 and Computer Validation.

Requirements for
electronic signatures
System
documentation

Not Applicable

Configuration
management and
change control

Initial configuration and changes are managed through the

SOPs in Ref. 1.10: Configuration Management and Version
Control of Software and Ref. 1.11: Change Control of
Software and Computer Systems.

Appropriate control over system documentation is ensured

through following SOP S-105: Document Management and
Control.

www.labcompliance.com (Replace with your companys name)

USE

FOR INTERNAL

Case Studies
Document Number: E-411 Version 1.xx
Part 11 Implementation

Page 32 of 47
April 1, 2012

Using Excel for Data Evaluation and E-Signing

5.10.1

Application and Use

An Excel spreadsheet is used to evaluate data acquired from automated

equipment using VBA scripts. The results are reviewed and electronically
signed by the analyst and QA. Before signing users have access to the data
and can change them.
5.10.2

System Summary and Business Process

5.10.3

Recommendations and Documentation

System Category

Configurable Off-the-Shelf Computer System

Records required by
predicate rule?

yes

no

Explanation:
Corresponding records are required to be maintained by GMP
21 CFR Part 211.

www.labcompliance.com (Replace with your companys name)

USE

FOR INTERNAL

Case Studies
Document Number: E-411 Version 1.xx
Part 11 Implementation
Impact on product
quality?

high

Page 33 of 47
April 1, 2012

medium low

Explanation:
Corresponding records are high risk records because they are
used as criterion for batch release.

Have users access to

the system?

yes

no

Explanation:
Users have access to the system, to original raw data and final
results.

Can users change

records?

yes

no

Explanation:
Users can interactively change original records.
Spreadsheets are loaded from a write protected server. The
source location of the spreadsheet is printed together with the
results. This ensures that only the non-modified original
spreadsheet is used for the calculations.

If users can change

records, how is the
change documented?

electronic audit trail others

Explanation:
We need Part 11 compliant electronic audit trail. This function is
not available through standard Excel but has to be added
through special add-on software.

Is validation required,
and if yes, what are
the key deliverables?

yes

no

Explanation:
The spreadsheet and the add-on software are validated
following the SOP in Ref. 1.6: Validation of Spreadsheet
Applications.
Key deliverables are:

Validation plan.
Requirement specifications.
Installation qualification.
Operational qualification with testing of security access and
correct inputs/outputs. All functions that have been
programmed with VBA are tested. We also test proper
functioning of the add-on modules with e-audit trail and esignatures.
Performance qualification. Includes regular MD5 hash
calculation to demonstrate that the spreadsheet file is
original.
Validation summary report.
How is authenticity

computer recording

handwritten signatures

www.labcompliance.com (Replace with your companys name)

USE

FOR INTERNAL

Case Studies
Document Number: E-411 Version 1.xx
Part 11 Implementation
ensured?

e-signatures

Page 34 of 47
April 1, 2012
digital signatures

Explanation:
The computer identifies and records people through user ID.
Users sign electronic records.
How is confidentiality
ensured?

controlled access to data encryption

Explanation:
Controlled limited access to system and data to authorized
individuals through adequate policies and system functionality.
Users can enter the system and applications only after entering
a password and user ID.

How are records

archived?

paper PDF/TIF

original electronic records

Explanation:
We electronically store:

Original records as captured from the automated instrument.

The spreadsheet with all calculations.
Calculated results.
Other Controls
Authority checks

The system checks if users are authorized to perform allowed

tasks.

People qualification

Persons who develop, maintain or use electronic systems have

the education, training and experience to perform their
assigned tasks. This is ensured through the SOP in Ref. 1.9:
Training for GxP, 21 CFR Part 11 and Computer Validation.

Requirements for
electronic signatures
System
documentation

Electronic signatures comply with Part 11 requirements

Configuration
management and
change control

Initial configuration and changes are managed through the

SOPs in Ref. 1.10: Configuration Management and Version
Control of Software and Ref. 1.11: Change Control of
Software and Computer Systems.

Appropriate control over system documentation is ensured

through following SOP S-105: Document Management and
Control.

www.labcompliance.com (Replace with your companys name)

USE

FOR INTERNAL

Case Studies
Document Number: E-411 Version 1.xx
Part 11 Implementation

Page 35 of 47
April 1, 2012

Using MS Access as a Database for Training Records

5.11.1

Application and Use

Original training records are entered from paper into a MS Database for easier
searching.
5.11.2

System Summary and Business Process

5.11.3

Recommendations and Documentation

System Category

Configurable Off-the-Shelf Software

Records required by
predicate rule?

yes

no

Explanation:
Original training records (raw data) are available and
maintained on paper. Training records are required by 21 CFR
Parts 820 and 58 and are also required by Part 211 to
demonstrate compliance with the requirement to train people,

www.labcompliance.com (Replace with your companys name)

USE

FOR INTERNAL

Case Studies
Document Number: E-411 Version 1.xx
Part 11 Implementation

Page 36 of 47
April 1, 2012

but if these records are readily available on paper there is no

need for additional records in electronic form.
Further actions

Because electronic records are not required by predicate rules,

we can stop any further activities.

