The Impact of 21 CFR Part 11 on Equipment Design for R&D Applications

The US Food and Drug Administration (FDA) regulation governing electronic records and electronic signatures, 21 CFR Part 11, has now been in effect for more than 5 years. It attempts to establish the standards required to ensure that electronic records and electronic signatures are the trustworthy equivalents of paper records and handwritten signatures. Considering recent changes to FDA's Part 11 guidance documents, the pharmaceutical and medical device industries are expected to be making significant progress towards achieving compliance with the rule. Interpretations of how Part 11 should be applied to research and development (R&D) activities vary widely. This article examines the application of Part 11 to those areas of R&D where application of the rule is not strictly required. The response of R&D equipment vendors to the requirements of the rule and the needs of their customers is also studied. The case is presented that vendors must accept that understanding and complying with the regulation is now part of the pharmaceutical business environment. Equipment vendors are urged to view the provision of Part 11 functionality and validation support as an opportunity to differentiate themselves from their competitors. Otherwise, they risk losing customers.

Background and scope

Definition. Effective since 20 August 1997, the regulation specifies how companies in FDA-governed industries must manage and control electronic records and electronic signatures. FDA defines an electronic record as "any combination of text, graphics, data, audio, pictorial or other information represented in digital form that is created, modified, maintained, archived, retrieved or distributed by a computer system."1 An electronic signature is defined as a "computer data compilation of any symbol or series of symbols executed, adopted or authorized by an individual to be the legally binding equivalent of the individual's handwritten signature."

The scope of the regulation "applies to records in electronic form that are created, modified, maintained, archived, retrieved or transmitted under any records requirements" as set forth by a predicate rule. A predicate rule is any FDA regulation that requires the maintenance or submission of a record for FDA review and approval including, for example:

• 21 CFR 58 (good laboratory practice [GLP])

• 21 CFR 210 and 211 (current good manufacturing practice [cGMP] in manufacturing, processing, packing or holding of drugs; general and cGMP for finished pharmaceuticals)

• 21 CFR 312 (investigational new drug application [IND])

• 21 CFR 820 (quality system regulation [for medical devices]).

Prior to the implementation of Part 11, FDA had no provisions for the storage or submission of any required records in electronic format. Part 11 did not change the basics of computer system validation, which has long been a regulatory requirement. It does, however, introduce the requirement for the validation of more systems than before and also requires new software functions, such as the generation of audit trails and the creation of accurate and complete copies, which must also be validated.

Part 11's broad scope applies to records required by FDA regarding the development, manufacture and marketing of life sciences products, including drugs, diagnostics and medical devices. It includes records created after the rule became effective and applies to any records created before 20 August 1997 if they have been modified, maintained, archived, retrieved or distributed via a computer system since that date. Although the rule is US-based, it has global reach as non-US companies must comply if they wish to do business in the US. Part 11 also affects the operations of companies that form part of the supply chain supporting the pharmaceutical and medical device industries. In February 2003, FDA issued a new draft guidance for the use of electronic records and signatures,2 and withdrew all other guidance documents related to Part 11. It has embarked on a re-examination of Part 11 as part of its initiative to apply a risk-based approach to cGMPs. The new guidance acknowledges the widespread criticisms from industry and states that, for the duration of the re-examination of Part 11, FDA intends to interpret the scope of Part 11 narrowly. The agency will also exercise enforcement discretion with respect to certain Part 11 requirements; for example, FDA will not normally enforce compliance with the validation, audit trail, record retention or the record copying requirements of Part 11. However, it stresses that Part 11 is still in effect and that records must be maintained and submitted in accordance with applicable predicate rules.

Costs. Achieving Part 11 compliance requires a substantial investment from each pharmaceutical company. Costs include, for example, a Part 11 committee's time; deploying life cycle methodologies; qualifying operation systems and databases; retrofitting time-stamped audit trails; and securing clinical data acquisition systems. This investment is balanced against the risk of receiving a non-compliance citation. FDA wants to ensure that Part 11 strategy is risk- and science- based, meaning that compliance efforts should be focussed on the records for those critical areas that have the greatest effect on product quality. FDA is, therefore, most concerned about systems involved in drug distribution, drug approval, manufacturing and quality assurance (QA), as these systems pose the greatest risk to patient safety. Companies found to be non-compliant with Part 11 and the underlying predicate rule could receive a Form 483, a warning letter or a more severe reprimand such as an injunction, which can involve a market recall, ban on importation or a consent decree. The receipt of a warning letter has caused companies' stock to lose up to half its value when the letter was made public.3 The number of warning letters related to failures to meet Part 11 requirements increased from 10 in 1999 to 25 during 2001.3

Application in R&D

FDA and the pharmaceutical and medical device industries are essentially collaborating to develop a consistent and practical approach to Part 11 application. Currently, however, there continues to be considerable variation regarding Part 11 interpretation. To the companies involved, it seems that the compliance target is moving. By and large, response to the rule's requirements has been slow, for which there are several possible reasons.

