21 CFR Part 11 is the FDA regulation — codified at eCFR Title 21, Chapter I, Subchapter A, Part 11 — governing electronic records and electronic signatures for every FDA-regulated industry. If your lab or manufacturing site keeps GxP records electronically instead of on paper, Part 11 is the rulebook for how those records have to behave.
The audit trail requirement: §11.10(e)
The clause that matters most in practice is §11.10(e): it requires "secure, computer-generated, time-stamped audit trails to independently record the date and time of operator entries and actions that create, modify, or delete electronic records." Critically, the regulation states record changes "shall not obscure previously recorded information" — meaning the trail has to survive intact even after a record is edited, and it has to be retained at least as long as the record itself, available for FDA review and copying on request.
The most common 483 finding
Shared login credentials are cited as the single most frequently cited ALCOA+ violation in FDA 483 observations — because a shared account makes it impossible to attribute an action to a specific individual, defeating the entire purpose of an audit trail.
Electronic signatures: Subpart C
Subpart C governs signatures specifically. Every electronic signature must be:
- Unique to one individual — never reused or reassigned to someone else, ever.
- Linked permanently to its associated record — a signature can't float free of what it signed.
- Accompanied by the signer's printed name, the date and time of signing, and the meaning of the signature (e.g. "reviewed by," "approved by").
For non-biometric signatures, §11.200(a)(1) adds a second layer: two distinct identification components are required — typically an active, authenticated session plus a fresh password re-entry at the exact moment of signing. This is why a well-built system asks for your password again when you approve or release a record, even though you're already logged in.
Does Excel comply with 21 CFR Part 11?
Not on its own. Excel's Track Changes feature is optional, can be disabled by anyone with edit access, doesn't reliably tie changes to an authenticated individual, and produces no tamper-evident record. Some organizations attempt narrow validation of specific calculation-only spreadsheets for a defined purpose, but as a system of record for GxP data — the thing an inspector actually asks to see — an unmodified spreadsheet doesn't satisfy §11.10(e)'s audit-trail requirement or the access-control expectations that go with it.
Why this matters beyond the checklist
Data-integrity deficiencies show up in the majority of FDA GMP warning letters. Part 11 isn't an abstract IT requirement — it's the mechanism that lets a company prove, on demand, that a record hasn't been quietly altered. A hash-chained audit trail (where each entry's integrity depends cryptographically on the one before it) goes further than the bare regulatory minimum: it makes tampering independently detectable, not just prohibited by policy.
Ready to see this in your own lab? Book a free ValiCore demo.