SOP for User ID Creation in the QC Laboratory

In short: This example SOP shows how a Quality Control laboratory can create, change and withdraw user IDs for the domain login and for laboratory software, with approval by QA and creation only by IT. It is an illustrative template: adapt every value to your own quality system, your software and a documented risk assessment.

Why user ID control matters

Every GMP record created on a computerised system must be traceable to a person. That is only possible when each user has a personal ID, nobody shares credentials, and access rights match the job. The main expectations are:

• EU GMP Annex 11 (January 2011), clause 12: physical and/or logical controls must restrict access to authorised persons (12.1); the strength of the controls depends on how critical the system is (12.2); creating, changing and cancelling access authorisations must be recorded (12.3); and systems should record the identity of the operator who enters, changes, confirms or deletes data, with date and time (12.4).
• 21 CFR Part 11, section 11.10: limit system access to authorised individuals (11.10(d)) and use authority checks so that only authorised people can use the system, sign records, alter records or perform an operation (11.10(g)).
• 21 CFR 11.300: for electronic signatures based on ID codes and passwords, each combination must be unique to one person, and credentials should be checked and renewed periodically. Lost or compromised credentials must be disabled promptly.
• 21 CFR 211.68(b): only authorised personnel may change master production and control records or other records held in a computer system.

Example SOP

This example SOP is a template. Software names, password settings and role names below are example in-house criteria and must be replaced by the settings of your validated systems.

1. Objective

To describe the procedure for creating the computer domain login ID and the user IDs of laboratory software, and for managing, changing and withdrawing them.

2. Scope

This SOP applies to the computers and workstations connected to software-based instruments and equipment in the Quality Control laboratory at [site name].

3. Responsibility

4. Procedure for creating login IDs

4.1 Domain login ID

1. Log in to the domain server with administrator rights.
2. Select the respective organisational unit (OU).
3. Select “create user” and enter the user name and the full name of the user.
4. Enter the initial password twice.
5. Configure the password policy as follows (example in-house criterion): the user must change the initial password at first login; minimum length 7 characters; blank passwords not allowed; complexity requirements enabled; password expires after 45 days; the last 10 passwords are remembered.
6. Record the request on the User ID Creation Form (Annexure I).

4.2 Titration software (TIMO)

1. Log in to the software with administrator rights.
2. Go to Tools, then User Administrator, then add the user.
3. Enter the user name, full name and initial password twice.
4. Activate “User must change password at next logon”.
5. Example in-house criteria: minimum password length 6 characters with at least one letter and one digit; password expiry 45 days.
6. Assign the user group. The system’s cut, paste and delete options on the PC are restricted for users.
7. Rights are assigned by group (Administrators, QA Reviewer, Reviewer, Users). Administrators hold full rights; QA Reviewer and Users can open and view methods and print to PDF but cannot create, edit, save or delete methods; Reviewer can create and edit methods.

4.3 IR software (OPUS)

1. Log in with administrator rights, select Setup, then User management, then add the user.
2. Enter the user ID, password (twice) and operator name, and select the user group.
3. Example in-house criteria: minimum user ID length 4 characters; blank passwords not allowed; maximum 4 wrong login attempts; 3 previous passwords kept in history; password expiry 45 days.
4. Restrict cut, paste and delete on the PC.

4.4 Stability chamber monitoring system (NEWTRONIC)

1. Log in with administrator rights, open Configuration, then Application User, and add the user.
2. Enter the user name, login name and password.
3. Example in-house criteria: letters and digits required; blank passwords not allowed; account locks after 5 wrong attempts; password expiry 45 days; automatic browser log-out after 2 minutes of inactivity.
4. Select the communication group and department, and the user group according to the approved request.

The roles are Administrator (system configuration, users, equipment set-up, backup and archive), Approver, Reviewer and Operator. Menu-by-menu rights (view, add, edit, delete, print) are set in the software, with audit-trail menus restricted so that operators cannot alter them. Keep the full rights matrix in the system’s validated configuration document.

4.5 SAP

1. Log in to the SAP server with an administrator ID and open Administration, then Setup, General, then Users.
2. Select the user code, enter the user name, select the department and enter the initial password.
3. Tick “change password at next logon”.
4. Example in-house criteria: minimum length 8 characters; blank passwords not allowed; complexity enabled; password expiry 45 days; last 10 passwords remembered.
5. Record the request on Annexure I and the authorisations on the SAP User Authorisation Form (Annexure III).

4.6 Data acquisition and analysis system (DAAS)

1. Open the application link, log in as administrator, go to the Security tab, then User, then New.
2. Enter the login ID, name and password and set the user to active; the user must change the password at first login.
3. Example in-house criteria: password 6 to 10 characters with at least one letter and one digit; blank passwords not allowed; maximum 3 wrong attempts; password expiry 7 days.
4. Assign the group and privileges. Administrators can configure channels, set values and utilities; analysts can view live and analysed data and audit reports but cannot change settings; the company user group has no privileges beyond those assigned.

