21 CFR Part 11 for Flow Cytometry Analysis: What the Software Owes You, and What You Owe the Auditor

QA has flagged a release record, and it is a 21 CFR Part 11 question. The CD3+ purity for the lot was re-gated after the first analysis, and the only evidence is two PDFs with two different numbers. The auditor is not asking whether the second gate was right. They are asking who moved it, when, from where to where, and why — and whether your system can answer without relying on anyone’s memory.

That is what the 21 CFR Part 11 audit trail requirements are for. This post covers what they ask of flow cytometry software, and which half of the job no software can do for you.

What 21 CFR Part 11 requires of a flow cytometry audit trail

Part 11 has been in effect since August 20, 1997. For closed systems, § 11.10(e) requires “secure, computer-generated, time-stamped audit trails to independently record the date and time of operator entries and actions that create, modify, or delete electronic records.” Record changes must not obscure what was recorded before, and the audit trail must be kept at least as long as the record it covers.

The regulation does not say what an entry should contain. FDA’s December 2018 guidance, Data Integrity and Compliance With Drug CGMP, gives a chromatography example. An HPLC audit trail should include “the user name, date/time of the run, the integration parameters used, and details of a reprocessing, if any,” with a documented justification for the reprocessing. Translated to flow analysis:

The rest of § 11.10 sets the surrounding controls: validation (a), accurate and complete copies (b), record protection for the retention period (c), limited system access (d), operational sequence checks (f), authority checks (g), device checks (h), trained personnel (i), written accountability policies (j) and documentation controls (k). Signed records must show the signer’s printed name, the date and time, and the meaning of the signature, such as review or approval (§ 11.50). The signature must be linked to its record so it cannot be copied onto another (§ 11.70). A non-biometric signature needs at least two distinct identification components, such as an ID code and a password (§ 11.200).

What the software owes you

These are the technical controls you can test during vendor evaluation. Ask the vendor for a clause-by-clause Part 11 compliance matrix — De Novo Software, BD Biosciences and Bio-Rad, for example, publish Part 11 documentation for their flow cytometry software. Then check it against these points:

• Gate-level granularity. An audit trail that logs only “analysis file saved” cannot reconstruct a re-gate. You need entries for each gate edit, compensation change and template application, with before and after values.
• No one can edit or delete entries, including administrators. Ask how an administrator account is prevented from purging the audit log, and whether the attempt itself is logged.
• A reason prompt at the time of change. The FDA guidance expects change justification as part of the record. A free-text field filled in a week later fails the contemporaneous test.
• Raw data integrity. The FCS file is the primary record. Ask whether the system stores a checksum of each data file and verifies it on open, so a modified file is detected rather than silently analysed.
• Retention and export. The audit trail must be readable and exportable for the full retention period of the record, including after a software upgrade.
• Signature manifestation. Printed name, timestamp and meaning appear on the human-readable output, not only in a database field.

What you owe the auditor

No flow cytometry package is “Part 11 compliant” out of the box. Compliance belongs to the system as validated and operated, and these steps are yours:

1. Validate for your intended use. FDA’s 2003 guidance, Part 11 Scope and Application, asks for a risk-based decision on whether and how far to validate. For a flow release assay, that usually means a locked set of reference FCS files with expected statistics, re-run on every software version. The same discipline as checking a batch template against a test set before locking it, written into a protocol.
2. Write the re-gating SOP before you need it. Define when a gate may be adjusted after the first analysis, who can approve it, and what the reason must say. FDA’s data-integrity guidance requires a “valid, documented, scientifically sound justification” to invalidate a result, and the original data stays in the record either way.
3. Review the audit trail with the record. FDA expects whoever reviews the data to review the audit trail alongside it, at the same frequency — before batch release when the predicate rule requires review before release.
4. Keep the dynamic record. FDA distinguishes static records (paper, an image) from dynamic ones that can be reprocessed, and gives an FT-IR spectral file as an example where a printout is not an acceptable true copy. An FCS file plus its analysis file is dynamic in the same sense; a PDF of a dot plot is not a substitute.
5. End shared logins. “Attributable” is the first letter of ALCOA in the 2018 guidance. A shared “FACS user” account on the acquisition PC makes every entry unattributable, however good the audit trail.

Where flow labs usually fall short

The software is rarely the weak link. The gaps tend to sit between systems:

• The spreadsheet step. Statistics are exported to an unvalidated spreadsheet where the release value is calculated — viable CD3+ count times dose volume, for example. FDA’s guidance names spreadsheet formulas as dynamic data that can be changed. If the number that goes on the certificate is computed there, the audit trail stops one step too early.
• Transfer between acquisition and analysis. The cytometer runs in a controlled mode, then FCS files are copied by USB stick to an analyst’s workstation. Every file move needs to be controlled and verifiable, which is the same problem as workspace files breaking in transit between labs, with a regulator watching.
• Template drift. A gating template validated on one instrument gives different results after a laser or detector service. Instrument changes should trigger change control on the analysis method, not just the cytometer.
• Misreading enforcement discretion. The 2003 guidance says FDA intends to exercise enforcement discretion on Part 11’s own validation, audit-trail, copy and retention requirements. Predicate-rule requirements still apply, and the 2018 guidance expects audit trails of CGMP data to be reviewed. Discretion over one clause is not an exemption from keeping a reconstructable record.

When Part 11 does not apply to your flow data

Part 11 covers electronic records kept under FDA record requirements (the predicate rules) and records submitted to the agency. Exploratory work — panel development, titration, assay optimisation before a method is locked — is generally outside it, as long as those files are never used to meet a predicate rule. Once a dataset supports a release decision or a regulatory submission, it is in scope, and so is everything used to produce it.

That boundary is where Cytomaton sits. Cytomaton is research-use-only software and is not 21 CFR Part 11 compliant, so it does not belong in a release-testing workflow. It fits the assay-development stage before that — building and stress-testing the gating strategy and checking how much your analysts disagree on the same files — before the locked method moves into your validated system.