What You Need to Know About FDA 21 CFR Part 11 Validation

Validating an ERP system helps a company ensure that their processes are consistent and operate in accordance with industry standards. The 21 CFR Part 11 validation process establishes documented evidence that, throughout its lifecycle, the ERP system will consistently function in accordance with its pre-determined specifications and quality attributes. For pharmaceutical and medical device companies, compliance with the FDA requirements outlined in 21 CFR Part 11 and the validation of this compliance, is a critical aspect of the implementation of DEACOM ERP. In this post, we will provide an overview of the validation process.


Validation Documents

DEACOM’s software development model allows it to act as a “Commercial off the Shelf” (COTS) software, simplifying the 21 CFR Part 11 validation process during implementation. DEACOM ERP software provides many tools to assist with the process which includes recording the history of all data conversion loads completed during implementation, outlining base test scripts that can be configured to support the OQ process, and providing Standard Operating Procedure (SOP) functionality to make creating the documents easier.

The FDA requires a specific set of documents as part of the 21 CFR Part 11 validation process and they are listed below. The documents highlighted in blue can be provided by Deacom.

CFR Part 11 Validated Documents with DEACOM ERP Software

Here is an overview of each required document:

Validation Plan

The validation plan provides a detailed list of the 21 CFR Part 11 validation activities that is conducted on the system being validated. In general, this document should describe the approach, deliverables, and acceptance criteria for each activity.

The table below outlines Deacom’s typical deliverable schedule for each of the primary areas of the validation process. The schedule may be tailored for individual companies as necessary.

Deliverable Days before “Go-Live”
Installation Qualification – Test Environment 120
Installation Qualification – Live Environment 90
Operational Qualification 30
Performance Qualification 14
Validation Report 7


Functional Specification

The functional specification identifies DEACOM’s well-detailed requirements, how the system will achieve each of these needs, and the acceptance criteria for a successful implementation. They are typically a blend of the functional descriptions found in the DEACOM help system and the end-user requirements outlined by the company implementing DEACOM.


Design Specification

The design specification describes how the software will meet the functional requirements outlined in the prior section. This document is typically a high-level overview of what is required of the software.

Deacom provides a high-level design document that includes the following:

  • Overview of DEACOM’s purpose
  • Development procedures and coding guidelines
  • Support procedures and processes for logging issues with the software
  • Hardware guidelines
  • Support software guidelines
  • Security measures provided through DEACOM


System Build

This phase involves the delivery of the system build that will be in place at the time go-live.

With Deacom’s unique development methodology and implementation structure, this phase normally occurs six to eight weeks prior to the projected go-live date.


Installation Qualification Process

The qualification documents produced during the validation process outline the relationship between cGMP best practices and DEACOM. The installation qualification verifies that all hardware and software related to DEACOM are installed in accordance with the vendor’s installation specifications.

Deacom’s installation qualification document provides a SOP for completing the installation qualification protocol. The tasks that are performed include, but are not limited to, the following:

  • Confirmation that the server-side installation is in accordance with Deacom’s installation specifications (defined in the DEACOM Design and Processes document)
  • Confirmation that the server-side tools, including SQL and .Net, are installed per Deacom’s recommendations
  • Confirmation that the disk space requirements are adequate on the server
  • Confirmation that a backup of the software exists
  • Confirmation that all clients are configured in accordance with Deacom’s installation specifications
  • Confirmation that server security is setup to limit database access
  • Evaluation of known issues to determine if they will impact operations and implement controls to mitigate these issues if they exist

The installation qualification document also provides reports on data migrated from a company’s legacy system into DEACOM. The DEACOM software tracks all data migrations and changes through System > View Import History, which produces the necessary reporting for the qualification document.


Operational Qualification

The operational qualification focuses on a complete test of the system. Any system interfaces that are governed by the 21 CFR Part 11 require that these components operate according to the system specifications included in the system documentation. The basis for the operational qualification is the DEACOM test script provided, additional customer test scripts, and customer specific SOP documentation. The test scripts include a validation of general functions, transactions, and end-user training. The tests to be executed under this protocol are divided into the following functional areas:

  • System Setup (including test system and WMS configurations, backup and recovery)
  • System Administration (including security, audit trails, electronic signatures, and report archiving)
  • Purchasing QC Transactions
  • Item Management
  • Formulation Management
  • Production Transactions
  • Production QC Transactions
  • Inventory Management

The deliverables for each functional area are the signed-off test scripts with any defects noted.


Performance Qualification

Validation Report

The IQ, OQ and PQ documents will together form the 21 CFR Part 11 validation report. The purpose of the report is to summarize the validation activities that are associated with the software system. The following documents should be included with the IQ, OQ and PQ documents:

  • SOP documentation
  • Training documentation showing appropriate training materials and outlining the dates/times of training
  • Summary reports from the testing process

Prior to completing any transactions in the live DEACOM environment, the final signatures must be completed on the validation report.


The Advantage of a Strong Foundation

The FDA’s 21 CFR Part 11 guidelines describe the requirements for electronic records and signatures, including the validation of the software used to create and maintain these records. By building upon a strong foundation, Deacom’s streamlined process for validation has proven to greatly impact the ease of validation for our customers in the medical device and pharmaceutical industries. Our ERP software includes the built-in tools necessary to assist you with this process and provide you with the most efficient means of meeting the requirements of 21 CFR Part 11 validation.

About the author

Global Digital Marketing Director at

Domenick Naccarato has been a featured writer on the Deacom blog for the past 8 years sharing his insight into manufacturing best practice techniques, conversations with customers, and videos of Deacom ERP experts and users.