21 CFR Part 11
21 CFR Part 11 — Electronic records and electronic signatures
Attributable, legible, contemporaneous, original, accurate — and enforced below the application.
Part 11 governs when the FDA will accept an electronic record in place of paper. Almost all of it comes down to three questions: can you prove who did it, can you prove what it looked like before, and can someone change it without leaving a mark. ErgoLIMS answers the third one at the database layer, which matters, because an audit trail implemented in application code is only as good as the code paths that remember to call it.
Who this is for: Pharmaceutical, contract research and regulated manufacturing labs whose records may be inspected.
Audit trail
Controlled changes are captured by a database trigger rather than by application code, so a change made through any path is recorded — the trail is not something a route can forget to call. Two stores work together: an event stream holding who acted, in what role, on which record, and a field-level trail holding the old and new value of every column that changed.
- Computer-generated, time-stamped, and independent of the operator
- Old and new values retained per field; the record is never overwritten in place
- Result submission and e-signature capture the full record — actor, role, module, request id, channel and the signed meaning
- A request id ties together every row a single call changed
- Change reasons captured at the point of change on the paths that collect them
- Trail is retained for the life of the record and available for review and copying
Electronic signatures
A signature is an identity challenge at the moment of signing, not a checkbox. The signed manifestation carries the printed name of the signer, the date and time, and the meaning of the signature — review, approval, responsibility or authorship.
- Identity re-challenged at signing, distinct from the login session
- Printed name, date, time and meaning recorded and displayed on the signed record
- Signature linked to its record so it cannot be excised, copied or transferred to another record
- Requirement is lab-configurable: a lab can require e-signature at defined steps, or use signature images, or both
Access and authority checks
Authority checks are applied server-side. A request to approve a result that the user is not authorised to approve is refused by the API, regardless of what the interface offered.
- Role-based permissions with per-user overrides, 239 permissions across 67 resources
- Separation of duties: the entering analyst cannot approve their own result
- Session expiry and brute-force lockout on repeated failures
- Six server-side guards on result entry, so the rules hold even for direct API calls
Record protection
Records have to be protected for the whole retention period, and you have to be able to demonstrate they came back intact.
- AES-256-GCM encryption at rest
- Soft delete with recovery — controlled records are not removed by a user action
- Nightly encrypted backups, with weekly restore tests that perform a real restore rather than checking a file exists
- Retention policies with approval, dry-run sweeps, dependency guards and legal holds
What one signature actually stores
An analyst e-signed and submitted a set of cough-syrup results. This is the row the database kept — every field below came out of a running system, and the fields nobody supplied are shown empty rather than filled in.
- event_id
- f1cf6c16-08d4-446c-a551-cfe0460e4656
- tenant
- Aushadhi Analytical Labsdemonstration tenant
- timestamp
- 2026-09-02 09:43:24.904797+00
- actor
- Ms. Bhavana Chowdary · bhavana.chowdary@…
- actor_role
- analyst
- action
- INSERT
- module
- test_management
- entity_type
- e_signatures
- entity_id
- 7cb09149-…
- request_id
- 0fdaaa35-589a-4a93-b6a2-17594cc29218groups every row this one call changed
- source
- ui
- old_values / new_values
- full signed row capturedon an UPDATE: changed_fields[] plus before and after
- reason
- — not suppliedthis path collects none; shown absent, not invented
- metadata
- — not supplied
- ip_address
- captured · redacted here
{
"meaning": "I certify these results are accurate and complete",
"signed_at": "2026-09-02T09:43:24.901Z",
"signer_name": "Ms. Bhavana Chowdary",
"signer_email": "bhavana.chowdary@…"
}action: job_sheet.results module: test_management actor_role: analyst request_id: 38d3e2f2-372b-… source: ui row_hash: 0730f92b40bea0e8… hash_version: 2
The same request_id pattern ties every row a single call touched. The hash is recomputable, so an altered row stops matching.
Scope, stated plainly: result submission and e-signature capture this today. Other write paths record the change and the values but not yet the actor — that work is in progress, and this page will not claim it before it lands.
Selecting 21 CFR Part 11 at signup turns these on
Selecting FDA at signup enables the Part 11 control set. The GMP packs (gmp, who_gmp, cdsco) enable an overlapping set built around batch records and change control.
accreditation code: fda · cfr_part11
What ErgoLIMS does not do here
Every vendor page lists what the software handles. These are the boundaries, so you find them now rather than three weeks into an evaluation.
- Part 11 compliance belongs to the regulated organisation, not to a vendor. No software is "Part 11 compliant" on its own; it is compliant as installed, validated and operated by you.
- Computer system validation — IQ/OQ/PQ against your own user requirements — is your responsibility. ErgoLIMS has not been through a third-party Part 11 audit.
- Signatures are electronic. Digital signatures based on public-key certificates are not implemented.
- Open systems under §11.30 are outside the current design; the system is intended to be operated as a closed system with controlled access.
- Attribution is not yet universal. Result submission and e-signature record who acted; other write paths currently record the change and its before/after values without the actor. That wiring is in progress — ask us where it stands rather than assuming either answer.
- Batch records and stability are coming soon, so those records live outside the system today.
Questions we get asked
Labs that hold this
Other standards
Bring your assessor’s checklist
The most useful demo is the one where you read the audit trail yourself and try to break an authority check. We would rather you found the limits in the demo than after signing.