Picture a QC lab at 23:58. An analyst signed in as shared01 deletes a failing assay result and reruns the sample. The rerun passes, and the batch ships. Eight months later an FDA investigator opens the lab system, filters the audit trail for deletions, and asks one question: who is shared01? Nobody can answer, and the question goes onto a Form 483.
21 CFR Part 11 audit trail requirements exist to make that question answerable. They come from one clause, 11.10(e). Your system must write a secure, computer-generated, time-stamped record each time someone creates, changes or deletes a regulated electronic record. The trail must keep the old value visible and must last as long as the record.
If you build software that pharma, biotech or medical device companies use to make, test or release product, your customers will ask you about Part 11 compliance before they sign. This guide covers what the rule asks for, how often software gaps land on FDA Form 483s, and what your team should build.
What do 21 CFR Part 11 audit trail requirements say?
Part 11 applies when a regulated company keeps a required record in electronic form or signs it with an electronic signature. Batch records, lab results, deviation reports, complaint files and training records all count. If a regulation requires the record and your system stores it, your system sits in scope.
Section 11.10 lists the controls. Read it as a feature spec:
| Clause | What FDA requires | What you build |
|---|---|---|
| 11.10(a) | Validation for accuracy, reliability, consistent performance | Requirements, risk assessment and test evidence for each release |
| 11.10(b) | Accurate, complete copies in human-readable and electronic form | Exports that carry metadata and the audit trail |
| 11.10(c) | Record protection for the retention period | Backups, restore tests, retention rules |
| 11.10(d) | Access limited to authorized people | Named accounts, roles, session timeouts |
| 11.10(e) | Secure, time-stamped audit trail; old values not obscured | Append-only change log with who, what, when, old and new value |
| 11.10(f) | Operational checks on the order of steps | Workflow states that block steps out of sequence |
| 11.10(g) | Authority checks | Permission checks on sign, edit and approve |
Electronic signatures carry their own Part 11 electronic signature requirements. Section 11.50 asks for the signer's printed name, the date and time, and the meaning of the signature, such as review or approval. Section 11.70 binds the signature to its record so nobody can copy it onto another one. Section 11.200 requires two distinct components, such as a user ID and a password, for any signature that is not biometric.
How often do software gaps show up on FDA Form 483s?
One in four drug 483s, in our data. We looked at 212 Form 483s issued to drug, biologic and animal-drug facilities in 2025 and 2026 in the Atlas Form 483 directory.
- 17.5% cite 21 CFR 211.68, the CGMP rule on computerized systems. Most of these cite 211.68(b), which covers controls that let only authorized people change records and that check the accuracy of inputs and outputs.
- 9.9% cite 21 CFR 211.194, complete laboratory records.
- 1 in 4 cite one or both.
The 483s that cite these sections run longer. They average 7.0 observations, against 4.3 across all 212. A facility with weak system controls tends to have weak controls elsewhere, and investigators find both.
Few drug 483s cite Part 11 by section number. Investigators cite the predicate rule, most often 211.68 or 211.194, and describe the software behaviour underneath. To an engineer, the cause looks the same: the system let a record change without a trace you could trust.
Which real 483s cited computer system controls?
Five recent examples from the directory, each with the observation list public:
- American Regent, Shirley, New York, April 2026: 10 observations. 211.68(b) sits beside investigations (211.192), environmental monitoring and cleaning.
- Baxter Healthcare, Round Lake, Illinois, November 2025: 5 observations, including 211.68(b) and 211.194(a)(1) on sample identification in lab records.
- Emergent BioSolutions, Winnipeg, May 2026: 9 observations. Both 211.68(a), on calibration and checking, and 211.68(b) appear.
- Chartwell Pharmaceuticals, Congers, New York, November 2025: 15 observations, with 211.68(b), batch record completeness (211.188) and annual record review (211.180(e)).
- Eugia Pharma Specialities, Sangareddy, India, February 2026: 11 observations, including 211.194(a)(8), the second-person sign-off on lab records. That is the paper version of an electronic signature control.