• There is a general lack of understanding of the law at the executive level, which results in Part 11 implementation teams not having the support of senior management to implement company-wide changes and programmes.

• Many organizations have not been able to agree on a consistent interpretation of the law and its scope. Additionally, the business implications are often not sufficiently recognized and understood.

• Within companies, it is not always clear who is responsible for compliance. Part 11 is still often considered an information technology (IT)-only issue instead of a combination of management, quality and IT responsibilities.

• Compared with Y2K, the absence of a formal deadline results in the assumption that the attainment of compliance is not urgent and many companies continue to adopt a wait and see strategy.

These companies, therefore, will fall further behind competitors and risk the receipt of a non-compliance citation. Other companies, however, are acting quickly, intending to help shape how the rule is applied. Although the new guidance and re-examination of Part 11 has generally been welcomed, the apparent vacillation in FDA opinion has resulted in increased frustration within the industry, and has even been felt to undermine the efforts and authority of individuals within impacted organizations tasked with ensuring compliance.

The application of Part 11 depends on the predicate rule applicable for the given situation. Audit trails, for example, are required by some predicate rules, but not by others. Part 11 applies to most predicate rules when data must be archived and a computer with durable storage is used. R&D activities in regulated laboratories are performed in compliance with GLP, GMP and good clinical practice (GCP) as appropriate. Part 11 applies to electronic data collected for non-clinical trials as described by GLP - 21 CFR Part 58. Compliance with GLP is required for non-clinical safety studies during the development of drugs; for example, long-term toxicology; carcinogenicity; reproductive toxicology; mutagenicity; acute toxicity in at least two species; drug adsorption; and metabolism. GLP is not required for basic research, studies to develop new analytical methods, initial pharmacology or proof-of-concept studies; therefore, Part 11 compliance is also not required.

In practice, the individual companies engaged in R&D activities form internal guidelines for the application of Part 11 to their work. Some pharmaceutical companies interpret the rule as meaning that any material submitted to FDA should be Part 11 compliant, even if it is not required by a predicate rule. This could be happening for two reasons; some companies prefer to be "safe not sorry" and thus apply the rule widely rather than risk a non-compliance citation or have to repeat the work in a compliant manner. Other companies apply company-wide data handling policies after realizing there are additional benefits to implementing Part 11 compared with the initial goal of solely attaining compliance. This is discussed in more detail in the following section.

Instrumentation compliance

FDA and the pharmaceutical industry are looking to equipment vendors to develop Part 11 compliant software. As this aim is gradually achieved, pharmaceutical companies will continue to be frustrated by the lack of compliance-supportive equipment. Many vendors claiming Part 11 compliance reveal incomplete understanding of the regulation by not attaining all software requirements or by not fully meeting their customers' expectations during vendor audits. Software or equipment by itself is not compliant; compliance is the responsibility of the organization that uses it, and includes:

• the procedures describing the use of the software (and equipment)

• the training of the personnel who use it

• an evaluation of software functionality against Part 11 and computer system validation requirements.

Out-of-the-box documentation is not considered sufficient, as FDA requires the meaning associated with the signatures. The meaning, such as authorization, review or approval, has to be customized by the user. Many equipment and software vendors have difficulty developing compliance-supporting products because of their lack of experience in working with FDA.

Lab equipment and LIMS. Laboratory equipment and laboratory information management system (LIMS) providers are generally regarded as the most compliance-supportive of all vendors that provide equipment for the pharmaceutical industry. This is not surprising as pharmaceutical companies are often their sole customers. Several vendors admit that their customers simply demanded that they provide versions of their products with Part 11 functionality. Many of these suppliers, however, still do not fully meet their customers' Part 11 requirements for the same reasons discussed earlier. It is in the best interest of these equipment and LIMS vendors to facilitate the compliance efforts of their customers and, thereby, differentiate themselves from their competitors.

Third parties. Suppliers that do not primarily sell to the pharmaceutical industry may not only lack a good understanding of FDA regulations, but may not be convinced that the business warrants the investments necessary to develop new software. In some cases, independent third parties develop software as an add-on with Part 11 functionality built in. As pharmaceutical companies are required to strive towards achieving compliance, they are establishing mechanisms to prevent or mitigate the purchase of non-compliant systems. They are also beginning to pressure vendors into supplying new versions of software and equipment with Part 11 functionality by including software development as a condition of a contract.

