Keep 21 CFR Part 11 audit trails and access controls inspection-ready

21 CFR Part 11 is the FDA regulation on electronic records and electronic signatures. It sets the criteria under which the FDA treats electronic records, and signatures applied to them, as trustworthy, reliable and equivalent to paper records with handwritten signatures. It was published on 20 March 1997 and took effect on 20 August 1997, and it covers system validation, audit trails, access controls, signature manifestations and identification code and password controls.

Any organisation that keeps or submits FDA-required records electronically must comply with 21 CFR Part 11. This includes pharmaceutical, biologics and medical device manufacturers, clinical trial sponsors, contract research organisations and laboratories. Part 11 applies to records created, modified, maintained, archived, retrieved or transmitted under FDA predicate rules, and to electronic submissions under the Federal Food, Drug, and Cosmetic Act and the Public Health Service Act.

The main requirements are in section 11.10, which lists controls for closed systems: system validation, accurate record copies, record protection, limited system access, secure time-stamped audit trails, operational, authority and device checks, trained staff, signature accountability policies and documentation controls. Sections 11.50 and 11.70 cover signature manifestations and signature to record linking, and sections 11.100 to 11.300 set rules for electronic signatures, identification codes and passwords.

Non-compliance is identified during FDA inspections and can lead to Form 483 observations and warning letters, and the FDA may question the reliability of data held in non-compliant systems. Because Part 11 supports underlying predicate rules such as good manufacturing practice and clinical practice requirements, data integrity failures can also lead to wider regulatory action under those rules. Part 11 itself does not set a fixed fine.

Section 11.10(e) requires secure, computer-generated, time-stamped audit trails that independently record the date and time of operator entries and actions that create, modify or delete electronic records. Changes must not obscure previously recorded information. The audit trail must be kept for at least as long as the records it covers and be available for FDA review and copying.

No. The FDA does not certify systems or organisations as Part 11 compliant. Compliance is demonstrated by the regulated company through system validation, documented procedures and controls, and FDA inspection. Software vendors can describe Part 11 supporting features, but responsibility for compliance stays with the organisation that uses the system for regulated records.

They overlap but are not interchangeable. ISO 27001 and SOC 2 cover information security controls such as access management, logging and change control, which support several Part 11 requirements. Part 11 adds FDA-specific obligations such as system validation, signature manifestations, signature to record linking and certifying electronic signatures to the FDA. A mature ISO 27001 or SOC 2 programme gives a strong base for the technical Part 11 controls.

21 CFR Part 11 is mapped in OneClickComply's control library and is available on request rather than as a standard framework today. It can be used to link Part 11 access, audit trail and password requirements to controls and evidence you already hold. OneClickComply does not certify Part 11 compliance or replace computer system validation, which remains the regulated company's responsibility.