21 CFR Part 11 is where 'approve by email' shops quietly fail — a typed name is not a signature

The CAPA that taught me what an email isn't

Two years ago I inherited a CAPA queue that included a finding from our prior notified body audit. The wording was polite but unambiguous: "The approval records for the post-market surveillance report could not be verified against a Part 11-compliant system." I went looking. The approval record was a four-message email thread. The approver had typed their name in a reply. The original report was an attachment that had since been edited and re-uploaded to the shared drive. The "signature" and the "record" had no binding I could demonstrate to an auditor — or to myself.

That's the trap. "Approve by email" feels rigorous. Someone wrote a name. Someone replied "approved." There's a date. It looks like evidence. Under 21 CFR Part 11, it isn't.

What Part 11 actually requires of an e-signature

When an electronic record is signed, Part 11 §11.50 and §11.70 expect a specific chain of controls. I keep this checklist taped to my monitor:

• Unique to one individual — never reused, never reassigned even after the person leaves
• Two distinct identification components (ID + password, or biometric)
• First-time signing requires identity verification against an authentic credential
• The signature must include the printed name, the date and time, and the meaning of the signature ("approved by," "reviewed by," "signed off")
• The signature must be permanently linked to the record so it can't be excised, copied, or transferred to another record
• The record itself must live in a closed system with a secure, computer-generated, time-stamped audit trail

That last point is where the email thread falls apart. An inbox is not a closed system. Attachments get overwritten. Threads get pruned. A reply-all "approved" doesn't bind to a specific file version. The auditor asks "show me what was approved on March 14" and you have to reconstruct it from server backups.

Why the email habit sticks around

I get why. Email is already in the workflow, it's already authenticated by SSO at most companies, and the approver's name is right there in the From: field. People genuinely believe the From: line is the signature.

It isn't. The From: line proves the email account sent the message. It doesn't prove the human at the keyboard:

• didn't fat-finger the reply
• was the actual role-holder for that approval
• was looking at the right version of the document
• intended the meaning the auditor is going to attribute to it

When I worked with our IT security counterpart on the CAPA, they pointed out the obvious risk I had been minimizing: an unencrypted inbox with a typed name in a reply is forgeable in about thirty seconds.

What compliant e-signature looks like in practice

In our environment (Class II, 200-person, mixed Class IIa/IIb work, implants), a Part 11 e-signature workflow does the following:

1. The approver logs into the QMS with their own credentials — not a shared mailbox, not a role account
2. The record opens at the version under review; version history is one click away
3. The signature action prompts for the second factor (password re-entry or token)
4. The system captures the user's printed name, the meaning ("Approved by"), and a server-side timestamp
5. The signature record and the document record are bound — you cannot edit one without breaking the link to the other
6. Any subsequent change triggers a new approval cycle

The approval record isn't an email you go find. It isn't a folder on a shared drive. It is the evidence. It lives in the same system as the document, with the same audit trail, on a record the auditor can open in under a minute.

Where qmsWrapper fits (and where I am not preaching)

We've been on Greenlight Guru for a few years. Earlier this year I spent a week in qmsWrapper for a side-by-side look. The Part 11 piece was the section I cared about most — specifically whether signing a controlled document produced a record I could demo to an auditor without screen-sharing my email. The signing event was bound to the document version, the meaning was captured, and the audit trail was one click from the record. That's the bar. I won't pretend that single check settled the migration question for us — it didn't — but the Part 11 surface passed the test I'd been failing for years in my own process.

I'm not here to say "switch to X." I'm here because the same finding keeps showing up in the same place: an email thread, a typed name, a missing audit trail. The fix isn't a tool. The fix is treating the signature as a record, not a message. Whatever QMS you run, the question to ask the vendor is the one I asked: when I sign, what exactly is bound to what, and can the auditor see the binding without leaving the record?

A question for the room

For those of you running Part 11 audits — internal or external — what is the most common e-signature gap you've cited recently? Is it still "approve by email," or has it moved on to something subtler like shared accounts, biometrics nobody enrolled, or signatures on records that were never opened? I'd like to know what I'm not yet seeing in our own shop.

Disclosure: I work on qmsWrapper.