Electronic records and signatures must be trustworthy, reliable, and equivalent to paper records.
21 CFR Part 11 Audit-Readiness Rubric — Regscribe v0
Sources: Verbatim text pulled directly from the govinfo.gov Federal Register/CFR archive (CFR-2003-title21-vol1-part11.pdf, current in substance — Part 11's operative text has not been amended since the March 1997 final rule, 62 FR 13464) and the FDA's official 2003 guidance PDF ("Guidance for Industry — Part 11, Electronic Records; Electronic Signatures — Scope and Application," August 2003, mirrored from the FDA docket at gmp-compliance.org/files/guidemgr/5667fnl.pdf). Failure-pattern examples are pulled from real, named FDA Warning Letters (fda.gov/inspections-compliance-enforcement-and-criminal-investigations/warning-letters), not third-party commentary. Could not get a clean fetch of the 2018 "Data Integrity and Compliance With Drug CGMP: Q&A" guidance PDF (fda.gov blocked automated fetch, mirror returned 403) — flagged below as a follow-up source rather than fabricated.
0. READ THIS FIRST — the 2003 narrowing (critical for scoring logic)
FDA significantly narrowed enforcement discretion in 2003, and this must shape what the AI flags as a "gap." Building the rubric off the bare 1997 text alone will over-flag and produce a product that looks aggressive/wrong to any regulatory-affairs reviewer.
The FDA's August 2003 guidance ("Part 11 — Scope and Application") states three governing principles verbatim:
- "Part 11 will be interpreted narrowly; we are now clarifying that fewer records will be considered subject to part 11."
- "For those records that remain subject to part 11, we intend to exercise enforcement discretion with regard to part 11 requirements for validation, audit trails, record retention, and record copying... and with regard to all part 11 requirements for systems that were operational before the effective date of part 11 (also known as legacy systems)."
- "We will enforce all predicate rule requirements, including predicate rule record and recordkeeping requirements."
What this means concretely for the scoring rubric
| Requirement | FDA enforcement posture per 2003 guidance | Scoring implication |
|---|
| §11.10(a) Validation | Enforcement discretion — FDA will not act to enforce Part 11's validation clause itself, but the underlying predicate rule's validation requirement still applies (e.g., 21 CFR 211.68(a)/820.70(i)) | Do NOT flag "no Part 11 validation doc" as a Part 11 gap. DO flag if the company lacks validation evidence required by the applicable predicate GMP/GLP/GCP rule. |
| §11.10(b) copies of records | Enforcement discretion on the Part 11-specific copy format requirement | Flag only if predicate-rule inspection-access requirements (e.g., 211.180(c)/(d)) aren't met — not the literal Part 11 clause. |
| §11.10(c) record retention/retrievability | Enforcement discretion on Part 11's own clause | Flag only against predicate-rule retention requirements (211.180(c)/(d), 108.25(g), 108.35(h)). |
| §11.10(e) computer-generated, time-stamped audit trails and (k)(2) | Enforcement discretion on the Part 11 clause itself — but FDA still enforces any predicate-rule date/time/sequencing documentation requirement, and separately states audit trails "can be particularly appropriate when users are expected to create, modify, or delete regulated records during normal operation" | This is the single most misunderstood point industry-wide. Don't hard-fail solely on "audit trail" citing 11.10(e) — cite the predicate rule instead if one exists, and treat 11.10(e) as a strong best-practice recommendation, not a bright-line requirement. |
| Legacy systems (operational before 20 Aug 1997) | Full enforcement discretion on all Part 11 requirements, IF: system was operational pre-8/20/1997, met applicable predicate-rule requirements then, still meets them now, and there's documented evidence/justification the system is fit for its intended use | Almost irrelevant for a 2026 client base, but keep the logic branch — don't hard-fail a genuinely ancient system on Part 11 clauses alone. |
| Everything else — §11.10(d), (f), (g), (h), (i), (j), (k)(1); §11.30 (open systems); §11.50; §11.70; §11.100; §11.200; §11.300 | FDA explicitly states it intends to enforce these fully. Direct quote: "We intend to enforce all other provisions of part 11 including, but not limited to, certain controls for closed systems in § 11.10. For example, we intend to enforce provisions related to... limiting system access to authorized individuals... use of operational system checks... use of authority checks... use of device checks... determination that persons... have the education, training, and experience... establishment of and adherence to written policies... appropriate controls over systems documentation... controls for open systems... requirements related to electronic signatures (e.g., §§ 11.50, 11.70, 11.100, 11.200, and 11.300)." | These should be scored as full, live requirements — no enforcement-discretion discount. |
Also narrowed: scope itself (which records are "Part 11 records" at all)
Per the guidance, Part 11 applies only when:
- the record is required to be maintained under a predicate rule (GMP/GLP/GCP/etc.), and
- it is maintained in electronic format in place of paper, or
- a paper printout exists but the company relies on the electronic record to perform the regulated activity.
