Warning letters

FDA has begun to issue warning letters and 483s for failure to comply with 21 CFR Part 11. FDA's "Compliance Policy Guide" gives this example of a regulatory citation for a violation of the device quality system regulations: "Failure to establish and maintain procedures to control all documents that are required by 21 CFR 820.40, and failure to use authority checks to ensure that only authorized individuals can use the system and alter records, as required by 21 CFR 11.10(g). For example, engineering drawings for manufacturing equipment and devices are stored in AutoCAD form on a desktop computer. The storage device was not protected from unauthorized access and modification of the drawings."

BioPharm's home on the Worldwide Web (www.pharmaportal.com) enables you to search the text of FDA warning letters online. Studying recent warning letters related to Part 11 will help you determine what inspectors will be looking for. The following samples illustrate the variety of responses FDA might make to Part 11 violations.

11 August 2000 (www.fda.gov/foil warning letters/m4105n.pdf). ". . . deficient controls in the laboratory electronic record keeping system, which is used for maintaining chromatographs and audit trails.... Please outline your firm's global corrective action plan, including timeframes for correction, to address this Part 11 issue."

12 November 1999 (www.fda.gov/foi/ warning_letters/m3190n.pdf). ". . . no documentation covering Excel application software, or any procedures instituted covering the protection of electronic records or an established back-up system."

21 July 1999 (www.fda.gov/foi/warning_ letters/m2819n.pdf). ". . . failed to properly maintain electronic files containing data secured in the course of tests from 20 HPLCS and 3 GLCS.... No investigation was conducted. . . to determine the cause of missing data and no corrective measures were implemented to prevent the recurrence of this event."

2 March 2000 (www.fda.gov/foi/warning_ letters/m3450n.pdf). ". . . lack of a secure system to prevent unauthorized entry in restricted data systems. Data edit authentication rights were available to all unauthorized users not only the system administrator. The microbiology department's original reports on sterility test failures of Penicillin G Potassium for Injection, lots 9804024 and 9811016 due to environmental mold, which were sent via electronic mail to the Quality Assurance management differed significantly from the versions included in the Quality Assurance management's official reports. The network module design limitations, which can only support up to four chromatographic data acquisition systems, had up to five chromatographic systems connected. ... No validation showing this configuration to be acceptable."

2 August 2000 (www.fda.gov/foi/warning_ letters/ m2811n.pdf). "Our inspection disclosed numerous and significant deviations from Part 11." Note in the following examples quoted that the investigator attempts to explain the importance of each item.

* "The system does not generate an audit trail, and there is no way to determine if values have been changed on batch production records. This is important because an audit trail can be the only evidence that an electronic record has been altered. We note, for instance, that your system only records the last value entered by an operator and that values, such as Oxygen potency levels that my have been entered earlier and that may indicate potentially serious quality problems, are not recorded. The system prompts an operator when equipment detects that an Oxygen potency value is non-conforming, and permits the operator to record a value that is within specification, but does not record the original out of specification value.

* "No written procedures that would hold individuals accountable for actions taken under their electronic signatures. It is vital that employees accord their electronic signatures the same legal weight and solemnity as their traditional handwritten signatures. Absent such written and unambiguous policies, employees may be more apt to make mistakes, under the erroneous assumption that they will be held to a lower level of accountability than they might otherwise expect when they execute traditional handwritten signatures.

* "No documentation or testing of the system's ability to discern invalid or altered records. This is significant because electronic records by their nature may be easily altered in a manner that is difficult or impossible to detect. If an employee were to alter an electronic batch record in an unauthorized manner, your system would not be able to detect such change.

* "No documentation to show if the system has the ability to generate accurate and complete copies of records in electronic form; copies of electronic records cannot be generated at these sites. It is vital for FDA to be able to audit electronic production records by, among other things, reviewing electronic copies of your electronic records. It is therefore a serious matter that your system cannot generate such on-site electronic copies.

*"No safeguards to prevent unauthorized use of electronic signatures that are based on identification codes/passwords when an employee who has logged onto a terminal leaves the terminal without logging off. This is serious because another employee or individual could impersonate the individual who has already been logged on, and thereby easily falsify an electronic record. The resulting batch production record, for instance, would not be an accurate and reliable indication of the lot's history. Moreover, in such an environment it would be fairly easy for the genuine logged on employee to disavow a signature as false, and thereby seek to avoid responsibility for actions under his/her signature (on the basis that it is fairly easy for someone else to apply his/her electronic signature.) .... The untrustworthy nature of the electronic production records would make it difficult to reliably reconstruct the full history of a lot's production in the event problems had to be investigated and solved.... We note that your electronic record keeping system is centralized and that all your facilities use the same procedures. This leads us to conclude that these deficiencies maybe replicated throughout your organization."