21 CFR Part 11 and your environmental monitoring system

Part 11 rests on data integrity — the ALCOA+ principles: records need to be attributable to a specific person, legible, contemporaneous, original, and accurate, with an audit trail that captures who changed what, when, and why for anything altered after the original entry. An EMS that logs values but has no exportable, tamper-evident audit trail is generating data, not records an inspector will accept as evidence of control.

Three technicians logging in as 'operator' means no record in the system is attributable to a specific person — the single most common finding we make.

The gaps we find most often on retrofits are almost never the sensors themselves. Shared logins are the single most common finding — if three technicians log in as 'operator', no record is attributable to a specific person, full stop. Close behind that: alarm acknowledgements with no requirement to record a reason, e-signatures that are just a typed name with no password re-entry, and historical data that lives only in a proprietary format the software vendor can export but nobody on site actually knows how to.

Scoping a retrofit properly means auditing the software configuration, not just adding sensors: individual user accounts with role-based permissions, a genuine audit trail export, password-based e-signature on any GxP-relevant action, and a documented backup and archival procedure that survives a server replacement. None of it is expensive to fix. All of it has to be found before an inspection, not during one.