21 CFR Part 11: Records, Signatures, and Audit Trails Without the Theatre
Part 11 in plain English: which records it covers, what a sound audit trail and signature look like, and how much validation is enough.
In Short
- Part 11 applies to electronic records required by another FDA rule, and to signatures on them.
- Audit trails keep old and new values and cannot be edited; review is defined in your procedure.
- Signatures show name, time and meaning, and stay linked to the record.
Electronic Records & Inspection Readiness Buyer Guide
For quality, regulatory, validation and IT teams evaluating electronic records, signatures and inspection readiness. Use it with or without V5.
- See what a signature must show.
- Check corrections keep the original.
- Know where Part 11 applies.
We ask for your name and email so we can handle this request. The full guide then opens on this site, ready to translate, print or save. Privacy policy. Practical orientation, not legal advice; your quality unit decides which rules apply.
UltimateFree guide
Electronic Records & Inspection Readiness Buyer Guide
For quality, regulatory, validation and IT teams evaluating electronic records, signatures and inspection readiness. Use it with or without V5.
21 CFR Part 11 has been law since 1997, and it still trips up companies in 2026. The rule is short — about a dozen pages — but the implementation choices are where most operators get hurt: open vs closed systems, the depth of the audit trail, how signatures are bound to records, how validation is documented. This guide explains Part 11 in plain English, separates the parts FDA actually enforces from the parts that have softened under the agency's risk-based guidance, and gives you a 60-day path to a defensible posture. It is written for QA leads, IT owners, and validation engineers at pharma, biotech, medical-device, and dietary-supplement manufacturers.
What Part 11 actually requires
Part 11 covers any electronic record or electronic signature that an FDA-regulated entity uses to satisfy a predicate-rule requirement (211, 820, 111, 117, 1271, 600s, etc.). It splits into two halves.
Is this record in scope?
- Required by a predicate rule (for example 21 CFR 211.188) and kept electronically.
- Part 11 controls apply: audit trail, signatures, access, validation.
More on what Part 11 actually requires
Subpart B covers electronic records: validation, accurate copies, record retention, access controls, audit trails, operational checks, authority checks, device checks. Subpart C covers electronic signatures: unique to one person, two distinct identification components (typically user ID + password), and a clear linkage between the signature manifestation and the record it signs. The 2003 scope-and-application guidance narrowed FDA's enforcement focus to records that are actually relied on for the predicate rule — but it did not delete the rule. If a record is in scope, every clause still applies.
Open vs closed systems — and why it matters
A closed system is one where access is controlled by the people responsible for the content (your eQMS behind SSO, for example). An open system is one where access is controlled by parties outside that responsibility — typically anything traversing the open internet without additional controls.
More on open vs closed systems — and why it matters
Closed systems carry Subpart B requirements; open systems add §11.30 obligations like document encryption and digital signature standards. In practice, almost every modern SaaS eQMS is treated as a closed system because the vendor authenticates users, controls the network path, and provides the access logs — but you have to be able to demonstrate that on demand. Get the architecture statement, the SSO configuration, and the TLS/encryption posture documented up front; an auditor asking 'closed or open?' on day one of an inspection is a bad surprise.
Audit Trails Done Properly
Section 11.10(e) requires secure, computer-generated, time-stamped audit trails that independently record operator entries and actions that create, modify or delete records, without obscuring earlier values, kept as long as the record. Three weaknesses recur: the new value is kept but not the old one; the reason for change is optional and left blank; and an administrator can edit history.
Audit-Trail Checks
More on audit Trails Done Properly
Part 11 itself does not set a review frequency, but FDA's data integrity guidance (December 2018) expects audit trails of critical records to be reviewed, for example before batch release. Put the review cadence in your procedure and sign the reviews.
Electronic Signatures: Identity, Intent, Binding
Sections 11.50 and 11.70 require each signed record to show the printed name, date and time, and meaning (such as review, approval or responsibility), with signatures linked so they cannot be cut, copied or transferred. Section 11.200 requires two distinct identification components such as user ID and password; in a continuous session the first signing uses both, later signings at least one.
Common gap. Signature meaning: a name and date with no statement of what the person did.
