IRB Electronic Signature Requirements: What Part 11 Demands for Approval Letters

Most conversations about Part 11 and clinical trials focus on the sponsor, the CRO, or the site. The Institutional Review Board rarely comes up, even though the IRB's electronic records carry their own signature requirements, and they're not the same requirements that govern a signed protocol or a delegation log. IRB electronic signature requirements come from a different predicate rule, involve a different kind of decision-making record, and trip up eIRB systems in ways that generic e-signature checklists don't anticipate.

This guide covers what 21 CFR Part 11 requires when an IRB or ethics committee maintains its records electronically: which documents need signatures, how continuing review timing interacts with signature dates, why board votes need to be attributed to individual members rather than just the chair, and the specific gaps FDA finds when it inspects an electronic IRB system.

Why IRB Records Fall Under Part 11 in the First Place

Part 11 doesn't independently require that any particular record exist. It applies to records that another FDA regulation, a predicate rule, already requires. For IRBs, that predicate rule is 21 CFR Part 56, which sets out how an IRB must be organized, how it must review research, and what it must document. Once an IRB decides to keep its approval letters, meeting minutes, and continuing review determinations in an electronic system instead of on paper, Part 11 applies to those electronic records and to any signatures on them.

This is easy to miss because IRBs, especially academic ones, often think of their electronic systems as internal administrative tools rather than FDA-regulated systems. But if the research being reviewed is subject to FDA oversight (an IND, an IDE, or a study supporting a marketing application), the IRB's electronic records are just as much in scope as the sponsor's TMF or the site's regulatory binder. An FDA inspector who pulls a study file can and does request the IRB's approval documentation.

Which IRB Documents Actually Require Electronic Signatures

Not every IRB record needs a signature, but a few carry consistent requirements across institutions and eIRB platforms:

• Initial approval letters. The letter documenting the IRB's approval of a study needs a signature from an authorized IRB official, typically the chair or a designated IRB administrator, and that signature should be dated to match the meeting or expedited review date, not the date the letter happened to be generated.
• Continuing review determinations. For FDA-regulated research, continuing review has to happen at least once a year unless a shorter interval was set by the board. The signed determination needs a timestamp that falls inside that window. A signature dated after the review deadline is itself a finding, independent of whether the review content was adequate.
• Meeting minutes with the vote record. Under 21 CFR 56.115, minutes must document attendance, the vote (number for, against, and abstaining), and the basis for requiring changes when changes were required. Where minutes are captured electronically, the record needs to be attributable to whoever recorded and finalized it, with an audit trail showing whether it was edited after the meeting.
• Expedited review determinations. A single IRB member, often the chair, can approve minor changes or certain low-risk protocols without convening the full board. That member's signature on the expedited determination has to be individually attributable, not a shared or generic "IRB office" account.
• Roster and membership certifications. The IRB's membership roster, including qualifications and conflict-of-interest disclosures, is itself a record that supports the validity of every vote taken. When it's maintained electronically and requires sign-off on updates, that sign-off is in scope too.

The Vote Attribution Problem Is Specific to IRBs

Most Part 11 signature discussions center on a single signer approving a single record: a PI signing a protocol amendment, a CRA signing a monitoring visit report. IRB approval works differently. 21 CFR 56.108(c) requires review at a convened meeting where a majority of IRB members are present, including at least one member whose primary concerns are in nonscientific areas, and approval requires a majority of the members present at that meeting. The vote itself, not just the outcome, is part of the required record.

That creates a specific electronic signature design problem. An eIRB system that only captures the chair's signature on the final approval letter is documenting the outcome of the vote, but not the vote. If the chair's signature is the only electronically signed artifact, an inspector reviewing the record has no individually attributable evidence of who was present, how each member voted, or whether a quorum existed at all. The system needs to capture each voting member's participation and vote as its own signed or otherwise attributable event, tied back to the meeting record, even if the letter itself only carries one signature at the end.

A single-signer approval pattern, common in general-purpose electronic signature tools, does not by itself satisfy this requirement. The multi-member vote pattern, where the record of who voted which way matters as much as the final decision, needs to be designed for specifically, not assumed as a byproduct of a general approval workflow.

