21 CFR Part 11: What Labs Actually Get Wrong
· Updated · Matt Citardi
Part 11 compliance is frequently misunderstood: either over-engineered into paralysis or under-implemented until an audit surfaces the gaps. Here's a grounded take.
21 CFR Part 11 has been in effect since 1997. It governs the use of electronic records and electronic signatures in FDA-regulated environments. Nearly three decades later, I still encounter labs that are either treating it as a binary pass/fail checkbox or building elaborate compliance architectures around requirements that don't actually apply to them.
The regulation is not complicated. The implementation is complicated. Here are the four areas where labs most consistently get it wrong.
1. Scope confusion
Part 11 applies to electronic records required by FDA regulations or submitted to the FDA. It does not apply to every electronic document in a regulated facility. I've seen labs spend months validating systems with no Part 11 obligation, and I've seen labs leave actual Part 11 records in spreadsheets with no audit trail. Start with scope. Map your records. Identify which ones are predicate rule records. That exercise alone will focus your resources where they belong.
2. Audit trails treated as optional
Section 11.10(e) requires computer-generated, time-stamped audit trails that record what changed, when, and by whom, with the previous value preserved. Logging that a record was changed is not enough. I still encounter LIMS implementations where audit trail functionality was never enabled, misconfigured, or disabled post-go-live and never re-enabled. In an FDA inspection, that is a serious finding.
3. Electronic signatures misconfigured
Part 11 electronic signatures are not a typed name in a field. Section 11.50 requires the printed name of the signer, date and time, and the meaning of the signature. Section 11.100 requires each signature be unique to one individual and never reassigned. Many LIMS systems support compliant e-signatures but are not configured to be compliant by default. The difference between a system that can support Part 11 and one that is configured to meet it is a validation exercise, and it is not a small one.
4. Treating validation as a document exercise
A binder full of validation documents does not make a system validated. Validation means demonstrating with documented evidence that a system does what it is supposed to do, consistently, in its intended environment. IQ, OQ, and PQ protocols that test real functions. Requirements traceability that connects user requirements to test cases. Change control that ensures modifications are assessed and documented. The FDA's expectation is not a specific format. It's a demonstration that you understood the risk and tested appropriately.
Frequently Asked Questions
Does Part 11 apply to every electronic record in a lab?
No. Part 11 applies to electronic records required by FDA regulations or submitted to the FDA, not to every electronic document in a regulated facility. Start by mapping your records and identifying which ones are predicate rule records, then focus your effort there.
What does a Part 11 audit trail need to capture?
Section 11.10(e) requires computer-generated, time-stamped audit trails that record what changed, when, and by whom, with the previous value preserved. Logging that a record was changed is not enough. An audit trail that was never enabled, or was disabled after go-live, is a serious finding in an FDA inspection.
What makes an electronic signature Part 11 compliant?
A typed name in a field is not enough. Section 11.50 requires the printed name of the signer, the date and time, and the meaning of the signature, and Section 11.100 requires each signature to be unique to one individual and never reassigned. Many LIMS systems support compliant e-signatures but are not configured to be compliant by default.
Does a binder of validation documents make a system validated?
No. Validation means demonstrating with documented evidence that a system does what it is supposed to do, consistently, in its intended environment. That takes IQ, OQ, and PQ protocols that test real functions, requirements traceability from user requirements to test cases, and change control.
A focused review of your Part 11 obligations, audit trail configuration, e-signature setup, and validation documentation, what I call a regulatory compliance and validation engagement, is usually a half-day exercise for someone who knows what they're looking at.
Validation is one of the most common places I see LIMS projects get into trouble, right alongside the other nine mistakes in Top 10 LIMS Implementation Mistakes. Worth a look before your next project kicks off.
To see how these gaps show up in a working LIMS, spin the LIMS Cog, a free interactive wheel of common compliance issues and why they matter.
If you're heading into an audit and aren't confident in your posture, that's a fixable problem. Schedule a free 30-minute consultation, and I'll help you figure out where you stand.
Schedule a Free 30-Minute Consultation → | Explore Cogsult services →