Using a Word Processor for Paper SOPs

5.12.1

Application and Use

MS Word is used to draft Standard Operating Procedures. Once the SOPs are
approved the final version is printed and distributed as a printed controlled
copy. The electronic version is maintained for future updates but not used by
users of the SOP.
5.12.2

System Summary and Business Process

5.12.3

Recommendations and Documentation

www.labcompliance.com (Replace with your companys name)

USE

FOR INTERNAL

Case Studies
Document Number: E-411 Version 1.xx
Part 11 Implementation
System Category

Configurable Off-the-Shelf Software

Records required by
predicate rule?

yes

Page 37 of 47
April 1, 2012

no

Explanation:
All FDA and equivalent international regulations require written
procedures for routine tasks.

Impact on product
quality?

high

medium low

Explanation:
Depending on the nature and use of the SOPs, they can have a
high, medium and low impact on product quality. For the
purpose of this exercise they are classified as a medium impact.

Have users access to

the system?

yes

no

Explanation:
Users of SOPs dont have access to the electronic version of
the SOP.

Can users change

records?

yes

no

If users can change

records, how is the
change documented?

electronic audit trail others

Explanation:
Users cannot change electronic SOPs, but authors will use the
original electronic version for updates. Before reusing the
electronic SOP the integrity should be demonstrated. This is
achieved through calculating, storing, recalculating and
comparing MD5 hash values.

Is validation required,
and if yes, what are
the key deliverables?

yes

no

Explanation:
Word processors are widely used for commercial software.
There is no need to verify standard functions. All we do is
document the vendor, product and version number. Or in other
words, we only perform IQ.
Key deliverables are:
IQ.

How is authenticity
ensured?

computer recording handwritten signatures

e-signatures digital signatures
Explanation:
The computer identifies and records people through user ID.
Users sign paper records.

How is confidentiality
ensured?

controlled access to data encryption

www.labcompliance.com (Replace with your companys name)

USE

FOR INTERNAL

Case Studies
Document Number: E-411 Version 1.xx
Part 11 Implementation

Page 38 of 47
April 1, 2012

Explanation:
Controlled limited access to the electronic version to authorized
authors through adequate policies and system functionality.
Authors can access records only after entering a password and
user ID.
How are records
archived?

paper PDF/TIF

original electronic records

Explanation:
SOPs used by users are signed and archived on paper.
Source records are archived as electronic records.

Other Controls
Authority checks

The system checks if authors are authorized to perform

allowed tasks.

People qualification

Persons who develop, maintain or use electronic systems have

the education, training and experience to perform their
assigned tasks. This is ensured through the SOP in Ref. 1.9:
Training for GxP, 21 CFR Part 11 and Computer Validation.

Requirements for
electronic signatures
System
documentation

Not Applicable

Configuration
management and
change control

Initial configuration and changes are managed through the

SOPs in Ref. 1.10: Configuration Management and Version
Control of Software and Ref. 1.11: Change Control of
Software and Computer Systems.

Appropriate control over system documentation is ensured

through following SOP S-105: Document Management and
Control.

www.labcompliance.com (Replace with your companys name)

USE

FOR INTERNAL

Case Studies
Document Number: E-411 Version 1.xx
Part 11 Implementation

Page 39 of 47
April 1, 2012

Using a Word Processor for Electronic SOPs

5.13.1

Application and Use

MS Word embedded in an electronic document management system (DMS) is

used to draft Standard Operating Procedures. SOPs are electronically
approved and electronically signed. A PDF is published on the company
Intranet. The original Word file is maintained for future updates but not used
by users of the SOP.
5.13.2

System Summary and Business Process

5.13.3

Recommendations and Documentation

System Category

Configurable Off-the-Shelf Software

Records required by
predicate rule?

yes

no

Explanation:
All FDA and equivalent international regulations require written

www.labcompliance.com (Replace with your companys name)

USE

FOR INTERNAL

Case Studies
Document Number: E-411 Version 1.xx
Part 11 Implementation

Page 40 of 47
April 1, 2012

procedures for routine tasks.

Impact on product
quality?

high

medium low

Explanation:
Depending on the nature and use of the SOPs, they can have a
high, medium and low impact on product quality. For the
purpose of this exercise they are classified as a medium impact.

Have users access to

the system?

yes

no

Explanation:
Users have access to the electronic PDF file of the SOP.
Authors have access to the electronic source document.

