Real e-signatures, real audit trails, real segregation of duties.
Gap assessment, remediation and validation of Part 11 electronic records and electronic signatures across your GxP system estate. We fix the common failures: shared logins, non-reauthenticated signatures, mutable audit tables, missing meaning/timestamp.
21 CFR Part 11 governs electronic records and signatures where a predicate GMP, GCP or GLP rule requires the record. Compliance rests on validated systems, secure computer-generated audit trails that are actually reviewed, and signatures carrying the signer's name, the date and time, and the meaning — permanently bound to the record signed.
Outcomes you can expect
- Part 11 gap assessment + remediation
- Signed & frozen document lifecycle
- Enforced segregation of duties
FDA 21 CFR Part 11 Compliance is delivered by our validation & compliance services practice. Where it saves time, the team uses our products: GxP Copilot for validation lifecycle work and TraceDraft for clinical documentation.
Explore related capabilities: Computer System Validation (CSV), Computer Software Assurance (CSA), AI Validation Services (Annex 22), EU Annex 11 & Annex 22 Compliance.
What 21 CFR Part 11 Actually Requires — and Where Organisations Fall Short
21 CFR Part 11 sets the FDA standard for electronic records and electronic signatures in GxP-regulated environments. It applies to any electronic record that is required by FDA regulations or is submitted to FDA — which covers the majority of records generated in pharmaceutical manufacturing, clinical trials, and medical device quality systems. The standard is not new: it was enacted in 1997 and has been the subject of FDA guidance, warning letters, and 483 observations ever since. Despite this, Part 11 compliance failures remain among the most commonly cited data integrity findings in FDA inspections.
The most prevalent compliance gaps are not exotic. Shared user accounts that make attribution impossible. Electronic signatures that do not include re-authentication, meaning, timestamp, or signer name. Audit trail records stored in database tables that application users can modify or delete. Documents that can be edited after electronic approval without creating a new version. Validation packages for electronic records systems that assess functional requirements but never verify the Part 11 controls themselves. These are not sophisticated failures — they are systematic gaps that persist because Part 11 compliance is routinely assessed at the policy level without being verified at the system level.
- 1The signer’s printed name
- 2When it was signed
- 3What the signature means
- 4Credentials entered again at signing
The §11.10 Controls for Closed Systems
Section 11.10 specifies the controls required for closed systems — systems where access is controlled by the organisation that owns the data. The controls include: validation of the system to ensure accuracy, reliability, consistent intended performance, and the ability to discern invalid or altered records; the ability to generate accurate and complete copies of records in human-readable form; protection of records to enable accurate and ready retrieval throughout the retention period; limiting system access to authorised individuals; use of operational system checks to enforce permitted sequencing of steps and events; use of authority checks to ensure only authorised individuals can use the system, electronically sign records, access the audit trail, or alter records; use of device checks as appropriate; personnel training; documentation of policies and procedures for using and verifying the authenticity of electronic signatures.
The most commonly failed §11.10 control in practice is the audit trail requirement. The control requires a secure, computer-generated, time-stamped audit trail that independently records the date and time of operator entries and actions that create, modify, or delete electronic records. Two elements of this control are frequently absent: the audit trail is application-managed rather than database-level, meaning it can be modified or deleted by application administrators; and the timestamps come from user workstation clocks rather than a controlled, synchronised time server, making them untrustworthy as contemporaneous evidence.
Electronic Signature Components: §11.100 and §11.200
Part 11's electronic signature requirements are specific and non-negotiable. Under §11.100, electronic signatures must be unique to one individual and not reused or reassigned. Under §11.200, each electronic signature must contain information associated with the signing — printed name of the signer, date and time of signing, and the meaning of the signature (review, approval, responsibility, authorship). The signature must be linked to the electronic record in such a way that the record cannot be separated from the signature — a signed document that can be printed and re-uploaded without the signature is not Part 11 compliant.
Re-authentication at the time of signing is a requirement for electronic signatures when the signer is not re-accessing the system for the first time in a session. Most organisations implement this correctly at login but fail it for subsequent signatures within the same session: a reviewer who signs 20 documents in sequence should re-enter their password at each signature, not just at login. Systems that implement a 'keep me signed in' model without per-signature re-authentication are not Part 11 compliant for those signatures. Our gap assessment verifies re-authentication at the system configuration level, not just at the policy level.
Common Warning Letter Findings and How to Prevent Them
FDA Warning Letters citing Part 11 deficiencies consistently cite a predictable set of failures: shared user accounts used by multiple analysts, making it impossible to attribute data records to a specific individual; password policies that do not require periodic changes or have minimum complexity requirements; audit trails that were technically enabled but not reviewed as part of the batch record review process; electronic signatures applied to summary records without linking to the underlying data records; and validation packages that covered functional requirements but did not test the Part 11 controls specifically.
Prevention requires explicit test scripts that verify every Part 11 control at the system configuration level during qualification — not just a checklist completed at a policy review. Our Part 11 compliance engagements include a dedicated test suite that verifies: unique user accounts, access control enforcement, audit trail content and immutability, electronic signature components and re-authentication, and system validation documentation. Passing these tests in OQ means the system's Part 11 posture is documented — not just assumed.
Part 11 Gap Assessment and Remediation Methodology
Our Part 11 gap assessment follows a structured methodology: system inventory and scope confirmation; regulatory applicability assessment for each system (does it create, modify, maintain, archive, retrieve, or transmit electronic records required by FDA?); configuration review against the §11.10 control list; live system testing of audit trail content, signature components, and access controls; and interview of system administrators and regular users to identify procedural gaps not visible in configuration settings alone.
The remediation plan from the gap assessment is risk-stratified: critical gaps (shared accounts, modifiable audit trails, missing signature components) receive immediate remediation before the next inspection cycle; major gaps (incomplete validation documentation, missing audit trail review procedures) receive 30–90 day remediation timelines; and minor gaps (missing period review SOPs, training record gaps) receive 90–180 day timelines. Each remediation action is tracked through the CAPA system with defined verification of effectiveness. Our validation team delivers the updated system validation documentation following remediation.
Sources
Primary documents referred to on this page, from their official publishers.
See it on your own system.
Bring a URS or a system. We show you the validation package it produces.
- We reply within one business day
- We run your URS live on the call
- You get a clear plan and scope