Making progress. Regulated companies are not expected to instantly achieve compliance, but they are expected to be making progress on a Part 11 implementation plan. Having first addressed improving compliance in those business areas directly affecting product quality, it has recently been observed that pharmaceutical companies have started focussing more on the R&D area of their Part 11 implementation plans. During the last year, suppliers reported a significant increase in their users' interest in the Part 11 features of their products. Pharmaceutical companies' interpretations of the application of Part 11 in their R&D operations are reflected by their purchasing policies. If the work performed by an instrument is obviously required by a predicate rule, such as GLP non-clinical work or stability studies, then it is clear that it should be performed in compliance with Part 11. Generally, regulated companies now require that, where available, any new equipment purchased must provide the software features to support Part 11 compliance. These companies must then validate that the new software meets regulatory requirements (or, at the very least, document its shortcomings). Validation usually involves a vendor audit or a comprehensive vendor questionnaire, which addresses such issues as whether the functional standards for the software and maintenance exist and whether procedural requirements are met, such as documentation of the training and experience of the system developers.

Purchasing. When equipment is purchased that does not necessarily require Part 11 compliance, the purchasing policies of pharmaceutical companies diverge. Part 11 compliance is not required for basic research; however, those purchasing discovery instrumentation, although not always well informed about what Part 11 compatibility means, have been told that it is important and that they should ask about it. More and more pharmaceutical companies are applying the same Part 11 requirements as part of their purchasing policies for discovery instrumentation, even issuing the same vendor questionnaires. These instrumentation users feel that, even though Part 11 may not be required, it is good practice to buy equipment that is compatible because they

• regard Part 11 compatibility as an indication of equipment and software quality

• have implemented (or plan to implement) an organization-wide Part 11 compatible information management system and have realized the benefits of tracking all their data in this way (implementation of a formal data management process improves operations efficiency - through the employment of search features and by improving accessibility, for example - and the use of electronic records and electronic signatures provides greater confidence in the authenticity of the data; also, laboratory data are often so rich in information that mere paper copies do not capture its full complexity)

• have not ruled out the possibility that they may need to operate the instrument in compliance with Part 11 in the future.

Instrumentation originally designed for basic research work can sometimes migrate into use in development as the technology is accepted and the therapeutic product under development advances. Instrumentation originally designed for basic research can also become an accepted diagnostic tool. Both of these scenarios are desirable and are pursued by equipment developers (as appropriate). If equipment is judged likely to eventually require Part 11 compliance-supportive features, then equipment developers are encouraged to design these features in from the beginning: it is significantly easier and less expensive to introduce Part 11 functionality and validate software during product development. After realizing it was losing sales because it was unable to meet its customers' desire for Part 11 compliance-supporting features, one prominent discovery instrumentation supplier has admitted it is now "scrambling" to add Part 11 functionality to many of its products.

Other organizations (or parts of) pursue a different tack altogether. Instead of purchasing Part 11 compatible equipment, they attempt to minimize the amount of equipment they use that is controlled by computers and/or logs electronic data to minimize computer system validation requirements. This strategy is most frequently applied in development laboratories and pilot production facilities, and occurs despite FDA claims that regulations are not intended to inhibit the use of sophisticated computer controlled systems. These organizations operate validated, manually controlled processes, avoiding the extra cost and time required to acquire and validate equipment with Part 11 functionality. Through the purchase of basic pilot-scale purification equipment, one biologic manufacturer estimated it saved approximately e72000 by avoiding the costs for both the computer controller and computer system validation. Users such as these are interested in the development and provision of more basic versions of process equipment, without sophisticated software capabilities.

Conclusion

The situation for equipment vendors has not changed very much with the recent announcement of FDA's re-evaluation of the requirements of Part 11 and the issuing of a new draft guidance for industry. Part 11 itself remains unchanged and still in effect. The products of many equipment vendors do not meet the requirements of the legislation and FDA has made it clear that they wish the regulated industries to adopt compliant technology as it becomes increasingly reliable and available off-the-shelf. Pharmaceutical companies are additionally applying pressure on vendors to develop such equipment.

Equipment vendors are encouraged to see the functional and procedural requirements of Part 11 as a business opportunity and not just a cost of doing business. The requirement provides vendors with an excellent opportunity to differentiate themselves from their competition by

• exhibiting a complete understanding of the legislation, its scope, and how it relates to their own products and their customers' needs

• ensuring that their products fully support compliance

• enabling easier integration with company-wide data management systems of data produced by their products

• providing a validation package for each product to address the needs of the vendor audit and to facilitate their ctomers' validation efforts.

Vendors who primarily sell to customers engaged in R&D activities must acquire an in-depth understanding of what their customers need and want with respect to Part 11 functionality. It is important that vendors recognize that their customers may want Part 11 compliance-supporting equipment even when it is not strictly required. Vendors must be prepared to supply compliance-supporting features, or to educate or convince their customers that it is not necessary; failure to do so could result in the loss of customers. It is imprudent for equipment vendors to delay addressing the implications Part 11 has on their businesses, as they will only drop behind their competitors.

References

1. "21 CFR Part 11; Electronic Records; Electronic Signatures; Final Rule," Federal Register 62(54), 13429-13466 (1997).

2. www.fda.gov/cder/guidance/5505dft.PDF

3. T.T. Phan, "21 CFR Part 11: How and Why to Comply," MX (September/October 2002). n