1. EDC Management Sheet in Japan
March 12, 2015
Hitoshi Matsui
CAC EXICARE

2. Outline
ER/ES Guideline in Japan PMDA’s Inspection Points for EDC EDC Management Sheet Points to Consider

3. Introduction
March 27, 2013, Pharmaceuticals and Medical Devices Agency (PMDA) published EDC Management Sheet, and PMDA is using this sheet at compliance inspection for GCP and Good Post-Marketing Surveillance Practice (GPSP) since October 1, Sponsors and Marketing Authorization Holders (MAHs) have to prepare and maintain this sheet, if they use EDC. EDC is not limited to eCRF and includes ePRO, eLABO and etc.

4. ER/ES Guideline in Japan
Guideline for Electromagnetic Records and Electronic Signatures Use on Application for Approval or Permission of Pharmaceuticals
Definitions
Electromagnetic Records
Electromagnetic records are records that are produced in an electronic form, electromagnetic form, or some other form that cannot be recognized through human perception, and shall refer to those that are made available for use in information processing by an electronic computer.
Electronic Signatures
A computer data compilation of any symbol or series of symbols executed, adopted, or authorized by an individual or a corporation to be equivalent of the individual's handwritten signature or the seal

5. ER/ES Guideline in Japan
Requirements for the Use of Electromagnetic Records
Management of Electromagnetic Records
Computerized system validation
prerequisite
&
Authenticity
Readability
Retention-ability

6. ER/ES Guideline in Japan
Requirements for the Use of Electromagnetic Records
Authenticity
The authenticity is assured when electromagnetic records are complete, accurate, and reliable, and also the locus of responsibility for generation, modification, and deletion of the electromagnetic records is clear.
Requirements to assure the authenticity
Rules and procedures for maintaining security are documented and appropriately implemented.
A person who stored information is distinguishable. The original information should remain when the stored information is changed, and a person who changes is also distinguishable. It is recommended that the audit trail is created by the system.
The backup procedures are documented, and appropriately implemented.

7. ER/ES Guideline in Japan
Requirements for the Use of Electromagnetic Records
Readability
The content of electromagnetic records should be able to output (display on screen, print on paper, and copy on electromagnetic recording media etc.) in human readable format.
Within the retention period, electromagnetic records should be archived assuring the authenticity and readability.
Requirements to assure Retain-ability
The procedures for assuring that Retain-ability is documented and appropriately implemented
When the archived electromagnetic records are copied to other electromagnetic media or other format, the transferred records retain their authenticity and readability

8. ER/ES Guideline in Japan
Requirements for the Use of Electromagnetic Records
Use of Closed System
When a closed system is used to create, modify, maintain, archive, retrieval, or transmit electromagnetic records, the requirements listed in '3.1 Management of Electromagnetic Records' should be met. The requirements listed in '4. Requirements for the Use of Electronic Signatures' should also be met when electronic signatures are used
Use of Open System
In addition to requirements of 'Use of Closed System', the procedures should be appropriately implemented to assure the authenticity and confidentiality of the records during the period of their generation to their reception

9. ER/ES Guideline in Japan
Requirements for the Use of Electronic Signatures
The procedures for management and operation of electronic signatures are documented based upon the Law Concerning Electronic Signature and Certification Services (Law No. 102 of 2000) and appropriately implemented.
Electronic signature is the only method to identify an individual, and its reuse or reallocation to others never occurs.

10. ER/ES Guideline in Japan
Requirements for the Use of Electronic Signatures
When electronic signatures are used for data of electromagnetic records, the information specifying all of the following items is included in the signed records.
Full name of the signer
Date and time when the signature is generated
Meaning of the signature (generation, checking audit, approval, etc.)
Electronic signatures in association with electromagnetic records are linked to corresponding electromagnetic records to prevent deletion and copying of the records in order not to occur their unauthorized use.

11. ER/ES Guideline in Japan
Othes
Applicants who uses electromagnetic records and electronic signatures should set the items for the person in charge, administrator, organization, facility, education and training which are required to use electromagnetic records and electronic signatures.
This is a massage for top management.

