Computer System Validation: Comparison between 21 CFR Part 11 and EU Annex 11

In last week’s blog post, Arithmos wrote about the importance of Computer System Validation for life sciences technology, pointing out that their are laws and regulations which guide CSV practices. This week, Arithmos discusses a comparison of 21 CFR Part 11 and EU Annex 11, in particularly with regards to electronic records and signatures. This month, Arithmos Chief Operating Officer, Stefano Piccoli, instructed a course on Part 11 and Annex 11 in Milan.

21 CFR Part 11 and EU Annex 11 share a common intent: that all computerized systems used in GxP-regulated environments require compliance for ensuring integrity of records and data. Part 11 is strictly applicable to the United States in all FDA (Food & Drug Administration) program areas as well as to all manufacturers outside the U.S. who wish to gain FDA market approval. Annex 11, on the other hand, applies to the European Union as well as foreign manufacturers who are seeking EU market approval.


21 CFR Part 11 Scope: Part 11 applies to records in electronic form that are created, modified, maintained, archived, retrieved, or transmitted under any records requirements set forth in agency regulations. It is applicable to all GxP computerized systems that are used to store and manage electronic records and signatures that are required by the predicate rule.

EU Annex 11 Scope: Annex 11 applies to Good Manufacturing Practices (GMP) for medicinal products for human use, investigational medicinal products for human use and veterinary medicinal products and concerns those computerized systems used in the GMP environment.

It is important to note that the EU Annex 11 is not a legal requirement, but a guideline – albeit a strongly recommended guideline. 21 CFR Part 11 is, however, a regulation set by the U.S.

Both Part 11 and Annex 11 apply to electronic records and signatures. Under 21 CFR Part 11, e-Signatures must include a printed name , verification of identity of the individual signing the document, requirements to prevent forgery and unique codes and passwords. Meanwhile, under Annex 11 e-Signatures have the same impact of a handwritten signature and must be permanently linked to a record as well as include a time and date.

Picture1However, Annex 11 goes beyond Part 11 in four key areas:

  • Supplier and service provider audits – in accordance with GAMP 5, the role of the supplier has been put in the spotlight due to the trend of purchasing clinical trial systems and outsourcing computer system related services.
  • IT infrastructure qualification – Validation of computer systems is an element of a project phase and takes center stage, and validation has been expanded to cover the complete life cycle. Annex 11 includes the qualification of the IT infrastructure.
  • Risk Management – The EU Annex 11 has added a new clause on risk management and taking a risk based approach to CSV. Computerized systems that support GxP processes must be validated in proportion to the level of risk they present to patient safety, product quality and integrity of regulated records.
  • Integrity of system operations and information stored in the system- Annex 11 goes beyond Part 11 to cover general, project phase, operational phase, data, data storage, audit trails and periodic review and security.

In conclusion, although Annex 11 is just a guideline, it has a much broader scope than Part 11 and has improved standards for regulated users and systems. The FDA is expected to report on the industry’s understanding of Part 11 implementation and focus on areas such as validation, audit trail, copies of records and record retention. The review will most likely generate revised/new revisions, closing the gap between Annex 11 and Part 11.

Arithmos and CSV

The Arithmos team has extensive experience in validating systems in the healthcare sector. To ensure patient safety and full adherence to regulatory requirements, we validate regulated systems in a cost-effective, efficient and fully compliant manner. We provide full evidence of the validation exercise, and when requested, fix non-compliant areas.

Related Links

Best Practices: Implementing Computer System Validation




Best Practices: Implementing Computer System Validation

Why is Computer System Validation important for the Life Sciences industry? CSV prevents software malfunction, but more importantly, it’s the law! Arithmos explains why CSV is particularly important in the clinical trial sector.

As the pharmaceutical and life sciences industries continue to modernize and implement technology, there is an increasing need to be sure these technologies are safe and accurate for patients and end users. Computer System Validation (CSV) is a documented process for assuring that a computer system does what it is designed to do. Both the European Medicines Agency (EMA) and the Food & Drug Administration (FDA) have produced guidelines for CSV practices.


There are two important reasons for performing CSV with life sciences technologies and software:

  • CSV can prevent software problems before reaching the usage environment. In particularly in the clinical trial field, malfunctioning computer systems can cause serious adverse consequences to the patient. This could lead to lawsuits, fines or eventual shutdown.
  • Not performing certain computer system validation in accordance with Best Practices could be against the law. Both the EMA and FDA have rules and regulations in effect for GMP (Good Manufacturing Practices), GLP (Good Laboratory Practices) and GCP (Good Clinical Practices).


