- Published
- Updated
- Sources checked
User access drifts as teams change roles, cover absences or leave a project. Reviewing the current account list against actual responsibilities is more useful than simply confirming that accounts exist.
Maintain the access register
Maintain an access register with identity, organisation, study role, approved privileges and authorising owner. Separate ordinary study activities from administration and unblinded work. Include service accounts and temporary vendor support, not only named clinical staff.
Follow a departing monitor
For a departing monitor, check EDC, CTMS, eTMF, file exchange and identity-provider access. Preserve attributable historical activity while removing the ability to make new changes. A personnel departure record and a system deactivation record should be reconcilable.
Access review checks
- Compare privileges with the approved role matrix.
- Investigate inactive, duplicate and orphaned accounts.
- Revoke temporary elevation and verify leaver deactivation across systems.
Verify the system action
Accept a review when every exception has a disposition and relevant system evidence confirms the action. Define review frequency according to risk and organisational procedures. A signed spreadsheet alone does not show that a privileged account was actually disabled. Include internal transfers and temporary support changes; a person may remain employed while no longer needing access to the former study.
Frequently asked questions
- Should former users be deleted completely?
- Preserve necessary attribution and records while preventing further access, using the system’s controlled process.
- Can colleagues share an account during leave?
- Arrange individual delegated access so activities remain attributable and privileges remain approved.