Question 7 of 20 Fundamentals Concept
What controls must an EDC system have to be trusted for trial data?
Short answer
An electronic data capture (EDC) system needs validation for its intended use, access limited to authorized and trained users, a secure computer-generated audit trail that never obscures earlier values, reliable timestamps, and the ability to produce complete readable copies. In the US these come from 21 CFR Part 11, and in the EU from EMA's 2023 guideline on computerised systems in clinical trials.
Why
The point of the controls is that a regulator can trust a record without seeing paper. 21 CFR 11.10 lists them for closed systems: validation, accurate and complete copies, protection of records through the retention period, limited access, time-stamped audit trails that record who created, changed or deleted data, operational and authority checks, and trained users. The audit trail must be kept as long as the records.
FDA's October 2024 question and answer guidance on electronic systems in clinical investigations explains how this applies to EDC and other tools and supports a risk-based approach to validation. The EU has no Part 11. EMA's GCP inspectors' guideline on computerised systems and electronic data, adopted in March 2023, sets similar expectations, including timestamps in coordinated universal time (UTC) or with the time zone, users unable to change the device clock, and individual accounts.
E6(R3) section 4.3 says the same in general terms. A practical example: a shared 'site' login defeats attributability, however good the audit trail is.
A strong answer covers
- Validation for intended use
- Unique accounts, access control and training
- Audit trail that keeps prior values and is retained with the data
- Unambiguous timestamps
- US Part 11 versus EU EMA guideline and E6(R3)
Common mistakes
- Saying Part 11 applies in the EU.
- Believing a vendor's validation certificate removes the sponsor's responsibility to confirm fitness for its trial.
- Allowing shared logins because the audit trail exists.
The interviewer might ask next
What would you check in a vendor audit of a new EDC provider?