21 CFR Part 11: Electronic Records and Electronic Signatures in Pharmacovigilance

Introduction

Pharmacovigilance is increasingly conducted through electronic systems. Safety databases, case-processing tools, signal-management platforms, document-management systems, regulatory-submission systems and electronic quality systems create records that may support regulated decisions. The question is not whether a system is electronic. The question is which records the organisation relies upon, what regulatory obligation gives those records significance, and whether the controls preserve their reliability throughout the record lifecycle.

21 CFR Part 11 is the United States Food and Drug Administration regulation that establishes criteria under which electronic records, electronic signatures and handwritten signatures executed to electronic records may be considered trustworthy, reliable and generally equivalent to paper records and handwritten signatures. It is therefore a control framework for specified electronic records and signatures, not a universal label applied to every digital file.

The regulation must be read with the applicable FDA requirements for the underlying activity. FDA calls those underlying requirements predicate rules. A predicate rule may require a record, a review, an approval, a submission or another regulated action. Part 11 addresses the electronic form in which that requirement is fulfilled; it does not independently create the underlying pharmacovigilance obligation.

This distinction is especially important in pharmacovigilance because a single safety database can contain regulated records, operational working data, system metadata and derived information. The whole database is not necessarily one undifferentiated Part 11 record. The organisation must identify authoritative records and the controls on which regulated decisions depend.

Regulatory position and terminology

What Part 11 does

Section 11.1 describes criteria under which FDA considers electronic records, electronic signatures and handwritten signatures executed to electronic records to be trustworthy, reliable and generally equivalent to paper records and handwritten signatures. Section 11.2 permits electronic records and signatures to be used in place of paper records and traditional signatures, in whole or in part, when the requirements of Part 11 and the applicable regulatory framework are met.

Part 11 contains requirements for electronic records maintained in closed and open systems, electronic signatures, signature manifestations, signature-record linking, identification codes and passwords. For a closed system, section 11.10 lists controls including validation, accurate and complete copies, record protection, access limitation, operational and authority checks, training, accountability policies, documentation controls and time-stamped audit trails.

What Part 11 does not do

Part 11 does not determine whether a pharmacovigilance activity must be performed. It does not replace FDA requirements for adverse-event reporting, record retention, submissions, clinical investigations, manufacturing, quality systems or other regulated activities. It also does not turn every database field, email or document created by a regulated organisation into a Part 11 record.

A system may contain information that is useful for managing a process but is not itself the authoritative record for a predicate-rule obligation. Conversely, an electronic record may fall within scope even when held in a general-purpose application, if the organisation relies upon it to fulfil a regulated requirement.

Regulation, guidance and operational practice

The legal and interpretive layers should remain distinct:

FDA’s 2003 guidance describes a relatively narrow interpretation of Part 11 scope and states that FDA intends enforcement discretion for specified provisions under the circumstances described in the guidance. That does not make Part 11 optional, remove predicate-rule obligations or justify ignoring controls that remain applicable. A company procedure may be stricter than the minimum legal requirement, but it should be described as company practice rather than presented as a Part 11 mandate.

The Part 11 applicability question

Predicate rule first

The assessment should begin with the regulated activity, not with the software:

1. What activity is being performed?
2. What FDA statute, regulation or other predicate rule creates the record, signature or submission obligation?
3. Which record is maintained, submitted or relied upon?
4. Is it maintained electronically in place of paper, or submitted electronically?
5. Which controls are needed to preserve reliability and integrity?
6. What evidence supports the conclusion?

This sequence avoids two opposite errors: declaring every electronic record in scope without understanding its significance, or declaring a record out of scope merely because a paper copy also exists or because a vendor hosts the system.

The record relied upon

The practical question is often which version the organisation actually relies upon to perform, review, approve, demonstrate or reconstruct the regulated activity. If a paper printout is merely a convenience copy while the electronic record is used for case assessment, approval, reconciliation or submission, the electronic record remains central to the evidence chain.

The conclusion should be documented in a system or process assessment. It should identify the authoritative record, linked source records, predicate rule, system boundary, retention and retrieval approach, and controls that protect the record.

The electronic lifecycle

A record should be considered across its complete lifecycle: creation or capture, review and assessment, modification or correction, approval or signature, transmission or submission, retention and retrieval, migration, archival and system retirement. A control that protects a record at creation but loses metadata during migration is not a complete lifecycle control.

