Guidance for Industry Part 11, Electronic Records; Electronic Signatures August 2003
certain events or actions occurred in accordance with the predicate rule (e.g. approved, reviewed, and verified). C. Approach to Specific Part 11 Requirements 1. Validation The Agency intends to exercise enforcement discretion regarding specific part 11 requirements for validation of computerized systems (§ 11.10(a) and corresponding requirements in § 11.30). Although persons must still comply with all applicable predicate rule requirements for validation (e.g., 21 CFR 820.70(i)), this guidance should not be read to impose any additional requirements for validation. We suggest that your decision to validate computerized systems, and the extent of the validation, take into account the impact the systems have on your ability to meet predicate rule requirements. You should also consider the impact those systems might have on the accuracy, reliability, integrity, availability, and authenticity of required records and signatures. Even if there is no predicate rule requirement to validate a system, in some instances it may still be important to validate the system. We recommend that you base your approach on a justified and documented risk assessment and a determination of the potential of the system to affect product quality and safety, and record integrity. For instance, validation would not be important for a word processor used only to generate SOPs. For further guidance on validation of computerized systems, see FDA’s guidance for industry and FDA staff General Principles of Software Validation and also industry guidance such as the GAMP 4 Guide (See References). 2. Audit Trail The Agency intends to exercise enforcement discretion regarding specific part 11 requirements related to C.第11条款特定要求的应对方法 1.验证 就第11条款中计算机系统验证（§ 11.10(a)和§ 11.30中的要求），FDA打算采取自由裁量权。尽管企业必须符合预定法规对验证的要求（如21 CFR 820.70(i)），对于验证来说，该指南则不再提出额外要求。 FDA建议计算机系统验证及其验证范围需考虑遵守预定法规对系统带来的影响。企业还要考虑受影响系统对记录和签名准确性、可靠性、完整性、有效性和真实性的影响。即使预定法规没有要求系统验证，在一些情况下系统验证仍然是重要的。 FDA建议基于方法依据合理的且记录的风险评估，确定系统对产品质量、安全和记录完整性的潜在影响。例如对于仅仅用于生成SOP的文本处理程序，验证就不重要了。 计算机系统验证指南详见FDA工业指南、FDA员工通用指南：软件验证，及工业指南，如GAMP 4指南（见参考文献）。 2.审计追踪 就第11条款中使用计算机产生的、标记时间的审计追踪（§ 11.10 (e), (k)(2)及§11.30），FDA打算采取 Page 9 of 13
Guidance for Industry Part 11, Electronic Records; Electronic Signatures August 2003
computer-generated, time-stamped audit trails (§ 11.10 (e), (k)(2) and any corresponding requirement in §11.30). Persons must still comply with all applicable predicate rule requirements related to documentation of, for example, date (e.g., § 58.130(e)), time, or sequencing of events, as well as any requirements for ensuring that changes to records do not obscure previous entries. Even if there are no predicate rule requirements to document, for example, date, time, or sequence of events in a particular instance, it may nonetheless be important to have audit trails or other physical, logical, or procedural security measures in place to ensure the trustworthiness and reliability of the records. We recommend that you base your decision on whether to apply audit trails, or other appropriate measures, on the need to comply with predicate rule requirements, a justified and documented risk assessment, and a determination of the potential effect on product quality and safety and record integrity. We suggest that you apply appropriate controls based on such an assessment. Audit trails can be particularly appropriate when users are expected to create, modify, or delete regulated records during normal operation. 3. Legacy Systems The Agency intends to exercise enforcement discretion with respect to all part 11 requirements for systems that otherwise were operational prior to August 20, 1997, the effective date of part 11, under the circumstances specified below. This means that the Agency does not intend to take enforcement action to enforce compliance with any part 11 requirements if all the following criteria are met for a specific system: ? The system was operational before the effective date. ? The system met all applicable predicate rule requirements before the effective date. ? The system currently meets all applicable predicate rule requirements. 自由裁量权。企业必须遵守预定法规中关于文件的所有要求，例如，日期（§ 58.130(e)）、时间、事件顺序和详细的变更记录不能掩盖之前的条目等。 即使预定法规对文件的日期、时间或事件顺序没有明确规定，审计追踪仍然是重要的，或采取安全管理程序保证记录的准确性和可靠性。FDA建议公司依据预定法规要求，及合理的且记录的风险评估，确定对产品质量、安全性和记录完整性的潜在影响，决定是否采用审计追踪或其他措施。FDA建议根据评估采取适当控制。日常操作中，当使用者创建、修改或删除规定的文件时，审计追踪显得尤为适用。 3.遗留系统（该指南中，遗留系统指的是在第11条款生效日期前已经执行的系统） 就第11条款中对1997年8月20日之前运行的系统，FDA打算采取自由裁量权。具体情况如下。 这就意味着如果系统满足以前所有要求，FDA则不强制执行第11条款中的要求。 ? 系统在生效日期（1997.08.20）之前执行 ? 系统符合生效日期前的所有预定法规要求 ? 系统现在符合所有预定法规要求 ? 企业有记录文件和合理依据证明系统符合预期用途（包括有文件记录安全性和完整性的可接受 Page 10 of 13
Guidance for Industry Part 11, Electronic Records; Electronic Signatures August 2003
