Risk-Based Approach to 21 CFR Part 11 (Part 2)

(Part 11)

Copies of Electronic Records
Reference: 21 CFR Part 11.10 (b).
The user firm should provide an investigator with reasonable and useful access to records during an inspection. The provision of electronic copies under Part 11 can bring significant technical challenges, especially for complex systems. We propose that user firms should be able to meet the requirement for accurate and complete copies by, in order of preference:

  1. Using industry standard portable formats where possible, if the use of such formats brings more benefits than disadvantages.
  2. Utilizing established automated conversion or export methods where available, to make copies in a more common format (e.g. PDF or paper copies).
  3. Allowing inspection and review of records on the firm’s site, using the firm’s hardware and software, following the firm’s established procedures and techniques for accessing those records.
    The key concepts are that the content and the meaning of the GxP records are preserved during copying, and that these GxP records are available in human readable form.

Retention and Maintenance of Records
Reference: 21 CFR Part 11.10 ©.
Archiving of electronic records can be problematic in two main ways: volume and processability.

If the definition of Part 11 scope is clarified, and interpreted according to a risk-based approach, then volume ceases to be such a significant problem. For example, an encapsulation machine with a check-weigher can measure two million capsule weights for a single batch. The batch record may only use these values to generate a curve that shows the batch weight distribution falls within validated norms. Only the weight distribution curve is meaningful and the individual data points need not be archived, provided the generation process of the distribution curve is validated. This meets the expectation of the predicate rule 21 CFR 211.188, yet considerably eases the record-keeping burden.

Archived records must be retrievable; it is not, however, always necessary to reprocess electronic records. The content and meaning of retrieved records must be evident.

Archiving to non-electronic media such as microfilm, microfiche, and paper, is an acceptable alternative to electronic media in some cases, as long as the content and meaning of the electronic record is not compromised, and the archiving process is validated.

Printing copies of records held electronically, and reviewing and subsequently approving them by means of a handwritten signature, to produce the master regulatory record for long term keeping can be effective and efficient. The user firms must ensure that any contextual and background information required to interpret the records is also kept. For high impact records it may be essential that electronic copies of the record are also retained – although not necessarily in reprocessable form.

Reprocessability is an additional challenging requirement placed on user firms when using electronic records. It should be the exception, rather than the rule. Those records needing reprocessability should be clearly identified and defined by the user firm, based on risk. For clinical records, reprocessability may be important, but not for manufacturing records where the main requirement is to support integrity and reliability of the records.

In most cases the value of the ability to reprocess records decreases as time passes. When a product is relatively new to the market there may be a host of issues not well understood, such as unusual drug interactions or environmental factors. The ability to analyze clinical data for new drug products based on new information gleaned from post-market reporting is important. However, as the product is used for several years without major problems, a profile begins to emerge of the drug as safe under normal conditions of use.

A risk-based approach should be used in deciding whether to migrate older records to a new format. Based on risk assessment data, a decision would be made whether it is important to retain processability of older data. If risk is sufficiently low, the firm may choose to write the records to a common, simple, permanent format for archival (PDF, microfiche, paper, etc.). The GxP records and their context and meaning are retained, and the key elements such as the audit trail can be captured and retained. The principal compromise accepted here is sacrifice of the ability to easily search and manipulate the records.

Link for part 3