12. Outline
ER/ES Guideline in Japan PMDA’s Inspection Points for EDC EDC Management Sheet Points to Consider

13. PMDA’s Inspection Points
Pharmaceuticals and Medical Devices Agency (PMDA) will inspect EDC from following point of view:
Investigators and the like enter or modify data
Investigators confirm data
Investigators sign off CRFs

14. PMDA’s Inspection Points
Investigators and the like enter or modify data
Who has is granted to enter or modify data
A right procedure is used for issuing user-ID and password to a right person
Only user-ID and password granted person is using system
Entered data is stored correctly
After changing data, data before change is kept with an audit trail

15. PMDA’s Inspection Points
Investigators sign off CRFs
Investigators confirm content of records and modified data.
Investigator can confirm everything how data is modified
When using electronic signature, the requirements for the use of electronic signatures are met
Who has sign-off privilege
Sign-off is done appropriately

16. Outline
ER/ES Guideline in Japan PMDA’s Inspection Points for EDC EDC Management Sheet Points to Consider

17. EDC Management Sheet History October 2009
Published EDC Inspection Check List (Draft)
December 2010
Conducted a survey on EDC Inspection
Jan– Mar 2012
Conducted a pre-pilot inspection using EDC System Sheet (draft) for sponsors and new version of EDC Inspection Check List (draft) for each investigation
Apr ‘12 – Mar ‘13
Conducted a pilot inspection using the revised EDC System Sheet (draft) and EDC Inspection Check List (draft)
March 2013
Published new EDC inspection guidance using EDC Management Sheet
October 2013
EDC Management Sheet became mandatory

18. EDC Management Sheet

19. EDC Management Sheet

20. EDC Management Sheet System Overview Name of the EDC System
System category
(System development type)
£ ASP (Application Service Provider) service (Company name ) £ In-house development £ Other ( 　)
Intended purpose (Collected information etc.)
£ 01 Case report form (CRF) used in clinical trial £ 02 Patient diary £ 03 CRF used in Post-marketing surveillance £ 04 Other ( )
Security measures for the overall system
£ ASP service security policy/procedure is used £ Internal security policy/procedure is used £ Other ( 　)

21. EDC Management Sheet System Overview Entry column [1] [2]
Version of the EDC system (Only major upgrades such as adding functions to be specified)
Duration of use (20xx/xx/xx – 20xx/xx/xx) ~
Release declaration (20xx/xx/xx)
Differences from the previous version * Briefly summarize the release notes of the version obtained internally or from a vendor. Can be left blank in case of a newly introduced system.
Status of conduct or confirmation of the computer system validation at the time of system introduction or system update

22. EDC Management Sheet

23. EDC Management Sheet
Outsourcing contract (Construction/operation of the EDC System, operation)
Entry column
*If there is an individual agreement in line with a comprehensive agreement, specify the comprehensive agreement in this column and the individual agreement in the "Operating Experience Sheet."
*If some operation was outsourced, note that the contract based on Ordinance of the Ministry GCP Article 12 or Ordinance of the Ministry GPSP Article 10 is required
Name of vendor/contracted resource (1)
Scope of outsourced services
Date/period of Contract, etc.
Contract date:
Contract period (from):
Contract period (until):
Automatic contract renewal £No　£Yes
Name of vendor/contracted resource (2)

24. EDC Management Sheet

25. EDC Management Sheet
Requirements for the Use of Electromagnetic Records - Management Methods of Electromagnetic Records
Management Method
Entry column * Specify in "1. System overview" the outline of results of the computer system validation at the time of system introduction and system update. *For testing trial-specific setup (UAT, etc.), specify it in this column.
Procedure of testing trial-specific setup
Written procedure of testing trial-specific setup Document number: Document title: Version: Effective date: Differences from previous version: Summary of the procedure and resulting documents:

26. EDC Management Sheet

27. EDC Management Sheet
Requirements for the Use of Electromagnetic Records - Authenticity of Electromagnetic Records
Management Method
Entry column
Measures for maintaining security
Encryption of the communication between the terminal and server £ SSL (Secure Socket Layer) £ VPN (Virtual Private Network) £ Other ( )
Personal authentication £ ID/password £ One-time password £ Biometrics authentication (fingerprint, retina, vein) £ Other ( )

