21 CFR Part 11: clause matrix

Every clause of 21 CFR Part 11 subpart B (electronic records) and subpart C (electronic signatures), the compliance questions on this site that answer it, and how far the software goes. A clause with no answer yet is a gap in this documentation, not a statement that the software does nothing.

Each question on a page is marked with one of four statuses:

Built — The software does this today; the evidence is cited.
Partly built — The software does part of this; the limits are stated.
Customer responsibility — The software cannot do this for you; your organization must.
Not built yet — Asked for, or expected, but the software does not do it.

This is evidence of what the software does. It is not a certification, and the software is not described anywhere on this site as validated: validation of the system for your intended use is your organization's responsibility.

17 of 17 clauses have at least one answer.

Clause	What it covers	Coverage	Answered on
`11.10(a)`	Validation of systems to ensure accuracy, reliability, consistent intended performance	Built ×15 · Partly built ×2 · Not built yet ×2	Is anything the AI produced accepted without a person reviewing it, and is its use recorded? Can a calculated value be altered by someone, or be wrong because of the browser? Is a form tested before it is used for real data? Are changes to a released data-collection design controlled, tested and approved before they take effect? Can a study's own checks be changed after release without a record of it? Is a validated design protected from change after it has been tested? Is the release of a validated configuration approved by independent people, and by whom? Is a failed validation test kept as evidence, with what was done about it? Is each form's design reviewed and tested before use, and is every change recorded? Is a change to the system's configuration validated and approved before it affects real data? Is the system tested for its intended use in an environment kept apart from real data? Can test activity ever be mistaken for, or mixed with, production data? Can a released design be changed in place? Can a change to a validated, running study be introduced without losing control of what was captured under the earlier version? Is the whole path from design to production controlled, tested and approved by independent people? Can a form that is wrong be used to collect data? Is there documented evidence that the software is tested, and do those tests run before a revision is released? Is the system validated for its intended use, with evidence? Is there a validation package: IQ, OQ, PQ and a traceability matrix?
`11.10(b)`	Ability to generate accurate and complete copies of records	Built ×7 · Not built yet ×1	Is a record legible, and is the copy an inspector receives readable without the system? Can the exact design that was tested and signed be produced, and matched to the data? Can I obtain a complete, accurate copy of the records for inspection? Can an auditor examine the records and the audit trail without being able to alter them? Can complete and accurate copies of the records be produced in electronic form for inspection? Can the audit trail be read and copied for inspection? Can an inspector see exactly what the system was configured to collect when a record was captured? Is there an export for statistical software, or a signed export?
`11.10(c)`	Protection of records to enable accurate and ready retrieval	Built ×4	Does the system keep what was entered exactly as it was entered, in a form that does not depend on how the field is displayed? Can a field that holds data be removed from a form? Can a locked database be changed without a trace? Can the application, or a person using its credentials, alter or delete the audit trail?
`11.10(d)`	Limiting system access to authorized individuals	Built ×21 · Partly built ×2 · Not built yet ×1	Is access protected against unauthorized use at the network edge, with transport security and secure session handling? Can the operator withdraw an organization's access immediately, and is the decision recorded with its reason? Is the creation of a tenant and its first administrator controlled and traceable? Is access to the platform's administrative functions limited to named individuals, and are failed attempts recorded? Is every operation behind an access check, or can a script do what a screen refuses? Is access limited to authorized people, by role? Is there a session timeout and a cap on how long a session lives? Can one person do everything on a study? Does the site's staff have access only after the investigator has authorized them? Is access for external supply staff limited to what their task needs? Are sign-in credentials controlled, limited in attempts and not reusable? Can access be withdrawn immediately when a person leaves, and does it leave a record? Are access credentials controlled, and does the system end unattended sessions? Can a person see and end the sessions held in their name? Can the organization show who holds which role, where and since when, at any time? Is access to the system limited to authorized individuals, and are roles defined before people are given access? Is delegation of trial tasks recorded and signed by the investigator before a delegate can act? Is access to a study granted only to named, attributable people, with every grant and withdrawal recorded? Can the person who raised a query also answer or close it? Is site staff access authorized by the principal investigator before it begins? Is the path from an empty system to a working, access-controlled organization controlled and recorded? Is a person's access removed when they leave or are suspended? Is access to clinical data limited to those who need it, including through exports? Can a blinded study be run, and is the allocation hidden from people who should not see it?