Continuing Review Timing and Why the Signature Date Matters

Continuing review lapses are one of the more frequent IRB-related findings in FDA inspections, and the electronic signature on the continuing review determination is where that finding usually surfaces. The requirement itself, that continuing review occur at intervals appropriate to the degree of risk but not less than once per year for FDA-regulated research, is set out directly in 21 CFR 56.109(f), consistent with the Common Rule framework most institutions also operate under.

The Part 11 angle is narrower but just as important: the signature (or equivalent electronic determination record) has to reflect when the review actually happened, and that timestamp has to come from the system, not from a date field a coordinator can adjust. If a continuing review determination shows a signature timestamp that's earlier than the actual review meeting, or if the date field can be backdated after the fact without an audit trail entry showing the correction, the record fails the same computer-generated, time-stamped audit trail requirement in Part 11 Section 11.10(e) that applies to any other clinical trial e-signature. Our guide on Part 11 audit trail requirements covers what that logging has to capture in more detail.

Retention: IRB Records Run on a Shorter Clock Than You'd Expect

21 CFR 56.115 sets IRB record retention at a minimum of three years after completion of the research. That's shorter than the retention periods most sponsors plan around for the rest of the trial record. Organizations building a single retention policy across the TMF, site records, and IRB records sometimes assume the longer investigator and site retention period (two years after NDA approval under 21 CFR 312.62, or 25 years under EU CTR 536/2014 for EU trials) automatically covers the IRB's obligations too.

It's a reasonable assumption in practice, since most institutions retain IRB records for longer than the regulatory floor anyway. But it's worth confirming explicitly with whatever eIRB platform is in use: ask how signed records are archived, whether the signature and its audit trail remain independently verifiable after the underlying system is upgraded or replaced, and who owns that archive if the IRB itself changes electronic systems mid-study.

What to Look For in an eIRB System's Signature Architecture

• Individual signature or attribution capture for each voting member, not just the chair or administrator
• Quorum and vote tally fields that are populated at the time of the meeting and locked afterward
• Two-component authentication at each signing event, not session-level login
• Timestamped continuing review determinations with an audit trail that flags any date correction
• Version-controlled approval letters that tie back to a specific meeting or expedited review record
• Retention and export capability that holds signed records independently verifiable past the three-year 56.115 floor

Klyverity's signing architecture was built for clinical research records specifically, which includes the multi-signer and role-based scenarios that IRB approval workflows need. It captures individually attributable signatures at each signing event, timestamps every action in an immutable audit trail, and keeps signed records independently verifiable for as long as your retention policy requires. If your institution or eIRB vendor is evaluating signature architecture, request a demo to see how it handles multi-member approval workflows.

FAQ

Does 21 CFR Part 11 apply to IRB records?

Yes, when those records are kept electronically. The predicate rule requiring the records is 21 CFR Part 56, which governs IRB organization, review procedures, and documentation. Once approval letters, minutes, and continuing review determinations move from paper to an electronic system, Part 11 applies to both the records and any electronic signatures on them.

Can one IRB chair's signature on the approval letter satisfy Part 11?

The chair's signature on the letter can satisfy the requirement for the letter itself, but it doesn't substitute for the vote record that 21 CFR 56.108(c) and 56.115(a)(2) require. The underlying meeting minutes need to separately document the quorum and how each member voted. An eIRB system should capture that vote as an attributable record even if the final letter carries a single signature.

How often must continuing review happen, and does the signature date matter?

For FDA-regulated research, continuing review generally has to occur at intervals appropriate to the degree of risk but not less than once a year, under 21 CFR 56.109(f). The electronic signature or determination record needs a system-generated timestamp that falls within that review window. A backdated or editable date field on the determination is itself a Part 11 audit trail gap, separate from whether the review content was sufficient.

How long must IRB records with electronic signatures be retained?

21 CFR 56.115 sets a minimum retention period of three years after completion of the research, which is shorter than the retention periods sponsors typically plan around for the rest of the trial record. Most institutions retain longer than this floor in practice, but it's worth confirming explicitly with your eIRB platform how signed records are archived and remain verifiable if the underlying system changes.