Millipore Technical Publications |
 | Application Guide - AN1075EN00 | |
CCP v5 Software Compliance with FDA Regulation 21 CFR Part 11 | ||
| Authors: | ; AN1075EN00 | |
| Citation: | AN1075EN00 | |
| Year: | 2002 | |
| Abstract: | Electronic batch records in all Millipore’s biopharmaceutical systems | |
|
The FDA regulation 21 CFR Part 11 concerns pharmaceutical manufacturers because it governs the agency’s acceptance of electronic records as authentic and electronic signatures as legally binding. The scope of the ruling is wide: Part 11 applies to all electronic signatures and records that are submitted to the FDA or in response to FDA requirements, and to all such submissions throughout FDA-regulated industry. Existing pharmaceutical software technology provides for compliant security in verifying electronic signatures and in authenticating and locking electronic records.
Millipore ’s Common Control Platform® version 5 (CCP v5 software), a software system used to control and manage data for chromatography and tangential-flow filtration (TFF) systems, complies with 21 CFR Part 11. Further, CCP v5 software incorporates tools, allowing you to authenticate and lock data in a compliant manner. You can also lock all chromatography and filtration recipes1 that you create using CCP v5 software and its associated systems. CCP v5 software uses a combination of proprietary routines and third-party authentication systems to provide Part 11-compliant security for electronic signatures and records.
21 CFR Part 11
In 1997, the FDA issued a regulation called 21 CFR Part 11 that governs electronic records, electronic signatures, and hand-written signatures executed to electronic records. Part 11 also governs several types of electronic records, including operation and recipe files. For example, Part 11 prescribes and directs the protection of recipe files after storage by the original author.
21 CFR Part 11 and CCP v5
In the terms of Part 11, CCP v52 software represents a closed system, “an environment in which system access is controlled by persons who are responsible for the content of electronic records that are on the system.”
Electronic Signatures
Under Part 11, an approved electronic signature is a computer data compilation of any symbol or series of symbols executed, adapted or authorized by an individual to be the legally binding equivalent of the individual ’s handwritten signiture.3 CCP v5 software uses PDF file formats and various commercially available electronic signature tools to affix Part 11-compliant electronic signatures to the batch reports that users can generate. CCP v5 software uses the combination of user ID and password to secure
access to these tools, and to provide a form of user authentication that itself represents a Part 11-compliant combination of symbols.
Electronic Records
Part 11 governs the following kinds of electronic records that are created by CCP v5 software:
- Historical logs
- Event logs
- Operation and Recipe Files
Historical Logs
A Historical Log is a form of data storage that holds sensor readings and other analog data that represents trends.The SCADA®4 software captures these sensor readings and records them into a series of binary collection files. The collection files have a proprietary format and cannot be altered. Read-only access to these files is provided via ODBC drivers for reporting purposes.
Event Logs
The CCP v5 software event log5 captures security events, typical or routine events, and alarm events. Security events, which are collected in the security log, include records of user logins and failed logins. Security events also include attempts to gain access to restricted security areas, such as the recipe editor.
Routine events include the switching of the pumps and valves in use during the chromatography or filtration process. Alarm events register the onset of any alarm conditions by date, time, and severity. The event log stores typical and alarm events and process setpoint values.
Audit Trail for Operation and Recipe Files
Recipes are control instructions for the process. Each recipe is stored as a distinct, uniquely named file.6 Part 11 requires the protection of recipe files after storage by the original author. CCP v5 software addresses this problem by creating a tamperproof signature file when each version of a recipe is saved.This file is created using digital signature technology based on Microsoft® Crypto API software program which cannot be altered. To help secure the audit trail, the custom interface prevents users from
getting into the operator system to change the date and time in the control panel. The above process ensures the reports are secured, unalterable and provides an audit trail for future review.
Report Delivery
Users of CCP v5 software have the additional option of generating electronically signed reports that are delivered as electronic files. Users also have the traditional option of delivering reports as hand-signed hard copy.
Unalterable Electronic Reports
Beginning with version 5,CCP software allows the user to produce electronically signable reports. To comply with Part 11, a system must address the fact that there may never be a paper copy of a particular report. For this reason,the author ’s signature and all subsequent signoffs and notes must be included in an electronic report
file. This file must be protected from subsequent alteration.
CCP v5 software complies with this requirement by being compatible with third-party components that have signature capabilities, such as Adobe ® PDFWriter. These components can be installed with CCP v5 software or, within limits, can be replaced according to customers’ choices. The signature components perform the act of
signing an electronic report.
Reports Delivered on Paper
To comply with Part 11, a system must guarantee that the constituent records are not altered when assembled in the report generator. Witnessed hand signatures verify the authorship of hard-copy reports.
References
1. Federal Register, Part II Department of Health and Human Services, Food and Drug Administration, (March 20,1997). 21 CFR Part 11, Electronic Records; Electronic
Signatures; Final Rule.
2. D W Selby, C. Jones and A J Margetts, Complying with 21 CFR Part 11 Electronic Records and Electronic Signatures, First Draft: Consultative Document to Solicit
Feedback as of 2 December 1999, GAMP Special Interest Group Document Reference: GAMP/SIG/CFR11.
3.FDA, 21 CFR Part 210, Current Good Manufacturing Practice in Manufacturing, Processing, Packing, or Holding of Drugs; General.
4.FDA, 21 CFR Part 211, Current Good Manufacturing Practice for Finished Pharmaceuticals, 1996.
5.“Compliance Assessment Worksheet ”, DEV404N is available from Millipore, Chromatography Hardware and Software Department, Bedford , MA 01730,USA.
Notes
1 Recipes are also referred to as “recipes” in documents conforming with the nomenclature suggested in “Batch Control Part 1: Models and Terminology ”, ANSI/ISA-S88.
01-1995.
2 “Compliance Assessment Worksheet for CCP v5 software ”, DEV404N is available from Millipore, Chromatography Hardware and Software Department, Bedford,MA
01730, USA.
3 Federal Register, Part II Department of Health and Human Services, Food and Drug Administration, (March 20,1997). 21 CFR Part 11, Electronic Records; Electronic
Signatures; Final Rule.
4 Standard products supplied by Millipore utilize the iFIX® SCADA package. Other SCADA packages can be supplied as specials. Please contact your Millipore representative. iFIX is a product of Intellution, Inc.It is also known as FIX DYNAMICS®. The version used in CCP v5 software is Intellution FIX DYNAMICS software version 2.21. For the full description see for example the “iFIX Fundamentals for New Users v2.1 ” from July 1999,,pages 1 – 4 to 1 – 14.
5 Earlier versions of FIX ™ refer to the event log by the name of “tabular log.”
6 Also see “Complying with 21 CFR Part 11 Electronic Records and Electronic Signatures ” by D W Selby, C.Jones and A J Margetts; First Draft: Consultative Document to
Solicit Feedback as of 2 December 1999 GAMP Special Interest Group. Document Reference: GAMP/SIG/CFR11