EFGCP Guideline for Auditing Clinical Laboratories - European ...

Guideline for Auditing Clinical Laboratories
Formal requirements to the format of passwords (e.g. minimum number of characters required,
alphanumeric plus number strings, recycling of passwords).
The security and administration of user access:
The auditor should verify whether access to computers is blocked when the user is not at his / her
desk (e.g. password protected screen savers)
System access needs to be controlled by a user ID and password protected.
3.11.2 System Description
The auditor should review the availability of the following:
• A general description of the computer systems in use.
• An assessment as to whether the computer system is an internally developed system, an "off-theshelf"
package or a combination of the two.
• In the case of globally operating central laboratories, the procedures for data exchange between
sites/subsidiaries, assess impact of different time zones, units used (metric vs other systems).
• System specification (covering user requirements and user acceptance test) for systems
developed in-house.
• Software life-cycle management: documentation of requests, requirements and acceptance of
new release.
3.11.3 Software Development
The auditor should ensure that the following issues are reviewed:
Standard for software development incl. coding standards.
Change control procedures for software development and maintenance.
Policy for user testing and acceptance.
Documentation for testing including unit testing, integration testing and acceptance testing.
3.11.4 Testing
The auditor should ensure that the following issues are reviewed:
• Test plans, inclusive tractability between user requirement specifications/systems specifications
and the test records.
• Test reports, inclusive test results and signed and dated screen dumps as applicable.
• Reports on change control and error handling.
• Audit trail for changes, completeness thereof and availability of any logs of changes.
3.11.5 Maintenance and Support
The auditor should ensure that the following issues are reviewed:
• Service contracts with third parties or SOP/service level agreements if maintenance is ensured by
company staff.
• System and user support. The auditor should assure that the system administrator controls the
software environment on PCs and laboratory work stations (e.g. via a software inventory) to avoid
the uploading of unauthorised software by personnel.
• Debugging of software.
3.11.6 Security
The auditor should verify the policy on access control:
Staff and contractors having access to the various systems and tasks they are authorized to execute.
EFGCP - Clinical Laboratories - Final Version 1.0 Page 12 of 15
2005