Part 11 in the pharmacovigilance system

Possible in-scope PV records may include an electronic case record relied upon for regulated reporting, a controlled assessment or approval, a submission record, a system-generated transmission acknowledgement or a controlled quality record. The exact conclusion depends on the predicate rule, business process and intended use.

Part 11 should be governed jointly by pharmacovigilance, quality, information technology, computerised-system assurance, regulatory affairs, data protection and suppliers where relevant. The QPPV does not own every technical control, but needs sufficient oversight of critical PV records and systems to understand whether information is reliable, available, traceable and appropriately controlled.

Figure: applicability path

Figure 1. The applicability path begins with the underlying regulatory obligation, identifies the authoritative electronic record and then selects controls proportionate to its use and risk. It is a conceptual framework, not a legal opinion.

Scope in practice

Records maintained in place of paper

Section 11.2 permits electronic records to be used in lieu of paper records, in whole or in part, when Part 11 requirements are met. A pharmacovigilance organisation should not begin by asking whether it has a paper backup. It should establish which record is official or relied upon and whether the electronic version is used to perform or demonstrate the regulated activity.

If an electronic safety case is used for medical review, regulatory reporting and later reconstruction of the reporting decision, printing a case summary does not by itself transfer authority to the paper copy. The electronic case, associated history and relevant metadata remain central to the evidence chain.

Records maintained alongside paper

Maintaining paper and electronic versions creates a risk of ambiguity. The organisation should define which version is authoritative, whether the second version is a controlled copy or independent record, how discrepancies are reconciled, how changes to each version are controlled and how both versions are retrieved during inspection.

A dual-record arrangement can be valid, but it must not allow the organisation to select whichever version is more convenient after an event.

Records used to generate paper

A computer may be used as a drafting or printing tool without every intermediate file becoming the record relied upon for the regulated activity. The assessment must reflect actual use. If electronic information is retained, reviewed, reconciled or used to support decisions, it may have significance beyond the printed output. Printing does not automatically remove all electronic-record obligations.

Records submitted electronically

Electronic submissions and transmissions require attention to both the record and the submission pathway. The organisation should identify the submitted record, final approved version, person or system authorising submission, transmission event, acknowledgement or rejection, and any correction or resubmission.

A working file that helped prepare a submission is not automatically the submitted record, but it may still be a required retained record under a predicate rule or company procedure.

Closed, open and hybrid systems

Closed systems

A closed system is one in which access is controlled by persons responsible for the content of the electronic records. A controlled pharmacovigilance application commonly operates as a closed system when the organisation controls identity management, roles, permissions, configuration, change control and relevant interfaces.

Section 11.10 lists controls for closed systems. The requirements are connected: validation addresses intended performance; access controls restrict unauthorised activity; authority checks limit actions to authorised roles; audit trails preserve history; training and written policies support accountability; and documentation controls preserve system evidence.

Open systems

An open system is one in which access is not controlled by persons responsible for the content in the manner described for a closed system. Section 11.30 requires additional measures designed to ensure record authenticity, integrity and confidentiality from creation to receipt.

A cloud or externally hosted system is not automatically an open system. Hosting location and system classification are different questions. The organisation should assess who controls access and the relevant security and integrity boundaries, including supplier interfaces and transfers.

Hybrid processes

Many PV processes are hybrid. A safety report may begin as an email or form, be entered into a vendor database, be medically assessed in another application, be submitted electronically and be subject to quality review in a document-management system. The process should be mapped as a chain of records rather than assessed only application by application.

The key controls are record identity, transfer completeness, reconciliation, timestamps, ownership, correction history and the ability to reconstruct the decision. A validated application cannot compensate for an uncontrolled hand-off at the process boundary.

Applying the assessment to pharmacovigilance

The table does not decide legal scope. It identifies evidence that a defensible assessment should examine.

Scope is a documented regulatory decision

A Part 11 assessment should be proportionate but explicit. A useful record includes:

• system and process name;
• intended use;
• regulated activities supported;
• applicable predicate rules;
• authoritative records and signatures;
• interfaces and third parties;
• closed, open or hybrid classification;
• required controls;
• retention and retrieval approach;
• risk assessment and residual risks;
• approval, review date and change triggers.

The assessment should be revisited when intended use, system boundary, record ownership, submission pathway, predicate rule or control environment changes.

Core controls for electronic records

Validation and intended use

Section 11.10(a) requires validation of systems to ensure accuracy, reliability, consistent intended performance and the ability to discern invalid or altered records. Validation or computerised-system assurance should be based on intended use and risk. It should cover relevant configuration, interfaces, calculations, workflows, security roles, audit trails, electronic signatures, migration and reporting outputs.

