HACCP Horsepower

Bolting on Part 11

These “pilot plans” used by the retail coffee chain and the Namibia meat company as Blanchard described essentially apply many aspects of what 21 CFR Part 11 is all about. The regulation, unveiled by the FDA in 1997, was part of an agency-wide effort to decrease the amount of paper generated by such record-keeping activities. It allows companies to keep electronic records and use electronic signatures through the use of Web- or local area network-geared database software. While Part 11 is the proverbial catalytic converter for such life science industries as pharmaceutical and biotech companies, it remains merely an option for the straight-pipe running food industry, says Sebastian Cianci, an FDA policy analyst and spokesman. “We don’t have a preference one way or the other,” he says. “It’s up to the company. We do, however, want the records to be true and accurate and be presented to us when requested. Now just because we don’t express a preference, it doesn’t mean [a company] won’t find benefits in one [method] or the other.” When presented with the belief that Part 11 would become a food industry regulation once the FDA finished helping life science industries comply, Cianci replied, “That may be the feeling, but I couldn’t speculate one way or the other.” However, if a food company or food service operation does decide to keep electronic records, there are guidelines on how to do so, he adds. The guidelines provide specifics on definitions for electronic records and signatures; appropriate controls for closed and open systems; signature manifestation and record linking and controls for signatures, identification and passwords. (Part 11 guidelines can be found at www.access.gpo.gov/nara/cfr/waisidx_04/21cfr11_04.html.) An electronic record, for example, is defined by the agency as “any combination of text, graphics, data, audio, pictorial or other information represented in a digital form that is created, modified, maintained, archived, retrieved or distributed by a computer system.” Electronic signatures are just that; the legally binding equivalent of an individual’s handwritten signature. The agency deems open systems as environments in which system access is not controlled by workers responsible for the content of the electrical records on that system. Access to a closed system, on the other hand, is controlled by persons responsible for electronic record content. The remainder of the guidelines deals strictly with maintaining the authenticity and integrity of those records by way of who has access to records and how they are maintained for audit trail purposes. “Part 11 deals with automated processes and how you go about validating that everything works,” says Bill Freitag, president Agile Technologies LLC, a Bridgewater, N.J-based consulting firm that assists life science companies in developing IT platforms. “The FDA is most interested in retention and how easy it is to access information, and how to make it easier to collect information so that it’s more accurate.” The agency, he explains, is equally concerned with maintaining the audit trial. “Say you don’t have a back-up strategy and your network crashes. Companies should not be losing data. [The FDA] wants to see ways of backing up and restoring that information.” Federal regulators also want validation when it comes to authenticating signatures, or how is it determined that people using the record-keeping system are who they say they are. “You have to make sure that only the people who need to have access have access,” Freitag says. “Some people should only be able to read the information, and some people should be able to edit or update it. You need to define who those people are and what they need access to. If everyone has access to the same information, there’s no audit trail.”