Audit trail
Secure, computer-generated, time-stamped records of who created, changed or deleted an entry. Changes must not hide earlier entries, and the audit trail is kept as long as the record.
For pharma, biotech and medical device companies
21 CFR Part 11 in your ITElectronic records you can trust
If you keep records the FDA requires in electronic form, 21 CFR Part 11 applies. It asks for trustworthy records, controlled access, secure audit trails and reliable electronic signatures. Your quality assurance team owns validation. We build and run the IT infrastructure underneath it and deliver the technical documentation your QA needs.
What Part 11 covers
21 CFR Part 11 applies to electronic records that FDA regulations require you to keep, and to electronic signatures on such records. Typical examples are batch records, laboratory data, complaint files, training records and records in a quality management system.
In its guidance on scope and application, the FDA explains that it interprets Part 11 narrowly and applies enforcement discretion to some requirements, such as validation, audit trails and record copies. That does not remove the underlying requirements in the predicate rules, such as GMP. Controls for access, operational checks and electronic signatures continue to apply in full.
The technical core
Access control
Only authorized people can use the system, sign records, change data or perform operations. We assign rights by role and review them regularly.
Unique accounts
Each electronic signature belongs to exactly one person. Shared accounts do not work in a Part 11 environment.
Synchronized time
Audit trails are only useful if all systems use the same reliable time source. We set this up for servers, clients and cloud services.
Backup and retention
Records stay readable and retrievable for the whole retention period, including after a system change. Restores are tested and documented.
Qualified infrastructure
Servers, network and cloud services that run validated applications are documented and kept in a defined state, with change control.
Electronic signatures under Part 11
- Each signature is unique to one person and is never reused or reassigned
- The signature shows the name of the signer, the date and time, and the meaning, such as review or approval
- Signatures are linked to their records so they cannot be copied or removed
- Signatures not based on biometrics use at least two components, such as a user ID and a password
- Password and token controls, including periodic checks and handling of lost tokens
- Your company certifies to the FDA that electronic signatures are the legally binding equivalent of handwritten signatures
Computer Software Assurance
In September 2025 the FDA finalized its guidance Computer Software Assurance for Production and Quality System Software. It applies to software used in medical device production and quality systems and recommends a risk-based approach: validation effort should match the risk to product quality and patient safety, rather than producing the same documentation for every tool.
For your IT this means fewer test scripts for low-risk tools and more focus on the systems that really matter. Your QA decides the approach. We provide the technical facts, such as system descriptions, configuration and change records.
Who is responsible for what
Validation is the responsibility of your company and its quality assurance. We do not validate your GxP applications and do not make regulatory decisions. We qualify and operate the infrastructure, implement access control, audit logging and backup, and document it in a form your QA can use.
How we work with you
- 01
Inventory
Together with QA we determine which systems hold Part 11 records and what the infrastructure beneath them looks like.
- 02
Gap list
You receive a list of technical gaps in access control, audit trail, time sync and backup, ordered by risk. The security assessment starts at $7,900 and is credited toward the follow-up project.
- 03
Implementation
We implement the measures and document them so QA can build the qualification and validation on top.
- 04
Operation under change control
Changes to the infrastructure follow an agreed process, so your validated state remains intact.
Experience in pharma research
Pharma research, international · 5 users, Germany
We took over the complete IT of an internationally active research company and realigned it in close cooperation with management.
Result: A fully automated IT environment designed for strict security requirements, with separate admin and user accounts and secured VPN routing between locations.
Updated:
FAQ
Frequently asked questions
When does 21 CFR Part 11 apply?
Part 11 applies when you keep records that FDA regulations require in electronic form, or submit them electronically to the FDA, and when you use electronic signatures on such records. Which records are affected follows from the predicate rules, such as the GMP regulations.
Who is responsible for validation?
Your company is, usually through quality assurance. We qualify and operate the IT infrastructure and provide the technical documentation. The validation strategy and the release of systems stay with your QA.
What does an audit trail have to record?
A secure, computer-generated, time-stamped record of when and by whom an electronic record was created, modified or deleted. Changes must not obscure earlier information, and the audit trail must be kept as long as the record itself and be available to the FDA for review.
Do we still have to validate everything?
The FDA expects a risk-based approach. Its Computer Software Assurance guidance, finalized in September 2025 for production and quality system software, recommends matching validation effort to risk. Your QA decides how to apply it.
Can we use cloud services under Part 11?
Yes, if the service supports the required controls, such as audit trails, access control and retention, and if you have assessed the provider. We help with the technical review and the configuration. Your QA decides whether the service can be used for GxP purposes.
Is there a Part 11 certification for software?
No. The FDA does not certify software as Part 11 compliant. A vendor can provide functions that support compliance, but whether your use of the system is compliant depends on configuration, procedures and validation in your company.
FDA 21 CFR Part 11
Let us talk about your systems
Tell us which systems hold your regulated records and how your IT is set up. We will tell you where we can support your QA and what the work involves.