octoplant and 21 CFR Part 11: Audit Trails, Annex 11 and GxP Change Control

The octoplant 21 CFR Part 11 question usually arrives from a quality or validation lead: if the plant uses AMDT’s platform to manage PLC, HMI and robot programs on GMP equipment, does its audit trail satisfy the FDA, and what else does the plant have to do? The short answer is that octoplant supplies an audit trail and controlled versions that support Part 11 and EU Annex 11 controls, and that the plant still validates the installation, owns the change control procedure and reviews the records. This page sits under the octoplant compliance overview, part of the AMDT cluster.

What 21 CFR Part 11 actually asks

Part 11 applies to records that an FDA predicate rule requires, when those records are kept electronically, and to electronic signatures applied to them. Since FDA’s 2003 Scope and Application guidance, the agency has read it narrowly and focused on risk. The controls that matter here sit in section 11.10:

• Validation of systems to ensure accuracy, reliability and the ability to discern altered records
• Protection of records so they can be retrieved accurately throughout the retention period
• Limiting system access to authorised individuals, with authority checks
• Secure, computer-generated, time-stamped audit trails recording the date and time of entries and actions that create, modify or delete records. Changes must not obscure what was recorded before, and the trail is kept as long as the record
• Written policies holding individuals accountable, and controls over system documentation, including revision and change control

Subpart C then governs electronic signatures: the signer’s name, date and time and meaning shown with the record, and the signature linked so it cannot be copied to another record.

For drug manufacturers, the predicate rule that pulls control logic into scope is usually 21 CFR 211.68, which requires controls so that changes to computer-related systems are made only by authorised personnel, and requires backup of data entered into those systems. For a PLC running a granulator or a CIP skid, that is a direct reason to version and back up the program. The batch record side of the same problem, where MES carries the traceability, is covered in our article on quality, MES and traceability compliance.

What octoplant’s audit trail covers under 21 CFR Part 11

AMDT describes octoplant’s audit trail as recording “who changed what, when, where, and why” (about octoplant). Its pharma page frames the evidence as “configuration histories, attributable changes, timestamps, and controlled versions,” and puts the relationship to validation neatly: “Validation establishes the state. Version control helps you protect its history.”

In practice, a change made through the check-in and check-out cycle produces:

• the user who checked the project out and back in
• the time of each action
• the device or project affected and the new version created
• a comment giving the reason, if the procedure makes it mandatory
• an approval step, where approval workflows are configured

A change made outside that cycle, directly from a laptop, appears at the next scheduled compare as a difference between the running program and the approved version. That is detection, not attribution: octoplant can prove that the program changed and what changed, but not who changed it.

octoplant and 21 CFR Part 11 themes: tool versus plant

Part 11 / Annex 11 theme	What octoplant can contribute	What remains the plant’s responsibility
Validation (11.10(a), Annex 11 §4)	IQ/OQ services from AMDT; a configurable, documented product	URS, risk assessment, PQ, traceability matrix, validation report
Audit trail (11.10(e), Annex 11 §9)	Attributed, time-stamped version and change history	Reviewing the trail; deciding which events are GMP-relevant
Record protection and retention (11.10(c))	Central repository of every version	Server backup, retention period, archive and retrieval tests
Access control (11.10(d), (g))	Users, roles and permissions	Joiner-mover-leaver process, periodic access review
Change control (11.10(k), Annex 11 §10)	Approved-version model, approval workflows, compare	The change control SOP, impact assessment, QA approval
Backup and restore (211.68, Annex 11 §7)	Scheduled device backups, known-good versions	Proving restorability periodically on real equipment
Electronic signatures (Subpart C)	Not confirmed publicly; ask AMDT	Signature policy, certification to FDA, or a paper signature route

GxP change control, and where the tool fits

An illustrative case. A validation engineer reviewing a tablet press line pulls the change record for a modified reject timer. The eQMS shows QA approval on Tuesday. The octoplant history shows check-in on Monday. The tool did its job; the sequence shows the change was made before it was approved. That finding comes from comparing two records, which is why both must exist and reference each other. Detection of out-of-cycle edits is covered on the change detection page.

EU Annex 11 and the octoplant GxP picture

EU GMP Annex 11 asks for broadly the same controls in different words. The clauses that touch a change management tool most directly are §7 (regular backups, with integrity and restorability checked during validation and monitored periodically), §9 (a risk-based audit trail of GMP-relevant changes and deletions, with the reason documented), §10 (changes made under a defined procedure), §11 (periodic evaluation) and §16 (business continuity). AMDT’s pharma material also cites GAMP 5, ICH Q12 and data integrity under ALCOA+ (AMDT pharma use case). The European Commission consulted on a revised Annex 11 from July to October 2025, alongside a new Annex 22 on artificial intelligence. The draft strengthens the expectations on audit trails, supplier oversight and security, so check which text is in force before a validation plan is approved.

The versiondog history matters for installed sites. AUVESY’s versiondog had a GxP Edition. With versiondog in its end-of-life phases, now consulting only to the end of 2026 (becolve), we found no public confirmation of an equivalent named GxP edition of octoplant. AMDT positions its Premium edition for “regulated or large sites” (pricing) and lists IQ/OQ services among its offerings. A plant migrating from a validated versiondog installation faces a revalidation, and the migration page covers the mechanics.

What validation still requires from the plant

octoplant is typically a configurable commercial product, which GAMP 5 would usually place in Category 4. Whether a site follows traditional computer system validation (CSV) or the risk-based Computer Software Assurance (CSA) thinking FDA has published, the plant owns:

1. User requirements stating what the tool must do for this site, including which devices are in scope
2. A risk assessment that decides how much testing each function needs
3. Supplier assessment of AMDT, where its ISO 9001 and ISO 27001 certificates help
4. Performance qualification on the plant’s own equipment, including at least one real restore
5. SOPs for change control, backup review, alert handling, access management and periodic review
6. Training records for engineers, approvers and administrators
7. Revalidation triggers for octoplant upgrades, which arrive regularly (105 in 2025, 107 in 2026)

Where it gets hard

• Electronic signatures. AMDT’s public pages do not say whether approvals inside octoplant meet Subpart C. Many sites keep the signed approval in the eQMS and treat octoplant’s approval as a technical gate. Decide which, and write it down.
• Audit trail review. Annex 11 and FDA data integrity guidance expect audit trails to be reviewed, not just kept. Define who reviews what, and how often.
• Integrator access. Contractors commissioning new equipment often work outside the tool. Build check-in into the acceptance and handover requirements, so the first approved version is the one that was qualified.
• Time and identity. Audit trail timestamps are only as good as the server clock and the shared accounts that should not exist.

An independent owner’s engineer can write the URS and test the supplier claims before purchase. Across the cluster, see octoplant, NIS2 and IEC 62443 for the security view, and pharma and life sciences for the industry context.