The Shared Login at a High-Enrolling Site
During remote monitoring review, the CRA notices that 38 CRF pages at Site 07 were entered within a 2-hour window on a Sunday, all under the username 'site07_coord'. The site has three coordinators and one PI. When asked, the lead coordinator explains: 'We share one login because creating individual accounts takes two weeks through the sponsor's helpdesk, and we had a backlog after the holiday. Everyone knows the password; it's fine because we all work in the same room.' The audit trail shows the shared account made 612 entries over four months. The site is the second-highest enroller (22 of 180 subjects). The EDC system supports individual accounts and role-based access; the bottleneck is the sponsor's provisioning process.
1. What is the compliance problem, and what is the immediate action?
Read the worked answer
The problem: shared credentials destroy attributability. Every entry in the audit trail is attributed to 'site07_coord,' which is not a unique natural person. Under 21 CFR Part 11 and GCP expectations, electronic records must be attributable to the individual who created or modified them. A shared login means the sponsor cannot demonstrate who entered what - a serious inspection finding, and potentially an integrity issue if any entry is disputed.
Immediate action:
- Instruct the site in writing to stop using the shared account; disable or lock it after confirming no active session.
- Provision individual accounts for the three coordinators and the PI now, using an expedited path - this is a documented business continuity need, not a routine request.
- Preserve the existing audit trail; do not delete or alter the shared account's history. It is evidence.
- Assess whether any data entered under the shared account are suspect (e.g., entries made when the named individual was demonstrably absent).
Do not simply 'remind' the site and move on - that leaves the non-attributable record in place.
2. The sponsor's provisioning delay is the root cause. What systemic fix and documentation are required?
Read the worked answer
Systemic fix:
- Establish an SLA for account provisioning (e.g., 2 business days) with an escalation path, and a documented interim procedure for urgent site onboarding that does not involve shared credentials.
- Review whether other sites have adopted the same workaround - a 612-entry shared account suggests this may not be isolated. Query the audit trail for accounts with implausible usage patterns (multiple users, odd hours, high volume).
- Consider self-service or delegated provisioning with appropriate controls, subject to validation.
Documentation:
- A deviation/CAPA record naming the shared-login practice, the affected site and period, root cause (provisioning delay), corrective action (individual accounts, SLA), and preventive action (monitoring for shared-account patterns, site training).
- Training records for the site staff on credential responsibility.
- A note in the monitoring report and, if material, disclosure in the data management report.
The exam angle: the site's behavior is the symptom; the sponsor's process is the cause. A complete answer treats both and documents the trail.