Recalculation E-Signature

A Recalculation E-Signature is the Part 11 / Annex 11 electronic-signature event that authorises a recomputation of a regulated calculation on a closed BMR after the fact. It is the only legitimate way to update a number that the §211.192 production-record-review process has already signed off on — and even then it is not an edit. The original value stays in place, immutable; the recalculated value is appended to the record; both are rendered side-by-side on every regenerated PDF; both carry full audit-trail metadata; and a deviation is always opened in parallel.

Common triggers: a per-lot potency factor that was transcribed from the wrong CoA section; an LOD figure that was applied without the basis conversion (anhydrous-vs-as-is); a salt-to-base factor that ignored a hydrate water-of-crystallisation; a counter-balance figure that drifted because PF was applied before scaling instead of after; a scaled theoretical that was computed against the previous MMR revision because the WO snapshot mis-pulled; an actual_net that double-counted (or omitted) an IPC sample mass; a yield % that read pass against the nominal denominator instead of the scaled. Anything that flows through the calculation engine and lands on the BMR is a potential recalculation target.

Every regulated electronic signature — including the recalculation e-sig — must carry four elements per 21 CFR 11.50 (signature manifestations) + 11.70 (signature/record linking). The recalculation event additionally carries a structured reason code and free-text justification, the original value, and the recalculated value.

A recalculation event without a paired deviation is a §211.192 + Annex 11 §13 (deviation management) violation. The deviation captures: what was wrong, what was recalculated, what the original-vs-recalculated values are, what the impact on disposition is (does the recalculated value change the pass/fail decision?), and what the cross-batch scope is (does the same root cause affect other batches?). Investigation closes the deviation; CAPA is opened if the recalculated value falls outside the validated envelope or if the root cause is systemic.

• Single-batch scope — root cause is unique to this batch (e.g. an operator transcribed one CoA wrong); deviation closure, no CAPA, BMR re-rendered with recalculated value alongside original.
• Cross-batch scope — root cause affects multiple batches (e.g. a master-data PF that has been wrong for three months); deviation expanded to scope all affected batches, each batch recomputed under its own recalc e-sig, impact on already-distributed product assessed for recall, CAPA opened.
• Wrong-MMR-snapshot scope — root cause is a system / process gap (e.g. WO snapshot was pulling from an outdated MMR cache); deviation + CAPA + change control (CSV revalidation if a software gap) under ICH Q10 §3.2.3.
• Out-of-envelope after recalc — recalculated yield % is outside the validated envelope even though the original read pass; deviation upgraded to OOS-equivalent; full §211.192 + §211.165 investigation; impact assessment on all batches in the affected campaign.

1. Overwrite-no-audit — a number is changed directly in the database / spreadsheet / PDF without going through the recalc event; original value is lost; auditor compares paper-trail to electronic record and the mismatch surfaces as a §211.68 + §211.188 violation.
2. Single-signature recalc — production supervisor performs the recalculation and signs it; no independent QA reviewer; §211.192 dual-control violation.
3. Recalculation without a paired deviation — change is made under e-sig but the deviation is not opened; §211.192 + Annex 11 §13 violation; root cause is never identified; cross-batch impact is never assessed; the same error recurs.
4. Scope-only-the-failing-batch — root cause turns out to be a master-data PF wrong for three months; the deviation is closed against only the one batch where it was noticed; the other batches go unrecomputed and remain shipped at incorrect potency; this is the most expensive form of the failure because it routinely escalates to recall.
5. New-PDF-replaces-old-PDF — the regenerated BMR PDF is uploaded over the original in document storage; the original is no longer available; ALCOA+ Originality and Available principles violated; even if the recalculation itself was correctly e-signed, the artefact chain is broken.
6. 'Minor administrative correction' label — operator marks the recalc reason as 'minor administrative correction — no impact'; the deviation is not opened; subsequent audit identifies that the corrected value crossed the disposition boundary; the 'no-impact' assertion is shown false retrospectively; data integrity 483 issued.

• Recalculation rate (per product per quarter) — target near zero; any rise is a master-data-quality or training signal, not normal operational noise.
• Time from discovery to e-sig (median hours) — target ≤72 h; longer indicates a process gap where issues sit known-but-unaddressed.
• Dual-signature compliance % — fraction of recalc events with distinct preparer + reviewer (target 100%; database constraint should keep this at 100%).
• Paired-deviation compliance % — fraction of recalc events with a linked deviation (target 100%).
• Cross-batch impact-assessment closure rate — fraction of recalc deviations whose scoping decision (single-batch vs cross-batch) is documented + closed within SLA (target ≥95%, target SLA 14 days).
• Recalculation leading to disposition change (count per quarter) — recalcs that changed pass→fail or fail→pass; any non-zero number triggers a focused review of the upstream calculation engine + master data.
• Recalculation leading to recall (count per year) — target 0; any non-zero number is a board-level event with mandatory CAPA + ICH Q10 §3.2.3 change control.

1. Originals are immutable: every regulated calculation row in dispense_results, work_orders.mmr_snapshot, and ipc_results is stored once at close and never overwritten; recalculations append a new row with version=original.version+1 linked to the recalc event ID.
2. Recalc UI is a guarded transaction: opening a recalc on a closed BMR requires a 'Recalculate this value' action that pre-fills the original value, asks for the reason code (structured taxonomy) + free-text justification, and forces the deviation to be opened in the same modal — no recalc without deviation, enforced at the transaction layer.
3. Distinct-user dual e-sig: preparer e-sig captures the recalculation; reviewer e-sig (separate user, enforced at DB level) approves the recalculated value; both Part 11 e-sigs with full four-element manifestation; both linked to the deviation.
4. Side-by-side PDF render: regenerated BMR PDF shows original value with a strike-through and the recalculated value adjacent, both annotated with their respective e-sig metadata + the recalc event ID; the original PDF is never deleted, only superseded — both are kept in report_renders with revision pointers.
5. Audit-trail review surface: the §211.192 audit-trail review dashboard surfaces all recalc events for QA pre-review; reviewer can filter by reason code, time-window, product, user, and impact-assessment-closure status.
6. Cross-batch impact-assessment workflow: a recalc event with reason code 'wrong-master-data' or 'wrong-snapshot' automatically asks 'is this isolated or systemic?'; selecting systemic opens an impact-assessment workflow that scopes all batches sharing the suspect master-data version + routes them to a parallel review queue.
7. Recall-scoping pre-flight: if the recalculated value crosses the disposition boundary (pass → fail or fail → pass), the recalc event auto-flags the batch as 'disposition-change candidate' and pages the QA director within 1 h; this is the recall pre-flight without yet declaring a recall.
8. Yield-% integration: a recalc on PF / LOD / SBF / counter-balance / scaled-theoretical / actual_net automatically chains a recalc on dependent yield % values; the chain is preserved in the audit trail as 'recalc cascade [parent event ID]'.
9. Change-control bridge: a recalc reason of 'wrong-snapshot' or 'wrong-master-data' that recurs N times in a rolling window automatically files a change-control candidate under ICH Q10 §3.2.3 — surfaced to the QA director at the next quarterly review.
10. Quarterly ICH Q10 §3.2.5 review: per-product recalc-rate, time-to-e-sig, dual-sig compliance, paired-deviation compliance, cross-batch closure rate, and disposition-change events — one report-pack the QA director presents at the management review.