Presentation at the IVT Conference,

Electronic Signatures&Records
London., on February 23, 2000

Ludwig Huber
Fax.: +49 7243 602 501
E-mail: Ludwig_Huber@agilent.com

Ludwig Huber
1
Topics
 Definition of Electronic Records and Raw
Data in Chromatography
 Specific situation with spectral detectors
 Accurate and complete copies and meta
data in chromatography
 Audit trail
 Long term archiving
 User requirement and functional
specifications
 Validating chromatographic systems

Assumption: Closed systems - Hybrid systems

Ludwig Huber
2
The Laboratory
• Mixed LC’s and GC’s
• Instrument control and
data acquisition through
data system
• Client/server Oracle
Database for first and
second pass review and
quality control charts
• Server for data archiving
• 24 hours shift operation

Ludwig Huber
3
21 CFR11: Do we really have a
choice for chromatographic
systems?
Criteria
• US-FDA regulated environment (GLP, cGMP)
• Using computers for creation, acquisition, evaluation,
maintaining, archiving and/or retrieval of data
• Electronic are safed on a durable device, e.g., on a hard
disk

In theory yes, in practice no

Ludwig Huber
4
 Electronic Records in
Chromatography
11.3 (6) Electronic record means any combination of text, graphics, data, audio, pictorial, or other
information representation in digital form that is created, modified, maintained, archived, retrieved, or
distributed by a computer system.
Examples for chromatographic data systems:
 Methods, Sequence tables
 Pre/Post-run macros
 Calibration tables
 Log books
 Audit trails
 Intermediate and final results
 Rawdata

Ludwig Huber
5
 Work Flow in
Chromatography

Instrument PC Server/Database
measurements data acquisition data management
data evaluation archiving

Ludwig Huber
6
 Original and Processed Data in
Chromatography
Signal (mV)
Original data
•time
•mV

RT Peak area
Processed data 1 through peak
integration
• Time at peak apex (retention
time)
• Peak area
Processed data 2 through
sample comparison with reference
• Time at peak apex (retention
reference time)
• Compound name
• Amount
Ludwig Huber
7
 Why are Raw Data on Paper
not Accepted?
• It is very difficult or not possible to Peak area
generate ‘complete’ copies of all ==> amount
records on paper
• FDA wants to have the same tools to
replay the data as the user had In spec?
when they were generated
• Electronic records are easier to
search
Out of spec?

Ludwig Huber
8
Storage Requirements for
DAD Acquisition Modes
• 1 signal: 290 kb
• Peak spectra (apex, slopes) 32 kb
• All spectra during a peak: 400 kb
• All spectra during run: 14,000 kb

UV Vis Diode-array, one hour run, 10 peaks

14,000 kbytes
400 kbytes

Ludwig Huber
9
 Validation
• Form a validation team, develop a validation plan
• Specify user requirements and system functions
• Qualify the vendor
• Perform IQ/OQ/PQ
• Validate 'Part 11' functions
• Develop procedures for controlled changes

From Interpharm
Agilent P/N: 5959-3879
Validation of more info on
Computerized www.labcompliance.com
Analytical
Systems Ludwig Huber
10
 FDA Warning Letters/
483 Observations - Validation -
• The firm’s computer software programs, which operate
all of the laboratory equipment during the analysis of
…, have not been qualified and/or validated.
• The software error checking system is not periodically
challenged and evaluated.
• Software testing has not been conducted simulating
worst case condition
• The current data acquisition system has not been
validated, challenged and evaluated.
• There are no provisions for periodic audits of validated
computer systems

Ludwig Huber
11
Accurate and Complete
Copies
11.10 (b):Procedures and controls shall include
the ability to generate accurate and complete
copies of records in both human readable and
electronic form suitable for inspection, review,
and copying by the agency.
Recommendation
• Store ‘meta data’ with raw data
- integration parameters
- calibration tables
- log books
- audit trails
• Develop or purchase new or software upgrades

Ludwig Huber
12
 FDA 483 Observation
- complete and accurate
copies -
• The firm does not
electronically store all
integration parameters
and chromatograms

• Threshold
• Area reject
• Peak width
• etc.
Ludwig Huber
13
Protection and Retrieval of
Records
11.10 (c): Procedures and controls shall include:
Protection of records to enable their accurate
and ready retrieval throughout the records
retention period
Recommendation
• Define retention period for records
(depends on predicate rule)
• Develop a procedure for the transition to a new version of the chromatographic data system or
to a complete new system
• Implement validated file conversions for future systems (must include meta data)

Ludwig Huber
14
 FDA 483 Observations
- data integrity -
• The firm lacks the controls necessary to ensure the
integrity of raw data generated by the laboratory computer
system
• Computer software programs which control and document
analytical data can not ensure data integrity and
traceability
• Analysts can overwrite the existing sample information
in the software program’s analytical raw data files, and
change results by overwriting the existing sample result
data files

Ludwig Huber
15
 FDA 483 Warning Letter
- data security/integrity -
• The software programs do not secure files from
accidental alteration or losses of data.
• The functions that modify and delete partial or whole
data files are available for use by all analysts
• The firm has not established any security
procedures for the laboratory computer systems
• There are no procedures for backing-up data files
and no levels of security access established

Feb 12, 1999

Ludwig Huber
16
Limited System Access
11.10 (d) Procedures and controls shall
include:Limiting system access to authorized
individuals.