28. EDC Management Sheet
Requirements for the Use of Electromagnetic Records - Authenticity of Electromagnetic Records
Management Method
Entry column
Procedures for maintaining of security
Policy / Guidance for maintaining security Document number: Document title: Version: Effective date: Differences from previous version: Summary of the procedure and resulting documents:
Written procedures of requesting user registration, granting ID/password, reviewing users, removing the registered users Document number: Document title: Version: Effective date: Differences from previous version: Summary of the procedure and resulting documents:

29. EDC Management Sheet
Requirements for the Use of Electromagnetic Records - Authenticity of Electromagnetic Records
Management Method
Entry column
Procedures for maintaining of security
Written procedures for users how to use the ID/password Document number: Document title: Version: Effective date: Differences from previous version: Summary of the procedure and resulting documents:
Written procedures for users how to train users Document number: Document title: Version: Effective date: Differences from previous version: Summary of the procedure and resulting documents

30. EDC Management Sheet
Requirements for the Use of Electromagnetic Records - Authenticity of Electromagnetic Records
Management Method
Entry column
Procedures for maintaining of security
Other Document number: Document title: Version: Effective date: Differences from previous version: Summary of the procedure and resulting documents:

31. EDC Management Sheet
Requirements for the Use of Electromagnetic Records - Authenticity of Electromagnetic Records
Management Method
Entry column
List of persons authorized to access the system (i.e. list of persons authorized to create and modify the data)
List of persons authorized to access the system
Trial being conducted:
Managed by means of hard copies
Managed by means of the system
Managed by means of electromagnetic records other than this system
Upon completion of the trial (to be submitted at the time of inspection)

32. Throughout the conduct of the Clinical Trial etc.
EDC Management Sheet
Requirements for the Use of Electromagnetic Records - Authenticity of Electromagnetic Records
Management Method
Entry column
Throughout the conduct of the Clinical Trial etc.
Outline of audit trails with regards to creation / modification of retained information
Possible £Not possible: Does the system have full audit trail capability?
Possible £Not possible: To clearly identify the initial data entry by user ID (account holder)
Possible £Not possible: To clearly identify which data was is automatically calculated/derived
Possible £Not possible: To clearly determine data loaded (through a system-to-system account or individual user account)
Possible £Not possible: To clearly identify the data modifications by user ID (account holder)
Possible £Not possible: To retain (i.e. not to delete) information prior to modification
Possible £Not possible: To view full audit history trails (sponsor)
Possible £Not possible: To view full audit history trails (medical institution) * For item of "Not possible," specify the situation. * Explanation about presentment (how and what information surfaces)

33. Throughout the conduct of the Clinical Trial etc.
EDC Management Sheet
Requirements for the Use of Electromagnetic Records - Authenticity of Electromagnetic Records
Management Method
Entry column
Throughout the conduct of the Clinical Trial etc.
Written procedure for securing the authenticity of retained information
Written procedure for modifying information retained in the EDC System Document number:
Document title:
Version:
Effective date:
Differences from previous version:
Summary of the procedure and resulting documents
Written procedure for viewing the audit trails
Document number:
Summary of the procedure and resulting documents:

34. Post completion of the Clinical Trial etc.
EDC Management Sheet
Requirements for the Use of Electromagnetic Records - Authenticity of Electromagnetic Records
Management Method
Entry column
Post completion of the Clinical Trial etc.
Outline of audit trails with regards to creation / modification of retained information
Possible £ Not possible : To clearly identify the initial data entry by user ID (account holder)
Possible £ Not possible : To clearly identify which data was is automatically calculated/derived
Possible £Not possible : To clearly determine data loaded (through a system-to-system account or individual user account)
Possible £ Not possible : To clearly identify the data modifications by user ID (account holder)
Possible £ Not possible : To retain (i.e. not to delete) information prior to modification
Possible £ Not possible : To view full audit history trails (sponsor)
Possible £ Not possible : To view full audit history trails (medical institution)
* For item of "Not possible," specify the situation.
* Explanation about presentment (how and what information surfaces)

