A CERT-In Empanelled Auditing Organization
Audits & Attestation

21 CFR Part 11

Compliance audits for electronic records and electronic signatures under FDA 21 CFR Part 11, for regulated life-sciences and medical-device environments.

Overview

Trustworthy electronic records, audit-ready.

For FDA-regulated organisations, Part 11 governs how electronic records and signatures must be controlled to be considered trustworthy and equivalent to paper.

We assess your systems and processes against Part 11 — covering validation, audit trails, access controls and signature requirements — and identify what’s needed to satisfy regulatory expectations.

What’s covered

The areas this audit examines.

System validation

Evidence that systems perform as intended.

Audit trails

Secure, time-stamped, tamper-evident logging.

Access & authority checks

Limiting system access to authorised users.

Electronic signatures

Uniqueness, binding and signature controls.

Records integrity (ALCOA+)

Accurate, complete and retrievable data.

Who needs this

Is this engagement for you?

The profiles that typically call on this service.

Pharma & biotechFDA-regulated electronic records.
Medical device manufacturersElectronic QMS records.
Clinical research / CROsTrial-data integrity.
Life-sciences software vendorsPart 11-capable systems.
Contract manufacturersRegulated production records.
FDA-regulated orgs with e-recordsPart 11 applicability.
Regulatory drivers

Why this is required

Life-sciences organisations selling into the US must demonstrate that electronic records and signatures meet 21 CFR Part 11 alongside the underlying predicate rules; independent assessment evidences data integrity to the FDA.

21 CFR Part 11
Sets requirements for electronic records, electronic signatures, audit trails and computer-system validation.
Predicate rules (GxP)
Part 11 applies on top of the GMP, GLP and GCP rules that govern the records themselves.
FDA inspection readiness
Demonstrable Part 11 compliance is expected during FDA inspections and audits.
How we work

A proven, methodical approach.

A staged approach built to deliver a defensible outcome.

Scoping & system inventory

Identifying the GxP systems and electronic records in scope.

Predicate-rule & Part 11 mapping

Mapping requirements to the predicate rules and 21 CFR Part 11.

Records & signatures testing

Testing electronic records and electronic-signature controls.

Audit-trail & access review

Reviewing audit trails, access controls and data integrity.

Validation evidence review

Assessing computer-system validation evidence.

Findings & remediation report

A report with findings and a remediation plan.

What you receive

Documentation built for every audience.

  • Compliance assessment reportFindings against 21 CFR Part 11.
  • Part 11 control matrixControls mapped to each requirement.
  • Records & signatures findingsAudit-trail and e-signature observations.
  • Gap registerGaps with risk ratings.
  • Remediation planA clear plan to address findings.

Standards & frameworks

The work is mapped to the standards and rules that apply to you.

21 CFR Part 11FDA data integrity guidanceGAMP 5ALCOA+
Checklist

Are you ready? A quick checklist

What to have in place before we begin.

In-scope systems inventoried
Validation documentation available
Audit-trail configuration reviewed
Access controls and roles defined
E-signature controls in place
Data backup / archival policy
SOPs for Part 11 systems
Data-integrity (ALCOA+) evidence
FAQ

Common questions

Who needs Part 11 compliance?
Any organisation regulated by the FDA that uses electronic records or electronic signatures in place of paper — including pharmaceutical, biotech and medical-device companies and their suppliers. If your quality, manufacturing or clinical records are created, modified or stored electronically, Part 11 applies to those systems.
Does this include computer system validation?
Our audit assesses the validation evidence relevant to Part 11 — that the systems holding your electronic records are validated, controlled and produce reliable, attributable records. A full computer-system-validation programme is a larger exercise, which we can scope and run alongside the audit where needed.
How does this relate to data integrity?
Part 11 underpins the data-integrity expectations regulators apply, commonly summarised as ALCOA+ — that records are Attributable, Legible, Contemporaneous, Original and Accurate, and remain so over time. We evaluate audit trails, access controls and record handling against these principles as part of the assessment.
Related services

Continue exploring

Ready to get started?

Tell us your goals and constraints, and we’ll shape the right engagement.