Hi all,
I am wondering if someone can answer a question regarding 21 CFR Part 11
requirements.
The question is around the auditing of the information stored with the
document. Is it required that any metadata changes must record who made the
change, the date of the change and what the value of a field was changed
to. Are you also required to record what the field was prior to the change?
Thanks in advance for any guidance!
Here is the actual verbiage …
It is the agency’s intent that the audit trail provide a record of
essentially who did what, wrote what, and when. The
write-to-file operations referenced in the proposed rule were not intended
to cover the kind of ‘‘background’’
nonhuman recordings the comments identified. The agency considers such
operator actions as activating a manufacturing
sequence or turning off an alarm to warrant the same audit trail coverage as
operator data entries in order to
document a thorough history of events and those responsible for such events.
Although FDA acknowledges that not
every operator ‘‘action,’’ such as switching among screen displays, need be
covered by audit trails, the agency is
concerned that revising the rule to cover only ‘‘critical’’ operations would
result in excluding much information and
actions that are necessary to document events thoroughly. The agency
believes that, in general,
the kinds of operator actions that need to be covered by an audit trail are
those important enough to memorialize in the
electronic record itself. These are actions which, for the most part, would
be recorded in corresponding paper
records according to existing recordkeeping requirements. The agency intends
that the audit trail
capture operator actions (e.g., a command to open a valve) at the time they
occur, and operator information
(e.g., data entry) at the time the information is saved to the recording
media (such as disk or tape), in much
the same manner as such actions and information are memorialized on paper.
The audit trail need not capture every
keystroke and mistake that is held in a temporary buffer before those
commitments. For example, where an
operator records the lot number of an ingredient by typing the lot number,
followed by the ‘‘return key’’ (where
pressing the return key would cause the information to be saved to a disk
file), the audit trail need not record every
‘‘backspace delete’’ key the operator may have previously pressed to correct
a typing error. Subsequent ‘‘saved’’
corrections made after such a commitment, however, must be part of the audit
trail.
At this time, the agency’s primary concern relates to the integrity of human
actions. Should the agency’s experience
with part 11 demonstrate a need to require audit trails of device operations
and entries, the agency will propose
appropriate revisions to these regulations. Accordingly, the agency has
revised proposed § 11.10(e) by removing
reference to all write-to-file operations and clarifying that the audit
trail is to cover operator entries and actions that
create, modify, or delete electronic records.
Stephanie Eaton
List archives at http://lists.ufl.edu/archives/recmgmt-l.html
Contact [log in to unmask] for assistance
To unsubscribe from this list, click the below link. If not already present, place UNSUBSCRIBE RECMGMT-L or UNSUB RECMGMT-L in the body of the message.
mailto:[log in to unmask]
|