What does 21 CFR Part 11 require for electronic records and audit trails?

21 CFR Part 11 requires that FDA-regulated electronic records be trustworthy, reliable, and protected from alteration — with independent, computer-generated, time-stamped audit trails that record every creation, modification, and deletion. The word independently in §11.10(b) is the requirement most systems fail: an audit trail maintained by the same organisation in the same database as the records it monitors is self-attesting, not independent.

The independence requirement in §11.10(b) means the audit trail mechanism must be controlled by a different party from the one creating records. A LIMS audit trail stored in the same Oracle database as the records, accessible to the same DBA who manages the system, is self-referential. FDA investigators in data integrity inspections consistently find that a determined administrator with database access can modify both records and their audit trail. The FDA's 2018 data integrity guidance acknowledges this: computerised systems must have audit trails that are stored in a way that prevents users from modifying them. Most on-premises ERP and LIMS systems do not meet this standard without additional controls.

FDA inspectors use the "data integrity investigational approach" (CDER/CBER, 2019): (1) review of the computerised system validation status and access controls; (2) comparison of printed batch records against raw electronic data to identify discrepancies; (3) analysis of audit trails for deleted, modified, or duplicate entries; (4) interviews with analysts about practices around data retention and system use; (5) IT forensics on shared network drives and instrument computers. Inspectors look specifically for "audit trail review" — whether the regulated facility reviews audit trails as part of batch record review. Many Warning Letters cite failure to include audit trail review in quality oversight procedures.

A validated Part 11 system handles access controls, user authentication, and internal record integrity. immut adds the one property the validated system cannot self-certify: independently verifiable proof that a specific record existed, unchanged, at a specific time. When you run immut at the point of each critical GxP activity (batch record completion, out-of-specification investigation, stability protocol approval), you create a blockchain-anchored timestamp that FDA inspectors can verify on the public XRP Ledger without trusting your system or your organisation. The Part 11 validation says the system is fit for purpose. immut proves the records it produced were contemporary with the events they record.

FDA found that audit trails had been disabled on manufacturing systems. Data had been deleted and re-entered. The Warning Letter finding: “Your firm failed to exercise appropriate controls over computerised systems to assure that only authorised personnel institute changes.” The inability to demonstrate audit trail integrity under §11.10(b) resulted in an import alert on all affected products.