Вы находитесь на странице: 1из 33

Due – Diligence Questionnaire

Company Name:

Company Address:
Company Representative:
Telephone #:
Date of the Assessment:
How many employees does the company
have?
List the products / services of the
company:

How long has the company been in


business?

Is the company ISO Certified?

Has the company ever been through a


regulatory inspection? (by whom, when,
results?)

Persons interviewed:

Form Created: 30-Dec-2009 Confidential Page 1 of 33


EXECUTIVE SUMMARY

Summary of Key Findings:


1.

Other observations:
1.

Form Created: 30-Dec-2009 Confidential Page 2 of 33


TABLE OF CONTENTS

1.0 GENERAL / CORPORATE .................................................................................................. 4

2.0 QUALITY ASSURANCE ..................................................................................................... 6

3.0 PROJECT MANAGEMENT ............................................................................................... 10

4.0 CLINICAL MONITORING ................................................................................................ 13

5.0 MEDICAL MONITORING AND SAFETY ....................................................................... 14

6.0 DATA MANAGEMENT..................................................................................................... 16

7.0 DATA CAPTURE SYSTEMS (EDC, IVR/IWR, ePRO) ................................................... 21

8.0 BIOSTATISTICS ................................................................................................................ 22

9.0 RESOURCE MANAGEMENT & PROCESS IMPROVEMENT ...................................... 24

10.0 INFRASTRUCTURE AND SUPPORT ............................................................................ 25

11.0 REGULATORY REQUIREMENTS (21 CFR Part 11) .................................................... 28

12.0 ADDITIONAL AREA(S) REVIEWED (please indicate) ................................................. 32

13.0 Supporting Evidence .......................................................................................................... 33

Form Created: 30-Dec-2009 Confidential Page 3 of 33


GENERAL / CORPORATE

1.0 GENERAL / CORPORATE


Ref. No. Requirements Observations Is there a finding Recommendation for
requiring corrective corrective action
action? If yes, explain.
1.1 Is there an organizational chart available? YES NO
* Does it show the interrelations between
departments?
* How many employees are employed world wide?
* What % of employees are full time versus
contracted outside personnel or consultants

1.2 What is the corporate financial profile? YES NO


* Annual revenues?

1.3 Does the company have world wide YES NO


experience?
1.4 What is the average management turnover rate YES NO
for the past 12-24 month period?
1.5 Does the company have personnel dedicated to YES NO
Ophthalmology trials which include surgical
(device), Ophthalmology Pharmaceutical and
consumer products?

1.6 Has the company ever been audited by the US YES NO


FDA or other regulatory agency?
* Obtain copies of results if you can

1.7 In what Therapeutic areas does the company YES NO


have experience?
* List or obtain evidence (graph?)

1.8 What % of your studies are in each phase of YES NO


clinical development (Phase I – IV)?
* Seek supporting documented evidence –
graphical is OK.

Form Created: 23-Feb-2010 Confidential Page 4 of 33


GENERAL / CORPORATE

Ref. No. Requirements Observations Is there a finding Recommendation for


requiring corrective corrective action
action? If yes, explain.
1.9 Does the company have job descriptions for YES NO
each employee?
* Does it include current responsibilities?
Signature? Training requirements?
1.10 Is there a formal training program for all YES NO
employees?
* Does it include SOPs? Job skills? Outside
training? Regulatory training like GCP, 21 CFR
Part 11 and etc.?

1.11 Who is responsible for ensuring employees are YES NO


properly trained and have the appropriate
experience to fulfill their role?
1.12 What % of the company’s trials use their own YES NO
SOPs versus client SOPs?

1.13 Is there a formal record retention policy? YES NO

Form Created: 23-Feb-2010 Confidential Page 5 of 33


QUALITY ASSURANCE

2.0 QUALITY ASSURANCE


Ref. No. Requirements Observations Is there a finding Recommendation for
requiring corrective corrective action
action? If yes, explain.
2.1 Is a formal Quality Assurance Procedure/Plan YES NO
or Manual available?
If yes, is it effectively implemented?
If no, does the company have a published
statement or standard for quality?
* Are written procedures, which establish the
Quality System developed, implemented and
maintained?
* Is there an available Quality Policy statement
and does it reflect top management's philosophy,
goals and commitment to quality?

