Part 11 Compliance

Planning and Remediation of Systems for Part 11 Compliance

By Stephen Robert Goldman

In order to perform remediation planning, it is best to have a plan that details what is to be done, who is to do it and the time frames necessary to affect a speedy resolution.

Create a project plan in both narrative and chart format that contains work breakdown structures for collecting information about each application, computer or computerized system. This information becomes part of the Validation Master Plan describing the details of the information collected.

The outcome of the work from the Project Plan is a Validation Master Plan. From this, the various projects and their priorities are identified and created. Gap analysis or retrospective validation is performed. Procedural and System Controls are identified and put into place.

For each of the requirements of the regulation, formulate a series of questions that can be answered with yes, no or not applicable. For each system being assessed, apply these questions and document all observations and comments. The areas to be covered are from the regulation itself.

Using the validation plan, gap analyses and other analysis, create the User and Functional requirements, Installation Qualification (IQ), Operational Qualification (OQ) and Performance Qualification (PQ) protocols.
Create and implement Standard Operating Procedures (SOPs) to control the work that will be performed and ensure the security and integrity of the data. This process applies to everyone working in the GxP and Part 11 environment – Employees, Vendors, Contractors and Consultants. Everyone must be qualified prior to performing work.

In order to accomplish the task expeditiously, it may not be feasible initially to create a suite of SOPs. Under these circumstances, it is acceptable to specify in each document the best industry practice instead of referencing an SOP.

However, the SOPs must be planned, scheduled and created.

Do not reference non-existent or future documents in any document. Documents are not permitted to precede or pre-exist the documents that govern them. Chronology is determined by approval dates.

Remember, you are not expected to get everything done at once. Show intent, document that intent, and maintain the written evidence that demonstrates continued reasonable progress toward your goal.

In performing the 21 CFR Part 11 assessment and the Gap Analysis, the system controls required by Part 11 are determined and addressed. The first one, Validation, answers the questions:

Was the system built right?
Was the right system built?

Implement the development, remediation or upgrade. If it is a retrospective validation or a remediation and it will take too long to implement, proceed with what can be validated retrospectively. Be sure to document reasonable progress.

Using the validation plan and qualification protocols for each software application, computer or computerized system, execute the qualification protocols and tasks.

Prepare and approve the summary report for each executed protocol before going on to the next one.

Also, demonstrate that the work follows the written procedures and vice versa, through documentation. This applies to the validation work as well as ongoing operation and use. Remember, if it wasn’t documented, it didn’t happen!

Best industry practices and FDA Guidance documents indicate that in order to demonstrate that a computer or computerized system performs as it purports and is intended to perform, interim and final Summary Reports are required to demonstrate, in a summarized format, the outcomes of qualification testing.

An SOP should contain instructions and procedures that enable the creation of a Summary Report for Unit Testing, Installation Qualification (IQ), Operational Qualification (OQ) and Performance Qualification (PQ) protocols.

Summary Reports should be prepared as standalone documents for all projects. It is not good practice to include them as part of other documents in an attempt to reduce paperwork. This would only create more work over the length of the project, from misunderstandings and confusion. Clear, concise documents that address specific parts of any given project are best.