The FDA is aiming to strengthen its CSV standards by aligning them with international standards like ISO 9000:2000. GAMP (Good Automated Manufacturing Processes) focuses on applying GxP (Good Practice Quality Guidelines) to the IT environment. FDA regulations depend on the type of software being validated, off-the-shelf, configurable or customizable software, “retrospective” validation for older systems that have never been validated and business and compliance risks.


The EMA revised its CSV guidelines in January 2011 which were implemented in June 2011. Topics include requirements for spreadsheets, data security of databases, risk management, retrospective validation, storage time of electronic data and documents and validation for small devices. The EMA’s website, offers the latest CSV regulations and validation.

21 CFR Part 11 Compliance

21 CFR Part 11 compliance is required for electronic records and electronic signatures. CSV becomes important as the FDA requires all computerized systems with GxP electronic records to be validated. The life sciences industry is proactive in validating systems in compliance with 21 CFR Part 11 which means the ability to generate accurate and protected records and time-stamped audit trails.

Arithmos and Computer System Validation

Arithmos has extensive experience in the computer system validation of GCP applications, in particular Oracle OC/RDC and AERS. Arithmos can support customers in planning, conducting, reviewing and maintaining the validation status of their applications through GxP assessment, validation planning, user requirement analysis and authoring as well as IQ/OQ/PQ authoring and execution including validation reports. Arithmos can provide CSV training and support customers in developing internal SOPs for CSV. Arithmos has an ISO 9001 certification for its Quality Management System.


Mobile “Apps” and Tablets Take Over Clinical Trials

The mobile and “apps” market has been growing rapidly and steadily for the past few years. With the introduction of the iPad in 2010, the tablet market is gaining attention as product value soars in many industries. Health and pharmaceuticals is one of those industries openly accepting the mobile and tablet takeover as these devices and their “apps” bring added benefit and new innovative solutions. In a follow up to last week’s post, Arithmos discusses the market and how devices are being integrated. 

Market Overview

iPad_Tablet_for_HealthCare (1)A snapshot of the overall market emphasizes the importance of embracing these technologies. In 2011, there were over 491 million smartphones sold worldwide. To clarify, a smartphone combines the capabilities of a mobile phone with PDA (personal digital assistant). Many of these smartphones include “apps”. The Apple store alone has over 500,000 “apps” which can be easily created by consumers. The tablet market has the fastest market growth rate, with the Apple iPad owning the majority of the market share. Apple recently reported that over 65% of Fortune 100 companies are using or testing the iPad for use within the company.

The pharmaceutical industry has been embracing these markets for several reasons. One of the biggest reasons is patient compliance. Patients want the “WOW Factor ” – the digital and personalized experience.

Devices such as tablets and smartphones can cut clinical trial costs as well. Setting up desktops or laptops, or even printing paper, can be more expensive than simply downloading information on a device. Using these devices also allows patients to just send information via click or an IM/SMS. With the installation of  “apps”, medical information can be downloaded instantly by doctors or Investigators.

Investment by the pharma industry in wireless devices has grown 78% in the past year. Reference “apps” like WebMD are most popular, and “apps” are used for compliance, consent and even diagnosis.


What are some of the most noteworthy mobiles, tablets and “apps” in use today in clinical trials? 


The Blackberry (BB) allows users to be identified via PIN which helps confirm patient compliance. Data can be transmitted via SMS, Blackberry Messenger (BBM) or Bluetooth technology. The BB allows for instant data transmission and instant communication between patient and Investigator. For clinical trials in diabetes (one of the fastest growing therapeutic areas in pharma), a glucometer can be connected via Bluetooth to a BB Curve model to transmit data.

The iPad and iPhone are garnering attention in the patient compliance area. The touch screens and “apps” make these Apple devices popular and easy to use. Patients are identified via username and password and Bluetooth technology is enabled.

See our last blog post: Clinical Trials & Business Intelligence: iPad and iPhone Revolution

The top Pharma “apps” are currently: WebMD, Novartis GIST Calculator, Roche Nursing ACE, Merck iChemoDiary and Sanofi-Aventis GoMeals for Diabetes patients.

Arithmos has extensive experience implementing such devices into the clinical trial process for collecting patient data. These ePRO devices increase patient compliance and can be integrated with an EDC system as well. Arithmos has experience using Blackberry and the iPad for questionnaires and data collection.

Related Links

Arithmos ePRO Solutions

Arithmos Electronic Data Capture Solutions




Clinical Trials & Business Intelligence: iPad and iPhone Revolution

As technology plays a bigger role in clinical trials, clinical study managers are looking for readily available data that is easy to extract. Business Intelligence is the use of computer-based techniques to collect and analyze data. 

