Memo of Meeting

Date: May 30, 2001

Location: 2094 Gaither Road

Rockville, MD

Subject: 21 Code of Federal Regulations, Part 11; Electronic Records; Electronic Signatures; Audit Trails

Representing the Industry Coalition on 21 CFR Part 11:

Mr. William Bradley, Vice President, Technical Affairs, Consumer Health Care Products Association

Glen Thomson, Compliance Assurance Services, Bristol Myers Squibb

Mr. Krishan Arora, Vice President Technical Operations, Pharmacia

Mr. Michael Weis, Director, IM Quality & Compliance, Janssen Research Foundation

Mr. Dave Everson, President IT Management Solutions, Inc.

Mr. Johnny Long, Director, Quality Management, Baxter Healthcare Corp.

Mr. Will Robinson, Staff VP, CR Bard, Inc.

Mr. Robert Rhorer, Dir., Validation Security, Pfizer, Inc.; Animal Health Institute

Mr. John Nagle, IS Manager, Medispectra, Inc.

Mr. Bernie Liebler, Director, Technology & Regulatory Affairs, Advanced Medical Technology Association

Representing the Food and Drug Administration, FDA Part 11 Compliance Committee:

Mr. John Taylor, Director, Office of Enforcement

Mr. Paul J. Motise, Consumer Safety Officer, Office of Enforcement

Dr. James McCormack, Consumer Safety Officer, Office of Enforcement

Ms. Sonal Vaid, General Attorney, Office of Chief Counsel

Mr. Mark Hackman, Consumer Safety Officer, Center for Food Safety and Applied Nutrition

Mr. Stewart Crumpler, Regulatory Officer, Center for Devices and Radiological Health

Mr. John Murray, Electronics Engineer, Center for Devices and Radiological Health

Dr. Randy Levin, Medical Officer, Center for Drug Evaluation and Research

Ms. Jennifer Thomas, Associate Director for Policy, Office of Compliance and Biologics Quality, Center for Biologics Evaluation and Research

The meeting was requested by the industry coalition to discuss the audit trail requirements of 21 CFR Part 11.

Mr. Taylor explained that we wanted this meeting to focus on matters relating to audit trails, because FDA is in the process of preparing industry guidance in this area and we were seeking input from a variety of sources. Mr. Thompson, the chair of the coalition’s subgroup on audit trails, commented that while the subject was not new, it overlapped other areas and was complex.

During the meeting we discussed the following points. Attached is a paper that the coalition presented.

When Audit Trials Should Begin:

We discussed aspects of when audit trails should begin, and several scenarios. In one scenario, audit trailing would begin depending upon the nature of the electronic records with respect to whether or not the records may be prepared in a draft or iterative manner. Some predicate regulations require information to be recorded contemporaneously with the actions or information being documented. For these type records drafts or preliminary versions would not be permissible. The audit trial for this type of electronic record in this scenario would commence upon writing the information to the electronic record from which a human readable form could be made.

For other records in this scenario that may undergo preliminary versions, audit trails would begin when the time of recording matters to record integrity and the point from which any changes and record deletion also mattered to record integrity. This category posed more varied types of records including, but not limited to the following:

• Single signature records. An individual develops a record, such as a procedure, and prepares a sequence of drafts in the process. Preliminary drafts might not be audit trailed. However, at some point the individual considers a version to be a completed work product, usually by affixing a signature. The audit trail would commence when the version is saved or signed. The record may be stand-alone or be part of a larger record, as in the next example.

• Multiple signature records. A record may be made up of several segments, each authored or otherwise signed by a different person. Once a signature has been affixed, the words attributed to that individual should not be changed so as to alter the attributed statements. Accordingly, the audit trail would begin with the first signing or other attribution. The signed record may still be part of a larger record that itself is still a "draft," but the audit trail would begin and carry forward to capture changes and record deletion. If the signed segment is overruled and ultimately rejected (e.g. sent back to the author for rework,) or replaced by an entirely different record, the rejected portion and its audit trail could be destroyed if the applicable predicate rule did not require that the rejected segment be retained.

• Unsigned records. Where predicate rules allow for preliminary versions or drafts, but there are no attributions, the audit trail would commence when, as defined by written procedures, a completed work product has been recorded to a retrievable form. The coalition raised the example of a database of values that are transcribed from original source records. As a quality control procedure to ensure accurate transcription of handwritten records to an electronic data set, data are transcribed by multiple data entry personnel (i.e., double data entry.) When the transcriptions do not agree, an inspection of the handwritten record is performed to determine the actual datum. Audit trailing of the database in this case would begin when there are no longer conflicts to be resolved, and the data set is determined to be an accurate transcription of the handwritten records. For example, changes in the data resulting from subsequent evaluation and query resolutions would be captured in the computer generated audit trail.

We commented that although the coalition members had some very specific scenarios in mind, our guidance has to be broad enough to have general applicability.

We also discussed the structure of an audit trail. The coalition commented that an audit trail may take on a variety of appropriate structures and that guidance should not imply that only a certain design could be used.

Regarding systems that are hybrid mixtures of traditional paper and electronic records, we commented that part 11 addresses audit trailing of electronic records, although predicate rules may require a broader reconstruction of events covered by both paper and electronic records. We also commented that part 11 requires the audit trail itself to be an electronic record.

The meeting concluded after about two hours.

DOC ID: Memo of Meeting053001.doc

P. Motise 07/30/01

cc: HFA-224

HFC-200

FDA Meeting Attendees