Part 11 Periodic Compliance Review

Periodic Compliance Review. The organization shall establish a periodic review program to ensure ongoing compliance with 21 CFR Part 11 for all systems within scope. The periodic review shall be conducted at defined intervals, not to exceed two (2) years for each system, and shall include: (a) verification that the system remains in a validated state and that all change control activities have been properly executed, documented, and assessed for Part 11 impact; (b) review of the system audit trail to identify any unauthorized changes, anomalous activities, or data integrity concerns; (c) review of user access lists to confirm that all active accounts are authorized and that access privileges are appropriate; (d) review of electronic signature configurations, including signature manifestation display, session management settings, and password policy enforcement; (e) confirmation that system documentation, including SOPs, validation records, and training records, is current and complete; (f) verification that backup and recovery procedures have been tested within the review period; (g) review of any system incidents, deviations, or CAPAs related to Part 11 compliance; (h) assessment of any changes in FDA guidance, predicate rule requirements, or organizational policies that may affect Part 11 compliance; and (i) documentation of all findings, including the overall compliance status of the system, any identified gaps, and required follow-up actions. The periodic review report shall be approved by the system owner and the Quality Unit and shall be retained as a controlled record.