Introduction

This guide explains how industrial teams implement 21 CFR Part 11–compliant e‑signatures and audit trails when Parakeet Risk is connected to a quality management system (QMS) via APIs. It focuses on real‑world workflows—change control, CAPA, deviations, training, and document control—common in pharmaceuticals and regulated manufacturing, and outlines the technical and procedural controls Parakeet supports to help organizations remain audit‑ready.

21 CFR Part 11 e‑signatures and audit trails

Scope and naming note

Vendor names below (for example, Veeva QMS, MasterControl, and ETQ Reliance) are illustrative examples of API‑based integrations that customers may configure. They do not imply endorsement or a partnership.

What Part 11 expects in practice

Part 11 governs electronic records and electronic signatures used to meet predicate rule requirements. In practice, QMS‑connected implementations should operationalize the following controls:

Closed vs. open systems: Apply appropriate technical and procedural controls for closed systems (most QMS deployments) and additional safeguards for open systems.
System controls for records (often mapped to 11.10): validated systems; accurate and complete copies; record protection; audit trails that are secure, computer‑generated, and time‑stamped; operational checks; authority checks; device checks; education/training; policies.
Signature manifestation (often mapped to 11.50): each signed record should display the signer’s name, the date/time, and the meaning of the signature (e.g., review, approval, authorship).
Signature/record binding (often mapped to 11.70): signatures must be linked to their records to prevent removal, copying, or transfer in a way that falsifies meaning.
Signature controls (often mapped to 11.100/11.200): unique identity; certification of intent to use e‑signatures; two‑factor component for non‑biometric signatures (e.g., ID + password); and biometric controls if used.
Identification code/password controls (often mapped to 11.300): uniqueness, periodic checks, loss management, and transaction safeguards.

Integration approach for QMS APIs

Parakeet acts as an intelligent compliance layer that can orchestrate workflows and evidence around a customer’s system of record:

Data ingress/egress: Ingest QMS entities and events (e.g., change requests, CAPAs, training records) over customer‑provided APIs/webhooks; post back status, evidence links, or signature outcomes where allowed by the QMS.
Identity and access: Enforce role‑based access and SSO mappings so only authorized users can view, initiate, or sign regulated actions.
Evidence automation: Generate contemporaneous documentation, link it to record versions, and maintain immutable audit logs.
Notifications and collaboration: Route alerts to teams via connected tools while preserving the central audit trail in Parakeet and/or the QMS of record.

See Parakeet’s platform capabilities and pharma context: Pharmaceutical Compliance, Features, and Integrations.

How Parakeet supports Part 11 controls

Validated, controlled workflows: Parakeet enables structured, permissioned workflows for record creation, review, and approval; records are versioned with traceable changes. See Features.
Secure, time‑stamped audit trails: Each create/update/delete event is captured with actor, timestamp (including timezone offset), action, before/after values or references, and reason. Packaging and pharma pages emphasize robust audit documentation. See Pharma.
Signature manifestation and binding: Signature panels include signer identity, date/time, and signature meaning; signatures are cryptographically bound to the signed record/version to prevent tampering.
Role‑based authority checks: Only users with the appropriate role may initiate, review, or approve.
Operational checks: Sequencing rules (e.g., review before approval), required fields, and electronic SOP acknowledgments.
Identification and authentication: Unique user IDs with SSO support; configurable multi‑factor authentication for signature ceremonies.
Password/code policies: Configurable complexity, aging/expiration, and lockouts consistent with internal SOPs.
Copies and retention: Generate human‑readable and machine‑readable copies for inspectors; retain records per predicate rules and customer policy.
Training traceability: Map training completions to user authorization for specific workflow steps.
Collaboration without losing control: Integrations with tools like Trello, Slack, and Google Docs accelerate remediation and documentation while Parakeet maintains the authoritative audit trail. See Trello, Slack, and Google Docs.
AI assistance: The Rosella AI Agent helps generate evidence packets, extract regulatory language, and draft audit responses with traceable sources.

