21 CFR Part 11: Compliance in the supply chain [Checklist]
21 CFR Part 11 applies to any official quality or manufacturing records pertaining to the design, development, or manufacture of a drug or device regulated by the FDA. Manufacturers must ensure that all of their records are compliant with these regulations, which includes their traceability documentation for partners within the supply chain. Because manufacturers need to ensure traceability of their product throughout the lifecycle, 21 CFR Part 11 may further apply to suppliers and distributors.
We'll break down the needed vocabulary to discuss 21 CFR Part 11 in the supply chain, and review what following the regulation looks like for suppliers, final processing and distribution. At the end of this article is a checklist for evaluating suppliers and their potential compliance with 21 CFR Part 11.
Looking for more information about 21 CFR Part 11? Check out our guides to 21 CFR Part 11 compliance:
Key definitions
Electronic record: Any document that is generated and saved in an electronic format. Any records that require signatures must have properly executed electronic or digital signatures.
Electronic signature: Any electronic representation that is tied to the document and is linked to the signer's identity. The signature must include the signer’s name, date and time of the signature, and the purpose or intention of the signature (i.e. reviewed by, approved by, etc.)
Digital signatures: Use an algorithm and encrypt the signature as part of the electronic record. The output signature may look like a string of characters and does not have to look like a signature.
Open system: This is not a dedicated system, but must still maintain limited access to edit documents. Document access in this system should be limited to appropriate personnel, retrieval should be possible throughout the retention period, and where possible, an audit trail should be maintained. Usernames and passwords should be instituted to ensure permissions are appropriately applied to records.
Closed system: This is a separate system that must be validated to ensure that it meets all security and retention requirements. A closed system is generally a separate software or cloud-based service that manages all record creation and retention. These systems also typically have a signature component built in. Validation must ensure that the system is 21 CFR Part 11 compliant.
Implementing 21 CFR Part 11 in the supply chain
Component suppliers
21 CFR Part 11 applies to traceability documentation for suppliers. These suppliers may include raw materials, packaging, sub-assemblies, or individual completed components that will later be reassembled into a new format, such as a kit.
When manufacturers are looking for suppliers they need to complete a supplier qualification process to ensure that the supplier can meet their needs from a manufacturing, quality, and price point perspective. Part of this qualification should include verification that the records that will be supplied with the record are acceptable.
An easy way to demonstrate conformity with the records requirements is to show that the supplier has processes in place for electronic records and signatures that comply with 21 CFR Part 11. This could look like a QMS system (see 'closed system' above) that manages all of the electronic records and signatures.
Another way to accomplish similar levels of compliance on a smaller scale is for production records to be signed using a program such as Adobe Sign or DocuSign and then saved to the company server.
FREE DOWNLOAD: Supplier management datasheet
Final processing
Some drugs or devices may be subject to a final processing step after it leaves primary manufacturing. For example, a shipment of medical devices may be sent to a sterilization house for final sterilization and from there may or may not return to the manufacturing facility.
Traceability for the devices must be maintained during all of the transit operations and the final processing. Any records for these processes that are generated electronically must be compliant with 21 CFR Part 11.
These records may include things like batch records, process flows for any final processing, and material certifications for any materials used in the final processing. For this type of record, suppliers may have a specific computer system for creating and managing the records. If these records are kept in a dedicated system, known as a closed system, the users will have specific access granted to the records and the signatures will be managed through the system as well. Typically copies of records can then be exported as a PDF to send to the device manufacturer as evidence.
Distribution and logistics
When selecting and authorizing distributors, manufacturers should consider how a partner will maintain accurate records about where the product is and how it has been stored. Manufacturers must ensure that their product remains traceable even after it leaves their facility in the event that they need to recall the product.
Additionally, if there are specific storage or handling requirements, compliance with those requirements must be documented. Products that are improperly stored, even temporarily, may need to be discarded to ensure patient safety. For example, a pallet of product may need to be scrapped because a temperature log was lost. Ensuring accurate and thorough records of travel and storage are retained is a must.
Shipping records are more likely to be maintained electronically, allowing for easier tracking of products. This may be through a dedicated closed system, such as order processing software. If records of these storage conditions and traceability are maintained electronically, 21 CFR Part 11 applies.
21 CFR Part 11 supplier checklist
The following checklist will help manufacturers evaluate potential partners when it comes to managing the production and distribution of their product. These points are also helpful for suppliers themselves looking to self evaluate.
- Does the supplier/distributor have procedures in place for complying with 21 CFR Part 11?
- Can the supplier/distributor provide records of product traceability including storage conditions (if applicable)?
- Are records retained for the required amount of time?
This may vary based on the expected lifetime/shelf life of the product, so confirm the archival period that applies to the product. For devices, at a minimum, records must be retained for 2 years after the product has entered commercial distribution, but must be retained for the shelf-life of the product. For drug products, records must be maintained for at least 1 year after the lot expiration date, or in the case of drugs without an expiration date, at least 3 years after distribution.
- Are electronic signatures used on records and if so, are they compliant with 21 CFR Part 11?
Determining if a signature is actually required by the regulations will be important. In general, signatures are used to indicate review and approval far more widely than is required by the regulations. Signatures are required for the individual authorizing the final release of the product, so this will need to be in compliance with the electronic signature regulations if managed electronically.
Paper records and 21 CFR Part 11
Companies can always choose to use paper records to eliminate the need to comply with 21 CFR Part 11, however this does not eliminate the need to retain records for an extended period of time to comply with records retention requirements. In some cases, it may work well to create the records on paper and then scan them electronically for storage. This would eliminate the need to adhere to the electronic signature portion of the requirement. The electronic records can then be securely stored to prevent tampering or loss.
Of course, the advantages of digital documents and an electronic quality management system far outweigh paper. Want to discuss migrating your paper system to an eQMS? We'd love to talk.
