21 CFR Part 11 Compliance when selecting a new ERP System
Updated: Oct 10
Choosing an ERP for a validated environment? If you run a regulated or multi-site company and need a full selection program — requirements, RFP, scripted demos, decision — rather than a quick answer, see how our life-sciences ERP selection program works, or talk to John.
Understanding the configuration and implementation requirements associated with 21 CFR Part 11 is an important part of ERP software selection for life sciences organizations. The regulation, formally titled Electronic Records; Electronic Signatures, establishes requirements for electronic records and electronic signatures used in FDA-regulated environments.
When selecting a new ERP system, the evaluation needs to go beyond confirming that the software includes Part 11 capabilities. Organizations need to understand how those capabilities will be configured, validated, maintained, and applied to the business processes and electronic records that fall within the regulated environment.
An ERP system used for regulated processes needs to support the controls required for the organization's intended use. That can include access controls, electronic signatures, audit trails, record integrity, data accuracy, and the documentation needed to support validation. How those capabilities are configured and applied is just as important as whether they exist in the software.
Questions to ask during an ERP Selection on 21 CFR Part 11 Compliance
Ask the ERP vendors as part of an ERP Software Selection specific questions about how the system supports compliance with 21 CFR Part 11. Start with Validation. You want to understand how a new ERP system supports Validation activities, what documentation they supply, and how upgrades are handled without breaking your Validated state.
Validation support and documentation
What validation documentation do you provide out of the box, such as requirements mapping, test scripts, and evidence templates?
What parts of the solution are pre-validated by you, and what parts must be validated by us based on our configuration and business processes?
How do you support validation for updates, patches, and new releases, and what is your recommended approach for regression testing?
Can you provide sample validation deliverables from similar regulated clients, with sensitive details removed?
User authentication and account security
How are users authenticated, and what options exist for multi-factor authentication and single sign on?
What are your password policies, lockout rules, and session timeouts, and can we configure them?
How do you prevent shared logins, and how do you handle service accounts or integrations that require access?
Access controls and permissions
How are roles designed and enforced across modules, and can you demonstrate least privilege access in practice?
Can you restrict access by site, department, product line, or transaction type?
How do you handle segregation of duties, and what tools exist to detect or prevent conflicts?
Can you report on who has access to what, and provide an access review report for audits?
Electronic records integrity
How do you ensure records cannot be altered without detection, including attachments and linked records?
What controls prevent unauthorized edits, deletions, or overwrites?
How is system time managed, and how do you ensure timestamps are reliable and consistent across environments?
Data integrity and accuracy controls
What controls exist to enforce complete and accurate data entry, such as required fields, controlled values, and validation rules?
How do you manage corrections, rework, and exceptions so the history remains clear and audit ready?
What checks exist to detect duplicate records, missing values, or out of range entries?
How do integrations protect data integrity when records move between systems?
Electronic signatures
Where are electronic signatures used in the system, and which transactions support signature approval workflows?
What does a signed record show, such as signer name, date and time, and the meaning of the signature like approval or review?
Does signing require re-authentication at the moment of signing?
Can you enforce dual approvals when needed?
Can you demonstrate how a signed record is locked and how changes are handled after signing?
Audit trails
What events are captured in the audit trail across the system, including create, change, delete, and approval actions?
Does the audit trail capture before and after values and the reason for change when required?
Who can view audit trails, and can anyone modify them?
How long are audit trail records retained, and can we export them for inspections?
Data retention and record retrieval
What retention options exist for regulated records, including how long data is stored and how it can be archived?
Can the system place records on legal hold or prevent deletion based on record type?
How quickly can you retrieve records, audit trails, and signature history during an inspection?
What reporting or export tools exist for producing audit ready evidence?
Security monitoring and incident response
What logging exists for security events like failed logins, permission changes, and unusual access patterns?
Do you provide alerts or monitoring integrations for security events?
What is your incident response process, and how are customers notified of security events that may affect regulated records?
Vendor responsibilities and your responsibilities
Which controls are managed by the provider and which controls are our responsibility to configure and operate?
What standard operating procedures do you expect customers to have in place to stay compliant, such as access reviews, training, and change control?
Can you provide a clear shared responsibility summary we can include in our compliance documentation?
Treat these questions as a qualification gate, not a check-the-box exercise. An ERP partner should be able to demonstrate how controls work in the exact workflows you will use, not just describe features in general terms. Ask for a guided walkthrough using realistic scenarios such as quality event approvals, batch record review, controlled document release, deviations and CAPA actions, master data changes, and any transaction that requires review and sign off. The goal is to see how records are created, how changes are controlled, how signatures are applied, and how the system proves who did what and when.
Why life sciences companies choose John Hannan LLC
Life sciences teams often need more than a software provider. They need a client-side ERP advocate who can translate regulatory expectations into practical system design, keep decisions grounded in real operations, and protect the program when timelines and budgets get tight.
John Hannan LLC brings deep experience supporting regulated life sciences environments where quality, traceability, and inspection readiness are non-negotiable. We help teams define clear requirements, pressure test vendors and implementation partners, and align workflows across quality, operations, IT, and finance so the solution fits the business and holds up under audit.
We also help architect and manage 21 CFR Part 11 controls across most major ERP platforms, including electronic signatures, audit trails, access controls, and data integrity safeguards. The focus is simple. Build a defensible path to a Validated state, maintain it through upgrades, and reduce reliance on manual workarounds that increase risk over time. If you are planning an ERP selection in a Part 11 environment, talk to John about your ERP program.