`11.10(e)`	Secure, computer-generated, time-stamped audit trails	Built ×30 · Partly built ×6	Can the audit trail be altered or deleted by the application, or by someone using its credentials? Can a reviewer check independently that the audit trail is intact? Is the time of every event the system's own, so that a wrong clock cannot misdate a record? Is the creation of a tenant and its first administrator controlled and traceable? Can a default value end up in the record as if the person had entered it? Is every change to a form's design recorded, with who and when, and can an earlier design be read back? Are the values in a table cell checked and recorded as carefully as those in a field? Which events does the audit trail record? Can an auditor examine the records and the audit trail without being able to alter them? Is source data verification independent of data entry, and is its evidence tied to the value verified? Is each value attributed to the person who entered it, and can a saved value be changed only with a reason? Is data review independent of data entry, and is the resolution of a discrepancy confirmed by someone other than the person who answered it? Is there an independent medical review of serious events, kept apart from the site's report? Are the reasons a participant leaves the study recorded in a standard form, with the safety follow-up that remains owed? Are changes to a study's operational state controlled and attributable? Can a locked database be changed without a trace? Is a failed validation test kept as evidence, with what was done about it? Is every correction traceable, with the reason, and the original preserved? Is the creation of a study attributable, and is there always someone accountable for it? Is every entry attributable and time-stamped, and is a change to an entry impossible to make silently? Is a change to a role traceable: who changed it, when, what and why? Can a monitor verify data against source, with the evidence tied to the exact value and protected from the person who entered it? Is consent, and consent to a changed protocol, recorded and linked to what the participant then follows? Are protocol deviations recorded, classified and reviewed, and are reportable ones identified? Can a reviewer confirm that the audit trail has not been tampered with? Is there a secure, computer-generated, time-stamped audit trail that records the date, time and operator of changes, and does not obscure earlier values? Can the audit trail be read and copied for inspection? Is every action on a query attributable and time-stamped, and can the record of it be changed afterwards? Can the application, or a person using its credentials, alter or delete the audit trail? Is every change to a clinical value traceable, reasoned and independent of the person who first entered it? Is there a secure, time-stamped, tamper-evident record of platform administration? Is a value set automatically by a rule distinguishable from one a person typed? Does a failing check always leave a record that a human has to look at? Is the time the site became aware of a serious event recorded, with a deadline derived from it? Are serious events tracked from awareness to reporting, follow-up, independent medical review and reconciliation, with every step attributable? Is the chain from an event to its regulatory report, follow-up, medical review and reconciliation recorded, timed and attributable?
`11.10(f)`	Operational system checks to enforce permitted sequencing of steps and events	Built ×16 · Partly built ×1	Can a hidden field block a form from being completed, or hide data that was entered? Can a calculated value be altered by someone, or be wrong because of the browser? Are out-of-range values flagged for review rather than silently accepted or refused? Are values checked as they are entered, and is a check applied in the same way on every route into the system? Does the system enforce the order of steps, or can a status be set to anything? Are the rules a configuration that could be weakened? Is a validated design protected from change after it has been tested? Are changes to a study's operational state controlled and attributable? Is the freezing of the database a controlled act that two people sign, knowing what was still open? Can a participant be enrolled without eligibility confirmed and consent on record? Are values checked at entry, and by the server rather than only the screen? Can a site start enrolling before its ethics approval and training are on record? Is entry outside the allowed window controlled and justified? Can test activity ever be mistaken for, or mixed with, production data? Is the whole path from design to production controlled, tested and approved by independent people? Is informed consent recorded before any study procedure, and is a participant's consent history kept? Can a form that is wrong be used to collect data?
`11.10(g)`	Authority checks	Built ×31 · Not built yet ×1	Is every operation behind an access check, or can a script do what a screen refuses? Is access limited to authorized people, by role? Can a role be given both sides of a separation of duties, such as entering data and locking it? Can one person do everything on a study? Can an administrator override a separation rule? Is a query closed by someone independent of the person who raised or answered it? Is each value attributed to the person who entered it, and can a saved value be changed only with a reason? Is data review independent of data entry, and is the resolution of a discrepancy confirmed by someone other than the person who answered it? Is the person who designs the data collection kept away from the data it collects? Is the administrator of the system independent of the people who enter and sign the clinical data? Is a role limited to the data entry its task needs? Does the site's staff have access only after the investigator has authorized them? Is the release of a validated configuration approved by independent people, and by whom? Can the person who runs the study alter the data it collects? Can oversight of site conduct be exercised without the ability to change the site's data? Does the sponsor approve a release independently of the people who built and tested it? Is the freezing of the database a controlled act that two people sign, knowing what was still open? Are authority checks and separation of duties built into how roles can be defined? Can the organization show who holds which role, where and since when, at any time? Are temporary deviations from a role controlled, time-limited and approved? Is consent recorded before any procedure, and eligibility decided by the investigator? Is access to the system limited to authorized individuals, and are roles defined before people are given access? Are the roles checked for separation of duties when they are created? Can one person approve their own work? Is delegation of trial tasks recorded and signed by the investigator before a delegate can act? Is access to a study granted only to named, attributable people, with every grant and withdrawal recorded? Can the person who raised a query also answer or close it? Is the final lock of the database controlled and attributable to two people? Is eligibility determined by the investigator and no one else? Is site staff access authorized by the principal investigator before it begins? Is the path from an empty system to a working, access-controlled organization controlled and recorded? Can a blinded study be run, and is the allocation hidden from people who should not see it?