A short 483 can carry the same finding. Bestco, Mooresville, North Carolina, August 2025 received 2 observations, and 211.68(b) is one of them.
What should an audit trail record contain?
Write one immutable row for each create, update or delete on a regulated record. Store these fields:
{
"record_id": "batch-B1042/assay",
"record_version": 7,
"action": "update",
"field": "assay_result",
"old_value": "98.6",
"new_value": "99.1",
"reason": "transcription error, see deviation DV-311",
"user_id": "m.chen",
"timestamp_utc": "2026-10-21T11:02:47Z",
"client": "lims-web/4.2.0"
}
Four rules keep that trail defensible:
- Server time only. Stamp entries with time from a controlled source. If a user can change the clock on the machine that stamps the record, the timestamp proves nothing.
- Append-only storage. Your application should have no update or delete path into the audit table. Restrict even admins to read access.
- Reviewable views. An audit trail nobody reads fails the control. Give QA a filtered view: changes after approval, deletions, edits outside working hours, edits by admin accounts. The audit trail tests used in computerized system validation list what a reviewer will try.
- Same retention as the record. If the batch record lives ten years, its trail lives ten years.
How do you meet Part 11 electronic signature requirements?
Show the signer's name, the date and time, and the meaning (reviewed, approved, authored) on the signed record and on every printout or PDF export. Ask the user to re-authenticate at the moment of signing. Bind each signature to a hash or version number of the record, so any later edit breaks the signature in a visible way.
Second-person review is where most signature gaps start. Eugia's 211.194(a)(8) observation above concerns a second signature on lab records. If your workflow lets one person act as both analyst and reviewer, expect that finding.
Part 11 compliance checklist for engineering teams
- One person, one login. No shared or generic accounts on instruments or workstations.
- Separate roles. People who create data cannot delete or approve it. System admins cannot edit GxP data.
- Append-only audit trail with old and new values and a reason field.
- Audit trail review built into the release workflow, with an approval of its own.
- Signatures with name, time and meaning, bound to the record version.
- Server-controlled time across every component.
- Exports that include metadata and the trail.
- Validation evidence per release. FDA's move to computer software assurance favors risk-based testing over screenshot evidence, which suits teams with automated tests. The CSA vs CSV comparison covers the change.
Do AI features change Part 11 compliance?
The same rules cover anything a model writes into a regulated record. Treat a model's output as an unsigned draft. The human who reviews and signs it performs the regulated act, and your audit trail must show what that person changed before signing. The longer argument sits in can LLM-based quality systems pass a Part 11 audit.
FAQ
What are the 21 CFR Part 11 audit trail requirements?
Section 11.10(e) requires secure, computer-generated, time-stamped audit trails that record the date and time of operator entries and actions that create, modify or delete electronic records. Changes must not obscure earlier values, and you must keep the trail for at least as long as the record and make it available to FDA.
Does Part 11 apply to every system in a pharma company?
Part 11 applies to electronic records that a predicate rule requires, such as the CGMP rules in 21 CFR 211 or the device rules in 21 CFR 820, and to electronic signatures on those records. An HR tool holding no GxP records sits outside it.
What does FDA cite when software controls fail?
On drug inspections, investigators cite the predicate rule more often than Part 11. 21 CFR 211.68(b) covers computer system access and data checks. 211.194 covers complete laboratory records. In 212 drug and biologic 483s from 2025 and 2026, one in four cited one or both.
Is a Part 11 certificate from a software vendor enough?
No. FDA holds the regulated company responsible for its records. A vendor can provide features and validation support, but the customer must validate the system for its intended use and run its own audit trail reviews.
What are Part 11 electronic signature requirements?
The signed record must show the printed name of the signer, the date and time, and the meaning of the signature (11.50). The signature must link to the record so nobody can copy it (11.70). Non-biometric signatures need two distinct components such as an ID and a password (11.200).
I work on Atlas Compliance, which tracks FDA inspections and Form 483 observations for pharma and medical device quality teams. You can search any facility's Form 483 history or read what an FDA Form 483 is.
