Transcription
Comparison of FDA’s Part 11 and the EU’s Annex 11IntroductionThe relationship between FDA’s Part 11 (21 CFR Part 11) and the EuropeanUnion’s Annex 11 (EUDRALEX Rules Governing Medicinal Products in theEuropean Union, Volume 4, Good Manufacturing Practice, Medicinal Productsfor Human and Veterinary Use) diverges in philosophy. Both documents coverthe same topic, the use of computerized systems in regulated activities. However, the approach of Part11 is to make clear there are requirements to be met in order to conform to regulations. The emphasis ison activities and reporting.In contrast, the approach of Annex 11 is to make clear how to conform to its rules. Annex 11 is adetailed guide to the areas of compliance that need documentation. A significant difference is theapproach to risk management. Annex 11 points to risk assessment as the start of compliance activities.Part 11 differentiates security for open and closed systems, with extra security measures for opensystems but without reference to risk or criticality. The aggregate of these differences is representedvisually with the point-to-point comparison matrix shown below.Table 1: High Level Comparison of Annex 11 and Part 11Annex 11Part 11Scope/PrincipleComputerized systems as part of GMPregulated activities.Application should be validated.IT infrastructure should be qualified.Electronic records and electronicsignatures as used for all FDAregulated activities.FocusRisk- based quality management ofcomputerized systems.Using electronic records andsignatures in open and closedcomputer systems.ObjectiveUsing a computerized system shouldensure the same product quality andquality assurance as manual systemswith no increase in the overall risk.Electronic records and signaturesshould be as trustworthy and reliableas paper records and handwrittensignatures.EduQuest, Inc. * 1896 Urbana Pike, #14, Hyattstown, MD 20871 USA* www.EduQuest.net * 1 (301) 874-6031
Comparison of FDA’s Part 11 and the EU’s Annex 11Table 2: Cross-Reference from Annex 11 to Part 11Annex 11Section No.Annex 4.74.8GeneralRisk ManagementPersonnelSuppliers and Service Providersformal agreementsaudit supplierreview documentation for COTSsupplier audit available on requestProject PhaseValidationcover life cyclechange control and deviationssystems inventoryuser requirement specificationsquality management systemprocess for customized systemsevidence of appropriate test methodsdata transfer validationOperational Phase5Data67Accuracy ChecksData Storage7.17.28secured and accessibleback-upPrintouts8.1clear printed copies8.2batch release/changed since originalPart 11 Cross Reference(substantially equivalent)11.2(b)- Implementation11.10(a)- Validationnot covered11.10(i)- Personnelnot coverednot coverednot coverednot coverednot covered11.10(a)- Validationnot covered11.10(k)- Documentation controlnot coverednot coverednot coverednot coverednot covered11.10(h)- Device checks11.10(f)- Operational system checks11.30- Controls for open systems11.10(f)- Operational system checks11.10(c)- Protection of records11.10(d)Limiting system access11.10(e)-Secure Records11.10(g)-Authority checksnot covered11.10(b)- Generate accurate andcomplete copiesnot coveredEduQuest, Inc. * 1896 Urbana Pike, #14, Hyattstown, MD 20871 USA* www.EduQuest.net * 1 (301) 874-6031
Comparison of FDA’s Part 11 and the EU’s Annex 11Annex 11Section No.Annex 11Title9Audit Trails10Change and ConfigurationManagement11Periodic ord eventsdata management/operators entriesIncident ManagementElectronic Signaturesame as hand-writtenpermanent linktime and dateBatch releaseBusiness ContinuityArchivingPart 11 Cross Reference(substantially equivalent)11.10(e)- Electronic audit trail,11.10(k)(2)- Documentation control11.10(d)- Limiting system access11.10(e)- Electronic audit trail11.300(b) and (e)- periodically checked11.10(k)- Documentation control11.10(c)- Protection of records11.10(d)- Limiting system access11.10(g)- Authority checks11.200(a) and (b)biometrics11.300(a) Unique11.300(d)- prevent unauthorized usenot covered11.300(b)and (c)-Controls forIdentification Codes/Passwords11.10(e)-Controls for Closed Systemsnot covered11.50-Signature manifestations11.1(a) Scope11.3(b)(7) Definitions11.100(c) Certify equivalent tohandwritten11.70- Signature/record linking11.10(e)- Electronic audit trailnot coverednot covered11.10(c)- Protection of records foraccurate retrievalEduQuest, Inc. * 1896 Urbana Pike, #14, Hyattstown, MD 20871 USA* www.EduQuest.net * 1 (301) 874-6031
