In an EDC study, user training and access must be monitored and addressed when all the following situations occur EXCEPT:

User training and access management are fundamental to maintaining data integrity, security, and regulatory compliance in clinical trials. Actions are required whenever a user's relationship with the study or system changes. This includes onboarding new staff, reassigning roles, or offboarding staff. However, a software upgrade that has no impact on the user interface, system functionality, or workflow for end-users does not necessitate re-training or modifications to access rights. Since the users' interaction with the system remains identical, their existing training and access permissions remain appropriate.

A. When site staff leaves a study, their system access must be promptly revoked to prevent unauthorized access and ensure data security.

B. New site staff must receive documented training on the protocol and EDC system and be granted role-appropriate access before they can perform study duties.

D. Reassigning a team member to a different role requires a review and update of their access permissions to align with the principle of least privilege for their new responsibilities.

1. Society for Clinical Data Management. (2023). Good Clinical Data Management Practices (GCDMP®).

Section 4.6, "User Access and Security," states that a process must be in place to manage user access throughout the study lifecycle, including additions, changes, and deactivations. This directly supports the need for action in options A, B, and D.

Section 4.7, "Training," mandates that training be provided and documented for individuals based on their roles and responsibilities. A change in role (D) or a new user (B) explicitly requires training. A system upgrade that does impact users would also require training, but the question specifies one that does not.

2. U.S. Food and Drug Administration. (May 2007). Guidance for Industry: Computerized Systems Used in Clinical Investigations.

Section IV.C, "Personnel," states, "Persons who develop, maintain, or use computerized systems should have the education, training, and experience to perform their assigned tasks." This implies that training is tied to the tasks performed. If a system change does not alter the tasks (as in option C), additional training is not required. The guidance also emphasizes controls for security and access, which are relevant to options A, B, and D.

3. Nahm, M., et al. (2022). The Society for Clinical Data Management’s Good Clinical Data Management Practices, Version 2: A summary of changes. Therapeutic Innovation & Regulatory Science, 56(4), 506-515. https://doi.org/10.1007/s43441-022-00403-z

This publication, which reviews the updates to the GCDMP, reinforces the importance of lifecycle management for user accounts (p. 511). It highlights that access should be based on role and that procedures must be in place for "granting, changing, and revoking access," directly addressing the scenarios in A, B, and D as necessary actions.