Electronic signatures and audit trails for maintenance and calibration records

Part 11 sets out the criteria under which FDA considers electronic records, electronic signatures, and handwritten signatures executed to electronic records to be trustworthy, reliable and generally equivalent to paper. It applies to records in electronic form that are created, modified, maintained, archived, retrieved or transmitted under any records requirement in FDA regulations.

That last phrase is the key. Part 11 does not create new records for you to keep. The duty to keep a maintenance log or a calibration record comes from another regulation, which FDA calls a predicate rule. Part 11 governs how that record must be controlled once you keep it electronically.

The regulation has two working parts. Subpart B covers electronic records: controls for closed systems (section 11.10), controls for open systems (11.30), signature manifestations (11.50) and signature to record linking (11.70). Subpart C covers electronic signatures themselves: uniqueness and identity (11.100), and the components and controls of a signature (11.200 and 11.300).

In its 2003 guidance on scope and application, FDA said it would interpret the scope of Part 11 narrowly while it re-examined the rule, and that Part 11 remains in effect. In short, Part 11 applies when records required by a predicate rule are kept in electronic format in place of paper, or when you rely on the electronic record to perform regulated activities. If you print a record, rely on the signed paper and the paper meets the predicate rule, Part 11 generally does not apply to the electronic draft behind it.

The guidance also announced enforcement discretion for some Part 11 controls, including validation, audit trails, legacy systems, record copies and record retention. Discretion is not exemption. FDA says records must still be kept or submitted in line with the predicate rules, and it expects decisions on validation and audit trails to rest on a justified and documented risk assessment. For systems that hold GMP records, it is usually simpler to keep audit trails and validation in place than to justify leaving them out.

Section 11.50 is short and specific. A signed electronic record must clearly show three things: the printed name of the signer, the date and time the signature was executed, and the meaning of the signature, such as review, approval, responsibility or authorship. Those three items must be controlled like the record itself and must appear in any human readable form of the record, on screen and on a printout.

Meaning is the element teams most often leave out. A name and a time say who touched the record. Only the meaning says what they were vouching for. 'Performed by' and 'Verified by' on a calibration record are two different signatures with two different responsibilities, and 211.182 expects both on major equipment work.

Section 11.70 then requires that signatures are linked to their records so they cannot be excised, copied or otherwise transferred to falsify a record by ordinary means. A scanned signature image pasted into a PDF is easy to copy onto another document, which is exactly what 11.70 is meant to prevent. A signature stored as part of the record it signs, and rendered from it, is much harder to transfer.

Subpart C adds controls on who can sign and how:

• One person, one signature. Each electronic signature is unique to one individual and is never reused by or reassigned to anyone else (11.100(a)). Shared logins on a maintenance tablet break this rule at once.
• Verified identity. Your organization verifies a person's identity before establishing their electronic signature (11.100(b)).
• A letter to FDA. Organizations certify to FDA that the electronic signatures in their system are intended to be the legally binding equivalent of handwritten signatures (11.100(c)). That letter is yours to send, not your software vendor's.
• Two components. A signature not based on biometrics uses at least two distinct components, such as an identification code and a password. In one continuous session the first signing uses all components and later signings use at least one. Signings outside a continuous session use all components each time (11.200(a)).

Section 11.10(e) asks for secure, computer-generated, time-stamped audit trails that independently record the date and time of operator entries and actions that create, modify or delete electronic records. Record changes must not obscure previously recorded information. The audit trail must be kept at least as long as the record itself and be available for FDA review and copying.

Read it closely and four tests fall out. The trail is generated by the system, not typed by a user. It is independent, so the person editing a record cannot edit its history. It is time-stamped. And the old value survives the change. A field that simply overwrites, with a 'last modified by' stamp, does not pass.

1. List the maintenance and calibration records your predicate rules require, and mark which ones you keep electronically and rely on.
2. For each, name the signatures needed and the meaning of each one.
3. Check that every signature shows printed name, date and time, and meaning, on screen and on printouts.
4. Check that edits keep the old value, the user and the time, and that users cannot edit the trail.
5. Remove shared logins from tablets and shop-floor terminals.
6. Document your validation approach and the risk assessment behind it.
7. Decide who reviews audit trails, how often, and where that review is recorded.

MaintenanceIQ keeps an audit log on every write, so changes to work orders, PM and calibration records carry who and when. Access is role-based and enforced on the backend for every action, including reads. Compliance evidence packs are frozen as records in private storage and downloaded through signed URLs.

An evidence pack can be electronically signed when it is generated. The signature records a named signer bound to their account, a timestamp and an intent statement, and is rendered as a signature block on the PDF. Those are the signer, time and meaning elements Part 11 describes. Signing is optional, and it applies to the evidence pack as a whole rather than to each individual entry. Validation for your intended use, your procedures and your FDA certification letter remain your responsibility. See compliance evidence packs.