SOCRA Source Documentation and Data 3 — Questions and Answers
Question 1: Under 21 CFR Part 11, which requirement applies to electronic records used as source documents?
- They must be printed and signed in wet ink within 24 hours
- They must have audit trails that capture who made changes and when, and electronic signatures must be linked to the record (Correct answer)
- They only require a system administrator password for access control
- They must be stored on FDA-approved servers only
Correct answer: They must have audit trails that capture who made changes and when, and electronic signatures must be linked to the record
21 CFR Part 11 mandates secure audit trails and electronic signatures that are permanently linked to the electronic record to ensure data integrity.
Question 2: What is the primary purpose of an audit trail in an electronic data capture (EDC) system?
- To automatically generate the final clinical study report
- To track all changes to data fields, including who made the change, what was changed, and when (Correct answer)
- To prevent any data changes after initial entry
- To synchronize data with the sponsor's safety database in real time
Correct answer: To track all changes to data fields, including who made the change, what was changed, and when
Audit trails provide a secure, computer-generated record of all data modifications, supporting data integrity and regulatory accountability.
Question 3: When is direct data entry (DDE) into an EDC system considered acceptable as source data?
- Only when paper source documents have been lost
- When the site has documented procedures establishing the EDC as the source and no prior paper record was created (Correct answer)
- Only for non-safety data points
- When the sponsor provides written approval for each individual entry
Correct answer: When the site has documented procedures establishing the EDC as the source and no prior paper record was created
DDE into EDC is acceptable as source when the site's SOPs designate the EDC as the source and data is entered contemporaneously without a prior paper record.
Question 4: A site uses an electronic health record (EHR) system. The monitor wants to verify subject data. Which approach is most appropriate?
- The site should print all EHR records and provide copies to the monitor to take offsite
- The monitor should be given direct remote access to the site's full EHR database
- The site should provide monitor access to relevant EHR fields in compliance with local privacy regulations and the clinical trial agreement (Correct answer)
- The monitor should rely only on the CRF data without access to the EHR
Correct answer: The site should provide monitor access to relevant EHR fields in compliance with local privacy regulations and the clinical trial agreement
Monitor access to EHR records must balance GCP source data verification requirements with local privacy laws and the agreements governing data access.
Question 5: Which statement about electronic signatures under 21 CFR Part 11 is correct?
- A typed name at the bottom of an email qualifies as a compliant electronic signature
- Electronic signatures must be unique to the individual and require at least two distinct identification components for first use (Correct answer)
- Electronic signatures are only valid if witnessed by a third party
- Any digital image of a handwritten signature complies with Part 11 requirements
Correct answer: Electronic signatures must be unique to the individual and require at least two distinct identification components for first use
Part 11 requires electronic signatures to be unique to one individual and executed with at least two distinct components (e.g., user ID and password) upon first signing.
Question 6: What is meant by 'system validation' in the context of electronic systems used for clinical trial data?
- Having IT personnel test the software once before study startup
- A documented process to confirm the system consistently produces results meeting predetermined specifications and quality attributes (Correct answer)
- Obtaining FDA clearance for the software product
- Running antivirus scans on the system monthly
Correct answer: A documented process to confirm the system consistently produces results meeting predetermined specifications and quality attributes
Computer system validation (CSV) ensures electronic systems perform as intended and meet regulatory requirements through documented testing and review.
Question 7: When a data query is raised in an EDC system, what should the site do before resolving it?
- Change the data to whatever value the monitor suggests without review
- Review the original source document, confirm the correct value, and document the reason for any data change (Correct answer)
- Delete the original entry and re-enter the corrected data
- Escalate all queries to the IRB before responding
Correct answer: Review the original source document, confirm the correct value, and document the reason for any data change
Query resolution must be source-document-driven; the site must verify the original record and document justification for any correction to maintain data integrity.
SOCRA Source Documentation and Data 3
Under 21 CFR Part 11, which requirement applies to electronic records used as source documents?