2.2 Is there a documented Quality System? YES NO


* Does it show the interrelations between
departments?

2.3 Are quality responsibilities clearly defined and YES NO


supported?
Where?
* Are there policies, procedures, SOPs, and/or
requirements that define who are responsible for
the effective implementation of the Quality
System?
* Are resources sufficient?

Form Created: 23-Feb-2010 Confidential Page 6 of 33


QUALITY ASSURANCE

Ref. No. Requirements Observations Is there a finding Recommendation for


requiring corrective corrective action
action? If yes, explain.
2.4 Is there evidence of management's YES NO
commitment to continuous quality
improvements?
* Are Quality improvement objectives defined
and supported by identifiable means of
achievement and results?
* Evidence can include metrics, reduction of
deficiencies by training, and corrective &
preventive action improvements.

2.5 Is there a process for control of YES NO


Documentation?
For SOPs?
For projects documents?
For supporting User Documentation?
* Seek evidence that the process is implemented,
understood and providing the desired results.
2.6 Does the documentation process include: YES NO
Formal Review and Approval?
* Electronic Approval?
* Traditional wet signature approval?
{indicate the type of approval process}
* Revision Control?
* Revision History?

2.7 Is there a cyclic review to ensure the YES NO


documents are still applicable?
Are SOPS within the review cycle? How many
and which ones are outside the review cycle?

Form Created: 23-Feb-2010 Confidential Page 7 of 33


QUALITY ASSURANCE

Ref. No. Requirements Observations Is there a finding Recommendation for


requiring corrective corrective action
action? If yes, explain.
2.8 Is the company utilizing an audit program to YES NO
verify the performance of their quality system?
* Does this program demonstrate the
effectiveness of internal audits through:
-- Records
-- Corrective actions

2.9 Are CAPA metrics maintained? YES NO


Number of Open, Closed, time to closure?
2.10 Are audits planned, scheduled and conducted YES NO
by trained personnel independent from the
areas being audited?
* Seek supporting documented evidence.
2.11 Do the persons responsible for the respective YES NO
area/function review the results of audits?
* Seek supporting documented evidence of review
2.12 Are the results of audits reported to YES NO
management?
* Seek supporting documented evidence of review
2.13 Is there evidence that management takes the YES NO
proper steps to resolve issues identified in an
audit (by internal or external sources)?

2.14 Is there a process for preventing and/or YES NO


correcting product/process problems?
* Documented process
* Tracking of corrective action, (follow-through)
* Training

Form Created: 23-Feb-2010 Confidential Page 8 of 33


QUALITY ASSURANCE

Ref. No. Requirements Observations Is there a finding Recommendation for


requiring corrective corrective action
action? If yes, explain.
2.15 Is there a process in-place for the control of YES NO
their vendors/Companys?
* Vendor rating or measurement system.
* Vendor assessments.
* Approved Vendor Listing.

2.16 Do Quality Records identify the capability and YES NO


performance of the Development Process and
the Quality System?
* Are records being kept for all areas that have
been identified as requiring records?

2.17 Are Quality Records YES NO


Identified,
Collected,
Indexed,
Accessible,
Filed,
Stored,
Disposition,
To prevent loss or damage?
* Are records legible and easily obtainable?

2.18 Are statistical techniques used to monitor YES NO


trends and verify corrective action and
continuous improvement?
* Look for evidence that statistical techniques are
adequate for the process.

2.19 Does your Clinical QA organization have YES NO


experience with Ophthalmology?
2.20 Does your Clinical QA organization have YES NO
experience with clinical auditing?

Form Created: 23-Feb-2010 Confidential Page 9 of 33


PROJECT MANAGEMENT

3.0 PROJECT MANAGEMENT


Ref. No. Requirements Observations Is there a finding Recommendation for
requiring corrective corrective action
action? If yes, explain.
3.1 Does the Clinical Project Management (CPM) YES NO
team have sufficient experience in the
following:
 Ophthalmology
 Surgical/IOL
 ENT

3.2 Describe company’s project organization YES NO


structure.

3.3 What is the typical number of projects YES NO


managed by each CPM at a given time? (start
up versus maintenance).

3.4 What is the company’s CPM turnover rate in YES NO


the past 24 months?

