Biotech briefing · 30 minutes · no demo
The Part 11 & IP Gap Review
Where your compound and clinical data actually lives, measured against the Part 11 record controls. You leave with a one-page gap map for submission prep or a partner audit.
- Compound or clinical data has left your ELN and you can't say where it went
- You have a submission or a partner audit on the calendar this year
- A CRO sent results back and their audit trail didn't come with them
No demo. No follow-up sequence unless you ask. The map is yours either way.
Biotech briefing · worksheet
Part 11 & IP Gap Map
A working artifact from your 30-minute diagnostic session
- 01The second copy
- 02The external hop
- 03Evidence you can produce
- 04Signature and identity
01 · The second copy
Which regulated files sit outside your systems of record?
02 · The external hop
How many CROs and CDMOs, through how many mechanisms?
03 · Evidence you can produce
Who accessed a record, whether it changed, and how fast you'd know.
04 · Signature and identity
Cryptographically bound to a person, or a typed name?
Teams that treat the exposure work and the Part 11 work as two projects buy the controls twice — once to close the exposure, again when submission prep starts. Finding out which one you're facing is usually worth more than the map itself.
What you leave with
The artifact is yours to use regardless of whether you ever work with us — which is why the blank worksheet is a download, not a form.
- A one-page gap map in two halves: where your regulated data and IP actually sit, and how your external exchange and signature workflow measure against the Part 11 record controls (§11.30, §11.10(d) and (e), §11.50/§11.70, §11.300).
- An honest separation of which gaps are a tooling problem and which are a process problem — the second kind no vendor can sell you out of.
- A clear answer to the sequencing question: whether your exposure work and your Part 11 work are one project or two.
- Language you can reuse with a partner auditor or an investor asking how you handle sensitive data externally.
The four questions we work through
The first two questions are about your IP. The last two are about what Part 11 asks you to produce. We run them together because the answers overlap more than most teams expect — but they are different questions, and we don't dress the first two up as regulatory ones.
01
The second copy
Which files containing compound, formulation, or clinical data currently sit outside your systems of record — in mailboxes, SharePoint, OneDrive, or shared drives? Could you produce that list today, or is it mostly trust?
A good answer looks like: A real answer about where the copies went, or a clear-eyed "we couldn't produce that list". Both are useful; only one of them is a surprise later.
An IP question, not a regulatory one — Part 11 has nothing to say about where a file is hosted.
02
The external hop
How many CROs, CDMOs, and sites do you exchange data with, and through how many different mechanisms? When data comes back from a partner, does their audit trail come to you, or do you have to request it?
A good answer looks like: You can name the mechanisms and say, per partner, whether the audit trail arrives with the data or has to be chased.
§11.30 (open systems): records moving through environments you don't control must hold authenticity, integrity and confidentiality from creation through receipt.
03
Evidence you can produce
If an inspector or a partner auditor asked today, what could you show for who accessed a given record and whether it has been altered since — and how long would assembling that take?
A good answer looks like: A named system, a real production time, and an honest account of which half of the question it can't answer.
§11.10(d) and §11.10(e) in practice.
04
Signature and identity
Where are electronic signatures applied in your workflow, and are they cryptographically bound to a verified individual or captured as a typed name? Worth confirming which tier of your current e-signature contract actually includes Part 11 — at the major vendors it sits behind an enterprise agreement.
A good answer looks like: You know which tier you're on and what it includes. A surprising number of teams discover the Part 11 module was never in their contract.
§11.50, §11.70 and §11.300.
The three outcomes
Across the four answers, biotech teams usually land in one of three places. All three are useful; only one of them is a project.
You're fine
You're further along than you thought
The systems of record are tight and the external exchange is already governed. You leave with a map that documents it — useful evidence in its own right for a partner audit or an investor's diligence questionnaire.
Worth pressing
A sequencing problem
The exposure work and the Part 11 work turn out to be the same work. Teams that treat them as two projects buy the controls twice — once to close the exposure, again when submission prep starts. Knowing that early is usually worth more than the map.
There's work
A gap with a date on it
There is a real gap and a submission or partner audit on the calendar. The map becomes a scoped list with a sequence, and you can decide honestly whether it is a this-quarter problem or a next-one.
Before you book
- Is this a sales call in disguise?
- No. We don't show you MnemoShare unless your own answers surface something that maps to what we do — and even then, only if you ask. If the session ends with us telling you your current stack is fine, that's a normal outcome and we'll say so plainly.
- What if we're happy with our incumbent?
- Then you leave with a documented, dated artifact saying so — which is useful evidence in its own right for a board, an auditor, or a diligence questionnaire.
- Can I just have the worksheet without the call?
- Yes — the download is right there, no email required. It's designed to be self-serve. The session mostly saves you time and adds an outside read on your answers.
- Can MnemoShare make us Part 11 compliant?
- No — and any vendor who says otherwise is worth a second look. No software is "Part 11 compliant": compliance is a property of your validated process, not a product you buy. MnemoShare maps to the Part 11 technical controls and produces the evidence; your validated process owns the certification. We are direct about this because your QA function will be.
- Half of this doesn't sound like Part 11 at all.
- Correct, and we label which half is which. Part 11 governs electronic records and signatures — it says nothing about where a file is hosted. So questions one and two are about protecting your IP, and questions three and four are about what the regulation asks you to produce. The clause that does reach data leaving your control is §11.30, and it applies at the CRO hop, not to your storage choices.
- Will you show us the product?
- Not unless your gap map surfaces something that maps to what we do, and even then only if you ask. The map is written to hold up against whatever you are running today, including nothing.
The exposure work and the Part 11 work are usually the same work. Most teams pay for it twice.
Thirty minutes, four questions, and a one-page gap map that tells you whether you're facing one project or two — before submission prep decides for you.
No demo. No follow-up sequence unless you ask. The map is yours either way.