Securing Regulatory Compliance: The Power of Digital Signatures

Digital signatures are proving valuable tools for businesses developing products for release in highly regulated sectors.

They are making it easy for companies to manage the approval and sign off process for complex medical devices and the like, while creating a clear and verifiable audit trail to prove GxP compliance.

This post explores how this functionality is improving transparency for regulators all over the world, while becoming part of a toolkit for smarter, more competitive business management.

But first, a definition:

What is a digital signature?

"A digital signature is an electronic signature based upon cryptographic methods of originator authentication, computed by using a set of rules and a set of parameters such that the identity of the signer and the integrity of the data can be verified." (FDA CFR Part 11)

In other words, a digital signature is like a fingerprint; it is unique to an individual. When you add your digital signature to a document, a trusted third party known as a Certificate Authority (CA) serves as notary and verifies your identity.

A 21 CFR Part 11 checklist: 7 key FDA e-signature requirements

The highest level of security and universal acceptance

Digital signatures work through Public Key Infrastructure (PKI) technology - they represent the highest level of security and universal acceptance for digital documentation. For example, a page of verifiable signatures can be added to the end of a PDF.  This will act as proof that the appropriate, authorised people have seen and approved the file.

In this way, a digital signature can guarantee every signer's identity and intent. It can add the date and time a signature was applied, further guarding against fraud or human error in the completion of documentation.

Once a document has been digitally signed, it cannot be tampered with; if the content of a file is changed in anyway, the signature will be invalidated.

Integrated into a DMS (document management system), digital signatures can help minimise document anarchy within an organisation, as well as proving necessary compliance procedures have been followed - reducing the risk of censure or fines from the bodies who oversee them.

FDA 21 CFR Part 11: US regulators embrace digital signatures

It may not be the snappiest abbreviation, but FDA 21 CFR Part 11, is of huge significance to  food and life science companies who do business in the US.

Part 11 of Title 21 of the Code of Federal Regulations (to give it its full title) was first published by the United States Food and Drug Administration (FDA) in 1996. Its 2007 iteration revolutionised the role of electronic records and electronic signatures (ERES) within these sectors.

These regulations did away with the onerous and outmoded requirement to submit and store hand-signed documentation related to products such as medical devices, launched in the US.

Now companies could satisfy the regulator of their compliance through the use of digital signatures.

But this was only part of a slew of regulations regarding electronic records that appeared with 21 CFR Part 11. The regulator required evidence of adherence to specific file formats, as well as record retention, security and data integrity best practice. In addition, they needed confirmation of companies' SOPs (Standard Operating Procedures) and assurances surrounding system validation.

The drive to standardise procedures and control many of these complex areas virtually through Document Management Systems, while sometimes burdensome, has also driven efficiencies and productivity.

It has allowed businesses to coordinate launch efforts from multiple locations around the world, helping them bring new products to market in the US and elsewhere more quickly and efficiently.

See how Cognidox can help you be ready for FDA compliance

Three ways digital signatures can help streamline your business

There are many ways a good DMS can support compliance through the integration of digital signatures while streamlining business processes. Here is a brief overview of what you should be looking for:

1. Managing documents requiring multiple signatories

• A good DMS should enable a document owner to request multiple signatures from key stakeholders to acknowledge they have had sight of and approved relevant documentation.
• It should allow email notifications to be sent out when signatures are required and notify document owners when approval is complete.
• All approvals required for a compliant product release should be handled quickly and virtually from one piece of software. Obviously, this is significantly less onerous than gathering ‘ink signatures' from a scattered workforce.

2. Creating verifiable audit trails

• Version control is key to any good business process, but being able to audit, properly, the changes a document has been through and the way it has been approved at each stage is often essential for regulators.
• Tamper-proof digital signatures within a DMS allow for complete data integrity as well as transparency and traceability in your product's development and release history.

3. Enhanced management features

• A high-quality DMS should support the creation and management of multiple signing certificates, including the ability to block users if security has been compromised.
• Signing certificates should require periodic renewal to ensure authorisation is still valid. In addition, an administrator should be able to ensure that signing can only occur from trusted locations.
• Full reporting rights should be present, including the ability to search for signed or unsigned documentation in the approval flow.
• Formatted signature pages should be able to be appended to documents, including a full version history together with notes added by any signatories.
• Enhanced features like this can help you keep tight control of the integrity of your processes, while also dramatically increasing efficiencies in the workplace.

For entrants to the US market, DMS software that properly integrates digital signatures is optimal for meeting FDA requirements. However, this functionality can help any organisation bring order to document anarchy and structure to complex approval processes.