Can users change

records?

yes

no

Explanation:
PDF files are created as non-editable files. Therefore users of
SOPs cannot change the SOPs.
Authorized authors can change the original source file.

If users can change

records, how is the
change documented?

electronic audit trail others

Explanation:
Users of SOPs cannot change SOPs.
Authors can change. Authoring and updates are done within a
document management system with electronic audit trail
functionality.

Is validation required,
and if yes, what are
the key deliverables?

yes

no

Explanation:
Word processors are widely used for commercial software.
There is no need to verify standard functions. What we do is
document the vendor, product and version number. Or in other
words, we only perform IQ. In addition, we verify limited access
and audit trail functionality.
Key deliverables are:
IQ.
OQ (limited access, e-audit trail).

How is authenticity
ensured?

computer recording handwritten signatures

e-signatures digital signatures
Explanation:
The computer identifies and records people through user ID.
Author and reviewer sign electronic records.

How is confidentiality

controlled access to data encryption

www.labcompliance.com (Replace with your companys name)

USE

FOR INTERNAL

Case Studies
Document Number: E-411 Version 1.xx
Part 11 Implementation

Page 41 of 47
April 1, 2012

ensured?
Explanation:
Controlled limited access to system and data to authorized
individuals through adequate policies and system functionality.
Users, authors and reviewers can enter the system and
applications only after entering a password and user ID.
How are records used
and archived?

paper PDF/TIF

original electronic records

Explanation:
Source documents are maintained as electronic records.
PDF files are used as electronic files.
Please note: If users cannot use electronic files for day-by-day
use, they must be printed, manually signed and distributed on
paper.

Other Controls
Authority checks

The system checks if users are authorized to perform allowed

tasks.

People qualification

Persons who develop, maintain or use electronic systems have

the education, training and experience to perform their
assigned tasks. This is ensured through the SOP in Ref. 1.9:
Training for GxP, 21 CFR Part 11 and Computer Validation.

Requirements for
electronic signatures
System
documentation

Electronic signatures comply with Part 11.

Configuration
management and
change control

Initial configuration and changes are managed through the

SOPs in Ref. 1.10: Configuration Management and Version
Control of Software and Ref. 1.11: Change Control of
Software and Computer Systems.

Appropriate control over system documentation is ensured

through following SOP S-105: Document Management and
Control.

www.labcompliance.com (Replace with your companys name)

USE

FOR INTERNAL

Case Studies
Document Number: E-411 Version 1.xx
Part 11 Implementation

Page 42 of 47
April 1, 2012

Paper Scanning for Electronic Archiving

5.14.1

Application and Use

A scanner with appropriate software is used to convert paper records to

electronic records for easier searching and archiving. Scans are converted to
PDF files.
5.14.2

System Summary and Business Process

5.14.3

Recommendations and Documentation

System Category

Configurable Off-the-Shelf System

Records required by
predicate rule?

yes

no

Explanation:
We assume that records are required by one or more predicate
rules.

Impact on product
quality?

high

medium low

Explanation:

www.labcompliance.com (Replace with your companys name)

USE

FOR INTERNAL

Case Studies
Document Number: E-411 Version 1.xx
Part 11 Implementation

Page 43 of 47
April 1, 2012

We assume that records have a high impact on product quality.

Have users access to
the system?

yes

no

Explanation:
Users have access to the scans and PDF files.

Can users change

records?

yes

no

Explanation:
Users cannot change PDF files. They are stored as noneditable files.

If users can change

records, how is the
change documented?

electronic audit trail others

Explanation:
Users cannot change electronic files.

Is validation required,
and if yes, what are
the key deliverables?

yes

no

Explanation:
The scanning process should be validated. This should ensure
that the scanned copies provide the content and meaning of the
original paper record.
The entire scanning and archiving process is validated following
the SOPs in Ref. 1.13: Scanning of Paper Records for GxP
Compliant Archiving.
Key deliverables are:
Description on how the scanning system is used.
Requirement specifications for scanning.
Documentation stating which scanner and which software
and version have been used.
Summary report.

How is authenticity
ensured?

computer recording handwritten signatures

e-signatures digital signatures
Explanation:
Original paper records are signed if necessary.
Signatures are carried into the electronic PDF file. This is
allowed as long as signatures are for internal use and for the
FDA. Care must be taken if signatures have a meaning for 3rd
party contracts. A problem may occur if, for example, a QCU
director signs a batch release. This needs to be assessed and
discussed with the signing parties.
If there are any questions, each copy should be certified.

