Is Your QMS 21 CFR Part 11 Compliant? Ask These Questions to Find Out

Gone are the days of paper-based quality systems as the “norm.” Sure, you can still use paper-based records for official documentation and the U.S. Food and Drug Administration (FDA) won’t mind (too much). Sure, you can even keep a web of siloed spreadsheets and/or standalone document folders and/or archived paper documents in cold storage, etc. with handwritten approval signatures. But, why?

With many options for digital transformation available in the quality software sector there’s never been more opportunity to digitize your quality management system (QMS).

Benefits of a Digital QMS

• House everything under one metaphorical roof.
• Do away with error-prone handwritten documentation.
• Gain easy access to all important documents when you, and the FDA, need them.
• Be confident your software system meets all FDA requirements and maintain compliance with current good manufacturing practices (cGMP).

The statement above sounds great. But you may be wondering, “What’s the catch?” Well, if you want to call it a “catch,” using a purpose-built digital quality management system facilitates compliance with FDA 21 CFR Part 11, and diminishes the risks associated with noncompliance. Below is a short explanation of 21 CFR Part 11 and a brief list of things to consider when looking at digital QMS solutions.

What Is 21 CFR Part 11 Compliance?

21 CFR Part 11 outlines the FDA-approved guidelines for the digital storage and usage of electronic records and signatures as official, auditable documentation in place of paper-based documentation and pen-and-ink signatures. The following is a brief explanation of the FDA’s expectations for electronic records, signatures, and software validation, along with questions to ask when looking at your digital QMS options.

Electronic Records and 21 CFR Part 11 Compliance

To maintain 21 CFR Part 11 compliance, electronic records must be housed in a secure digital system with clear, auditable document approval trails that can’t be easily accessed by outside parties.

What to ask:

• Does your QMS allow you to keep comprehensive audit trails that can be retrieved in a human readable format?
• Does your QMS provide system security including password protected login, multiple levels of user access control, as well as notification and tracking of active users and suspicious login activity?

Electronic Signatures and 21 CFR Part 11 Compliance

To maintain 21 CFR Part 11 compliance, electronic signatures must be used and tracked in a way that excludes the possibility of refuting any signature as not genuine.

What to ask:

• Does your QMS provide secure creation, storage, and tracking of all electronic signatures for active users?
• Does your QMS require an electronic signature for all official approvals of documentation creation and alteration?
• Does your QMS protect and/or block electronic signatures from being duplicated or entered by multiple users?

Software Validation and 21 CFR Part 11 Compliance

To maintain 21 CFR Part 11 compliance, a software system must be validated and easily accessible for FDA review.

What to ask:

• Does your QMS come with software validation that’s 21 CFR Part 11 compliant?
• Does the software developer understand your industry and its particular risks and validation needs?
• Can you be sure the software will keep its validation overtime?
• If the software is cloud-based, is there re-validation with each release?

To learn more about how to avoid noncompliance to 21 CFR Part 11, as well as more about what to look for in a digital QMS solution, read MasterControl’s new industry brief, “21 CFR Part 11: 7 Ways to Avoid Noncompliance.”