21 CFR Part 11 Compliance Checklist for Compounding Pharmacies

First determine which records are in scope

Using software does not automatically make every pharmacy record subject to Part 11. Identify the FDA recordkeeping requirement behind each record and how the electronic version is relied on. FDA’s scope and application guidance explains predicate rules and its enforcement-discretion policy. Underlying recordkeeping obligations still apply.

Create an inventory with record type, regulatory basis, authoritative copy, system owner, retention period and reviewer. Evaluate state requirements separately. The checklist below is an implementation review aid, not a vendor certification or a finding that every item applies identically to every system.

Checklist: control, evidence and demonstration

Review applicable controls against the official rule

Area	Evidence to retain	Practical demonstration
Intended use and validation	Approved requirements, risk assessment, test evidence, deviations and release decision.	Follow a critical record through creation, review, signature and export using the deployed configuration.
Access and authority	Role definitions, approved access, account removal and access-review records.	Show that a user cannot approve outside assigned authority and that a disabled account loses access.
Audit history	Applicable change history with attribution and timestamps, plus a review procedure.	Correct a record and retrieve the previous value and the associated change history.
Copies and retention	Retention schedule, export specification and restoration evidence.	Retrieve a readable historical record with signature meaning and supporting context.
Signatures	Identity verification, signature accountability policy and signing-control tests.	Demonstrate the identity, time, meaning and record association of an actual test signature.
Change control	Change assessment, approvals, relevant retesting and training updates.	Explain how a software or configuration update affected the validated use.

The controlling text is 21 CFR Part 11: closed-system controls are in §11.10, open-system controls in §11.30, signature manifestations and linking in §§11.50–11.70, and signature/account controls in §§11.100–11.300. Apply the provisions together with the FDA guidance and your predicate rules.

Three claims to challenge during vendor evaluation

• “Every click must require a password.” Section 11.200 distinguishes the first signing in a continuous controlled session from subsequent signings. Assess the implemented session and signature controls instead of assuming one universal user-interface pattern.
• “All signatures must use cryptography.” Section 11.70 requires signature-to-record linking that prevents ordinary transfer or falsification. Cryptography is an implementation choice, not the only named method for every closed system.
• “The software makes the facility compliant.” The facility still owns intended use, procedures, access governance, training and validation decisions. Ask for evidence that fits the configuration you will actually operate.

A pharmacy-specific review exercise

Choose a completed environmental excursion, an approved SOP revision and a personnel competency record. For each, identify the authoritative copy and retrieve who entered it, who reviewed it, what changed, and what the exported record preserves. Attempt an unauthorized action with a test role. Record expected and observed behavior, rather than treating a feature brochure as test evidence.

For an SOP revision, check whether training refers to the version in effect when the employee acknowledged it. For an excursion, check whether the original reading and later investigation remain distinguishable. These are useful record-integrity questions even when your applicability assessment concludes that a particular record is outside Part 11.

Related implementation work

Use the CAPA guide for investigation and closure evidence, the training guide for personnel records, and the inspection preparation guide to rehearse retrieval. During a CompliRx demonstration, request these record examples and the available implementation evidence; do not accept this article as a validation package.

Is there a single Part 11 retention period?

No. Identify the retention obligation from the applicable predicate rule and record type, then verify the system and procedures support it.