21 CFR Part 11 in Environmental Monitoring: Software Functions vs. Procedures

The regulation is barely more than two pages long. For an environmental monitoring system, what is directly relevant is Section 11.10, “Controls for Closed Systems”: the system's data are electronic records, and a monitoring system is a closed system — access is controlled by the people responsible for the content of those records. The open systems section (11.30) does not apply, and the electronic signature sections (11.50, 11.70, and Subpart C) typically do not apply, because monitoring systems do not use electronic signatures for data review.

An important nuance: Part 11 does not apply to the system vendor — it applies to the regulated application and the firm responsible for it. The right question for a vendor is not “is your system compliant?” but “if we use your system, will we be able to operate it in a manner that is compliant with 21 CFR Part 11?”

The “procedures and controls” Section 11.10 requires come, in order of importance, from three sources: actions performed by the system user, functions built into the software, and services provided by the vendor. Most compliance activities rest on user procedures: validation guided by the firm's own procedures, access limits, training, written accountability policies, and control of system documentation.

The software is primarily responsible for the audit trail, operational checks that enforce event sequencing, authority and device checks, and generating accurate, complete, human-readable copies of records — the latter being one of the few requirements only software can fulfill. The vendor contributes services: standard IQOQ protocols and, in some regions, validation execution as a service.

Protecting records and keeping them retrievable throughout the retention period depends on software design. Vaisala's viewLinc system solves this in two ways: very small record sizes — data stays in the database, available for direct retrieval, instead of being exported to an external archive — and guaranteed backwards compatibility, so any future version of the software can open historical records.

Combined with the audit trail, access controls, encryption, and authority levels, that design leaves the user with what genuinely belongs to them: procedures, training, and policies — with the technical evidence generated automatically.