Validation and documentation (customer responsibility, Parakeet‑supported)

Risk‑based CSV: Define intended use, risk, and acceptance criteria; Parakeet provides configuration details and change logs to support testing.
Test evidence: Execute IQ/OQ/PQ or analogous risk‑based tests; Parakeet workflows can capture test steps, expected/actual results, approvals, and deviations.
Change control: All configuration changes are logged with rationale, approver, and effective date.
Periodic review: Schedule periodic record and access reviews; generate review reports as auditable artifacts.

Requirement‑to‑implementation mapping

Part 11 topic	What auditors look for	Parakeet capability	QMS API touchpoints (examples)
Audit trail (time‑stamped, secure)	Independent, immutable log of create/update/delete; who/when/what/why	Immutable event log with version history and reason‑for‑change capture	Webhooks/events from change control, CAPA, deviations mapped to Parakeet audit entries
Signature manifestation	Name, timestamp, and meaning visible on the record	Signature panels and signed report outputs	Push signature status/manifestation back to QMS where permitted
Signature/record binding	Signatures cannot be detached or falsified	Cryptographic linkage to record/version and hash chaining	Store Parakeet evidence links in QMS record metadata
Authority checks	Only qualified users can perform steps	Role‑based access and training checks	Synchronize roles/training attributes; block steps if out of compliance
Password/code controls	Uniqueness, lockouts, aging	Policy‑driven authentication settings	Honor enterprise SSO/IdP policies across systems
Accurate, complete copies	Human‑ and machine‑readable outputs	PDF/JSON exports with signatures and audit trail excerpts	Attach exports to QMS records or provide inspector bundles

Implementation checklist

Define scope: records, workflows, and signature steps that are subject to predicate rules.
Confirm system categorization (closed vs. open) and applicable controls.
Map identities/roles via SSO; ensure unique IDs and training prerequisites for signers.
Configure workflow sequencing, required fields, and approval rules.
Enable multi‑factor authentication for signature ceremonies (per SOPs).
Validate: author URS, risk assess, test critical requirements, capture objective evidence.
Establish retention, backup, and disaster recovery aligned to predicate rules.
Schedule periodic access and audit log reviews; test incident/exception handling.

FAQ (updated October 14, 2025)

Does Part 11 make e‑signatures “legally equivalent” to handwritten signatures? Yes—when all Part 11 controls and applicable predicate rules are met, e‑signatures are considered the legally binding equivalent of handwritten signatures.
Do I need biometrics to comply? No. Non‑biometric signatures must use at least two distinct components (e.g., user ID and password). Biometrics may be used if controls ensure they cannot be used by anyone other than the genuine owner.
Are audit trails required for read‑only records? Audit trails are required for creation, modification, or deletion of regulated electronic records. Read‑only copies don’t require audit trails but must be accurate and complete.
Who is the system of record—the QMS or Parakeet? Customers decide. Many keep the QMS as the record system and use Parakeet for workflow orchestration, evidence generation, and consolidated audit logs linked back to the QMS.
How are time zones handled? Store audit timestamps in UTC with the local offset; display locale‑aware times in user interfaces and reports.
Can we keep spreadsheets in scope? Yes—when managed under controls (access, versioning, audit trail, and signature steps) as part of a governed workflow. See Features.
Does Parakeet “certify” our Part 11 compliance? No vendor can. Parakeet provides capabilities and evidence; compliance results from your validated implementation and SOPs.
How long must we retain records? Retention follows predicate rules (e.g., cGMP); Part 11 itself does not set retention durations.

References

21 CFR Part 11 — Electronic Records; Electronic Signatures (U.S. FDA, eCFR). Sections commonly cited: 11.10, 11.30, 11.50, 11.70, 11.100, 11.200, 11.300.
FDA Guidance for Industry: Part 11, Electronic Records; Electronic Signatures — Scope and Application (2003).
FDA Guidance: Data Integrity and Compliance With Drug CGMP Questions and Answers (2018).

Related Parakeet resources