Being an Oracle Gold Partner, Arithmos is already a user of Oracle Business Intelligence. Its team of Oracle application experts was looking for a way to integrate Oracle BI with new market technologies – in particularly smartphones and tablets. Arithmos has successfully integrated Oracle BI with the iPhone and iPad.

AERS2 reports

The rationale was the the iPad and iPhone are ideal devices for access to study data information beacause:

  • They are easy to use due to small size and zero footprint installation
  • Accessible anytime due to Internet availability
  • Able to focus on useful data

Prior to Oracle BI there were many ways to access study data including standard reports, web portal for downloading data, Excel files sent via email and sFTP reporting. These methods are considered old-fashioned and more importantly, they are not portable and do not always have Internet connection availability.

Oracle BI provides the BI Publisher “app” for iPhone and iPad which is available for download in the Apple iTunes store. The system requires first the installation of an Oracle database and the BI system. Then, BI should be installed with the Publisher component.

The installation of Oracle BI Mobile to the iPhone is a straightforward configuration of the connection to the BI Publisher Server. Communication is secure using HTTPS, and then credentials are created for the user. The same process can be applied to the iPad.

ipadstudyOnce logged in, data can be accessed via the Catalog where personal and shared folders are available. The iPod and iPad application also make specific reports available. The iPod and iPad application also make specific reports available including enrollment status, SAE reporting, study metrics, site personnel and monitor activities, and aggregated study data. The devices are in fact easily portable and have easy access to WiFi or Internet subscriptions.

Arithmos has also considered the data privacy aspect. Data is transmitted securely through HTTPS via Internet and stored in the BI server and the Arithmos data center ensuring privacy, security and backup.

Automating Signal Detection to Efficiently Manage Safety Data

In order to ensure patient safety and comply with pharmacovigilance regulations, massive amounts of safety data must be analyzed. Arithmos explains how automating pharmacovigilance systems can improve the identification of adverse events through real time data results.

Pharmacovigilance Regulations: Signal Management

Regulatory authorities and governing bodies have taken steps to improve patient safety. The European Union took action in July 2012 by implementing the first seven modules of new pharmacovigilance legislation. The changes are designed to tackle the startling statistic that 200,000 patients in the EU die each year from adverse drug reactions (ADRs).

Part of the implementation plan is to better analyze and understand data from clinical studies – especially post-market studies – to identify risks to patients. One of the more significant modules to pass in July 2012 was Module IX: Signal Management which includes requirements on the statistical analysis and systems used to detect signals. It also outlines how data should be assessed by a Qualified Person in a “timely” manner, how the process should be documented and how urgent action should be taken whenever a safety issue arises.

The Industry Need

Due to the increased regulation on safety data and the need to improve data quality, signal detection becomes very data intensive and difficult to manage. Pharmaceutical companies are searching for a signal detection solution that can produce real time results with accurate signal identification at an affordable operational cost.

Technology can facilitate the automation of signal detection to help reduce workload.

Combining Statistical Programming & Data Integration Technology

Combining statistical analysis, statistical programming and IT support under a commonly used platform like SAS is an ideal solution for automating data collection and analysis from multiple sources to implement an efficient signal detection process. In order to automate the process, a system needs to be in place to pull and analyze data from the safety database.

The identification of signal criteria and the implementation of standardized programs automates the signal detection process. It also produces structured data which speeds up the task of finalizing Eudravigilance submissions.

This approach is appropriate even for small companies, or for products with  small amounts of safety data, because automation can be done without a complex or expensive Business Intelligence platform.

Arithmos Case Study: Producing Pharmacovigilance Reports Using Data Integration Technology

A large pharmaceutical company contacted a CRO to do statistical analysis and reporting on adverse events for a suspect drug reported in individual case safety reports (ICSR). The Sponsor was using a third party adverse reporting system along with SAS to collect post-marketing adverse reactions data.

Signal Detection 2

The methodological statistician defined a Proportional Reporting Ratio for the detection of “Signals of Disproportionate Reporting (SDRs)”. To produce line listings and summary tabulation for signal detection and reporting, the Sponsor needed a set of SAS programs which allowed data to be retrieved from ARES database instantly and in a structured manner. To use these programs, SAS programming knowledge is not required because the programs are automatically set up for all the variables required. Therefore, pharmacovigilance officers do not need to have a knowledge of SAS.

The end result was an automated signal detection process which leads to better analysis, real time results, and structured and formatted data for efficient preparation of regulatory submissions.

Related Links

Arithmos Pharmacovigilance

Arithmos Pharmacovigilance Services – AERS vs Argus