35. Post completion of the Clinical Trial etc.
EDC Management Sheet
Requirements for the Use of Electromagnetic Records - Authenticity of Electromagnetic Records
Management Method
Entry column
Post completion of the Clinical Trial etc.
Written procedure for securing the authenticity of retained information
Written procedure for modifying information retained in the EDC System Document number:
Document title:
Version:
Effective date:
Differences from previous version:
Summary of the procedure and resulting documents
Written procedure for viewing the audit trails
Document number:
Summary of the procedure and resulting documents:

36. EDC Management Sheet
Requirements for the Use of Electromagnetic Records - Authenticity of Electromagnetic Records
Management Method
Entry column
Throughout the conduct of the Clinical Trial etc.
Procedures of operation for data backup and recovery
Written procedure for viewing the audit trails
Document number:
Document title:
Version:
Effective date:
Differences from previous version:
Actual operation status of data backup:
Post completion of the Clinical Trial etc.

37. EDC Management Sheet

38. EDC Management Sheet
Requirements for the Use of Electromagnetic Records - Readability of Electromagnetic Records
Management Method
Entry column
Throughout the conduct of the Clinical Trial etc.
Ensuring the readability of retained information
£ Possible £ Not possible
Feasible output format:
Output to display
Output to paper
Copy to electromagnetic recording medium
Other (
Post completion of the Clinical Trial etc.
Securing of the visual readability of stored information

39. EDC Management Sheet

40. Post completion of the Clinical Trial etc.
EDC Management Sheet
Requirements for the Use of Electromagnetic Records - Storability of Electromagnetic Records
Management Method
Entry column
Post completion of the Clinical Trial etc.
Ensuring the storage stability during the retention period
Written procedure of electromagnetic records after the completion of trial
Document number:
Document title:
Version:
Effective date:
Differences from previous version:
Summary of the procedure and resulting documents:

41. Post completion of the Clinical Trial etc.
EDC Management Sheet
Requirements for the Use of Electromagnetic Records - Storability of Electromagnetic Records
Management Method
Entry column
Post completion of the Clinical Trial etc.
Ensuring the storage stability during the retention period
Actual storage condition (including audit trails)
Medical institution
* Audit trails:
£ Available
£ NOT Available
* File format, etc. :　
* Storage form
£ Electromagnetic medium (Type: )
£ Printed paper
Sponsor/MAH etc.

42. EDC Management Sheet

43. EDC Management Sheet Requirements for the Use of Electronic Signatures
Use of electronic signature yes/ no
£ No £ Yes (start date if eSignature is used in the EDC system: )
Management Method
Entry column
Procedure to ensure the reliability of electronic signature
Policy / guidance for electronic signature
Document number:
Document title:
Version:
Effective date:
Differences from previous version:
Summary of the procedure and resulting documents:
* If it is same as the above section ER/ES "Policy / guidance for maintaining the security", it is unnecessary to specify here.
£ Use the same procedure

44. EDC Management Sheet Requirements for the Use of Electronic Signatures
Management Method
Entry column
Procedure to ensure the reliability of electronic signature
Written procedure for user authentication
Document number:
Document title:
Version:
Effective date:
Differences from previous version:
Summary of the procedure and resulting documents:
* If it is the same as the above section ER/ES "Written procedures of requesting user registration, granting ID/password, reviewing users, removing the registered users" and "Written procedures for users how to use the ID/password", it is unnecessary to specify here.
£ Use the same procedure

45. EDC Management Sheet Requirements for the Use of Electronic Signatures
Management Method
Entry column
Procedure to ensure the reliability of electronic signature
Others
Document number:
Document title:
Version:
Effective date:
Differences from previous version:
Summary of the procedure and resulting documents:

46. EDC Management Sheet Requirements for the Use of Electronic Signatures
Management Method
Entry column
Information included in electronic signature
£ Possible £ Not possible :To clearly identify the following information:
Name of signer
Date and time of signature
Meaning of signature (creation, confirmation, approval, etc.)
** Describe how eSignature is displayed including audit trail, meaning of the signature, etc:

47. EDC Management Sheet Requirements for the Use of Electronic Signatures
Management Method
Entry column
Explanation on "Electronic signatures executed to electromagnetic records are linked to their respective electromagnetic records to ensure that the signatures are not able to be excised and/or duplicated by ordinary means in order to avoid unauthorized use."
Describe the validation mechanism(s) ensuring and preserving eSignatures authenticity:

