SOCRA Electronic Records and Electronic Signatures (21 CFR Part 11) — Questions and Answers
Question 1: Under 21 CFR Part 11, what must a computer-generated audit trail record?
- Only the final value of each data point
- The date and time of operator entries and actions that create, modify, or delete records, without obscuring earlier entries (Correct answer)
- Only deletions made by the sponsor
- Login attempts only
Correct answer: The date and time of operator entries and actions that create, modify, or delete records, without obscuring earlier entries
Section 11.10(e) requires secure, computer-generated, time-stamped audit trails of operator entries and actions. Changes must not obscure previously recorded information.
Question 2: A non-biometric electronic signature must use at least:
- One component, such as a password
- Two distinct identification components, such as a user ID and a password (Correct answer)
- A fingerprint scan
- A handwritten signature scanned into the system
Correct answer: Two distinct identification components, such as a user ID and a password
Section 11.200(a) requires non-biometric e-signatures to use at least two distinct identification components, such as an ID code and a password.
Question 3: Which information must appear in a signed electronic record's signature manifestation?
- The signer's printed name, the date and time of signing, and the meaning of the signature (Correct answer)
- Only the signer's initials
- The signer's IP address
- The sponsor's protocol number
Correct answer: The signer's printed name, the date and time of signing, and the meaning of the signature
Section 11.50 requires the printed name of the signer, the date and time the signature was applied, and its meaning, such as review, approval, responsibility, or authorship.
Question 4: Before or at the time of using electronic signatures, organizations must certify to the FDA that:
- Their software is FDA-approved
- Electronic signatures are intended to be the legally binding equivalent of handwritten signatures (Correct answer)
- All records will also be kept on paper
- Passwords are changed daily
Correct answer: Electronic signatures are intended to be the legally binding equivalent of handwritten signatures
Section 11.100(c) requires a certification, submitted on paper with a traditional handwritten signature, that the organization's electronic signatures are the legally binding equivalent of handwritten signatures.
Question 5: Under Part 11, an electronic signature must be:
- Shared within a study team for efficiency
- Unique to one individual and never reused by or reassigned to anyone else (Correct answer)
- Reassigned when an employee leaves
- Identical to the person's email password
Correct answer: Unique to one individual and never reused by or reassigned to anyone else
Section 11.100(a) requires each electronic signature to be unique to one individual and not reused by or reassigned to anyone else.
Question 6: Compared with a closed system, an open system under Part 11 requires additional controls such as:
- Paper backups of every record
- Document encryption and appropriate digital signature standards (Correct answer)
- Removing audit trails
- Annual FDA inspection of the software
Correct answer: Document encryption and appropriate digital signature standards
Section 11.30 requires open systems, where access is not controlled by the people responsible for the records, to add measures such as encryption and digital signature standards to protect authenticity, integrity, and confidentiality.
