Professional Documents
Culture Documents
Draft Guidance:
Scope and Applications
1
Overview
2
21 CFR Part 11 - History
• 1992 - Advanced notice of Proposed Rule
Making (ANPR)
• 1994 - Proposed Rule
• 1994 - 1997 Industry responses
• 1997 - Final rule, Effective date: August 20
• 1999 - FDA insp.reports and warning letters
• 2001-2003 Five Draft guidance documents
• Feb 20, 2003 New Draft Guidance
3
FDA Part 11 Guidance Documents
Withdrawn
• Compliance policy guide 7153.17 (1999)
www.fda.gov/ora/compliance_ref/cpg/cpggenl/cpg160-850.htm
• Validation industry guidance (draft, 2001)
• Glossary industry guidance (draft, 2001)
• Time stamps (draft, 2002)
• E-records management (draft, 2002)
• E-copies
New on Feb 20, 2003
• Scope and applications
4
What Happened?
• On February 4, 2003, the FDA did withdraw the draft
Guidance: E-copies of E-records.
• Reason: The guidance does no longer represent FDA’s
approach under the CGMP initiative
• On February 20, 2003, the FDA published a new
guidance on “Scope and Applications” and did withdraw
all other guidances
• The Guidance states that the FDA may re-examine part
11 as part of FDA’s new initiative to go for risk based
inspections
5
Part 11 and Industry Problems
• Scope not clear or too broad (all computer generated material
as required by predicate rule)
• Software for e-audit trail not available, especially for
manufacturing systems
• Biggest problem: long term archiving and reprocessing of
data not technologically feasible (up to 10+ years, high cost)
• High cost and long time to bring legacy systems into
compliance
• Some industry did overreact, e.g., hold back new technology
6
FDA Part 11 Draft Guidance for Industry
7
What Did Change?
Before Feb 20, 2003
• Wide scope (all documents as required by predicate rule and generated
by computer)
• FDA expects active implementation plan based on documented risk
assessment (industry has developed guidance, e.g. GAMP)
• Enforcement of deviations based on impact on product quality
After Feb 20, 2003
• Narrow scope
• Implementation defined by company in documented risk analysis
• ‘Risk’ depends on product quality and data integrity
8
Enforcement
During part 11 Re-examination Period
On hold
• Part 11 specific requirements, e.g., e-audit trail,
validation, record maintenance, e-copies
• Legacy systems (installed before August 20, 1997)
Ongoing
• FDA will enforce predicate rule requirements for
records that are subject to Part 11. (Validation is one of
them)
• Security, data integrity, accountability
9
Enforcement - Examples
During part 11 Re-examination Period
10
Records Under the New Scope
12
Part 11 and Paper Copies
15
Audit Trail
16
Impact on Product Quality is Key
17
Electronic Copies
18
Record Retention
• We suggest that your decision on how to maintain records be based on
predicate rule requirements and that you base your decision on a justified
and documented risk assessment and a determination of the value of
the records over time.
• FDA normally does not intend to object if you decide to archive required
records in electronic format to non-electronic media such as microfilm,
microfiche, and paper, or to a standard electronic file format, such as PDF.
• Persons must still comply with all predicate rule requirements, and the
records themselves and any copies of the required records should preserve
their content and meaning.
20
Legacy Systems
21
High Risk Records
Criteria
1. Primary records with direct impact on product quality
2. When operators can influence accuracy of results
Example
• Computer systems for analysis of products, if results are used for batch
releases
• Electronic batch record systems
22
Low Risk Systems/Records in
Laboratories
Secondary records without direct impact on product quality
Examples
• Environmental monitoring systems
• Instrument qualification/calibration records
• Word processing for operator training records/SOPs/
validation documentation
23
ISPE=International Society for
ISPE White Paper Pharmaceutical Engineering
26
Recommendations
- if you have your part 11 remediation plan in
place -
• Don’t panic, continue as before
• You may remove some of the ‘low risk’ systems
from the plan
• You may look at your archiving strategy. Look at
your business practices and archive records you may
need later on for re-processing in e-form. Document
your archiving strategy.
27
Recommendations
- if you no part 11 plan in place -
• Develop a part 11 master plan
• Make a computer system inventory and identify GxP type systems
• Implement requirements not affected by the new guidance (see slide #10 of this
presentation)
• Develop an SOP for risk assessment
• Validate all systems classified as medium or high risk
• Develop and document a strategy to implement and defend an archiving
strategy. Look at your business practices and archive records you may need later
on for re-processing in e-form. Document your archiving strategy.
28