How-to guide · Data Integrity

21 CFR Part 11 compliance checklist for manufacturing systems

Team ValidLeaf · September 2026 · 8 min read

21 CFR Part 11 has governed electronic records and signatures since 1997, and it still generates findings — not because the rule is mysterious, but because plants assume their systems comply without ever checking. This is the checklist we use to assess manufacturing systems: the controls inspectors actually verify, grouped so you can score each system in an afternoon.

What Part 11 actually covers

Part 11 doesn't create record-keeping requirements — your predicate rules (GMP regulations like 21 CFR Parts 111, 117, or 507) do that. Part 11 sets the conditions under which electronic versions of those records are trustworthy: controlled, attributable, and complete. Most manufacturing systems are "closed systems" (access controlled by the people responsible for the records), which is the simpler of the two categories the rule defines.

1. Validation

• The system is validated for its intended use — requirements written, testing documented, traceability maintained.
• Changes go through impact assessment: patches, upgrades, and configuration changes are evaluated for re-validation need before going live.
• Vendor documentation is leveraged, not blindly trusted — assessed against your configuration and your use.

2. Audit trails

• Audit trails are secure, computer-generated, and time-stamped — recording who did what, when.
• Original records are preserved; the audit trail can't be edited or deleted by users.
• Someone actually reviews the audit trail on a defined schedule — for batch release and periodic review.

3. Access and authority

• Every user has a unique login — no shared "lab" or "operator" accounts.
• Authority is role-based: users can only perform the actions their role permits.
• Access is removed promptly when people change roles or leave — and the removal is documented.

4. Electronic signatures

• Each signature is attributable to one person and applied at the time of the action (no signing "for the shift").
• The printed or displayed record shows the signer's name, date/time, and the meaning of the signature (review, approval, authorship).
• For non-biometric signatures, the system requires both identification components at signing — and repeated signings during a continuous session are controlled.

5. Records, backup, and retention

• Records are backed up, and restore has been tested — not just assumed.
• Retention meets the predicate rule's requirement, and records remain retrievable for the full retention period.
• System documentation (requirements, validation, procedures) is retained as long as the records it supports.

6. People and procedures

• Written procedures cover system operation, security, and review responsibilities.
• Users are trained on the system and on Part 11 expectations — including why shared logins and unreviewed audit trails are findings.
• Periodic review of the system is scheduled, not aspirational.

A note on enforcement

FDA's 2003 guidance narrowed enforcement on certain Part 11 provisions (particularly around legacy systems), which some plants misread as the rule going away. It didn't. Validation, audit trails, access controls, and electronic signatures remain fully expected — and they remain the source of most Part 11 observations.

How to use this checklist

Inventory every computerized system holding regulated records. Score each against the six groups above. Fix access and audit-trail review first — they're the fastest findings to close and the most common ones cited. Then sequence validation work by risk. Our data-integrity assessments run this exact checklist across your operation and turn the scores into a sequenced remediation plan.