3.5 What is the percentage of studies that started YES NO


and ended with the same project manager?

3.6 Is there a documented Project Management YES NO


process?

*Overview?

3.7 Is there a defined project management YES NO


transfer or handoff process documented?

3.8 Does the company have experience planning YES NO


and running Investigator Meetings?

3.9 How many Investigator meetings has company YES NO


been involved with in the past 2 years?

Form Created: 23-Feb-2010 Confidential Page 10 of 33


PROJECT MANAGEMENT

Ref. No. Requirements Observations Is there a finding Recommendation for


requiring corrective corrective action
action? If yes, explain.
3.10 Does company have experience planning and YES NO
running both live and virtual Investigator
meetings?

*How virtual meetings are conducted?

3.11 Who typically delivers training to the PI? YES NO


(PM, training organization, outside source).

*Please explain.

3.12 Does the company have medical writing YES NO


experience? Please explain.

3.13 Does the company have CPM capability YES NO


world-wide? Please describe how project
management is handled around the world.

3.14 Does the company have experience managing YES NO


supplies both locally and globally?
* drug supply, device supply
3.15 How do they ensure available drug and device YES NO
globally?

3.16 Please describe any tools used for subject YES NO


recruitment.

3.17 How does company ensure subject retention? YES NO

3.18 Does company maintain an investigator YES NO


database?

*Responsibilities? Updates? See below…


3.19 How often is the investigator database YES NO
updated? Who has access to update it?

Form Created: 23-Feb-2010 Confidential Page 11 of 33


PROJECT MANAGEMENT

Ref. No. Requirements Observations Is there a finding Recommendation for


requiring corrective corrective action
action? If yes, explain.
3.20 Do investigator records indicate experience YES NO
with ophthalmology studies? Previous
Sponsor trials?

3.21 What is company’s method for developing YES NO


relationships with principal investigators?

3.22 What % of company’s principal investigators YES NO


do repeat work with their organization?

3.23 What typical metrics and or reports are YES NO


presented to sponsor personnel for project
progress and review?

(e.g. performance against budget, DCR’s, etc.).


* are example reports available for review?
* Are reports & metrics spelled out in the project
plan (or contract)

Form Created: 23-Feb-2010 Confidential Page 12 of 33


CLINICAL MONITORING

4.0 CLINICAL MONITORING


Ref. No. Requirements Observations Is there a finding Recommendation for
requiring corrective corrective action
action? If yes, explain.
4.1 Does the Monitoring team have experience in YES NO
the following:
 Ophthalmology
 Surgical/IOL
 ENT
 Other?
4.2 What is the Monitoring personnel turnover YES NO
rate in the past 24 months?

4.3 Does company world-wide monitoring YES NO


capabilities? Please describe.

4.4 Are monitors trained in the query process for YES NO


the study?

4.5 How is the trial master file (TMF) YES NO


maintained? If electronic, how is access
controlled?

4.6 Does company have a Rapid Startup Group? YES NO


Please describe tasks that are typically
included.

4.7 What is the average time frame from protocol YES NO


approval to site initiation?

4.8 What metrics are typically provided to the YES NO


sponsor to oversee monitoring activities and
progress?

Form Created: 23-Feb-2010 Confidential Page 13 of 33


MEDICAL MONITORING AND SAFETY

5.0 MEDICAL MONITORING AND SAFETY


Ref. No. Requirements Observations Is there a Recommendation for
finding corrective action
requiring
corrective
action? If
yes, explain.
5.1 Does company provide medical monitoring YES
services?
NO

5.2 What experience does company have with YES


international safety reporting?
NO

5.3 Do the safety personnel have experience with YES


 Safety signals NO
 SAE narratives
 Safety Monitoring Boards

5.4 Please describe the typical SAE reconciliation YES


process. NO

5.5 Does company have experience with the YES


following safety systems (Relsys, ClinTRACE,
Argus… OTHER.)? NO

*Does company allow the sponsor to specify the


system used?