If a company generates a paper printout from a computer system, that printout meets all predicate-rule requirements, and the company genuinely relies on the paper (not the electronic version) to do its regulated work — FDA says Part 11 does not apply at all to that record. This "narrow scope" holding is distinct from the "enforcement discretion" holding above, and it's the first gate the AI should apply before running any Part 11 checks: is this even a Part 11 record?
Practical scoring recommendation: implement two severity tiers —
- Tier 1 (hard gap / cite Part 11 directly): §11.10(d),(f),(g),(h),(i),(j),(k)(1); §11.30; §11.50; §11.70; §11.100; §11.200; §11.300 — no enforcement-discretion discount.
- Tier 2 (best-practice flag / cite predicate rule, not Part 11): §11.10(a),(b),(c),(e),(k)(2) — score against the applicable predicate rule (21 CFR 211, 820, 58, 312, etc.) rather than Part 11 itself, and label these findings differently in the UI so they don't read as "Part 11 violations" to a reviewer who knows the guidance.
Subpart A — General Provisions
§ 11.1 — Scope
| |
|---|
| Requirement (plain language) | Part 11 sets the criteria under which FDA will consider electronic records/signatures trustworthy and equivalent to paper records/handwritten signatures. Applies to electronic records under any agency recordkeeping regulation, and to records submitted to FDA under the FD&C Act/PHS Act even if not specifically named in agency regs. Does not apply to paper records merely transmitted electronically. Computer systems, controls, and documentation must be available for FDA inspection. |
| Citation | 21 CFR 11.1(a)–(e) |
| Evidence of compliance | A documented determination (e.g., an SOP or scope memo) of which company records are "Part 11 records" under the narrow-scope test above; system inventory identifying which systems hold Part 11-scoped records; statement/procedure confirming systems are inspection-ready. |
| Common failure pattern | Companies treating every electronic record as Part 11-scoped (over-application) or, conversely, assuming a system is out-of-scope without documenting the analysis — FDA's own guidance recommends documenting the scoping decision (guidance §III.B.2: "We recommend that you document such decisions"). |
§ 11.2 — Implementation
| |
|---|
| Requirement | For records not submitted to FDA, electronic records/signatures may substitute for paper if Part 11 is met. For records submitted to FDA, substitution is allowed only if Part 11 is met and the specific document type is listed in public docket 92S-0251 as accepted electronically by the specific receiving unit. |
| Citation | 21 CFR 11.2(a)–(b) |
| Evidence of compliance | Documentation confirming, for any electronic submission channel used, that the document type/receiving unit combination is on the accepted list; SOP governing electronic vs. paper submission decisions. |
| Common failure pattern | Not directly warning-letter-common; mostly a submissions/regulatory-affairs process gap rather than a system gap. |
§ 11.3 — Definitions
| |
|---|
| Requirement | Defines Agency, Biometrics, Closed system, Digital signature, Electronic record, Electronic signature, Handwritten signature, Open system. |
| Citation | 21 CFR 11.3(a)–(b) |
| Evidence | N/A — reference section. Use to correctly classify each system as "closed" vs "open" before scoring (this determines whether §11.10 or §11.30 applies). |
| Failure pattern | N/A |
Subpart B — Electronic Records
§ 11.10 — Controls for closed systems
Preamble text (governs all subclauses): "Persons who use closed systems... shall employ procedures and controls designed to ensure the authenticity, integrity, and, when appropriate, the confidentiality of electronic records, and to ensure that the signer cannot readily repudiate the signed record as not genuine."