Validation is a lifecycle activity. Requirements, risk assessments, testing, deviations, release decisions, change control, periodic review and retirement evidence should remain connected. The scope of assurance should reflect the records and decisions the system supports.

Accurate and complete copies

Section 11.10(b) requires the ability to generate accurate and complete copies in human-readable and electronic form suitable for FDA inspection, review and copying. A screenshot or isolated export may be insufficient if it omits metadata, history, linked records, attachments, signatures or context.

Representative retrieval scenarios should be tested. A copy should preserve enough context to show what the record was, who acted, when the action occurred, what changed and how the record relates to the surrounding process.

Record protection and retention

Section 11.10(c) addresses protection that enables accurate and ready retrieval throughout the required retention period. Protection includes more than backup: access, preservation of associations and metadata, readable formats, restoration testing, retention rules, legal holds where applicable and controlled migration.

Part 11 does not create one universal retention period for all PV records. The organisation should document the governing retention basis and ensure that deletion, archival and system retirement do not destroy required evidence.

Access, operational and authority checks

Section 11.10(d) requires limiting access to authorised individuals. Effective access control includes unique identities, role design, least privilege, segregation of duties where appropriate, provisioning, modification and timely deprovisioning. Shared accounts undermine attribution.

Section 11.10(f) addresses operational checks and section 11.10(g) authority checks. For PV, examples include preventing case closure before required fields are completed, restricting approval to designated roles and preventing submission without required validation. A system check is useful only when its requirement, configuration, test evidence and exception handling are understood.

Training, policies and documentation

Section 11.10(i) requires determining that persons who develop, maintain or use electronic record or signature systems have appropriate education, training and experience. Section 11.10(j) addresses written policies that hold individuals accountable for actions initiated under electronic signatures. Section 11.10(k) addresses controls over system documentation.

Training should be linked to assigned roles and functions. Policies should address credential use, signature meaning, correction practices, prohibited sharing and escalation. Documentation controls should preserve approved requirements, configuration, validation evidence, operating procedures, change history and relevant supplier documentation.

Audit trails and review

Section 11.10(e) requires secure, computer-generated, time-stamped audit trails that independently record the date and time of operator entries and actions that create, modify or delete electronic records. The audit trail is evidence of record history, not a decorative feature.

The organisation should determine which events must be captured, whether the trail can be altered, how time is synchronised, how it is retained and how it is reviewed. Review frequency and depth should be based on process risk and record type. Review should identify unusual, unauthorised or unexplained changes and document investigation and disposition.

A time-stamped trail does not by itself prove that an entry is correct. It shows what the system recorded. Data quality, source verification, review and reconciliation remain necessary.

Electronic-record controls are interdependent

A record can fail even when each control appears present in isolation:

• a validated system may have excessive privileges;
• a complete audit trail may not be reviewed;
• a secure signature may be attached to the wrong version;
• a backup may omit linked metadata;
• a trained user may have inappropriate authority;
• a vendor may control a critical interface without adequate oversight.

Assessment should therefore test control relationships, not only individual checklist items. The required outcome is trustworthy evidence of the regulated activity.

Electronic signatures

When an electronic action is a signature

Part 11 addresses electronic signatures intended to have the same significance as handwritten signatures, initials or other required signings. Not every click, login, acknowledgement or workflow event is necessarily a Part 11 electronic signature. The organisation should define the meaning of each signing action and its relationship to the regulated record.

Examples may include approval of a safety assessment, certification of a submission, approval of a controlled procedure or authorisation of a validation decision. The significance comes from the regulated process and intended use, not from the visual appearance of a button.

Signature manifestations and linking

Section 11.50 requires signed electronic records to contain information associated with signing that clearly indicates the signer’s printed name, date and time of execution, and meaning associated with the signature, such as review, approval, responsibility or authorship.

Section 11.70 requires the signature to be linked to its electronic record so that it cannot be excised, copied or transferred by ordinary means to falsify another record. The organisation should test whether the signature remains associated with the approved version after export, revision, migration, archival and retrieval.

Signature uniqueness and identity

Section 11.100 requires each electronic signature to be unique to one individual and prohibits reuse or reassignment. Identity must be verified before the organisation establishes, assigns, certifies or otherwise sanctions the signature.

Section 11.200 describes controls for signatures based on at least two distinct identification components, such as an identification code and password. Section 11.300 addresses controls for identification codes and passwords. Biometric or certificate-based methods may be used where appropriate, but the method must support reliable identity, secure use and evidence of the action.

