21 CFR Part 11 sets the US FDA’s requirements for electronic records and electronic signatures. It applies to records required by predicate rules (such as 21 CFR 211) that are kept electronically. Most gaps sit in four places: shared or generic accounts, audit trails that are off or never reviewed, signatures without their meaning, and validation that never covered the configured system.
What the checklist covers
- Controls for closed systems — 11.10(a) to (k): validation, copies, retention, access, audit trails, operational, authority and device checks, training, accountability and documentation control.
- Open systems — 11.30.
- Signature manifestations and record linking — 11.50 and 11.70.
- Electronic signature general requirements — 11.100, including certification to the FDA.
- Signature components and controls for identification codes and passwords — 11.200 and 11.300.
Requirement summaries are paraphrased — always read the regulation text. EU and UK sites should check EU GMP Annex 11 too; our free Part 11 & Annex 11 assessment covers both.