Finding a materials testing software that adheres to the FDA 21 CFR Part 11 has long been an issue to the medical industry where data integrity is key to safe, traceable
materials testing of
pharmaceuticals and
medical devices.
Many materials testing machine suppliers claim that their software or machine solutions adhere to FDA 21 CFR Part 11, but does it really when you look at it closely, or is it just a play with words?
In this article, we will go through each of the steps that it requires for the materials testing in a pharmaceutical manufacturing organization to adhere to FDA 21 CFR Part 11.
What is FDA 21 CFR Part 11
First, let’s take a look at what FDA 21 CFR Part 11 is and why it is important to materials testing within the pharmaceutical industry.
FDA 21 CFR Part 11 is a result of the US Food and Drug Administration (FDA) defining regulations for the conditions under which regulated companies can submit electronic records instead of signed paper documents. In the pharmaceutical manufacturing industry, where errors in the quality testing can have fatal consequences for the end-users of the products, it is crucial that all data related to the testing process is logged in a secure place, so the manufacturer can always track who did what, when they did it, and why in case of faulty batches of medicine or other pharmaceuticals accidentally being sent to the market.
To make sure that data is stored correctly and logged sufficiently, Good Manufacturing Practice (GMP) details the measures that must be in place to ensure the integrity and reliability of the electronic records:
Sub Part A – General Provisions
The regulations in this part set forth the criteria under which the agency considers electronic records. Electronic signatures, and handwritten signatures executed to electronic records to be trustworthy, reliable, and generally equivalent to paper records and handwritten signatures executed on paper.
Sub B – Electronic Records
Persons who use open systems to create, modify, maintain, or transmit electronic records shall employ procedures and controls designed to ensure the authenticity, integrity, and, as appropriate, the confidentiality of electronic records from the point of their creation to the point of their receipt.
Sub C – Electronic Signatures
Each individual should have their identity confirmed and have a unique signature that has never been and never will be used by another individual. Specific requirements exist for password creation and complexity.
This means that FDA 21 CFR Part 11 consists of three types of controls that are all required fulfilled in order for an organization to become compliant:
1) Administrative controls (Sub Part A), hereunder quality system policies, IT policies, training etc.
2) Procedural controls (Sub Part B), hereunder for example SOPs.
3) Technical controls (Sub C), hereunder for example a materials testing software where secure login, electronic signatures, audit trail, and change tracking is available.
So what does this mean from a materials testing standpoint? It means that a materials testing software package alone cannot be compliant, or make a pharmaceutical manufacturing organization compliant, as it only covers one out of the three controls. And it means, that when a materials testing manufacturer claims that their software is FDA 21 CFR Part 11 compliant, you should always look deeper into the software as well as the company offerings to make sure that they know exactly what FDA 21 CFR Part 11 entails and if they can truly help your organization to be compliant.
What to Look For
Checking into a materials testing software supplier’s experience in FDA 21 CFR Part 11 compliance can be tricky, but here is some advice on what you should look for.
As data integrity refers to the completeness, consistency, and accuracy of data, the ALCOA rule applies. ALCOA means that data should be Attributable, Legible, Contemporaneously recorded, Original, and Accurate. In short, this means that a materials testing software should, as a minimum, offer you the data of what happened, when it happened, where it happened, who made it happen, and why.
The ALCOA Principles
Diving deeper into the ALCOA principles, for a materials testing software, they should be interpreted as:
- Attributable: Who created the record and when?
- Legible: Is the data in human readable form?
- Contemporaneous: Is data recorded as it is observed in real time?
- Original: Is source data in its original form and accessible?
- Accurate: Is the data complete, valid, and reliable?
Additionally, the ALCOA principles need, to be followed by the questions:
- Available: For the lifetime of the record, it can be accessed or retrieved for review and audit
- Enduring: Is the data available for the necessary time span?
- Consistent: Have all elements and data files been time stamped in the expected sequence?
- Complete: Is there an audit trail to show that no data has been deleted or lost?
Below are some concrete examples of data that should be logged in the materials testing software:
- Current date/time/zone- Changes to test setup inclduding new and old values
- ID and name of the user
- Computer name
- Description
- Reason for a change
- Electronic signatrues for test method approval, test run approval and reviewer approval
- Time, date and timezone for when user logged in and out
- Hardware parameters and version numbers
- Any machine error event that occurs
- If a required user authentication failed
- If permission relating to an action was denied
- Changes made to a user
- If a report was printed
- If a file was deleted or renamed
- If default test units were changed
- If auto-save settings were changed
- If auto-archive settings were changed
- If security configurator group, user, and options were changed
- Changes to test results
- If there was an attempt made to run a non-approved report
- If user re-authentification was canceled
Look for Active Directory (AD) integration, this simplifies validation significantly as it ensures all user management policies such as user identity checks and password policies follow your existing internal policies.
What We Learned
In this article we learned, that:
A) If a materials testing supplier claims that its software is FDA 21 CFR Part 11 compliant it just means that the software MIGHT be compliant to one out of the three controls that it takes for your organization to actually be compliant to FDA 21 CFR Part 11. It does not mean that your organization will be FDA 21 CFR Part 11 compliant just because you purchase that specific piece of software. This is simply not possible.
B) Always check the software capabilities using the ALCOA principles to make sure that the software can help your organization become FDA 21 CFR Part 11 compliant.
C) Your organization’s own administrative and procedural policies need to be in place before you can truly be FDA 21 CFR Part 11 compliant.
Where to Go From Here
When you are on the market for a materials testing software, or materials testing machine, that can help your organization become FDA 21 CFR Part 11 compliant, make sure to choose a supplier who shows true insights to all three controls that it takes for your organization to be FDA 21 CFR Part 11 compliant and that the supplier can help you set up your solution correctly by offering guidance to both the technical control, under which the materials testing software residence, but also to the administrative and procedural part of performing safe, accurate and traceable materials testing of your pharmaceuticals.
It is a common misunderstanding within the materials testing industry that a software package alone can be compliant with FDA 21 CFR Part 11, so make sure you choose to partner up with a supplier who can offer you correct guidance. A few manufacturers and suppliers of materials testing equipment offer a 360-degree solution to organizations that needs FDA 21 CFR Part 11 compliance solutions. Some of these offer full guidance in regards to installation services, IQ/OQ, test result calculation verifications, operator training, calibration in accordance to ISO 17025, and more so your organization is sure to adhere to FDA 21 CFR Part 11 - also after the materials testing software or machine has been installed.
Download this article as PDF