| Clause | Requirement (plain language) | Evidence of compliance | Failure pattern (from FDA Warning Letters / guidance) | Enforcement tier |
|---|
| 11.10(a) | System validation for accuracy, reliability, consistent intended performance, and ability to discern invalid/altered records | Validation protocol + report (IQ/OQ/PQ or equivalent), traceability matrix, sign-off | N/A under Part 11 directly (enforcement discretion) — score against predicate rule validation clause instead (e.g., 21 CFR 211.68(a)) | Tier 2 |
| 11.10(b) | Ability to generate accurate, complete copies of records in both human-readable and electronic form for FDA inspection/copying | Export/reporting function evidence; sample audit-ready record export | Enforcement discretion on the Part 11 clause — score against predicate-rule inspection-access clauses (e.g., 211.180(c),(d)) | Tier 2 |
| 11.10(c) | Protection of records for accurate, ready retrieval throughout the retention period | Backup/archival policy, retention schedule, disaster-recovery test evidence | Enforcement discretion — score against predicate-rule retention requirements (211.180(c),(d); 108.25(g); 108.35(h)) | Tier 2 |
| 11.10(d) | Limiting system access to authorized individuals | User access list, role-based access control (RBAC) config, deactivation-on-termination procedure/logs | Shared/generic logins. Vi-Jon, LLC (Warning Letter, 03/31/2022): "All QU users utilized a shared generic account with administrative privileges capable of changing and deleting files." Ava Inc. (04/14/2026): "utilized a common username and password to access HPLC equipment." | Tier 1 — fully enforced |
| 11.10(e) | Secure, computer-generated, time-stamped audit trails independently recording date/time of operator create/modify/delete actions; changes must not obscure prior data; retained ≥ as long as the record; available for FDA review/copying | Audit-trail configuration screenshot/export showing user, timestamp, action, before/after values; audit-trail review SOP and periodic-review logs | Enforcement discretion on the Part 11 clause itself, BUT predicate-rule date/time/sequencing requirements still apply, and audit trails are FDA's stated best practice where users can create/modify/delete records. Landy International (06/12/2024, cited under 21 CFR 211.68(b) not 11.10(e) directly): "gas chromatogram system lacking an audit trail and individual log-in access... shared password, located in an unsecured drawer." Accu Bio-Chem Laboratories (02/24/2022): "software controlling HPLC and GC systems... did not have all appropriate audit trails enabled." | Tier 2 for the Part 11 clause / Tier 1 in practice via predicate-rule citation — treat "audit trail disabled/not reviewed" as a high-severity finding regardless, citing 211.68(b) alongside 11.10(e) |
| 11.10(f) | Operational system checks to enforce permitted sequencing of steps/events, as appropriate | Workflow/state-machine config documentation; test cases showing out-of-sequence actions are blocked | Fully enforced | Tier 1 |
| 11.10(g) | Authority checks — only authorized individuals can sign, access I/O devices, alter records, or perform the operation | Role/permission matrix mapped to system functions; segregation-of-duties documentation | Fully enforced; overlaps with 211.68(b) admin-privilege findings above (e.g., Wisconsin Pharmacal, 08/22/2025: "lacking sufficient controls over administrative privileges for file modification and deletion") | Tier 1 |
| 11.10(h) | Device checks — validity of data-input source or operational instruction, as appropriate | Instrument/interface qualification records, device-authentication configuration | Fully enforced | Tier 1 |
| 11.10(i) | Personnel who develop/maintain/use the system have documented education, training, experience for their assigned tasks | Training records/matrix tied to system roles, curricula, competency assessments | Fully enforced | Tier 1 |
| 11.10(j) | Written policies holding individuals accountable for actions under their electronic signature, to deter falsification | Signed acknowledgment/policy (e.g., "electronic signature accountability" SOP), onboarding records | Fully enforced | Tier 1 |
| 11.10(k)(1) | Adequate controls over distribution/access/use of systems documentation | Document-control SOP covering system SOPs/specs, access logs to controlled docs | Fully enforced | Tier 1 |
