CPEDC common mistakes
CPEDC · Understand the traps and how to avoid them.
Treating 21 CFR Part 11 as the only regulation that governs electronic records, and giving generic answers that never cite the underlying predicate rule (e.g., 21 CFR 312.62 for record retention, 312.64 for investigator reporting).
Candidates memorize Part 11 scope language and assume it stands alone, missing that Part 11 only applies where a predicate rule requires a record or signature.
What to do instead
For each Part 11 question, first identify the predicate rule and the record type, then layer Part 11 controls on top. Practice writing the citation chain: predicate rule -> record requirement -> Part 11 control.
Confusing the roles of the sponsor, CRO, investigator, and IRB when asked who is responsible for a given data management or reporting obligation.
The regulations assign duties by function, and candidates conflate the party who performs a task with the party who remains accountable for it.
What to do instead
Build a responsibility matrix (sponsor / CRO / investigator / IRB / data manager) for the major obligations (adverse event reporting, informed consent, source documents, record retention) and review it until the accountable party is automatic.
Assuming an EDC system must be 'Part 11 certified' and answering that certification by a regulator is required, rather than describing a documented, risk-based validation with audit trails, access controls, and e-signature components.
The word 'certified' appears in marketing material and informal training, and candidates transfer that to the exam.
What to do instead
State clearly that no regulatory body certifies software; compliance is demonstrated through validation evidence, SOPs, training records, and audit trails. Use that framing in every validation question.
Designing a CRF that collects a value without specifying the corresponding database field type, codelist, or edit check, then failing questions that ask what must be defined at study build.
Candidates think of study build as form design only and skip the data dictionary, edit specification, and codelist versioning that the exam expects.
What to do instead
For any build question, list the full artifact set: annotated CRF, data dictionary, codelist versions, edit check specification, and test scripts. Practice describing each artifact's purpose in one sentence.
Resolving a query by editing the field value directly in the database without documenting the query, the response, and the resolution in the system.
Candidates focus on getting the correct value into the database and treat documentation as optional overhead.
What to do instead
Treat every query as a closed loop: query text, subject/field reference, response, resolution, who resolved it, and date. If a value changes, the audit trail must show old value, new value, reason, and user.
Describing reconciliation as 'comparing two datasets' without naming the specific reconciliation types and their triggers (SAE reconciliation, external lab reconciliation, serious adverse event and vendor data, coding reconciliation).
Reconciliation is taught as a general concept, and candidates cannot enumerate the concrete reconciliation activities the exam asks about.
What to do instead
Memorize the reconciliation checklist: SAE vs. clinical database, central lab vs. clinical database, PK/ECG/vendor data, medical coding, and randomization. For each, state the source of truth and the frequency.
Giving a single generic answer for access control (e.g., 'users have unique logins') instead of describing role-based access, least privilege, and how permissions are granted, reviewed, and revoked.
Candidates learn the headline requirement and never work through the lifecycle of an account.
What to do instead
Answer access questions with the full lifecycle: request and approval, role assignment, periodic review, modification on role change, and deactivation on departure. Tie each step to an audit trail entry.
Treating change control as paperwork that happens after a system change, and describing validation as a one-time event at go-live.
Candidates separate 'the change' from 'the controlled process' and assume validation ends when the system goes live.
What to do instead
Frame every change question as: impact assessment, approval, testing (including regression), documentation update, and release. State that validated state is maintained through ongoing change control, not achieved once.
Leaving out the data management plan, the database lock checklist, or the transfer of the final database and documentation to the sponsor when asked about study closeout.
Closeout is associated with the clinical/statistical side, and candidates overlook the data management deliverables.
What to do instead
Memorize the closeout package: DMP, final data review, query closure, database lock documentation, archival of the database and metadata, and documented transfer to the sponsor with retention responsibilities.
Answering audit trail questions by saying the trail 'records changes' without specifying what must be captured (who, what, when, old value, new value, reason) and that the trail must be retained and reviewable.
The general idea of an audit trail is familiar, but the required data elements and the review obligation are not.
What to do instead
Recite the audit trail element list on every relevant question and add the review requirement: who reviews the trail, how often, and how the review is documented.