Government regulations – including CFR21, Part 11 – establish standards for the way companies manage their electronic data and file electronic submissions rather than paper-based mechanisms. Indeed, as business practices evolve, governments in all countries have been introducing new rules for the use of electronic reporting for regulatory compliance.
From an IT management perspective, these sector-specific requirements must become part of the entire project process. Specifically, they must influence every stage of software development projects from analysis and requirements definition through test and deployment.
Overall, it’s a fundamental exercise in strategic planning and risk assessment.
CFR21, Part 11
The Code of Federal Regulations (CFR) codifies the permanent rules for US government departments. CFR Title 21 specifies the rules for the Food and Drug Administration (FDA) and the organizations it regulates, including biotechnology firms, medical device manufacturers, and pharmaceutical companies along with the entire food and drug sector.
CFR21 Part 11 defines requirements for storing electronic signatures and electronic records in a manner that will be accepted by the FDA when consuming documentation during auditing activities.
For companies operating in this space, these rules affect every part of their business.
Compliance with CFR21, Part 11 – IT Project Management Meeting the Standard
Effectively meeting the CFR21, Part 11 standard requires certain key steps.
- Legal Review – The first step is to understand the requirements and assess your internal readiness. Every company’s in-house counsel should review the regulations – in this case it’s the CFR21, Part 11 – then assess those requirements against the company’s systems to advise on the overall organizational exposure.
Perhaps most importantly, these interpretations should not be confined to the C-suite or the legal team. Instead they must be stored in a central location and shared widely so that risk perspective becomes part of the day-to-day IT project work.
- Systems Mapping – The next step is to identify your systems and show their use in company activities by creating business process flows, visual use cases, ecosystem maps, system context diagrams and other visual models to identify the vulnerable points.
- Risk Assessment – Once you understand each system’s particular business processes, you can conduct the risk assessment. The risk assessment will determine whether each individual IT system needs a course correction in order meet the compliance demands. Your company must evaluate the estimated risk against your own risk appetite, then determine the level of resolution it will pursue.
- Action Plan for Resolution – Major IT systems are complex, so there will certainly be times when the company does not meet the full compliance requirements. Where the risk appetite can accept that level of vulnerability, then a company may choose to retain the status quo. However, in most cases, the company will develop an Action Plan – a comprehensive approach of outlining the desirable changes, assigning the appropriate tasks and creating a workplan.
Effective IT teams inherently understand that action plans must be comprehensive. In other words, while individual solutions may offer short-term fixes, they lack the real effectiveness of a coordinated, system-wide approach. Implementing positive change that meets regulatory requirements necessitates a re-visiting of the overall IT platform and its requirements.
Precise traceability is key to developing and implementing your action plan. With precise traceability, analysts can associate systems with different types of users, as well as different steps in business processes, in order to get a clear picture of how the system is used within the organization. Most importantly, precise traceability will show why it is important to assess against Part 11 regulations.
Stay Flexible in a Changing Regulatory Environment
CFR 21, Part 11 covers companies operating in the United States that are regulated by the FDA, but there are similar standards in other countries and other industries. Whatever the regulatory requirement, this process of assessing risk, mapping your systems and creating an informed action plan for a comprehensive
It’s an investment in time and resources, but it’s an essential part of your company’s overall compliance strategy.
For more information, contact Blueprint Systems today.
