Developing CFR Part 11 compliance flows

[muralidharan]

Hi Experts,

We are developing Document Approval workflow to comply with CFR 21 audits. CFR part 11 requires users to enter password while doing the review.

In technical terms we need to reauthenticate the user while approving / rejecting the flow. We have enabled MFA(Multi Factor Authentication) in our organization.

Question:
What is best way to achieve reauthenticating the user during the approval process ?

Please suggest

• Different ideas for developing compliance with CFR Part 11 in flows.
• Different ways to Reauthentication in Microsoft 365 / Power Platform.

Thanks,
Murali.

[Danna]

Hi Murali,

Thanks for the post.

I have one question, I develop a flow on Power Automate and will make some testes to assure is performing correctly, and we are questioning if should be a Verification or Validation, could you please help us to know if Power Automate is validated joined to Microsoft Tools? 

I really appreciate your support as soon as possible.

Regards,

Danna

[swathirajan]

Hi Danna,

The workflow testing performed by testers is considered as Validation.

It is a dynamic testing performed by testers / end users.

Whereas, Verification is static testing performed during development of the workflow such as unit testing.

Upon answering your question, I would like to state the example that I read in this site . 

-----------------------------

Imagine yourself going to a restaurant/diner and ordering maybe blueberry pancakes. When the waiter brings your order out, how can you tell that the food that came out is as per your order?

The first things are that we look at it and notice the following things:

Does the food look like what pancakes typically appear to be?
Are the blueberries to be seen?
Do they smell right?

Maybe more, but you get the gist right?

On the other hand, when you need to be absolutely sure about whether the food is as you expected: You will have to eat it.

Verification is all when you are yet to eat but are checking on a few things by reviewing the subjects. Validation is when you actually eat the product to see if it is right.

---------------------------

Please confirm if I have answered to your question.

-------------------------------------------------------------------------
If I have answered your question, please mark your post as Solved.
If you like my response, please give it a Thumbs Up.

[Danna]

Thank you very much Muralli, 

Have a great day, the information was very usefull.

[CRMKonrad]

Hello Murali,

I'm wondering the same thing you are about Approval Flows and how to comply with FDA/CFR Part 11 requirements.

I can't find a way to ensure a user is prompted for a password, or MFA challenge, at each approval.  Did you have any luck?

This is the only way to to comply with Subsection 11.200 (a)(1)(i), 11.200 (a)(1).  "When an individual
executes a series of
signings during a single,
continuous period
of controlled system
access, the first signing
shall be executed
using all electronic
signature components;
subsequent signings
shall be executed using
at least one electronic
signature component that
is only executable by, and
designed to be used only
by, the individual."

[muralidharan]

Dear @CRMKonrad ,

Nope, I couldn't find specific solution for this.

Thanks,

Murali

[muralidharan]

Hi All, 
I am happy to share that, I developed custom control (PCF) for Power Apps to implement the re-authentication. The workflow approvers will use the custom Power Apps to approve / reject the workflow instead of default approval pages / link.

Additionally we can enable, MFA (Multi-factor authentication) using Azure AD - Conditional Access Policy.

I will be writing a blog-post with all the steps and will be useful for others as well.

Thanks,

Murali.

[asavarid]

@muralidharan : You had mentioned that you will be writing a blog post with all the steps required for Part 11 compliance. Wanted to know if you have those documented somewhere. Would be very helpful to use.

[Rhorne06]

@muralidharan 

that is really great that you've found a solution! I'd also be very interested in your blog post, as I'm trying to implement a CRF compliant eTMF using SharePoint and Power Automate. 

[Vivienne]

Hi Murali,

I'd be interested in reading your blog post when it is available. I am working on a power apps solution that must be part 11 compliant.

Thanks!

Vivienne

[pauwelspiet]

Hi @muralidharan ,  a customer of mine is looking for a similar solution.  Would be great if you could share the link to your blog.  Tx !  Piet

[Light65]

Hi @muralidharan, 
I would be really interested in your solution for CFR 21 Part 11 compliance within Approvals flows, please can you pass this on.  

Many Thanks