22 October 2008

eCTD and 21CFR Part 11 Compliance

So as a technologically advanced sponsor, I've decided to embrace the future and send my next US submission to the FDA in eCTD format. I'm researching all of the FDA and ICH guidances, and I feel good about my ability to make all my links blue, create an STF, generate an index.xml file, etc. All I need to do is find a great set of software solutions to help me with the technical challenges associated with submitting in eCTD. But with great software, comes great responsibility! After talking to my colleagues in the CMC department, I realize that my shiny new software better be able to comply with the FDA's 21CFR Part 11 requirements!

Here is a common question posed to eCTD publishing/DMS/other types of software vendors in our field: "Is your software 21CFR Part 11 compliant?" Of course, they all reply "totally!"...or something more professional-sounding. However, this doesn't mean that you don't have to worry about Part 11 requirements. It is certainly possible to implement a software system that is compliant with Part 11 in a way that isn't compliant with Part 11 (confused?)

The FDA released a document called “Guidance for Industry: Part 11, Electronic Records; Electronic Signatures — Scope and Application” way back in 2003 that outlines their: ”… current thinking regarding the scope and application of part 11…”[1]. There are five main areas within this scope, that are listed on pages 6 through 8 of the document [1].

I’m not going to be able to tackle the details of each consideration in one blog post. Here is a list of what the FDA considers important and how it might relate to our eCTD-supporting software:

  • Validation: You have to make sure your software is installed and working within your business process.
  • Audit Trail: Your software must track all of the actions performed by all users.
  • Legacy Systems: Your old software doesn't have to comply with the newest rules as long as it still meets the old requirements. (Probably not relevant for this example, because we are talking about new software.)
  • Copies of Records: When you are asked to provide Part 11 - related records to the FDA, make sure they are in a convenient format and easy for the agency to read/interpret.
  • Retention of Records: If you're going to archive your old records, then make sure they retain their meaning.

[1], http://www.fda.gov/cder/guidance/5667fnl.pdf.