This is a ready-to-use checklist. Replace every <<FILL: ...>> placeholder, mark each item Pass, Fail, or N/A with a reason, and route through your normal QA sign-off. Use it at go-live and again at every periodic review. A filled specimen follows.
Checklist
| # | Item | Pass / Fail / N/A | Evidence reference |
|---|---|---|---|
| 1 | A written Part 11 / Annex 11 assessment is on file for this system, mapped to the live version | <<FILL>> | <<FILL>> |
| 2 | Audit trail is enabled, its coverage is documented, and a defined risk-based review is actually performed and recorded | <<FILL>> | <<FILL>> |
| 3 | Every user has an individual account; no shared accounts exist; data and administrator roles are segregated | <<FILL>> | <<FILL>> |
| 4 | An account management procedure covers provisioning, password rules, periodic review, and prompt deprovisioning | <<FILL>> | <<FILL>> |
| 5 | Electronic signatures display full name, date/time, and meaning; two-component authentication is enforced | <<FILL>> | <<FILL>> |
| 6 | The one-time §11.100(b) FDA certification letter is on file | <<FILL>> | <<FILL>> |
| 7 | Backup, restore, retention, and archive retrieval have been tested across the record lifetime, not just at go-live | <<FILL>> | <<FILL>> |
| 8 | The system clock is controlled and synchronized to a trusted time source | <<FILL>> | <<FILL>> |
| 9 | A supplier assessment and quality/service agreement exists for any outsourced or hosted component (Annex 11 cl.3) | <<FILL>> | <<FILL>> |
| 10 | A periodic review procedure reassesses the system, including audit trail review, against changes since the last review | <<FILL>> | <<FILL>> |
Disposition
| Field | Entry |
|---|---|
| Number Pass / Fail / N/A | <<FILL>> |
| Any Fail blocks go-live unless formally risk-accepted with an interim control and a closure date | <<FILL: list any risk acceptances>> |
| Reviewer | <<FILL: name, date>> |
| QA approval | <<FILL: name, date>> |
Filled specimen
System: Manufacturing Execution System recipe module, v6.1. Reviewed at go-live gate, 18 August 2026.
| # | Item | Result | Evidence |
|---|---|---|---|
| 1 | Written assessment on file, mapped to live version | Pass | Assessment CSV-2026-088, matches v6.1 |
| 2 | Audit trail on, reviewed | Pass | Weekly recipe audit-trail review record, last review 15 Aug |
| 3 | Individual accounts, segregated roles | Fail | One shared “engineering” login used for recipe deployment |
| 4 | Account management procedure | Pass | IT-SOP-019 |
| 5 | Signatures, two-component | Pass | Test case TC-77 |
| 6 | FDA certification letter | Pass | On file with QA, filed 2022 |
| 7 | Backup/restore/retention tested | Pass | Restore test report RT-2026-014 |
| 8 | System clock controlled | Pass | NTP sync configuration verified |
| 9 | Supplier assessment/agreement | Pass | Current agreement, renewed 2026 |
| 10 | Periodic review procedure | Pass | QA-SOP-041, 24-month cycle |
Disposition. 9 Pass, 1 Fail, 0 N/A. Item 3 (shared engineering login) is risk-accepted for go-live with an interim control (the shared login is excluded from recipe approval rights, restricted to deployment only, with individual-account remediation due within 60 days). Reviewed by CSV lead, 19 August 2026. Approved by QA, 20 August 2026, with the interim control and closure date documented.
Common inspection findings this checklist prevents
- A go-live decision made without a documented pass/fail record against the baseline, relying on memory or an informal walkthrough.
- A Fail item quietly carried forward through periodic review after periodic review with no closure date ever set.
- Risk acceptance of a Fail item with no interim control specified, just a promise to fix it later.
How to adapt this checklist
- Use this exact list at go-live and again at every periodic review so results are comparable over time.
- Where an item is genuinely not applicable (for example, no supplier involvement for a fully in-house system), mark N/A with the reason rather than leaving it blank.
- Attach this checklist to the validation summary report or periodic review record it supports.