| 11.10(k)(2) | Revision/change-control procedures maintaining an audit trail of time-sequenced development/modification of systems documentation | Change-control records/version history for system documentation (not data records) | Enforcement discretion (grouped with audit trail clause) | Tier 2 |
§ 11.30 — Controls for open systems
| |
|---|
| Requirement | Same authenticity/integrity/confidentiality goal as §11.10, from point of record creation to point of receipt, applied to systems where access is not controlled by the record owner (e.g., internet-facing/cloud/third-party-hosted). Must include §11.10 controls as appropriate plus additional measures like encryption and digital-signature standards. |
| Citation | 21 CFR 11.30 |
| Evidence | All §11.10 evidence, plus: encryption-in-transit/at-rest configuration, digital signature/PKI implementation details, vendor security assessment if third-party-hosted (highly relevant for SaaS QMS/eQMS/LIMS vendors). |
| Failure pattern | FDA explicitly states this is fully enforced, "corresponding to the controls for closed systems bulleted above" — no enforcement-discretion discount for open-system controls that map to the Tier-1 §11.10 clauses. |
§ 11.50 — Signature manifestations
| |
|---|
| Requirement | Signed electronic records must display: (1) printed name of signer, (2) date/time signature executed, (3) meaning of the signature (review/approval/responsibility/authorship). These three items are subject to the same record controls and must appear on any human-readable form (display or printout). |
| Citation | 21 CFR 11.50(a)(1)–(3), (b) |
| Evidence | Screenshot/printout of a signed record showing all three elements; system spec confirming these fields are captured and rendered on every human-readable output, not just the live UI. |
| Failure pattern | Systems that show signature metadata on-screen but strip it from PDF export/printout are a common gap — §11.50(b) explicitly requires the same elements on printouts. |
| Tier | Fully enforced (Tier 1) |
§ 11.70 — Signature/record linking
| |
|---|
| Requirement | Electronic and handwritten-to-electronic signatures must be linked to their records so they cannot be excised, copied, or transferred to falsify a different record by ordinary means. |
| Citation | 21 CFR 11.70 |
| Evidence | Technical description of the signature-binding mechanism (e.g., cryptographic hash tying signature to record content/version, database foreign-key + immutability control); test showing a signature cannot be copy-pasted onto a different record instance. |
| Failure pattern | Signature stored as a separate, editable field/table not cryptographically or structurally bound to the specific record version — allows "signature reuse" across records. |
| Tier | Fully enforced (Tier 1) |
Subpart C — Electronic Signatures
§ 11.100 — General requirements
| |
|---|
| Requirement | (a) Each electronic signature unique to one individual, never reused/reassigned. (b) Before establishing/assigning/certifying a person's electronic signature, the organization must verify that individual's identity. (c) Before or at first use of electronic signatures intended as legally binding equivalents (on/after 8/20/1997), the company must submit a paper certification, signed by hand, to FDA's Office of Regional Operations — and provide additional certification/testimony on request. |
| Citation | 21 CFR 11.100(a)–(c)(2) |
| Evidence | Identity-verification procedure/records at user provisioning (e.g., HR/IT onboarding checklist); uniqueness enforcement in the system (no duplicate signature IDs, no reassignment of a departed employee's ID to a new hire); the actual signed paper 11.100(c) certification letter on file — this is a one-time document per legal entity, easy to overlook and easy to check for. |
| Failure pattern | Missing or unlocatable 11.100(c) certification letter is a very common documentation gap in smaller/newer companies — check for it explicitly since it's binary (exists / doesn't exist), not a judgment call. |
| Tier | Fully enforced (Tier 1) |
§ 11.200 — Electronic signature components and controls
| |
|---|
| Requirement (non-biometric signatures) | (a)(1) At least two distinct components (e.g., ID code + password). In a single continuous controlled session, first signing uses both components; subsequent signings in that session may use just one component executable only by that individual. Signings outside a continuous session each require both components. (a)(2) Usable only by the genuine owner. (a)(3) Administered so any attempted use by someone else requires collusion of ≥2 people. (b) Biometric signatures must be designed so they cannot be used by anyone but the genuine owner. |