Comparison of FDA’s Part 11 and the EU’s Annex 11Table 3: Cross-Reference from Part 11 to Annex 11Part 11Section No.11.1011.10(a)11.10(b)Part 11TitleSubpart B--Electronic RecordsControls for closed systemsValidationGenerate accurate and complete copies11.10(c)Protection of records for accurate retrieval11.10(d)Limiting system access to authorized individuals11.10(e)Record of operator entries (audit trail)11.10(f)Operational system checks11.10(g)Authority checks11.10(h)Device checksPersonnel (who develop, users and maintainsystems)User accountability for actions initiated tion control11.30Controls for open systemsAnnex 11 Cross Reference(substantially equivalent)4-Validation8.1-Printouts17-Archiving, 12-Security7-Data Storage7.1- secured and accessible10- Change and ConfigurationManagement12.1-Security, physical/logical7.1- secured and accessible9-Audit Trails10-Change and ConfigurationManagement12.4- datamanagement/operators entries14(c)-Electronic Signature5-Data, 6- Accuracy Checks7.1- secured and accessible12.1-Security, physical/logical4.8-Validation2-Personnelnot covered9-Audit Trails4.2- change control anddeviations10-Change and ConfigurationManagement11- Periodic evaluationPrinciple (all systems)5. DataEduQuest, Inc. * 1896 Urbana Pike, #14, Hyattstown, MD 20871 USA* www.EduQuest.net * 1 (301) 874-6031
Comparison of FDA’s Part 11 and the EU’s Annex 11Part 11Section 0011.200(a)11.200(b)11.300(a)Part 11TitleSignature manifestationsSignature/record linkingSubpart C--Electronic SignaturesGeneral requirementsUnique/not reusedVerify identityCertify equivalent to handwrittenElectronic signature components and controls.not based on biometricsbased on biometricsUnique11.300(b)periodically checked11.300(c)11.300(d)11.300(e)procedures to deauthorizeprevent unauthorized useproper functionAnnex 11 Cross Reference(substantially equivalent)14-Electronic Signature14(b)-Electronic Signaturenot coverednot covered14(a) same as hand-written12.1-Security, physical/logical12.1-Security, physical/logical12.1-Security, physical/logical11. Periodic Evaluation12.3-Security- record events12.3-Security, record events12.1-Security11-Periodic evaluationConclusionsAnnex 11 for computerized systems impacts manufacturers who export to the EU and those whomanufacture products in the EU. Close scrutiny of the parallel FDA and EU rules shows the authoritiesshare a mutual intent to have safe, validated computer systems and qualified networks for drug anddevice manufacturing.Limited areas of Part 11 are dissimilar to Annex 11; these, for the most part, are limited to theverification of identity and accountability of actions by authorized individuals, as well as to the reportingto authorities. Part 11 applies to e-submissions to the FDA. Annex 11 is different from Part 11 in that ittakes a risk management approach to criticality and emphasises a systems approach to periodicevaluations. Annex 11 is ‘how to’ while Part 11 is ‘thou shalt’ in tone. Together they form a robust andusable guide for computer validation professionals leading their companies and clients to compliance.About EduQuestEduQuest is a global team of FDA compliance experts based near Washington, DC. Founded by former senior FDAofficials, EduQuest provides practical auditing, validation and training services to bio-pharmaceutical and medicaldevice companies worldwide.EduQuest, Inc. * 1896 Urbana Pike, #14, Hyattstown, MD 20871 USA* www.EduQuest.net * 1 (301) 874-6031
Comparison of FDA ˇs Part 11 and the EU ˇs Annex 11 EduQuest, Inc. * 1896 Urbana Pike, #14, Hyattstown, MD 20871 USA* www.EduQuest.net * 1 (301) 874-6031 Introduction The relationship between FDA ˇs Part 11 (21 CFR Part 11) and the European Union ˇs Annex 11 (EUDRALEX Rules Governing Medicinal Products in the European Union, Volume 4, Good Manufacturing Practice,
