Before digitizing a clinical process, it’s worth being clear on what 21 CFR Part 11 requires. This checklist sums up the points we review in every delivery.
Electronic signature
- Each signature uniquely binds to one person.
- Name, date/time and the meaning of the signature are recorded.
- A signature cannot be reused or transferred.
Audit trail
- Secure, time-stamped record of creations, changes and deletions.
- The audit trail cannot be edited or disabled by users.
- It is retained for the required period and available for review.
Access control
- Strong authentication and roles with least privilege.
- Lockout after inactivity and revocation of access when leaving the team.
Data integrity
- Input validation and integrity controls.
- Backups and recovery capability.
This checklist is a reference, not regulatory advice. Adapt it with your quality team.
Want us to review it against your system? Talk to our team.