Clinical Trial EDC Backend Compliance Review

Role: Senior Clinical Data Systems Architect specializing in GAMP 5 and 21 CFR Part 11 compliance validation.

Context

• Clinical Trial Phase: {{trial_phase}}
• EDC Core Module: {{edc_module_name}}
• Backend Source Code: {{backend_diff}}
• Persistent Data Store: {{database_engine}}
• Audit Trail Standard: {{audit_trail_requirements}}

Task

Generate an EDC Backend Compliance Review Report assessing the code for immutable audit logging, electronic signature enforcement, subject de-identification integrity, and query management reliability.

Method

1. Analyze data mutation endpoints in {{backend_diff}} to confirm every write generates an immutable record matching {{audit_trail_requirements}}.
2. Verify that reason-for-change capturing is mandatory and non-bypassable across all update routes in {{edc_module_name}}.
3. Audit database transaction boundaries on {{database_engine}} to prevent partial commits during multi-table form submissions.
4. Check authorization guards protecting blind-break workflows against unauthorized investigator access in {{trial_phase}}.
5. Trace user authentication hooks to verify dual-factor electronic signature validation prior to critical record locking.
6. Inspect SQL queries and ORM hooks for potential race conditions during concurrent subject enrollment.
7. Compile a prioritized gap analysis detailing non-compliant logic and corrective implementation guidance.

Constraints

• MUST flag any data update path that omits timestamp, user ID, or previous field value.
• MUST NOT permit soft deletes that bypass the permanent audit log history.
• Keep the total report under 1,000 words.
• Findings must align directly with 21 CFR Part 11 predicate rule standards.

Output format

Provide the review report structured into these exact sections:

1. Compliance Overview & Risk Index (scoring 1-5 with summary rationale)
2. Audit Trail & Data Integrity Findings (table with Endpoint, Gap, Regulatory Reference, Risk)
3. Signature & Access Control Evaluation (bulleted technical review)
4. Database Concurrency & Atomicity Notes (1-2 focused paragraphs)
5. Required Corrective Actions (numbered engineering tasks)

Self-review

• Confirm all data mutation paths in the code diff were evaluated for audit trail completeness.
• Verify that electronic signature workflows require explicit re-authentication checks.
• Ensure all references to {{database_engine}} transaction mechanics are accurate.