Locate the authoritative record
Identify the system and the intended use before reviewing a delivery event.
21 CFR Part 11 · Audit-trail review
21 CFR Part 11 audit trails and file delivery evidence
A download record can show that a reviewer collected a file. To assess a regulated electronic record, trace its creation, changes and review in the system responsible for that record.
Follow a recorded change
Ask how a reviewer can inspect the earlier entry and the event associated with the change.
Reconstruct the review
Test whether the evidence explains the record history as well as the external delivery.
Compare the two histories
Use a sample record and its exported copy. Have quality assurance establish which events each system records and how reviewers connect them.
Who acted?
Identify the individual or system associated with the recorded event.
What changed?
Determine whether the event describes a change to the source record or delivery of an exported copy.
When did it happen?
Read the timestamp in context, including time zones where the systems differ.
Can it be reviewed?
Ask a reviewer to reconstruct a sample change from the information retained in the record system.
Two histories.
Different questions.
Exchange history
Use recipient and delivery activity to answer questions about the transfer.
Discuss the available MX exchange records, their scope and how your team would use them.
Regulated record history
Assess the source system’s history against the record’s intended use and applicable requirements.
Evaluate these requirements within the system and procedures governing the electronic record.
Begin with the
intended use.
Part 11 applicability depends on the records and underlying FDA requirements. Use the FDA scope guidance alongside the applicable predicate rules and your quality procedures.
Bring the record
and its questions.
Use a synthetic example to explain the source system, review process and intended recipients. We can explore where file exchange sits within that workflow.
Review your exchange requirementsQuestions for
your review.
Does every file sent by a life-sciences company fall under Part 11?
No. Determine applicability from the record, its use and the underlying FDA requirements. A company’s industry alone does not establish the scope.
Is a delivery log a Part 11 audit trail?
Not by itself. A delivery log describes exchange events. The applicable record system may need to capture creation, modification and deletion with additional controls and reviewability.
Does an audit trail replace system validation?
No. Validation, audit trails, access controls and other requirements need to be evaluated in the context of the intended use and applicable rules.
Does this page demonstrate MX electronic signatures?
No. The illustrative history is educational sample data. Electronic-signature functionality and associated requirements must be evaluated separately.