5.6 Is there a documented process for unmasking? YES


Please describe scenarios where this would be
invoked. NO

5.7 Does company perform SAE Coding? YES


What dictionaries do you use or have
experience with? NO

Form Created: 23-Feb-2010 Confidential Page 14 of 33


MEDICAL MONITORING AND SAFETY

Ref. No. Requirements Observations Is there a Recommendation for


finding corrective action
requiring
corrective
action? If
yes, explain.
5.8 YES
Does company have responsibility for any site
interaction? Please explain. NO

5.9 Does company handle expedited reporting? YES


NO

Form Created: 23-Feb-2010 Confidential Page 15 of 33


DATA MANAGEMENT

6.0 DATA MANAGEMENT


Ref. No. Requirements Observations Is there a finding Recommendation for
requiring corrective corrective action
action? If yes, explain.
6.1 Does the Data Management team have YES NO
experience in the following:
 Ophthalmology
 Surgical/IOL
 ENT
 Other?
6.2 What is the DM staff turnover rate in the past YES NO
24 months?

6.3 Does the DM personnel have experience YES NO


working with both paper and/or EDC
systems?
(Please specify which EDC systems you have
experience with)

6.4 Is there a documented procedure for CRF YES NO


design?
* Review with any supporting procedures
* Does it cover design, development, version
control?
* Can the company describe the “life of a CRF”
at their company?
* Is the CRF designed along with the protocol to
ensure collection of ONLY data specified in the
protocol?
* Are CRF’s designed with primary safety and
efficacy endpoints in mind as the main goal of
data collection?

Form Created: 23-Feb-2010 Confidential Page 16 of 33


DATA MANAGEMENT

Ref. No. Requirements Observations Is there a finding Recommendation for


requiring corrective corrective action
action? If yes, explain.
6.5 Is there formal CRF training at clinical sites YES NO
prior to subject enrollment?
* Documentation of trainings? Storage?

6.6 Is there a library of standard forms? YES NO


*Storage? Access? Maintenance?

6.7 Does the DM group use NCR paper or other YES NO


means to ensure exact replicas of paper
collection tools?

6.8 How is data entered from CRF’s? YES NO


* Explain process, any specific requirements?

6.9 Are Data Clarification Forms (DCF) YES NO


used?
* Provide example

6.10 What data cleansing procedure are used? YES NO


* Study specific or SOP?.

6.11 How is access to clinical data controlled? Can YES NO


you explain who has access to clinical
databases and at what point during a study?
6.12 Database Design? YES NO
* Is it COTS1 or designed in house?
* Does it include meta data components as part
of data schema?

1
Commercial Off The Shelf Software (COTS)

Form Created: 23-Feb-2010 Confidential Page 17 of 33


DATA MANAGEMENT

Ref. No. Requirements Observations Is there a finding Recommendation for


requiring corrective corrective action
action? If yes, explain.
6.13 Documentation Storage? YES NO
* Orignal CRF’s?
*DCRs, other documentation?

6.14 Is there adequate Source Control YES NO


(Configuration Management) for software
databases?
* When does control start?

6.15 Does the Source Control contain the following: YES NO


Access Control?
* Is the source code protected from unauthorized
changes? After database lock?
Version Control?
* Explain this process.
Identification Control?
* Labeling.

6.16 Are there documented procedures for each YES NO


data management process?
* Are written procedures controlled and
approved?.
* Do the procedures identify the responsibility and
authority for implementation?
* Are the procedures accessible to the persons
performing the tasks?

6.17 How is clinical data shared and or transferred? YES NO


*With other vendors?
*Is removeable media encrypted or password
protected?
* During the study?
* At Study completion?

Form Created: 23-Feb-2010 Confidential Page 18 of 33


DATA MANAGEMENT

Ref. No. Requirements Observations Is there a finding Recommendation for


requiring corrective corrective action
action? If yes, explain.
6.18 Does the company identify and control YES NO
nonconforming product (software bugs)?
* Describe the process used by the company?

6.19 Is there a flow chart or process that defines YES NO


how product or CRF changes are made?
* Does the team have the authority to make
accept/reject decisions?
6.20 How are changes to clinical databases or YES NO
systems controlled?
* Describe this process.
* How are customers notified of these changes?

6.21 Is the database environment backed-up? YES NO


Is the data/source code stored off-site?
* Seek evidence of the process.
* Are there records to support this process?

6.22 What is the query management process? YES NO


* Flowchart?

6.23 Does the company ensure that electronic data YES NO


capture systems do not restrict the answers that
site personnel can provide in a way that
introduces bias into the study?
* Describe process?

