FDA 21 CFR Part 11 Audit Trail Specification Guide

21 CFR Part 11 establishes the U.S. Food and Drug Administration’s criteria for electronic records and electronic signatures to be considered trustworthy, reliable, and equivalent to paper records. Within this framework, the audit trail requirement mandates that systems maintain secure, computer-generated, time-stamped records documenting who made a change, what was changed, when it occurred, and—where technically feasible—why or how the change was made. For PLC-based process control systems (e.g., in pharmaceutical, biotech, or medical device manufacturing), implementing compliant audit trails presents unique challenges due to real-time constraints, deterministic execution, limited storage, and legacy hardware; thus, the specification guide provides architecture patterns—including centralized logging servers, OPC UA event models, and timestamp-synchronized edge devices—that align with both IEC 62443 security principles and FDA’s Data Integrity (ALCOA+) expectations. The guide emphasizes design controls such as role-based access enforcement, cryptographic hashing of log entries to prevent tampering, automatic archiving with retention policies aligned with 21 CFR §11.10(e), and validation protocols (e.g., IQ/OQ/PQ) demonstrating audit trail completeness, accuracy, and retrievability under operational load. Crucially, it distinguishes between 'system-level' audit trails (e.g., PLC firmware updates, configuration downloads) and 'process-level' audit trails (e.g., setpoint modifications, batch parameter overrides), requiring both to be independently verifiable and linked to authenticated user identities—not just generic operator IDs.