4.7 TOC analyser software

1. Open the software, select Administrator, then User Account, and sign in with the administrator ID.
2. Select User, then New; enter the user ID, user name and password twice.
3. Example in-house criteria: change of initial password at first login; minimum 8 characters; complexity enabled; password expiry 45 days; 10 passwords kept in history; cut, paste and delete restricted on the PC.
4. Assign the user level. Administrator holds user administration, system policy and database manager rights; Main User can create and edit methods, calibration curves and templates; User can run samples, maintain hardware and create sample tables but cannot edit methods; Guest can only run sample measurements.

4.8 UV software

1. Open the software with administrator privilege, double-click User Administrator and click Add.
2. Enter the user ID, user name and password twice.
3. Example in-house criteria: change of initial password at first login; minimum 6 characters; maximum 3 wrong attempts; 8 passwords kept in history; password expiry 45 days; cut, paste and delete restricted on the PC.
4. Assign the user rights. Analysts can run programs and operate the connected instrument; Reviewers can additionally edit methods, perform file operations and record the first two signature levels; Service Engineers can change instrument and system settings; Administrators hold all rights, including deleting projects, rolling back files and the higher signature levels.

5. Creation, management and withdrawal of user IDs and rights

1. The Head of Department fills in the User ID Creation Form (Annexure I) with the person’s name and the rights required.
2. For a service engineer, the Head of Department fills in the service engineer form (Annexure II). The engineer records completion of the work on the form and the user department confirms it. The service engineer’s ID is disabled as soon as the work is complete.
3. QA approves the form before it is submitted to IT.
4. An authorised IT designee creates the ID with the approved rights and gives the initial password to the user.
5. Any change in a user ID (withdrawal or addition) or in rights is carried out by IT only after approval of the Head of QA or designee.
6. IDs of persons who leave or change role are disabled promptly. IDs are not deleted, so that earlier records and audit trails stay attributable.
7. IDs are personal: shared logins are not allowed. Review the list of active users and rights periodically (for example, every year, example in-house criterion).
8. Records of requests, approvals and withdrawals are retained as GMP records, at least 1 year after the expiry date of the respective product batch to which the systems’ data relate, and longer where local law or the marketing authorisation requires.

6. Domain workstation policies

7. Abbreviations

8. Training and distribution

• Trainer: Head of Information Technology. Trainees: IT officers and executives, QC and QA staff.
• Distribution: controlled copies to Head of QA, Head of IT and Head of QC; original with QA.

9. Annexures

• Annexure I: User ID Creation Form
• Annexure II: User ID Creation Form for Service Engineer
• Annexure III: SAP User Authorisation Form

10. References

EU GMP Annex 11 (2011), 21 CFR 11.10 and 11.300, and 21 CFR 211.68(b), as listed below.

11. Revision history

Frequently asked questions

Can two analysts share one login if the instrument is old? No. Annex 11 clause 12.4 expects the identity of each person making entries to be recorded, and 21 CFR 11.300(a) requires each ID and password combination to be unique to one person. If the software cannot support individual IDs, document the risk and the compensating controls.

Who should create IDs, QC or IT? Keep creation separate from use. In this example, the department requests, QA approves, and IT creates the ID.

Should leavers’ IDs be deleted? Disable them. Deleting an ID can break the link between a person and the records they created.

How strict should password rules be? Annex 11 and Part 11 do not set numeric limits. Choose values from a documented risk assessment and the capability of each validated system.

Is Annex 11 changing? A revised Annex 11 (with a revised Chapter 4 and a new Annex 22 on artificial intelligence) went to a joint European Commission and PIC/S consultation from 7 July to 7 October 2025. As of October 2026 it has not been adopted, so the January 2011 Annex 11 cited here still applies. Review this SOP when the final text is published.

See also

• Example SOP on data integrity
• Example SOP for backup and restoration
• Good documentation practices for BMR, BPR, processing, packaging and testing records
• Example SOP for checking analytical reports and data

References

1. European Commission, EudraLex Volume 4, Annex 11: Computerised Systems (revision January 2011), clauses 12.1 to 12.4.
2. US FDA, 21 CFR Part 11, sections 11.10(d), 11.10(g) and 11.300 (eCFR, current).
3. US FDA, 21 CFR 211.68(b), Automatic, mechanical and electronic equipment (eCFR, current).
4. European Commission, EudraLex Volume 4, Part I, Chapter 4, clause 4.11 (record retention), and 21 CFR 211.180(a).