6.24 Is there a documented Disaster Recovery YES NO


Program in place for the database
environment?
* Has it be it been tested?

Form Created: 23-Feb-2010 Confidential Page 19 of 33


DATA MANAGEMENT

Ref. No. Requirements Observations Is there a finding Recommendation for


requiring corrective corrective action
action? If yes, explain.
6.25 Is there a Data Management Plan, SOP or YES NO
Template (if study not active).

6.26 Does company ensure that data can be traced YES NO


from acquisition to report and analysis?

6.27 Does company ensure that systems have easily YES NO


accessible audit trails for data audit and
investigation?

6.28 Describe the data archiving procedure? YES NO


*Is this documented?

Form Created: 23-Feb-2010 Confidential Page 20 of 33


DATA CAPTURE SYSTEMS (EDC, IVR/IWR, ePRO)

7.0 DATA CAPTURE SYSTEMS (EDC, IVR/IWR, ePRO)


Ref. No. Requirements Observations Is there a finding Recommendation for
requiring corrective corrective action
action? If yes, explain.
7.1 Does the company have dedicated EDC YES NO
resources (personnel)?

7.2 Does the company have dedicated IVR/IWR YES NO


resources (personnel)?

7.3 Does the company have dedicated ePRO YES NO


resources (personnel)?

7.4 Please list the EDC systems with which you YES NO
have worked?

7.5 Please indicate which ePRO systems you have YES NO


worked with (InVivo, PHT, CRF, etc.)?

7.6 How does company ensure data capture YES NO


systems are compliant with 21 CFR Part 11
and consistent with CSUICI?
7.7 Does company have documented development YES NO
life cycles for all data capture tools?

7.8 Are data capture tools validated prior to YES NO


deployment in production?

7.9 Does company facilitate User Acceptance YES NO


testing prior to implementation and
deployment to site?
*How is this documented?

7.10 Does company train sites in the use of data YES NO


capture tools?
*How is this typically accomplished?

Form Created: 23-Feb-2010 Confidential Page 21 of 33


BIOSTATISTICS

8.0 BIOSTATISTICS
Ref. No. Requirements Observations Is there a finding Recommendation for
requiring corrective corrective action
action? If yes, explain.
8.1 Describe the typical profile of the biostat YES NO
team? (e.g. Number of staff? Do they all have
statistical degrees? Average number of years
of biostat experience, etc.)

8.2 What is the turnover rate among YES NO


biostatisticians in the past 24 months?

8.3 Describe your typical business model(s) in YES NO


respect to the biostatistics services you provide
(e.g., traditional CRO model, staff
augmentation, etc.). Would you consider one
of more of these models to be a focus?
8.4 Describe the range of biostatistics services that YES NO
you offer (e.g., study design, protocol
development, analysis plan development, etc.).

8.5 Comment on your in-house biostatistics YES NO


expertise to support protocol/SAP
development in Bayesian statistics, interim
analyses, other advanced design methods, etc.

8.6 Do you have in-house expertise in modeling YES NO


and simulation?

8.7 Specific to staff augmentation, if applicable for YES NO


your organization, what metrics can you
provide to document timeliness for identifying
qualified, biostatistics and programming
candidates for Sponsors?

8.8 Describe the profile of your statistical YES NO


programming organization (e.g., number of
staff, years experience, etc.).

Form Created: 23-Feb-2010 Confidential Page 22 of 33


BIOSTATISTICS

Ref. No. Requirements Observations Is there a finding Recommendation for


requiring corrective corrective action
action? If yes, explain.
8.9 What statistical programming languages do YES NO
you support with in-house expertise? SAS?
Other?

8.10 Describe your quality processes for statistical YES NO


programming, including validation
procedures, traceability, audit trails, etc.

8.11 Do you have technology solutions in place such YES NO


as a clinical data repository or statistical
computing environment? Describe.

8.12 What are your policy restrictions, if any, in YES NO


respect to providing SAS code, .log, and .lis
files to Sponsors as an end-of-contract
deliverable?

8.13 Is there a documented process for unmasking YES NO


treatment codes prior to database lock?
Please describe scenarios where this would be
invoked.

8.14 What is your target timeline for distribution of YES NO


initial study results to Sponsors following
database lock? What about complete TLGs?

