CRAP Documentation & Record Management 2 — Questions and Answers
Question 1: Under 21 CFR Part 11, which technical control is required to ensure electronic record integrity over time?
- Digital watermarking
- Audit trails that record date, time, and operator identity (Correct answer)
- Weekly printed backup copies
- Password rotation every 30 days
Correct answer: Audit trails that record date, time, and operator identity
21 CFR Part 11 mandates audit trails that capture who made a change, what was changed, and when, to ensure electronic record integrity.
Question 2: A Document Change Control procedure must include which of the following elements?
- Marketing approval before technical review
- Impact assessment of the change on related documents and processes (Correct answer)
- Mandatory external regulatory filing for all changes
- CEO sign-off for every revision
Correct answer: Impact assessment of the change on related documents and processes
Impact assessment ensures that changes to one document do not inadvertently invalidate or conflict with related documents or validated processes.
Question 3: Which retention period applies to device master records (DMR) under 21 CFR Part 820 for a Class III medical device?
- 2 years after manufacture
- 5 years after last date of manufacture
- The expected life of the device or 2 years, whichever is greater (Correct answer)
- Indefinitely, with no defined minimum
Correct answer: The expected life of the device or 2 years, whichever is greater
21 CFR 820.180 requires records be retained for the expected useful life of the device or a minimum of 2 years from release, whichever is longer.
Question 4: In a regulatory submission, a 'controlled document' is best defined as:
- Any document marked confidential by legal counsel
- A document subject to a formal approval, version control, and distribution process (Correct answer)
- A document stored in an FDA-registered repository
- Any document created within the last 12 months
Correct answer: A document subject to a formal approval, version control, and distribution process
Controlled documents are managed through a defined lifecycle including authoring, review, approval, distribution, revision, and retirement.
Question 5: When a Standard Operating Procedure (SOP) is retired, what is the best practice for handling the document?
- Permanently delete it from all systems immediately
- Archive it with its superseded status clearly marked and retain per the document retention schedule (Correct answer)
- Transfer ownership to the quality department only
- Convert it to a training record
Correct answer: Archive it with its superseded status clearly marked and retain per the document retention schedule
Retired SOPs must be archived rather than destroyed to support historical investigations and regulatory inspections.
Question 6: An 'as-built' configuration record in regulatory documentation primarily serves to:
- Satisfy accounting depreciation requirements
- Document the exact specifications of a product as actually manufactured (Correct answer)
- Establish pricing for regulatory filing fees
- Authorize shipping to international markets
Correct answer: Document the exact specifications of a product as actually manufactured
As-built records provide a verified snapshot of the final product configuration, supporting traceability and post-market surveillance.
Question 7: Which practice is a CAPA (Corrective and Preventive Action) record required to demonstrate according to 21 CFR 820.100?
- Financial cost of the nonconformance
- Verification or validation of corrective action to ensure it does not adversely affect the finished device (Correct answer)
- Approval by an FDA district office before closure
- Annual retraining of all employees on the CAPA topic
Correct answer: Verification or validation of corrective action to ensure it does not adversely affect the finished device
21 CFR 820.100 requires that CAPA effectiveness be verified or validated before the action is closed to confirm the root cause was eliminated.
CRAP Documentation & Record Management 2
Under 21 CFR Part 11, which technical control is required to ensure electronic record integrity over time?