Recommendation
• Develop procedures to limit system access by person, group and function
• Use Windows NT or equivalent security procedures for individual authorized file access. Don’t
use Windows 95 or 98!!
• The user I.D. should be unique to the individual
• Implement system time outs in case the system is unattended

Ludwig Huber
17
Authority Checks
11.10 (g) Use of
authority checks to
ensure that only
authorized individuals
can use the system,
electronically sign a
record and access the
• Define individual user
operation or computer
profiles
system
• Define which actions the
user is authorized to do
• Use standard profiles as
a template

Ludwig Huber
18
 FDA Warning Letter
- security -
• An employee user name and computer password
were publicly posted for other employees to use the
access the Data Management System
• During the injection another employee who did not
have the established user name or password was
observed obtaining access to the Data Management
system utilizing the posted user name and password
• Three previous employees, who had terminated
employment in 1997 and 1998, still had access to
critical and limited Data Management System
functions on March 18, 1999
April 28, 1999
Ludwig Huber
19
 Audit Trail
11.10 (e) Use of secure, computer-generated, time-stamped audit trails to independently record the date
and time of operator entries and actions that create, modify, or delete electronic records. Record changes shall
not obscure previously recorded information.

Independently means
Availability of software? without operator
Level of detail? interaction
Question: Should there be a reason for the change?

Recommendation
• Upgrade existing systems with audit trail functionality.
• Include audit trail functions in user requirement and functional specifications

Ludwig Huber
20
Audit Trail Functional
Specifications
 System must generate electronic audit trail
(user ID, date and time, new value, old value and transaction
type).
 Audit trail must be saved together with the raw data file
(not required by part 11, but convenient)
 Audit trail must include any modification to the raw data,
methods, calibration table, intermediate results
 Entering a 'reason for change' should be optional (the reason for
this is that some regulations like GLP’s require a reason for the
change)
 Time zone, e.g., relative to Greenwich time, should be
configurable and be part of raw data file

Ludwig Huber
21
 Example: Audit Trail to
Equipment

Builds links between instrument, data acquisition PC and, if

different, the data transfer PC ==> part of meta data

Ludwig Huber
22
FDA 483 Observations
- audit trail -
• Operations that could affect the integrity of
chromatographic data files … are not controlled
by electronic audit trails that maintain who, why
and what was changed to any given sample
record
• There are no records of user transactions when
data is deleted, copied, renamed or purged
• The firm can not determine if reintegration of a
sample occurred once or several times.In spec?

Ludwig Huber
23
Operational System Checks

11.10 (f) Use of operational system checks to

enforce permitted sequencing of steps and
events, as appropriate.

• In chromatography: Sequence determined by software, e.g., injection,

data acquisition, peak integration, quantitation, first pass data review,
second pass data review reporting

Recommendation
• Document that programmed sequence steps have been executed in the
right order

Ludwig Huber
24
Signature/record linking
11.70 Electronic signatures and handwritten signatures executed to
electronic records shall be linked to their respective electronic records
to ensure that the signatures cannot be excised, copied, or otherwise
transferred to falsify an electronic record by ordinary means.

• For signatures on paper, use report templates which contain adequate

fields and date/time information such that the electronic record(s) to
which the signature does, and does not, apply can be determined with
absolute certainty.
• The report should clearly indicate the printed name of the signer, date
and item of signature, and what it concerns, e.g., a ‘first pass review’.

Ludwig Huber
25
Summary

• Define general compliance strategy and procedures

• Make inventory of all affected systems
• Check for compliance with part 11 and make gap analysis
• Make risk assessment
• Develop implementation plan to become compliant
• Check and document progress

Ludwig Huber
26
 Additional Information

Validation of www.labcompliance.com
Computerized • Global on-line resource for
Analytical
• 260 pages Systems validation&compliance issues
• What, when and how to in laboratories
validate computer systems • Regulatory news
and software in • Discussion forum
laboratories
• Monthly newsletter
• SOPs and checklists
• Usersclub with free downloads
• Interpham bestseller • Links to literature, documents
• ISBN 0-935184-75-9 and other websites
• HP P/N: 5959-3879 • Several pages dedicated to
• details and ordering info 21CFR11
www.labcompliance.com Ludwig Huber
27