`11.10(h)`	Device checks to determine the validity of the source of data input or operational instruction	Built ×1	Does a safety or eligibility rule that never fires look as if it is working?
`11.10(i)`	Determination that persons who develop, maintain or use the system have the education, training and experience	Partly built ×1	Does the system stop an untrained person from working?
`11.10(j)`	Written policies that hold individuals accountable for actions under their electronic signatures	Customer responsibility ×1	Are there written policies that hold individuals accountable for what they do under their electronic signatures?
`11.10(k)`	Controls over systems documentation (distribution, revision and change control)	Built ×19	Is the configuration of a study under change control, so that "what was in force on this date" can be answered? Can the exact design that was tested and signed be produced, and matched to the data? Can a standard form be reused across studies without the copy changing later? Is every change to a form's design recorded, with who and when, and can an earlier design be read back? Are changes to a released data-collection design controlled, tested and approved before they take effect? Is the schedule of assessments (which forms at which visits) controlled and part of what is tested and signed? Are documents version-controlled, and can an earlier version be produced? Can a study's own checks be changed after release without a record of it? Can the protocol-level settings of a study be changed after release without a record? Are regulatory documents version-controlled and approved, with a record of who handled them? Is a protocol change implemented under control, with participants consenting again where required? Is a study's data-collection design built under change control from the start? Is each form's design reviewed and tested before use, and is every change recorded? Are essential documents kept with their versions, and can the version in force on a date be produced? Is the visit schedule and its windows controlled as part of the validated design? Is a change to the system's configuration validated and approved before it affects real data? Can an inspector see exactly what the system was configured to collect when a record was captured? Can a released design be changed in place? Can a change to a validated, running study be introduced without losing control of what was captured under the earlier version?
`11.30`	Controls for open systems	Partly built ×1	Are records and signatures protected when the system is used over networks the organization does not control?
`11.50`	Signature manifestations	Built ×3	Is the freezing of the database a controlled act that two people sign, knowing what was still open? Are electronic signatures on a release attributable, bound to what was signed, and checked by a second factor? Do electronic signatures show the signer, the time and the meaning, and are they linked to the record so they cannot be copied?
`11.70`	Signature/record linking	Built ×3 · Partly built ×1	Is the freezing of the database a controlled act that two people sign, knowing what was still open? Are electronic signatures on a release attributable, bound to what was signed, and checked by a second factor? Do electronic signatures show the signer, the time and the meaning, and are they linked to the record so they cannot be copied? Are records and signatures protected when the system is used over networks the organization does not control?
`11.100`	Electronic signatures: general requirements	Built ×4	Is the investigator's responsibility for eligibility, delegation and signature exercised only by the investigator? Is each user uniquely identified, and is an identity never reused? Are electronic signatures on a release attributable, bound to what was signed, and checked by a second factor? Do electronic signatures show the signer, the time and the meaning, and are they linked to the record so they cannot be copied?
`11.200`	Electronic signature components and controls	Built ×4 · Partly built ×3 · Not built yet ×1	Is the investigator's responsibility for eligibility, delegation and signature exercised only by the investigator? Does the sponsor approve a release independently of the people who built and tested it? Are electronic signatures on a release attributable, bound to what was signed, and checked by a second factor? Is the final lock of the database controlled and attributable to two people? Do the identification codes behave like Part 11 identification codes and passwords? Can a sign-in or signature code be intercepted from a log or a queue? Does a signature use two distinct components? Are there passwords, single sign-on or multi-factor sign-in?
`11.300`	Controls for identification codes/passwords	Built ×6 · Partly built ×3 · Not built yet ×1	Is access to the platform's administrative functions limited to named individuals, and are failed attempts recorded? Is there a session timeout and a cap on how long a session lives? Are sign-in credentials controlled, limited in attempts and not reusable? Is each user uniquely identified, and is an identity never reused? Are access credentials controlled, and does the system end unattended sessions? Can a person see and end the sessions held in their name? Do the identification codes behave like Part 11 identification codes and passwords? Can a sign-in or signature code be intercepted from a log or a queue? Does a signature use two distinct components? Are there passwords, single sign-on or multi-factor sign-in?