A generic approval account, shared password or signature performed by a delegate without controlled authority is not a satisfactory substitute for individual accountability.

Certification and legal equivalence

Section 11.3 defines electronic signatures and related terms. Section 11.100(c) addresses certification to FDA that an electronic signature is the legally binding equivalent of the signer’s handwritten signature. Organisations using Part 11 signatures should understand the certification requirements applicable to their process and retain evidence of the relevant certification.

Implementation, oversight and inspection

Practical implementation sequence

A proportionate implementation usually follows this sequence:

1. Map regulated processes and predicate rules.
2. Identify authoritative records and signatures.
3. Define system boundaries, interfaces and suppliers.
4. Perform a documented risk assessment.
5. Specify controls for access, audit trails, signatures, copies, retention and change.
6. Validate or assure the system for intended use.
7. Train users and approve procedures.
8. Operate the controls and review performance.
9. Reassess after changes, incidents, migrations or new regulatory use.
10. Preserve inspection-ready evidence.

QPPV oversight

The QPPV should have visibility of critical PV systems, data-quality risks, significant deviations, vendor controls, material system changes and escalations that could affect the reliability or availability of the pharmacovigilance system. Technical ownership may remain with IT, quality or a system owner.

The QPPV should not be presented as the mandatory approver of every technical configuration unless a specific legal, regulatory or company requirement says so. The oversight question is whether the QPPV can identify and escalate system conditions that threaten the pharmacovigilance system.

Inspection questions and evidence

An inspector may ask:

• What predicate rule makes this record significant?
• Which record is authoritative?
• How do you know the electronic copy is complete?
• Who can create, modify, approve or delete the record?
• How are access changes controlled?
• Can you show the audit trail for a representative correction?
• How are audit trails reviewed?
• How is a signature linked to the approved version?
• What happens during migration or system retirement?
• How are vendor-hosted records and interfaces overseen?
• What evidence shows that controls operate effectively?

Evidence may include the applicability assessment, requirements, risk assessment, validation package, access reviews, training records, audit-trail reviews, signature tests, change controls, backup and restoration tests, supplier oversight and deviation or CAPA records.

Common failure modes

The following are illustrative failure modes, not claims about a particular inspection:

• treating the whole application as automatically in scope without identifying records;
• treating guidance enforcement discretion as an exemption from Part 11;
• relying on a paper printout while the electronic record is used for the decision;
• allowing shared accounts or delayed deprovisioning;
• configuring an audit trail but never reviewing it;
• signing a document without preserving the signed version;
• validating the application but not its interfaces or migrated data;
• retaining a backup that cannot be restored in a readable and complete form;
• failing to assess supplier access and hosted-system responsibilities;
• changing the business process without reassessing the applicability decision.

Practical checklist

Before relying on an electronic PV record or signature, confirm that:

• the regulated activity and predicate rule are identified;
• the authoritative record is defined;
• the scope decision is documented;
• system boundaries and interfaces are known;
• access, authority and segregation controls are appropriate;
• audit trails capture relevant events and are reviewed;
• signatures show identity, time and meaning and remain linked;
• accurate and complete copies can be produced;
• retention, backup, migration and retirement are controlled;
• users are trained and accountable;
• vendors are governed;
• changes, incidents and deviations trigger reassessment where necessary.

Summary

Part 11 is neither a universal label for digital information nor a substitute for underlying FDA requirements. A sound implementation connects predicate rules to authoritative records, applies proportionate lifecycle controls, preserves attributable history and demonstrates that electronic signatures represent intentional actions by identified and authorised individuals.

References

1. 21 CFR Part 11, Electronic Records; Electronic Signatures.
2. FDA, Guidance for Industry: Part 11, Electronic Records; Electronic Signatures — Scope and Application.
3. FDA, Electronic Systems, Electronic Records, and Electronic Signatures in Clinical Investigations.
4. FDA, Data Integrity and Compliance With Drug CGMP.
5. FDA, Part 11 Subpart B — Electronic Records.
6. FDA, Part 11 Subpart C — Electronic Signatures.

Regulatory Note

This article explains the US FDA framework for educational purposes. Part 11 applies within its defined scope and must be read with applicable predicate rules, product-specific requirements, submission pathways and current FDA guidance. EU pharmacovigilance organisations may also be subject to EU and national requirements for data integrity, computerised systems, records and electronic signatures; those requirements are not replaced by Part 11. Obtain current regulatory and legal advice for a specific system or compliance decision.