? You have documented evidence and justification that the system is fit for its intended use (including having an acceptable level of record security and integrity, if applicable). If a system has been changed since August 20, 1997, and if the changes would prevent the system from meeting predicate rule requirements, Part 11 controls should be applied to Part 11 records and signatures pursuant to the enforcement policy expressed in this guidance. 4. Copies of Records The Agency intends to exercise enforcement discretion with regard to specific part 11 requirements for generating copies of records (§ 11.10 (b) and any corresponding requirement in §11.30). You should provide an investigator with reasonable and useful access to records during an inspection. All records held by you are subject to inspection in accordance with predicate rules (e.g., §§ 211.180(c), (d), and 108.35(c)(3)(ii)). We recommend that you supply copies of electronic records by: ? Producing copies of records held in common portable formats when records are maintained in these formats ? Using established automated conversion or export methods, where available, to make copies in a more common format (examples of such formats include, but are not limited to, PDF, XML, or SGML) In each case, we recommend that the copying process used produces copies that preserve the content and meaning of the record. If you have the ability to search, sort, or trend part 11 records, copies given to the Agency should provide the same capability if it is reasonable and technically feasible. You should allow inspection, review, and copying of records in a human readable form at your site using your hardware and following your established procedures and techniques for accessing records. 标准，如果适用的话） 如果系统在1997年8月20号后变更，且变更会引起系统不满足预定法规，就要按照该指南中描述的执行政策管理第11条款中的记录和签名。 4.记录的复印 就第11条款中对记录复印的要求，FDA打算采取自由裁量权（§ 11.10 (b)和§11.30相应要求）。检查期间，企业要向检察官提供合理有用的记录。所有保存记录要接受符合预定法规检查（如§§ 211.180(c)，(d)，108.35(c)(3)(ii)） FDA建议企业通过以下方式提供电子记录复印件： ? 当记录按照常见方式保存时，以常见便携方式复印记录 ? 使用已建立的自动转换或输出方法，常见形式有PDF，XML，SGML等 FDA建议无论哪种复印方式，都要保存复印记录的内容和意图。如果可以搜索、归类或趋向第11条款记录，技术上合理并且可行的话，递交FDA的复印件也应一样。企业应该允许通过硬件可读方式检查、审核和复制记录文件，并且遵守接触记录文件的相关操作和规定。 Page 11 of 13
Guidance for Industry Part 11, Electronic Records; Electronic Signatures August 2003
5. Record Retention The Agency intends to exercise enforcement discretion with regard to the part 11 requirements for the protection of records to enable their accurate and ready retrieval throughout the records retention period (§ 11.10 (c) and any corresponding requirement in §11.30). Persons must still comply with all applicable predicate rule requirements for record retention and availability (e.g., §§ 211.180(c),(d), 108.25(g), and 108.35(h)). We suggest that your decision on how to maintain records be based on predicate rule requirements and that you base your decision on a justified and documented risk assessment and a determination of the value of the records over time. FDA does not intend to object if you decide to archive required records in electronic format to nonelectronic media such as microfilm, microfiche, and paper, or to a standard electronic file format (examples of such formats include, but are not limited to, PDF, XML, or SGML). Persons must still comply with all predicate rule requirements, and the records themselves and any copies of the required records should preserve their content and meaning. As long as predicate rule requirements are fully satisfied and the content and meaning of the records are preserved and archived, you can delete the electronic version of the records. In addition, paper and electronic record and signature components can co-exist (i.e., a hybrid situation) as long as predicate rule requirements are met and the content and meaning of those records are preserved. 5.记录保存 就第11条款保存记录，确保保存期间记录的准确性和可检索性（§ 11.10 (c)和§11.30的相应要求），FDA打算采取自由裁量权。企业必须遵守预定法规的所有要求来保存记录（如211.180(c)，(d)， 108.25(g)和108.35(h)）。 FDA建议企业决定如何保存记录要根据预定法规、基于合理的依据和以文件形式记录的风险评估及记录随时间流逝体现的价值。 FDA不干涉企业选择电子形式还是非电子媒体（如微缩胶卷、微缩胶片、纸质文件或标准电子文件格式PDF、XML、SGML等）保存记录。企业必须遵守所有预定法规，所有记录及复印件都应保留内容。只要满足预定法规要求，记录文件都有保存和归档，企业就可以删除电子版本的记录文件。除此之外，在符合预定法规、有保存记录的情况下，纸质和电子记录及签名可以同时存在。 Page 12 of 13
Guidance for Industry Part 11, Electronic Records; Electronic Signatures August 2003
IV. REFERENCES 参考文献 Food and Drug Administration References 1. Glossary of Computerized System and Software Development Terminology (Division of Field Investigations, Office of Regional Operations, Office of Regulatory Affairs, FDA 1995) (http://www.fda.gov/ora/inspect_ref/igs/gloss.html) 2. General Principles of Software Validation; Final Guidance for Industry and FDA Staff (FDA, Center for Devices and Radiological Health, Center for Biologics Evaluation and Research, 2002) (http://www.fda.gov/cdrh/comp/guidance/938.html) 3. Guidance for Industry, FDA Reviewers, and Compliance on Off-The-Shelf Software Use in Medical Devices (FDA, Center for Devices and Radiological Health, 1999) (http://www.fda.gov/cdrh/ode/guidance/585.html) 4. Pharmaceutical CGMPs for the 21st Century: A Risk-Based Approach; A Science and Risk-Based Approach to Product Quality Regulation Incorporating an Integrated Quality Systems Approach (FDA 2002) (http://www.fda.gov/oc/guidance/gmp.html) Industry References 1. The Good Automated Manufacturing Practice (GAMP) Guide for Validation of Automated Systems, GAMP 4 (ISPE/GAMP Forum, 2001) (http://www.ispe.org/gamp/) 2. ISO/IEC 17799:2000 (BS 7799:2000) Information technology – Code of practice for information security management (ISO/IEC, 2000) 3. ISO 14971:2002 Medical Devices- Application of risk management to medical devices (ISO, 2001)
Page 13 of 13
相关推荐：
loading