48. EDC Management Sheet

49. Throughout the conduct of the Clinical Trial etc.
EDC Management Sheet
Others
Management Method
Entry column
* Provide the information about the organization who directly administers the electromagnetic records. If the sponsor / MAH actively participate in the system administration, provide the both information
Throughout the conduct of the Clinical Trial etc.
Person responsible
Administrators
Organization
Facilities/equipment
Training
* Describe the training for the person who administers/maintains electromagnetic records. Training for end users is described in the above section of "Education and training on securing of security"

50. Post completion of the Clinical Trial etc.
EDC Management Sheet
Others
Management Method
Entry column
Post completion of the Clinical Trial etc.
Person responsible
Administrators
Organization
Facilities/equipment
Training
* Describe the training for the person who administers/maintains electromagnetic records. Training for end users is described in the above section of "Education and training on securing of security"

51. EDC Management Sheet

52. Date of the inspection / date when the sponsor knew the situation
EDC Management Sheet
"(Critical) system faults occurred and incompliance with the procedure during the trial," "Matters pointed out in previous inspections," and improvements made
Date of the inspection / date when the sponsor knew the situation
System (version)
Trial number
• (Critical) system faults occurred and incompliance with the procedure during the trial
• Matters pointed out in the prior inspection
*Such occurrence as lack of data or audit trails, data collection error occurred due to an error in setting an individual trial, event which influenced blindness or safety of trial subjects, unauthorized use of use ID and so on will be specified.
Improvement status (including the consideration of impact to other trials)

53. EDC Management Sheet 7. Revision history of this EDC Management Sheet
Revision number
Document date
Contents 1 2 3

54. EDC Management Sheet
EDC System Sheet (for sponsor / MAH) Operating Experience Sheet
Trial Number
System Name (version)
Title of the Clinical Trial etc.
(Period of Clinical Trial etc.: )
In-scope of this time of inspection?
Vendor/Contracted resource (Contract for each clinical trial)
* The individual agreement stated in the Operational Sheet "2. Subcontracting agreement" will be specified. 1
□ Yes
□ No
Name of vendor/contracted resource
Scope of outsourced services:
Contract date:
Contract period (from):
Contract period (until):
Automatic contract renewal £No　£Yes 2 3

55. EDC Management Sheet
EDC System Sheet (for sponsor / MAH) Operating Experience Sheet
Trial Number
Procedure of validation upon setting of trial information (Trial specific UAT etc.)
Written procedures of requesting user registration, granting ID/password, reviewing users, removing the registered users
Written procedure for training on security 1
Document number:
Document title:
Version:
Effective date:
Summary of the procedure and resulting documents:
Completion date of UAT: 2 3

56. EDC Management Sheet
EDC System Sheet (for sponsor / MAH) Operating Experience Sheet
Trial Number
*In case another written procedures is to be added, insert a new column to provide the information.
Date of application for approval
Brand/trade name
CTD number 1
Document number:
Document title:
Version:
Effective date:
Summary of the procedure and resulting documents: 2 3

57. Outline
ER/ES Guideline in Japan PMDA’s Inspection Points for EDC EDC Management Sheet Points to Consider

58. Points to Consider One Sheet Formtat Fits All System?
Since EDC includes not only eCRF, but also other electronic data capture system, various systems are targeted.
EDC Systems are operating on-promises or on clouds.
EDC Management Sheet is one format and does not consider system complexity.
Sponsors and MAHs need to consider ingenuity to enter information using same format

59. Points to Consider
Sponsors’ and MHAs’ responsibility for quality of Data and EDC system
In case of outsourcing everything EDC operation and management, sponsors and MHAs ask CROs doing everything that include quality control and quality management.
Service supplier audit satisfies their responsibilities to assure EDC system and data captured by EDC.
PMDA is requesting more deep involvement process at sponsors and MHAs sites to assure quality of data and EDC system

60. Points to Consider Excel Meets Long Term Use?
EDC Management Sheet is a management ledger for EDC.
EDC Management Sheet is providing in Excel format.
Excel has no audit trail function and also version compatibility is not fully assured.
Sponsor and MHAs consider another tool as a ledger to maintain information that EDC Management Sheet is requesting.

61. Any Questions？