21 CFR Part 11 checklist for electronic records and signatures

Most GMP systems are closed systems — access is controlled by the people responsible for the records. Section 11.10 requires procedures and controls to ensure authenticity, integrity and, where appropriate, confidentiality. Check each of these:

1. Validation — the system is validated for accuracy, reliability, consistent intended performance and the ability to discern invalid or altered records.
2. Copies — accurate and complete copies can be generated in human-readable and electronic form for inspection.
3. Retention — records are protected so they can be accurately and readily retrieved throughout the retention period.
4. Access — system access is limited to authorised individuals.
5. Audit trail — secure, computer-generated, time-stamped audit trails independently record the date and time of entries and actions that create, modify or delete records. Changes must not obscure previously recorded information, and the audit trail is retained as long as the record and available for review.
6. Operational checks — the system enforces the permitted sequence of steps where sequencing matters.
7. Authority checks — only authorised individuals can use the system, sign records, access operations or alter records.
8. Device checks — the validity of the source of data input or operational instruction is checked where appropriate.
9. Training — people who develop, maintain or use the system have the education, training and experience for their tasks.
10. Accountability — written policies hold individuals accountable for actions under their electronic signatures.
11. Documentation control — distribution, access and change control over system documentation.

Section 11.30 adds controls for open systems, such as encryption and digital signature standards, where access is not controlled by the record owner.

Signature manifestation — 11.50

• Each signed record shows the printed name of the signer, the date and time of signing and the meaning of the signature, such as review, approval, responsibility or authorship.
• The same information appears on any human-readable form of the record, including prints and PDFs.

Signature/record linking — 11.70

• Signatures are linked to their records so they cannot be removed, copied or transferred to falsify another record.

General requirements — 11.100

• Each electronic signature is unique to one individual and is never reused or reassigned.
• The organisation verifies the identity of the individual before assigning a signature.
• The organisation certifies to the FDA that its electronic signatures are intended to be the legally binding equivalent of handwritten signatures.

Signature components — 11.200

• Non-biometric signatures use at least two distinct identification components, such as a user ID and a password.
• In a continuous session, the first signing uses all components; later signings use at least one component that is private to the individual. Signings outside a continuous session use all components.
• Signatures are designed so that only their genuine owner can use them, and any attempt by someone else requires the collaboration of two or more people.

• Each combination of user ID and password is unique.
• Identification codes and passwords are checked, recalled or revised periodically — for example through password ageing.
• Lost, stolen or compromised credentials and devices are deauthorised under a documented procedure.
• Transaction safeguards prevent unauthorised use, and attempted misuse is detected and reported — for example account lockout after repeated failed attempts, with the event logged.
• Devices that carry or generate identification information, such as tokens, are tested periodically.

A common mistake is to treat Part 11 as a product feature. Some requirements are technical and must be designed into the system; others can only be met by the regulated company.

Mainly built into the system

• Audit trail generation, time stamps and change reasons.
• Access control, roles and authority checks.
• Signature manifestation, record linking and re-authentication at signing.
• Sequencing of workflow steps and segregation of duties.
• Password rules, lockout and multi-factor login.
• Readable exports of records and audit trails.

Owned by your company

• Validation for your intended use, including risk assessment and testing of your configuration.
• SOPs for user administration, periodic access review and audit trail review.
• Training records and the accountability policy for electronic signatures.
• The certification letter to the FDA on electronic signatures.
• Backup, restore and record retention procedures, and change control over the system.

Any vendor who tells you their software is “Part 11 compliant” out of the box is overselling. Ask instead which Part 11 controls the system is designed to provide, and what support they give for your validation.

Inspectors increasingly test Part 11 controls live rather than reading the validation summary. Rehearse these with your own system:

• Change a value and show the audit trail entry with the old value, new value, user, time and reason.
• Try to approve your own record and show the system refuses.
• Print a signed record and show the name, date, time and meaning on the print.
• Show the list of active users and when access was last reviewed.
• Show evidence that audit trails are reviewed — not just that they exist.
• Export a complete record and its audit trail in a form the inspector can take away.

Swat iQua Suite is designed to comply with 21 CFR Part 11 and EU GMP Annex 11, following ALCOA+ data-integrity principles and a GAMP 5 risk-based validation approach. The technical controls are built into the platform and shared by every module.

• Audit trail — every write and its log entry commit in one database transaction, with old and new values, the user, the operating site and a mandatory reason for the change.
• Trusted time — every entry is time-stamped centrally and shown in the local time of the site where the work was done.
• Electronic signatures — re-authentication at signing by password, or password plus OTP/MFA, configured per module and per site. Signed records show the signer’s name, designation at the time of signing, meaning and date.
• Segregation of duties — server-enforced rules such as preparer ≠ reviewer ≠ approver across 25 modules, with no admin bypass on most quality workflows.
• Access control — role-based permissions per site, forced password change at first login and on expiry, time-limited lockout after repeated failed logins or MFA codes, and multi-factor login.
• Audit trail reporting and review — a filterable, cross-module audit trail report with logged PDF and Excel export, and periodic audit trail review that flags deletions, privileged changes, configuration changes, after-hours activity and changes after approval.
• Validation support — a CSA requirement and traceability register with e-signed approval, plus validation services from our team during implementation.

Your procedures, training, validation for intended use and FDA certification letter remain yours — Swat iQua Suite gives you a system designed to make them straightforward to evidence.