| Citation | 21 CFR 11.200(a)(1)(i)–(ii), (a)(2)–(3), (b) |
| Evidence | System spec describing the two-factor signing mechanism and session-timeout logic that forces re-entry of both components after a session break; password-policy configuration; for biometric signatures, the enrollment/verification mechanism spec. |
| Failure pattern | Systems using a single factor (e.g., just being logged in = signed, with no second re-authentication step at the moment of signing) are a frequent gap in home-grown/legacy eQMS tools. |
| Tier | Fully enforced (Tier 1) |
§ 11.300 — Controls for identification codes/passwords
| Clause | Requirement | Evidence | Tier |
|---|
| 11.300(a) | Uniqueness — no two individuals share the same ID+password combination | User-provisioning records showing uniqueness enforcement; system-level unique-constraint config | Tier 1 |
| 11.300(b) | Periodic checking/recall/revision of ID/password issuances (e.g., password aging) | Password policy (expiration interval, complexity), password-change logs | Tier 1 |
| 11.300(c) | Loss-management procedures to deauthorize lost/stolen/compromised credentials/tokens and issue rigorous replacements | Incident-response/account-lockout SOP; helpdesk ticket sample showing a lost-credential deauthorization | Tier 1 |
| 11.300(d) | Transaction safeguards against unauthorized use, with immediate detection/reporting to security unit and management | Failed-login lockout/alerting configuration; intrusion-detection or account-lockout logs | Tier 1 |
| 11.300(e) | Initial and periodic testing of token/card devices to confirm proper function and no unauthorized alteration | Token/hardware-authenticator testing records/schedule | Tier 1 |
Quick-reference severity model for the AI rubric
IF record is not a "Part 11 record" per §11.1/scope test → OUT OF SCOPE, no Part 11 finding (cite predicate rule only if applicable)
ELSE IF clause ∈ {11.10(a),(b),(c),(k)(2), 11.30-corresponding} → check against PREDICATE RULE, label finding "predicate-rule / best-practice", NOT "Part 11 violation"
ELSE IF clause = 11.10(e) → check against predicate-rule date/sequence requirement AND flag as high-severity best-practice (cite both 11.10(e) guidance language and predicate rule, e.g. 211.68(b))
ELSE IF system is a documented pre-8/20/1997 legacy system meeting the 4-part test → full enforcement-discretion exemption
ELSE (11.10(d),(f),(g),(h),(i),(j),(k)(1); 11.30 corresponding; 11.50; 11.70; 11.100; 11.200; 11.300) → FULL Part 11 requirement, no discount
Gaps / follow-ups before this goes into production scoring
- 21 CFR 211.68 (equipment/automatic-mechanical-electronic equipment controls, part of the CGMP predicate rule) is doing a lot of the actual enforcement work FDA cites in warning letters for exactly the failure patterns above (shared logins, disabled audit trails, admin-privilege sprawl). Since the first vertical is Part 11 specifically, a short cross-reference table mapping each Tier-2 Part 11 clause to its live predicate-rule citation (211.68, 211.180, 211.194, 820.70, 820.180, 58.130, 58.185 depending on GMP/QSR/GLP context) is worth adding — otherwise the rubric will under-flag real, actively-enforced issues just because the Part 11 clause itself is under enforcement discretion. Not built in this pass.
- Could not get clean text out of FDA's 2018 "Data Integrity and Compliance With Drug CGMP: Questions and Answers" guidance (fda.gov blocked automated fetch; the regulations.gov mirror returned 403). That document goes deeper on exactly the failure patterns in this checklist (shared logins, backdating, blank/uncontrolled forms, invalidating results without justification) and would be a strong second layer once ready to broaden past strict Part 11 into general CGMP data integrity — worth fetching manually.
- All Warning Letter examples above cite 21 CFR 211.68(b), the CGMP predicate rule for computerized equipment controls — not 11.10 directly — because FDA's actual enforcement pattern in recent letters runs through the predicate rule per its own 2003 guidance. That's a feature, not a bug, for citation accuracy, but means product UI copy should say "Part 11-related control gap, enforced via [predicate rule]" rather than "Part 11 violation" when citing these patterns, to stay accurate to how FDA actually writes findings.