- Published
- Updated
- Sources checked
Reliable electronic signing depends on more than a signature image. Design identity verification, individual authority, signature meaning and linkage to the signed record together, then test the actual workflow rather than relying only on a vendor’s demonstration.
Verify the signer’s identity
21 CFR 11.100 requires an electronic signature to be unique to one individual and identity to be verified before assignment. Distinguish signing requirements from login requirements. Possession of an account does not demonstrate authority to approve a particular record or act in a particular role.
Define the meaning of the signature
Explain whether the signature means review, approval or acceptance of responsibility. Preserve required signature information and its connection to the record. The signer should understand which document version is being signed and the decision represented by the action before completing the workflow.
Test the lifecycle
Exercise account creation, role changes, access termination and document revisions. Observe what happens when signed content changes. Exported records should retain understandable signature meaning and relevant version information; include continued access in the archive as part of the assessment of the complete signing lifecycle.
- Separate identity verification evidence from signing authority.
- Display signature meaning against the relevant record version.
- Test role changes and revisions of signed records.
Prevent misleading practices
Shared accounts or another person’s credentials obscure individual accountability. Where delegation is needed, create a process in which the delegate uses their own identity and authority. Include assessment of the regulation’s certification provision concerning the legally binding nature of electronic signatures.
Frequently asked questions
- Is a signature image sufficient?
- The image alone does not demonstrate identity, meaning or linkage to the record.
- Can a delegate sign through another person’s account?
- Use an explicit authorized process with the delegate’s own identity rather than credential sharing.