Being asked to sign a SAT for a batch record system that fails Part 11
You are the lead automation engineer for a contract engineering firm commissioning Glacier Fabricant batch-record and electronic-signature functionality at a client's sterile fill plant. Two weeks before go-live, the client's quality manager asks you to sign the SAT protocol. During testing you found three things: the audit trail can be disabled by a shared "admin" account used by three technicians; the electronic signature is a single username and password with no second component; and the recipe approval step can be bypassed by editing the underlying SQL table directly. The plant manager calls the findings documentation nits, says a shipment worth USD 2.4 M is at risk, and notes that your firm's USD 180 k milestone payment is released on SAT signature. Your project manager suggests signing with an open-items list attached. Regulations in scope are 21 CFR Part 11 and EU GMP Annex 11. You hold the CAP credential.
1. What do you sign, and what do you refuse to sign? Put your position in terms of the specific regulatory requirements.
Read the worked answer
I sign the factual test record showing what was executed and what was observed. I do not sign the SAT as passed, and the open-items list is not a substitute for that refusal.
Why these are not documentation nits.
- Shared admin account that can disable the audit trail breaches 21 CFR 11.10(e) (secure, computer-generated, time-stamped audit trails) and 11.10(g) (authority checks limiting system access to authorised individuals). A shared account removes attribution entirely - you cannot tell which of three technicians did anything.
- Single-component e-signature breaches 11.200(a), which requires two distinct components for non-biometric signatures, and Annex 11 clause 12 on security. It is a design defect, not a configuration preference.
- Direct SQL edit bypassing recipe approval breaches the same access-control and audit-trail requirements and defeats the approval workflow the batch record depends on. Annex 11 clause 9 requires that audit trail data cannot be modified or deleted by the system owner.
What signing as passed would mean. My signature would assert that the system was tested against its specification and met it. The evidence says otherwise. Attaching an open-items list to a pass signature converts a known non-conformance into an accepted one; if the client then releases product on electronic records, my signature is part of the chain that permitted it.
Practical form. Issue a SAT report with the tests, the observed results, a numbered deviation list, and a clear statement that the protocol is not complete. That protects the client's ability to remediate and protects the factual record.
2. How do you handle the project manager's pressure and the milestone payment, and what is your escalation path?
Read the worked answer
Separate the two questions: is the system conformant (technical), and who decides whether to go live anyway (client management, on documented risk). I answer the first; I do not let the second be decided by silence.
Steps.
- Put the findings in writing the same day, addressed to the PM and copied to my firm's engineering manager and quality lead. Facts, clause references, test IDs, no adjectives.
- Meet the PM. Acknowledge the commercial pressure explicitly - it is real, and pretending otherwise makes the conversation adversarial. Then state that a signature I know to be false is not a commercial risk my firm can carry; if the client releases product and the records are later found non-conformant, the signature is the first thing examined.
- Propose the alternative the PM actually needs: a route that gets the plant running without my signing a false statement. That is a limited go-live with interim controls, or a paper-record fallback.
- Escalate to the client's Quality Director, not only the plant manager. In a GMP plant, QA owns the release decision; the plant manager does not. This is the correct escalation, not an end-run.
- If I am instructed to sign, request the instruction in writing. Do not refuse to document; document and refuse to sign.
On the milestone. Payment terms are a contract matter for my firm's management. I do not sign a technical document because it triggers an invoice. If the firm's position is that the milestone releases only on a passed SAT, that is a commercial dispute between the firms and should be handled as one.
Professional basis. The ISA code of conduct requires honesty in professional reports and holding public safety and welfare paramount. A CAP's value is precisely that the signature is not purchasable.
3. The client asks whether any limited go-live is defensible. What interim controls and remediation would you specify, and what conditions attach?
Read the worked answer
A limited go-live can be defensible, but only as a documented, time-bound deviation owned by the client's QA, and only if the electronic records are not relied upon for release until the defects are fixed.
Interim controls (must all be in place before any production run).
- Disable and delete the shared admin account. Issue named individual accounts with role-appropriate privileges. No shared credentials anywhere in the system.
- Re-enable and lock the audit trail. Administrative ability to disable it removed from every account including IT; any such capability held by a controlled, logged break-glass account.
- Remove direct database write access from all application and human users; recipe approval only through the workflow.
- Until the two-component signature is implemented, do not use electronic signatures for batch release. Fall back to paper with wet signatures, signed by QA, with a documented rationale.
- Add a QA second-person review of any record generated in the interim period, recorded as a specific procedural control.
Remediation plan with owners, dates and verification tests: two-component signature, audit trail hardening, access control redesign, plus a re-test of the recipe approval bypass.
Conditions. QA signs a formal deviation and risk assessment accepting the interim state; the go-live is limited to defined products or a defined period; a named person owns the remediation; and the SAT is signed as passed only after re-test evidence exists. If QA will not sign the risk acceptance, there is no limited go-live - the decision belongs to them, and that is the correct place for it.