Form Created: 23-Feb-2010 Confidential Page 23 of 33


RESOURCE MANAGEMENT & PROCESS IMPROVEMENT

9.0 RESOURCE MANAGEMENT & PROCESS IMPROVEMENT


Ref. No. Requirements Observations Is there a finding Recommendation for
requiring corrective corrective action
action? If yes, explain.
9.1 Will company be able to provide unit based YES NO
pricing?

9.2 Is the company willing to provide pricing YES NO


based on Sponsor units and/or requirements?

9.3 Does company have any experience with YES NO


reward/penalty clauses? Please describe.

9.4 What is the average number of change YES NO


orders/project?

9.5 What typical project metrics are provided to YES NO


measure progress?

9.6 Are financial metrics available to monitor YES NO


progress against budget?

*Please detail.

9.7 Is company willing to begin studies under a YES NO


signed Letter of Intent or require a full
contract before work can begin?

Form Created: 23-Feb-2010 Confidential Page 24 of 33


INFRASTRUCTURE AND SUPPORT

10.0 INFRASTRUCTURE AND SUPPORT


Ref. No. Requirements Observations Is there a finding Recommendation for
requiring corrective corrective action
action? If yes, explain.
10.1 Is access to the facilities controlled? YES NO
* Explain?
*Office
* Data Center
* Are unauthorized attempts detectable?
* What action would be taken?

10.2 Is the computing environment protected: YES NO


From unauthorized access?
* Firewall?
 * Periodic auditing of access logs to
detect unauthorized attempts?
Unauthorized changes?
* Review the procedures supporting this process.
* Decommissioned users?

10.3 Is access to the computer system (both YES NO


physical and logical) controlled?
Access limited to authorized individuals?
Are failed attempts tracked?
10.4 Do change control procedure exist for YES NO
hardware changes?
* Are all hardware changes recorded?
* Controlled
* What type of testing (validation) is done when
changes are made to the computer systems? Is it
recorded?

10.5 Is there maintenance program in place for YES NO


computer systems?

Form Created: 23-Feb-2010 Confidential Page 25 of 33


INFRASTRUCTURE AND SUPPORT

Ref. No. Requirements Observations Is there a finding Recommendation for


requiring corrective corrective action
action? If yes, explain.
* The extent of the program should be
concurrent with the complexity and sensitivity of
the equipment.
* Can the company demonstrate that P/M is
performed on a scheduled periodic basis where
appropriate?
* Does the company maintain records of P/M?

10.6 Is there a documented process for the back- YES NO


up and off-site store of electronic records and
critical computer programs?
* Seek evidence of the process.
* Are there records to support this process?

10.7 Is there a documented Disaster Recovery YES NO


Program (DRP) in place for the computer
environment?
* Has it be it been tested?
* Is testing of the disaster recovery process
schedule to be accomplished on a periodic basis?
10.8 Is there a documented business continuity plan YES NO
that goes hand in hand with the DRP above?

10.9 Does company have a live support center YES NO


available 24/7/365, 24x5 or business hours??

10.10 What systems are supported by the internal YES NO


support center?

10.11 Is the support center ever outsourced? YES NO

10.12 Please describe the overall support center? Is YES NO


it in one location? Does it follow the sun in

Form Created: 23-Feb-2010 Confidential Page 26 of 33


INFRASTRUCTURE AND SUPPORT

Ref. No. Requirements Observations Is there a finding Recommendation for


requiring corrective corrective action
action? If yes, explain.
terms of local office support? What is the
primary and secondary language support?

10.13 Does company provide local or toll free YES NO


telephone access on a world wide basis to the
support center?

10.14 Does the support center provide support via YES NO


telephone? Fax? Email? Live chat? Other?
Please describe methods.

10.15 What is company’s typical support center YES NO


volume in terms of cases/month?

10.16 What is the typical close time for support YES NO


center cases? What is the % of cases closed on
first contact?

Form Created: 23-Feb-2010 Confidential Page 27 of 33


REGULATORY REQUIREMENTS (21 CFR Part 11)

11.0 REGULATORY REQUIREMENTS (21 CFR Part 11)


Ref. No. Requirements Observations Is there a finding Recommendation for
requiring corrective corrective action
action? If yes, explain.
11.1 Identify applicable regulations that the List:
company is required to meet.

