Skip to content

21 CFR Part 11 Compliance and R

4 messages · Richard Haney, Frank E Harrell Jr, Bert Gunter +1 more

Frank E Harrell Jr
#
Richard Haney wrote:
Rich,

Whoever told you that is not well-informed.  CFR Part 11 has to do with 
critical software that runs medical devices and about certain primary 
data management software.  It does not apply to statistical analysis 
software.  We use R all the time in industry-sponsored and NIH sponsored 
clinical trials.  You do not need to seek FDA's approval.  FDA accepts 
all comers and does not dictate software policy for analysis.  They even 
accept Excel and Minitab for NDAs.  There are many messages related to 
this in the r-help archive; please look at them.

Frank

  
    

      
      
    

  


  


      

    

    

      
      

        


  

        

      Bert Gunter
    

    

      
      #
    

  


  

      
To further add to and perhaps clarify Frank's remark: 21 CFR Part 11 defines
certain requirements for electronics records. A general requirement relevant
for statistical software used in submissions is, I presume (quoted):

  " Persons who use closed systems to create, modify, maintain, or 
transmit electronic records shall employ procedures and controls 
designed to ensure the authenticity, integrity, and, when appropriate, 
the confidentiality of electronic records, and to ensure that the signer 
cannot readily repudiate the signed record as not genuine. Such 
procedures and controls shall include the following:
    (a) Validation of systems to ensure accuracy, reliability, 
consistent intended performance, and the ability to discern invalid or 
altered records. "


Note that there is no requirement for ANY specific software -- only that a
process for software validation has been followed. Presumably, ANY
reasonable validation process can be used and, as R already has extensive
built-in validation suites, these certainly should go a long way toward
fulfilling the bulk of this validation requirement. 

The widespread use of SAS within the pharmaceutical industry is simply a
historical legacy (many would say an archaic one, but we won't go there).
Because of a huge existing infrastructure and code base, many companies
don't/can't even consider changing it. This is a common paradigm for
technological change: RCA was working mightily on improving vaccuum tubes
for their TV sets even as Sony was using transistors to blow them away. My
understanding is that it will take decades at least for fiber optics to
replace the gazillions of miles of copper in the phone network even though
that copper is a major obstacle to wider bandwidth and new services.

Older technologies are frequently difficult to displace merely because they
are there. This is certainly heightened in a regulatory environment where
anything that slows approval of a submission -- for example, use of software
that FDA reviewers may not be as familiar with -- is avoided. But that
neither mandates nor argues for avoidance. If R produces better submissions
more efficiently, then why not use it?

-- Bert Gunter
Genentech Non-Clinical Statistics
South San Francisco, CA
 
"The business of the statistician is to catalyze the scientific learning
process."  - George E. P. Box

            

      
      
      
    

        

      
      
    

  
  


  


      

    

    

      
      

        


  

        

      A.J. Rossini
    

    

      
      #
    

  


  

      
21 CFR Part 11 is mostly about data audit trails (tracking changes and
electronic signatures) and validation of software.

Most of this involves documentation and the creation of documentation
LOCALLY at YOUR site, regarding YOUR processes and operating
procedures.

R satisfies most of what is needed, depending on who you are.  If you
happen to be working for a large Pharma, it comes up slightly short,
but not too short; I happen to know of 2 pharmas very interested in
getting the gaps filled, and an analysis suggests that this is simple,
though time consuming, of course.  Hopefully, the missing pieces will
exist soon (mostly traditional vendor documentation for validation).

If you happen to be working in an nonprofit/academic setting, R is
probably fine (again depending on your SOPs, data transport audit
trail, etc).

best,
-tony

        
On 5/23/05, Richard Haney <richard.haney at duke.edu> wrote: