21 CFR Part 11 sets the conditions under which FDA treats electronic records and electronic signatures as trustworthy and equivalent to paper. This checklist walks through the controls in sections 11.10, 11.50, 11.70, and 11.100 through 11.300 that a regulated system and its procedures need to cover.
Does Part 11 apply to your records?
Part 11 applies to records that a predicate rule, such as Part 211 or Part 111, requires you to keep, when you create, modify, maintain, archive, retrieve, or transmit them electronically. FDA's scope and application guidance takes a narrow, risk-based reading and applies enforcement discretion to some requirements, but predicate-rule obligations still apply in full. The regulation text is on the eCFR.
System controls (11.10)
- Validation for accuracy, reliability, consistent performance, and the ability to detect invalid or altered records
- Accurate and complete copies in human-readable and electronic form
- Records protected for accurate retrieval throughout the retention period
- System access limited to authorized individuals
- Secure, computer-generated, time-stamped audit trails of entries and changes that never obscure earlier values and are kept as long as the record
- Operational checks that enforce the permitted sequence of steps
- Authority checks on who can sign, alter records, or perform operations
- Device checks on the validity of data input sources
- Training for the people who build, maintain, and use the system
- Written policies holding people accountable for actions under their signatures
- Control over system documentation, including change control
Signature manifestations and linking (11.50, 11.70)
Every signed record must show the signer's printed name, the date and time of signing, and the meaning of the signature, such as review, approval, or authorship, including in printed and displayed copies. Signatures must be linked to their records so they cannot be removed, copied, or transferred to falsify another record.
Electronic signature controls (11.100 to 11.300)
- Each signature is unique to one person and never reused or reassigned
- Identity is verified before a signature is assigned
- The organization certifies to FDA that its electronic signatures are the legally binding equivalent of handwritten ones
- Non-biometric signatures use at least two components, such as an ID and a password
- In one continuous session, the first signing uses all components and later signings use at least one
- ID and password combinations stay unique, are periodically checked, and are disabled when lost or compromised
Procedural controls teams forget
Most Part 11 gaps are procedural, not technical: no SOP on signature accountability, no periodic access reviews, audit trails that are never reviewed, untested backup and restore, and changes made without change control. Validation is covered in the GAMP 5 and computer system validation guide.
How Ovada handles Part 11
Ovada is 21 CFR Part 11 compliant. Signatures capture the signer, the meaning, re-authentication at signing, and a permanent link to the signed record; actions land in an append-only audit trail; and a validation package with IQ/OQ/PQ documentation comes with the system. See Ovada's Part 11 approach.
Questions
Does 21 CFR Part 11 require audit trails?
Section 11.10(e) requires secure, computer-generated, time-stamped audit trails for records in scope. FDA's scope and application guidance applies enforcement discretion here, but most regulated companies keep audit trails because predicate rules and data integrity expectations still apply.
What does Part 11 require on a signed electronic record?
The signer's printed name, the date and time of signing, and the meaning of the signature, such as review, approval, or authorship.
Is a typed name an electronic signature under Part 11?
It can be, but only with the Part 11 controls around it: a signature unique to one person, at least two identification components, and the required signature manifestation linked to the record.