FDA 21 CFR Part 11 and Compliance for FTIR

Here I will give an overview of FDA 21 CFR Part 11, which has been an important topic in the pharmaceutical industry for several years, and consider its observance in the field of FTIR.

■ FDA 21 CFR Part 11

In the 1990's, in order to promote a reduction in the amount of paper used for documentation, the FDA (Food and Drug Administration, USA) established requirements related to the transfer of conventional paper-based records to electronic media. These came into effect in 1997. Electronic documentation is easier to falsify than paper-based documentation and so these requirements establish criteria for recognizing electronic records and electronic signatures as credible and of an equal standing to paper-based.

FDA 21 CFR Part 11 applies to the following corporations:

Pharmaceutical companies conducting business in the U.S.
Companies providing products and raw materials to these pharmaceutical companies
Contract laboratories commissioned by these companies to perform analysis work

FDA 21 CFR Part 11 applies to records and systems in the following cases:

Cases where a PC is used to create, correct, save, restore, and transfer data
Cases where data is saved in electronic format
Examples include analytical instruments, balances, laboratory information management systems (LIMS), electronic document management systems, manufacturing management systems, equipment control management systems, manufacturing environment monitoring systems, and entrance/exit management systems.

■ FDA 21 CFR Part 11 and Requirements

The items required by FDA 21 CFR Part 11 are organized into sections.

Subpart A	General Provisions
11.1	Scope
11.2	Implementation
11.3	Definitions
Subpart B	Electronic Records
11.10	Controls for closed systems
11.30	Controls for open systems
11.50	Signature manifestations
11.70	Signature/record linking
Subpart C	Electronic Signatures
11.100	General requirements
11.200	Electronic signature components and controls
11.300	Controls for identification codes/passwords

The contents of these sections, however, are not very specific. Details can be confirmed by referring to other documentation, such as the GAMP Guide.
I will leave detailed explanations of each section to be covered in other documentation. Broadly speaking, the requirements of FDA 21 CFR Part 11 can be categorized as follows:

Access control
Data integrity
Data security
Audit trail
Electronic signature
Validation

■ Shimadzu Corporation's Response to FDA 21 CFR Part 11

At Shimadzu Corporation, in order to comply with FDA 21 CFR Part 11, we have suggested the following steps:

Use Windows 2000 Professional or Windows XP Professional, which offer a high level of security.
Increase the security level (e.g., access control and log functions) of client software (e.g., IRsolution) that performs device control and measurement/data processing.
Use in combination with CLASS-Agent data management software, which has database- management and electronic-signature functions.
Store and manage all measured and processed data in the CLASS-Agent database.

The following are also carried out:

Validation of software and hardware
Support and implementation of installation qualification and operational qualification
Support of system construction

Taking the field of FTIR as an example, let us look at how we can comply with FDA 21 CFR Part 11.

■ Compliance with FDA 21 CFR Part 11 for Shimadzu FTIR Systems

In order to comply with FDA 21 CFR Part 11 when using a Shimadzu FTIR system, IRsolution software and IRsolution Agent software are used in combination.
Both IRsolution and IRsolution Agent have high-level security-control functions, and measured and processed data is stored and managed in CLASS-Agent, which has high-level security functions.

(1) Access Control

FFDA 21 CFR Part 11 demands the following with respect to access control:

Access must be restricted to authorized users.
Available functions must be restricted according to the user.
It must be possible to change the password regularly.
There must be functions for preventing illegal access.

IRsolution and IRsolution Agent have a software security function that prompts the user for a user name and password at startup.
Users are divided into at least 3 groups (Administrators, Developers, Operators, etc.) and the functions that can be used by each group are restricted. There are also functions for setting the validity period of passwords, locking accounts, and automatically logging out, which can be used to prevent illegal access.

(2) Data Integrity

FDA 21 CFR Part 11 demands the following with respect to data integrity:

FDA 21 CFR Part 11 demands the following with respect to data integrity:

With IRsolution, in addition to information on the measurement conditions, times/dates, the user name, and device names, interferograms, which represent the real "raw data", are recorded and stored together in data files (container files). Also, because all data is stored together in container files after data processing, raw data and partly processed data can be recovered from processed data.
Also, all measured and processed data is automatically stored in the CLASS-Agent database, which has high-level security functions, and is therefore reliably protected from falsification and corruption.

