To make your ANDA submission workflow compliant with 21 CFR Part 11, you need to ensure the software, processes, controls, and records all support trustworthy, secure, and FDA-auditable electronic submissions. In practice, compliance is not just a software feature—it’s a combination of validated systems, governed procedures, and documented accountability.

Here’s a practical framework.

---

1) Confirm the software is suitable for Part 11 use

Your submission management software should support:

• Unique user IDs for each person
• Role-based access control and least-privilege permissions
• Strong authentication (ideally MFA)
• Secure, computer-generated audit trails
• Electronic signatures tied to a specific individual
• Record integrity controls to prevent unauthorized change or deletion
• Time-stamped logs and synchronized system clocks
• Record retention and retrieval for the required period
• Controlled export of submission content and metadata

If the software cannot support these functions, you’ll need compensating procedural controls or a different system.

---

2) Validate the system for its intended use

Part 11 expects systems to be validated. For an ANDA workflow, that means proving the software consistently performs as intended.

Typical validation deliverables:

• User Requirements Specification (URS)
• Functional/Design specifications
• Risk assessment
• Installation Qualification (IQ)
• Operational Qualification (OQ)
• Performance Qualification (PQ) or user acceptance testing
• Traceability matrix linking requirements to tests
• Validation summary report

Focus on critical functions such as:

• document routing and approval
• version control
• audit trail capture
• e-signature execution
• submission assembly
• final publishing/export
• access restrictions
• backup and recovery

---

3) Implement strong access and identity controls

Part 11 requires that electronic records/signatures be attributable to an individual.

Best practices:

• Assign individual user accounts only; no shared logins
• Enforce password complexity, expiration, lockout, and session controls
• Use MFA for privileged and submission-approval users
• Maintain joiner-mover-leaver procedures to onboard/offboard users quickly
• Periodically review user access against job roles
• Separate duties so authors, reviewers, approvers, and administrators do not have inappropriate overlap

---

4) Ensure audit trails are complete and reviewable

Your system should automatically capture audit trails for any action that affects regulated content.

Audit trails should record:

• who did it
• what changed
• when it changed
• previous and new values
• reason for change, where appropriate
• whether the action was electronic review/approval/signature

Important:

• Audit trails must be secure, tamper-evident, and retained
• They should be readable and searchable
• There should be a defined process for periodic review of audit trail activity, especially around submission finalization

---

5) Control electronic signatures properly

If you use e-signatures for approvals, they must meet Part 11 requirements.

That means:

• signatures are unique to one individual
• signature controls are not reusable or transferable
• signature events are linked to the specific record
• the system records the printed name, date/time, and meaning of the signature
• there is a documented process for signature issuance, authentication, revocation, and training

For submissions, clearly define signature meaning, such as:

• prepared by
• reviewed by
• approved by
• final authorization to submit

---

6) Maintain data integrity throughout the workflow

Part 11 compliance depends heavily on data integrity principles like ALCOA+:

• Attributable
• Legible
• Contemporaneous
• Original
• Accurate
• plus complete, consistent, enduring, and available

For an ANDA process, this means:

• controlled authoring templates
• version-controlled documents
• no uncontrolled local copies
• defined naming conventions
• documented reconciliation of source data to final submission content
• controlled transformation into submission format

---

7) Lock down the submission package and publishing process

ANDA submissions often involve assembling a final electronic package, so you should ensure:

• only authorized users can create/finalize submission sets
• there is a formal review and approval gate before publishing
• final published files are checksum-verified or otherwise integrity-checked
• the final package is frozen so it cannot be altered without creating a new version
• a complete submission history is retained, including rejected drafts and final approved versions

If you use eCTD tools, ensure the publishing sequence and lifecycle handling are controlled and tested.

---

8) Establish SOPs for the entire workflow

Even compliant software can be used noncompliantly without procedures.

You should have SOPs for:

• document creation and review
• submission assembly
• approval and e-signature use
• access management
• audit trail review
• change control
• deviation handling
• backup/recovery
• record retention
• periodic system review
• vendor management
• disaster recovery and business continuity

Make sure roles and responsibilities are clear.

---

9) Manage change control and periodic review

Part 11 compliance is ongoing.

Any software/configuration changes should go through:

• change control
• impact/risk assessment
• regression testing
• re-validation where needed

Also perform periodic reviews to confirm:

• users still have appropriate access
• audit trails are functioning
• backups are successful
• signatures are functioning as intended
• records remain retrievable
• vendors have not changed critical infrastructure without notice

---

10) Control backups, archives, and retention

FDA expects you to retain records and be able to retrieve them.

Ensure:

• backups are performed and tested
• archives are secure and readable over time
• retention periods are defined according to applicable regulatory and business requirements
• you can reconstruct the submission package and supporting records if audited
• the archive preserves audit trails and signature metadata

---

11) If using a vendor/cloud platform, qualify the vendor

If the submission management system is hosted or SaaS-based:

• assess the vendor through supplier qualification
• review their validation package, security controls, and audit trail capabilities
• confirm data ownership, access, export, retention, and deletion terms
• define incident response and breach notification expectations
• ensure your quality agreement covers Part 11 responsibilities

You remain responsible for compliance even if the software is hosted externally.

---

12) Train users and document competency

Users need to know how to use the system compliantly.

Training should cover:

• Part 11 basics
• how e-signatures work
• proper review/approval steps
• no sharing of credentials
• handling corrections
• audit trail expectations
• how to report issues or deviations

Keep training records and re-train after major changes.

---

13) Perform a Part 11 assessment before go-live

A formal gap assessment is very useful.

Review:

• system capabilities vs. Part 11 requirements
• procedural controls
• validation status
• security/access controls
• audit trails
• signature controls
• retention/retrieval
• vendor controls

This assessment should end with a remediation plan and documented approval to go live.

---

Practical checklist for your ANDA workflow

Use this as a quick checklist:

• URS includes Part 11 requirements
• System validated for intended use
• Individual accounts and strong authentication in place
• Audit trails enabled, secure, and reviewed
• E-signatures linked to users and records
• Access is role-based and periodically reviewed
• Submission package is version-controlled and frozen at approval
• SOPs cover the full workflow
• Backup, archive, and retention controls tested
• Vendor/cloud provider qualified
• Users trained
• Change control and periodic review established

---

Important note

Part 11 compliance is not a one-time certification. It’s a state of control you maintain through validation, procedures, training, and oversight.

If you want, I can also provide:

1. a Part 11 gap assessment template for ANDA submission software, or
2. a SOP outline for an electronic submission workflow.