Guide

Signing every step at the bench: what an inspector can actually check

Published October 25, 2026

An inspector opens a study file and picks a step at random. Who did it? At what time? With which reagent lot, on which instrument? If the answer depends on someone's memory, the file proves nothing.

This page covers one narrow point: the electronic signature applied to each step, at the moment of the action, and what it lets you demonstrate under 21 CFR Part 11. It does not replace your validation. It describes what a record has to capture for bench execution to hold up in an inspection.

The end-of-day signature

At the hood you wear gloves, your hands are wet and a timer is running. You do not write. You jot on a scrap of paper, on the glove, or you remember. In the evening you reconstruct.

The file that comes out is tidy and probably accurate. But it was written afterwards. For an inspector, the gap between "accurate" and "demonstrable" is the whole question.

US GLP requires data to be recorded directly and promptly, each entry dated on the day of entry and signed or initialed by the person entering it; for automated systems, the person entering data must be identified at the time of input (21 CFR 58.130(e)). One signature at the end of the day over a run of steps drifts away from that.

What §11.50 asks of a signature

§11.50 is about what a signature must show. An electronically signed record has to display the signer's printed name, the date and time of signing, and the meaning of the signature (review, approval, responsibility, authorship). Those items fall under the same controls as the record and appear in its human-readable form.

At step level it works like this: the operator does not sign "a page". They sign "I performed step 14", and the record keeps their name, the moment, and what that act means.

What we state: each step is signed by the authenticated operator at the time of execution, with the reagent lot and equipment used. Do all three §11.50 elements show on screen and in the readable export? That is the question to put to any vendor, us included.

A signature with no name, no time and no meaning proves nothing.

The step, not the study

A single signature on the whole study says "I approve the result". It does not say who pipetted, or with what.

A signature per step ties a person to an action, a lot and an instrument. If a reagent lot turns out to be bad, you find the steps that carry it without rereading notebooks.

The limit is clear. A signature shows that an authenticated person declares they performed the step. It does not show the action was done well. That is the job of the declared deviation, with its category (missed step, order, parameter, timing, sterility, reagent, equipment, safety, other), and of the step that requires a photo: until it is attached, validation is refused.

The wider the signature, the less it proves.

What breaks at the bench

The network drops. The workstation keeps recording and resynchronizes on its own. The next question is the clock: which one counts? The release notes state that the reception time of steps is set by the server. How an offline workstation's clock behaves belongs in your validation documents.

A mistake is entered. In the record, every correction carries its audit entry, and a recorded correction cannot be rewritten. The trail is append-only, timestamped and SHA-256 hash-chained, so tampering shows. §11.10(e) asks for a secure, computer-generated, time-stamped audit trail, and that record changes do not obscure previously recorded information.

Another limit. A hash chain reveals alteration. It does not stop a wrong value from being entered in the first place. That is what the signature, the deviation and QA review are for.

What a signature does not settle

It does not validate the system. Computerized system validation remains each organization's responsibility. Biotraxion provides the technical traceability building blocks and the material to carry it out.

It does not replace staff training or account management. Part 11 also asks for adequate training (§11.10(i)), signatures unique to one individual (§11.100) and controls on identification codes and passwords (§11.300).

It does not pick your framework. Depending on your sponsors and authorities, you work with Part 11, Annex 11 or OECD GLP Advisory Document no. 17, Application of GLP Principles to Computerised Systems (2016, revised 2022). These three texts address related subjects (computerised systems, data integrity), each within its own framework. None of them comes down to a signature.

Five questions for any system

Who signed, and how were they authenticated at that moment?
What does the signature mean, and where do you read it in the export?
Which time counts, the workstation's or the server's, and what happens offline?
What happens to a correction: does the old value stay readable?
Can a third party verify the file without taking your word for it?

For the last one, our answer is the Audit Pack: approved protocol, signatures, deviations and hash-chained audit trail, exported in one click as a sealed deliverable your sponsor and your inspector can verify.

See where your current record loses the trail

We show a sample Audit Pack and go through where your current records lose the trail: contact@biotraxion.com, or request a pilot from the home page. Product changes are dated in the release notes.

Keep reading

← Back to home