(3) Data Security

In FDA 21 CFR Part 11 systems, sampled raw data must be reliably protected from deletion, overwriting, alteration, and accidents.
With IRsolution, all measured raw data is automatically stored in the hard disk. Deletion and overwriting of data is prohibited and so the loss of data due to processing or accidents is prevented.

(4) Audit Trail

FDA 21 CFR Part 11 demands the following with respect to audit trails:

An operation log for devices that includes information on logon activity and details of operations must be recorded.

With IRsolution and IRsolution Agent, a history of operations, including user names and details on measurements and data processing, is recorded and displayed in the operation (system) log. The times and dates at which measurements are performed and details of the data processing carried out are recorded in the data log.

(5) Electronic Signature

FDA 21 CFR Part 11 demands the following with respect to electronic signatures:

Electronic signatures are unique to individuals and must not be reused by or reassigned to other parties.
There must be at least two identification components (e.g., an ID and a password).
Signed electronic records must contain signature information detailing the full name of the signer, the time and date of the signature, and the reason for signing.
Electronic signatures must be linked to the electronic records to which they apply.
There must be mechanisms for preventing the use of signatures to disguise electronic records.

Electronic signatures are used with IRsolution. Electronic signing requires the input of a user name and password.

(6) Validation

FDA 21 CFR Part 11 demands the following with respect to validation:

Validation is required for elements that may affect the results of experiments, such as hardware and software.

IRsolution and IRsolution Agent are equipped with an alteration check program that can be used to check whether or not software has been installed correctly. Validation of hardware (e.g., IRPrestige-21 or FTIR-8400S) is performed with a validation program that complies with the Japanese and European Pharmacopoeia and ASTM. There is also support for the installation qualification and operational qualification that is carried out at installation and in periodic inspections.

■ Compliance with FDA 21 CFR Part 11 Using IRsolution

The following components are required for compliance with FDA 21 CFR Part 11 when using a Shimadzu FTIR system:

IRsolution Ver. 1.10 or later
IRsolution Agent Ver. 2.11 or later (equipped with Agent Manager, User Authentication Tool, and MSDE)

■ Networked Systems and Stand-Alone Systems

If there is only one FTIR instrument, it is convenient to use a stand-alone system where an Agent database is created on the FTIR computer and data measured and processed with FTIR is stored and managed on the database. In this case, MSDE (Microsoft Data Engine) is used as the database.
Alternatively, when using Shimadzu analytical instruments, such as UV-VIS spectrophotometers and liquid chromatographs, it is possible to construct a network system where computers used to control the analytical instruments are connected via a network. In this case, a database can be created on a server and all data can be centrally managed on this database. Also, performing user management 1) at the server makes management considerably easier. In this case, Microsoft SQL Server or Oracle is used as the server. At present, there are many types of instrument that use software compatible with the CLASS-Agent system. These include the following:

UV-VIS spectrophotometers, atomic absorption spectrophotometers, LC, GC, LC-MS, GC-MS, balances, thermal analyzers, TOC, dissolution testing machines (Toyama Sangyo Co., Ltd.), Karl Fischer moisture titrators (Kyoto Electronics), and general titrators (Kyoto Electronics).

Select a system that is suitable for the type and number of analytical instruments used.

1) IRsolution's user-management functions cannot be shared with CLASS-Agent or other software. This functionality is due to be added in the future.

■ Future Developments

FDA 21 CFR Part 11 was established in order to promote a reduction in the amount of paper used for documentation and to increase the reliability of data and systems. In the U.S., in accordance with the Government Paper Elimination Act (GPEA), a project to render all government documentation into electronic format is being promoted. The Environmental Protection Agency (EPA) and the U.S. Patent and Trademark Office are working towards the establishment of similar regulations. Japan's Ministry of Health, Labour and Welfare implemented similar regulations.

In practice, there are many things that have to be done in order to construct a system that complies with FDA 21 CRF Part 11. These include the establishment of the required specifications for devices and software, discussions prior to system construction and installation, installation, installation qualification, operational qualification, training, and the establishment of equipment management methods and SOP. At Shimadzu Corporation, we are providing support for our customers in order to facilitate compliance with FDA 21 CFR Part 11.

FTIR Talk Letter Vol. 3