Q: There’s a Microsoft white paper on SharePoint validation that was published in 2012 entitled “SharePoint Configuration Guidance for 21 CFR Part 11 Compliance“. [Editor’s Note: There’s also a 2013 version, available for download here.] It describes how to set up a Document Control system in SharePoint that will be compliant with Part 11.
We’ve long heard and have communicated within our company that SharePoint can’t be validated. Therefore, we use a different software package that is validated and meets FDA’s predicate rules and Part 11 requirements.
What is the FDA’s current perspective on SharePoint? Has it changed?
A: You’re correct that SharePoint cannot be validated in and of itself. But your use of SharePoint can be validated if you can set up your use to be compliant with Part 11. There are ways to do this — but you have to configure SharePoint correctly and make sure people use the software only that way.
The problem with SharePoint is that people who know the software well can use it in ways that are not compliant with FDA’s requirements. I find it’s difficult to lock SharePoint down to ensure you have the audit trails you need. Also, it’s difficult to lock SharePoint down so that all documents must be checked out to be worked on and then properly checked back in (with version control) — thus maintaining a chain of custody.
[pullquote align=”right” cite=”” link=”” color=”” class=”” size=””]The problem with SharePoint is that people who know the software well can use it in ways that are not compliant with FDA’s requirements.[/pullquote]
I have seen SharePoint validation done correctly. But there are many people who complain about SharePoint’s tight controls and the lack of open collaboration, which are SharePoint’s strengths and also its weaknesses when it comes to Part 11 compliance.
Overall, FDA doesn’t care what software package you use. The Agency is concerned about your specific use of the software and whether or not your use complies with the FDA predicate regulations and 21 CFR Part 11.
Answered by Janis Olson, Vice President of Regulatory & Quality Services at EduQuest (22 years as an expert FDA investigator and as the FDA regional director of information management resources). Jan also is the co-instructor of EduQuest’s FDA Auditing of Computerized Systems and Part 11/Annex 11 training class.