Anatomy of One Electronic Signature
What a signed record should show (21 CFR 11.50 and 11.70). Example invented.
| Part | Example | Rule |
|---|---|---|
| Printed name | Dana Ortiz | 11.50(a)(1) |
| Date and time | 2026-09-14 15:42 local | 11.50(a)(2) |
| Meaning | Approved for release | 11.50(a)(3) |
| Linked to record | Batch B-2291, version 3 | 11.70 |
| Two components | User ID + password at first signing | 11.200(a) |
- Printed name
- Example
- Dana Ortiz
- Rule
- 11.50(a)(1)
- Date and time
- Example
- 2026-09-14 15:42 local
- Rule
- 11.50(a)(2)
- Meaning
- Example
- Approved for release
- Rule
- 11.50(a)(3)
- Linked to record
- Example
- Batch B-2291, version 3
- Rule
- 11.70
- Two components
- Example
- User ID + password at first signing
- Rule
- 11.200(a)
More on electronic Signatures: Identity, Intent, Binding
Define meanings in your procedure, offer them in the system, and store them with the record.
Validation — and FDA's risk-based stance
Section 11.10(a) requires validation for accuracy, reliability, consistent intended performance and the ability to spot invalid or altered records. FDA's 2003 scope and application guidance set out a risk-based approach, and FDA's Computer Software Assurance guidance (revised February 2026, superseding the September 2025 final guidance; nonbinding, scoped to medical device production and QMS software) encourages testing focused on what affects product quality and data integrity.
More on validation — and FDA's risk-based stance
For Part 11 controls, that means showing the audit trail captures events, signatures stay linked, access follows least privilege, backup and restore work, and operational checks behave as designed.
A Readiness Order of Work
List every electronic record relied on for a predicate rule (batch records, deviations, CAPA, training, release, supplier qualification, complaints). For each system, confirm unique log-ins, role-based access and audit-trail completeness, and close gaps in reason-for-change and signature meaning.
More on a Readiness Order of Work
Write the system description (including open or closed), the access matrix, the data-integrity procedure and the audit-trail review procedure. Run risk-based validation on the Part 11 controls that matter most. Then hold an internal mock inspection. Pace depends on how many systems you have; the aim is a system an investigator can open at random.
What enforcement looks like in 2026
Recurring themes in FDA observations and warning letters include audit trails not reviewed, shared log-ins, and uncontrolled spreadsheets used for regulated records. Enforcement usually pairs a Part 11 gap with a failure of the underlying rule (for drugs, for example, 21 CFR 211.68 or 211.194; for devices, the QMSR requirements now in Part 820).
More on what enforcement looks like in 2026
Make the underlying record sound on its own and let Part 11 controls sit on top.
Questions
Do spreadsheets count as Part 11 records?
If the spreadsheet is used to satisfy a predicate-rule requirement and the data is relied on for a regulated decision, yes — it is in scope. That means access control, audit trail, validation, and signature binding all apply. Most spreadsheets fail all four. The pragmatic move is to migrate any regulated calculation into your eQMS and keep spreadsheets for ad-hoc analysis only.
Is a typed name plus a checkbox a valid electronic signature?
Not on its own. §11.200 requires two distinct identification components, captured under controls that enforce non-repudiation. A typed name in a free-text field with no re-authentication, no audit trail and no binding to the record is not compliant. The signature has to be issued through a system that authenticates the user, captures intent (meaning), and links the signature to the specific record version.
Does Part 11 apply to records we keep voluntarily?
FDA's enforcement focus is on records required by a predicate rule. Records you keep purely for internal purposes (e.g. management metrics not tied to a predicate rule) are out of scope. But if those same data also feed a regulated record — for example, a training metric that supports release decisions — they are in scope. When in doubt, treat the record as in scope; the marginal cost in a modern eQMS is low and the marginal risk of getting it wrong is high.
How often should the audit trail be reviewed?
FDA does not prescribe a frequency, but the expectation is that review is documented, signed, and proportionate to the risk of the record. Batch records and release records typically get a per-batch review; system-level configuration changes get a periodic (monthly or quarterly) review. The cadence belongs in your SOP, the evidence belongs in the eQMS, and the reviewer's signature belongs on the record itself — not in a separate log.
Practical orientation, not legal advice. Rules differ by jurisdiction; your quality and compliance team decides what applies.
Keep reading
AI and 21 CFR Part 11: Where AI Fits in Regulated Records
21 CFR 111 Readiness: Identity, Master and Batch Records
21 CFR Part 211 Guide: Scope, Batch Controls and QCU Review
21 CFR 212 PET Drug cGMP Readiness: Production Evidence Guide
BSE Feed Rule Readiness: 21 CFR 589.2000 and 589.2001 for Feed and Pet Food
21 CFR 820 to ISO 13485 Crosswalk: Re-citing Procedures Under the QMSR