21 CFR Part 11 is the FDA’s primary regulation on electronic records. Since pharmaceutical companies must be compliant, it governs much of how they document their processes and procedures from research to marketing of the product. There is a considerable amount of information on this regulation on the FDA website.
In order for employee time tracking software (my particular area of expertise) to meet the same requirements that paper timesheets do for this regulation, the software must exhibit several qualities.
First, it must meet the most critical requirements of the standard — audit trail generation and storage functionality. The historical information is a key functionality of an application associated with audit trails. The software must capture and preserve all the data associated with adding, changing, and deleting time-related information in a real-time database that can be audited.
Second, as with all technical controls, there still must be a management and operational component that ensures compliance with the regulatory standards. There must be established policies and procedures that provide guidance as well as control implementation details associated with the authenticity, integrity, and in many cases, the confidentiality of electronic records (a.k.a. timesheet audit trails).
In other words, software alone will not solve your 21 CFR Part 11 compliance problem, just as it doesn’t solve Sarbanes-Oxley or compliance issues by itself. There must also be a third-party validation for the system, as well as documentation and configuration to ensure that the processes, policies, procedures and technical controls are in place and are effective based on the regulatory requirements of the organization.
Finding timesheet software that contains all of these features is very important for complying with Part 11 regulations. According to www.21CFRPart11.com, the right vendor ''can offer an application containing the required technical requirements of a compliant system''2 They can help you look towards the future and make the switch to electronic records and signatures in the easiest way possible.
Sometime in 2007, the FDA will release its amendments to 21 CFR Part 11, and this will change the way laboratories manage their electronic records. The goal is to create and thoroughly document a pragmatic process by which regulatory compliance initiatives can be prioritized while still maintaining overall productivity. The deliverable is a careful, thorough, risk-based methodology that enables companies to build quality into their processes based on qualified regulatory risks and identification of key areas for increasing efficiency.
Although this regulation has been around for 10 years, there is still confusion about it which is sometimes caused by software vendors selling into the space. For example, it is not possible for any vendor to offer a turnkey ''Part 11 compliant system.” Any vendor who makes such a claim is incorrect. Part 11 requires both procedural controls (i.e., notification, training, standard operating procedures, and administration) and administrative controls to be put in place by the user in addition to the technical controls that the vendor can offer. At best, the vendor can provide an application that contains the technical requirements needed in order to maintain a compliant system.
Another area of confusion regards handwritten signatures. Having handwritten signatures on paper is acceptable if signatures are linked in some reliable way to electronic records so that signers cannot repudiate records. What this means is that electronic and handwritten signatures executed electronically must be verifiably bound to their respective records to ensure that signatures could not be excised, copied, or otherwise transferred to falsify another electronic record. Technology solutions typically do this better than paper-based ones.
If you use electronic signatures in any way, then you must be in compliance with all provisions of 21 CFR Part 11, according to the FDA. More information is available at http://www.21cfrpart11.com.
1. http://www.fda.gov/oc/speeches/2004/gpss0525.html
2. http://www.21cfrpart11.com/pages/faq/index.htm
About the Author
Curt Finch is the CEO of Journyx, a provider of web-based software located in Austin, Texas, that tracks time and project accounting solutions to guide customers to per-person, per-project profitability. Journyx has thousands of customers worldwide and is the first and only company to establish Per Person/Per Project Profitability (P5), a proprietary process that enables customers to gather and analyze information to discover profit opportunities. In 1997, Curt created the world’s first Internet-based timesheet application — the foundation for the current Journyx product offering. Curt is an avid speaker and author, and recently published All Your Money Won’t Another Minute Buy: Valuing Time as a Business Resource.