How is confidentiality
ensured?

controlled access to data encryption

Explanation:

www.labcompliance.com (Replace with your companys name)

USE

FOR INTERNAL

Case Studies
Document Number: E-411 Version 1.xx
Part 11 Implementation

Page 44 of 47
April 1, 2012

Controlled limited access to system and data to authorized

individuals through adequate policies and system functionality.
Users can enter the system and applications only after entering
a password and user ID.
How are records
archived?

paper PDF/TIF

original electronic records

Explanation:
Paper records can be destroyed if:

The process has been validated.

Signatures on the PDF files are considered to be legally

valid.

It is recommended that original paper records are kept for 3

months. Within this timeframe QA should have the right to
verify accuracy of scans.
Other Controls
Authority checks

The system checks if users are authorized to perform allowed

tasks.

People qualification

Persons who develop, maintain or use electronic systems have

the education, training and experience to perform their
assigned tasks. This is ensured through the SOP in Ref. 1.9:
Training for GxP, 21 CFR Part 11 and Computer Validation.

Requirements for
electronic signatures
System
documentation

Not Applicable

Configuration
management and
change control

Initial configuration and changes are managed through the

SOPs in Ref. 1.10: Configuration Management and Version
Control of Software and Ref. 1.11: Change Control of
Software and Computer Systems.

Appropriate control over system documentation is ensured

through following SOP S-105: Document Management and
Control.

www.labcompliance.com (Replace with your companys name)

USE

FOR INTERNAL

Case Studies
Document Number: E-411 Version 1.xx
Part 11 Implementation

Page 45 of 47
April 1, 2012

Clinical Study Reporting over the Public Internet

5.15.1

Application and Use

Clinical study samples are shipped from the sponsor to a contract laboratory
for analysis. Results are reported back through e-mail attachments over the
public Internet. Raw data and test results are maintained and archived by the
contract lab.
5.15.2

System Summary and Business Process

5.15.3

Recommendations and Documentation

System Category

Configurable Off-the-Shelf Computer System

Records required by
predicate rule?

yes

no

Explanation:
Clinical study data are required to be maintained by Good
Clinical Practice regulations.

www.labcompliance.com (Replace with your companys name)

USE

FOR INTERNAL

Case Studies
Document Number: E-411 Version 1.xx
Part 11 Implementation
Impact on product
quality?

high

Page 46 of 47
April 1, 2012

medium low

Explanation:
Clinical study data can have a high impact on product quality.

Have users access to

the system?

yes

no

Explanation:
Users of the PCs at transferring and receiving sites have
access to study data.

Can users change

records?

yes

no

Explanation:
Users of the PCs at transferring and receiving sites can change
study data.

If users can change

records, how is the
change documented?

electronic audit trail others

Explanation:
Relevant software applications on the PCs at transferring and
receiving sites have built-in electronic audit trail.

Is validation required,
and if yes, what are
the key deliverables?

yes

no

Explanation:
Relevant software applications on the PCs at transferring and
receiving sites should be validated. Also the data transfer
between the computers should be validated.
Key deliverables are:

Validation plan.
Requirement specifications.
Vendor assessment.
Installation qualification.
Operational qualification with testing of key parameters that
can be influenced by the users environment.
Performance qualification.
Validation summary report.
How is authenticity
ensured?

computer recording handwritten signatures

e-signatures digital signatures
Explanation:
The computer identifies and records people through user ID.
Users sign records electronically.
When data are transferred through the public Internet, data
must be digitally signed using some kind of certification through
public key infrastructure.

www.labcompliance.com (Replace with your companys name)

USE

FOR INTERNAL

Case Studies
Document Number: E-411 Version 1.xx
Part 11 Implementation
How is confidentiality
ensured?

Page 47 of 47
April 1, 2012

controlled access to data encryption

Explanation:
Controlled limited access to system and data to authorized
individuals through adequate policies and system functionality.
Users can enter the system and applications only after entering
a password and user ID.
When data are transferred through the public Internet, data
must be encrypted.

How are records

archived?

paper PDF/TIF

original electronic records

Explanation:
Clinical study data are maintained as original electronic records.

Other Controls
Authority checks

The system checks if users are authorized to perform allowed

tasks.

People qualification

Persons who develop, maintain or use electronic systems have

the education, training and experience to perform their
assigned tasks. This is ensured through the SOP in Ref. 1.9:
Training for GxP, 21 CFR Part 11 and Computer Validation.

Requirements for
electronic signatures
System
documentation

Electronic signatures comply with 21 CFR Part 11.

Configuration
management and
change control

Initial configuration and changes are managed through the

SOPs in Ref. 1.10: Configuration Management and Version
Control of Software and Ref. 1.11: Change Control of
Software and Computer Systems.

Appropriate control over system documentation is ensured

through following SOP S-105: Document Management and
Control.

www.labcompliance.com (Replace with your companys name)

USE

FOR INTERNAL