11.2 Does the company understand the YES NO


requirements of 21 CFR Part 11?
* Seek evidence of this.
* Training Records should contain documented
evidence to support this.

11.3 Does the company have a 21 CFR Part 11 YES NO


policy statement?
* If so, review.

11.4 Is the product validated prior to release to YES NO


production or to clients?
* Internal and external release.

11.5 Are Part 11 requirements clearly identified in YES NO


the:
Product Requirements?
Development Specifications?
Test Specifications or test cases?
* Is there a document that traces the product
requirements  the specifications  the
regulation?

11.6 Can the system discern invalid or altered YES NO


records?
* Explain.
* Is there evidence that this has been tested?
11.7 Is the audit trail protected from unauthorized YES NO
changes?

Form Created: 23-Feb-2010 Confidential Page 28 of 33


REGULATORY REQUIREMENTS (21 CFR Part 11)

Ref. No. Requirements Observations Is there a finding Recommendation for


requiring corrective corrective action
action? If yes, explain.
* Is there evidence that this has been tested?
11.8 Does the audit trail capture all actions that YES NO
create, modify, and/or delete data from
electronic records?
* Is there evidence that this has been tested?

11.9 Do all actions in the audit trail contain a date YES NO


time stamp?
Operator entries?
Reason for changes?

11.10 Do changes to electronic records obscure YES NO


previously recorded information?

11.11 Is the audit trail available for viewing? YES NO


Printing?
11.12 Is the audit trail linked to the data? YES NO
* Explain this for the product being audited?

11.13 Security -- Is system limited to authorized YES NO


individuals?
* Is there evidence that this has been tested?
* Document the type of access controls that are
available to the software.

11.14 Are operational checks implemented as YES NO


appropriate?
Where required, does the system permit
forced actions (i.e. actions in a particular
order)?
11.15 Is the system used as an “open” or “closed” YES NO
system?

Form Created: 23-Feb-2010 Confidential Page 29 of 33


REGULATORY REQUIREMENTS (21 CFR Part 11)

Ref. No. Requirements Observations Is there a finding Recommendation for


requiring corrective corrective action
action? If yes, explain.
* Explain.
11.16 Do signed electronic records contain the YES NO
printed name of the signer?
Date time stamp when the signature was
executed?
The meaning of the signature?
* Such as review, approval, responsibility, or
authorship?
11.17 Are the electronic signatures linked to the YES NO
electronic record?
* Is there evidence that this has been tested?

11.18 Are the electronic signatures unique to one YES NO


individual?
* Is there evidence that this has been tested?

11.19 Has the organization certified to the agency YES NO


that electronic signatures used on after August
20, 1997, are intended to be the legally binding
equivalent of traditional handwritten
signatures?
11.20 Are electronic signature based on two distinct YES NO
identification components?
*Such as identification code and password?
Are both components required for the initial
execution of the electronic signature?

11.21 Do controls exist that ensure the security and YES NO


integrity of the electronic signature?

Form Created: 23-Feb-2010 Confidential Page 30 of 33


REGULATORY REQUIREMENTS (21 CFR Part 11)

Ref. No. Requirements Observations Is there a finding Recommendation for


requiring corrective corrective action
action? If yes, explain.
11.22 Do controls exist that ensure the uniqueness of YES NO
each combination of identification code and
password?

11.23 Do safeguards exist to prevent the YES NO


unauthorized use of passwords and
identification codes?
Detection?
Reporting?

Form Created: 23-Feb-2010 Confidential Page 31 of 33


ADDITIONAL AREA(S) REVIEWED (please indicate)

12.0 ADDITIONAL AREA(S) REVIEWED (please indicate)


Ref. No. Requirements Observations Is there a finding Recommendation for
requiring corrective corrective action
action? If yes, explain.
12.1 YES NO

12.2 YES NO

Form Created: 23-Feb-2010 Confidential Page 32 of 33


Supporting Evidence

13.0 SUPPORTING EVIDENCE


List Document(s) that have been reviewed Is there a finding requiring corrective Recommendation for corrective action
action that has not already been noted?
If yes, explain.

Form Created: 23-Feb-2010 Confidential Page 33 of 33

Вам также может понравиться