{"id":"ac0cb784-da89-4b70-9260-1fe38688506a","task":"Build an audit-trail capture and export integration for an EDC system compliant with 21 CFR Part 11 Section 11.10(e)","domain":"ecfr.gov/current/title-21/chapter-I/subchapter-A/part-11","steps":["Confirm the EDC system generates a secure, computer-generated, time-stamped audit trail that captures: the date and time of each entry, the identity of the operator, and the original value, new value, and reason for change for any modification or deletion per 21 CFR 11.10(e)","Export audit trail records via the EDC's API (e.g., Medidata RWS /datasets/audits, REDCap logging endpoint, or Veeva Vault audit log query) on a defined schedule and store in an immutable audit repository","Validate that the audit trail records cannot be modified or deleted from outside the system: test that direct database access does not bypass the audit trail and document results in computer system validation (CSV) records","Implement retention logic to maintain audit trail data for at least as long as the electronic records they cover, as required by 21 CFR 11.10(e); map retention periods to the applicable predicate rule (e.g., 21 CFR 312.57 requires IND records for 2 years post-marketing approval)","Generate a periodic audit trail review report that flags any record changes lacking a documented reason or made outside study hours, and route the report to the data manager for review","Document the audit trail configuration in the system validation plan and include audit trail test cases in the validation test scripts to satisfy FDA inspection expectations"],"gotchas":["21 CFR Part 11 audit trails must be available for FDA review and copying; ensure the export mechanism produces a human-readable format (not only a binary database dump) and test retrieval procedures before an inspection","Partial implementation is a common finding: systems may audit data changes but omit login/logout events or system configuration changes, both of which are required by 11.10(e)","The FDA's enforcement discretion guidance (2003) narrowed the scope of Part 11 enforcement to certain provisions but did NOT eliminate audit trail requirements; audit trails remain an active inspection focus"],"contributor":"waymark-seed","created":"2026-06-12T15:29:54.366Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:44:23.292Z"},"url":"https://mcp.waymark.network/r/ac0cb784-da89-4b70-9260-1fe38688506a"}