De-Bunking the Myth – “21 CFR Part 11 is more of a Suggestion than a Requirement.”

Eastlake Quality Consulting has heard this statement (or variations of it) so many times we’ve lost count.  Its often said by management personnel supervising drug substance and drug product manufacturing, testing labs, product storage facilities, computer network systems, and electronic platforms used to sign GxP documents.  By treating 21 CFR 11 as a suggestion and not a requirement, companies are knowingly inviting regulatory inspection observations. 

Here is a short list of common excuses for avoiding compliance with 21 CFR Part 11:

“We only have one chromatography software license so our analysts share a single username and password”

• Warning Letter from 2022 – Mid-West, USA – Requirement for unique passwords for laboratory instruments used to generate analytical data for finished API are not in use.
• Warning Letter from 2019 – Analytical Lab, Mid-West, USA – Access to Chromatography software does not require employee-specific logins.

“One of our lab analysts is also our software system administrator.”

• Warning Letter from 2021 – Analytical Lab, West Coast, USA. – The company’s Quality Systems lack of controls to prevent deletion and alternation of raw data files from gas chromatography systems.  The lab analyst performing drug analyses had administrative privileges in the GC software as is able to delete data sequences, change/modify methods, and disable audit trails.

“We don’t validate our Excel spreadsheets we use to calculate results.  Our official GMP documentation is our certificates of analysis”

• Warning Letter from 2021 – Analytical Lab, West Coast, USA – Company failed to validate electronic worksheets used by laboratory personnel for microbial challenge efficacy testing. These unvalidated calculations call into question the validity of the data generated from these spreadsheets.

“21 CFR Part 11 only applies to the Quality Controls Labs”

• Warning Letter from 2022 – Analytical Testing Lab, Location: Mid-West, USA. – No procedures governing review of audit trails of both production and laboratory equipment by Quality Assurance. Software audit trails were not enabled.

““Our Quality Control Supervisor only reviews our printed testing summaries”

• Warning Letter from 2017, Manufacturer, West Coast, USA – Your firm does not conduct reviews of electronic data to ensure HPLC integrations were performed correctly and to assess whether data has been manipulated to make results meet specifications.

Discovery how Eastlake Quality Consulting can improve your company’s compliance with 21 CFR Part 11