Published on 10/12/2025

User Access Reviews: Joiners/Movers/Leavers

User Access Reviews are critical processes in the lifecycle of computer systems used within the pharmaceutical industry. As companies increasingly adopt cloud technologies, it is essential to ensure that these processes comply with various regulatory requirements including those set forth by the US FDA, EMA, and MHRA. This tutorial will provide a comprehensive step-by-step guide geared towards professionals in pharma, clinical operations, regulatory affairs, and medical affairs. It will cover aspects of computer software assurance (CSA), computer system validation (CSV), intended use risk assessment, and more in the context of User Access Reviews.

Understanding User Access Reviews

User Access Reviews (UAR) are an integral component of maintaining the security and integrity of systems used in drug development, manufacturing, and distribution. UAR involves examining user accounts and permissions to ensure they align with the users’ roles and responsibilities. Effectively managing user access is crucial for compliance with regulations such as 21 CFR Part 11 and Annex 11, which require companies to maintain proper oversight of who can access systems that manage sensitive data.

The Importance of User Access Reviews

• Data Security: Ensures sensitive data is only accessible to authorized individuals.
• Regulatory Compliance: Helps to adhere to necessary FDA, EMA, and MHRA guidelines.
• Risk Management: Identifies and mitigates potential security risks related to user accounts.
• Operational Integrity: Verifies that user credentials are current and properly managed.

In this section, we will delve deeper into the components of the User Access Review process: ‘Joiners’, ‘Movers’, and ‘Leavers’. Each category pertains to different user scenarios affecting access management.

Joiners: New User Access

The first step in the UAR process is managing new user access, often referred to as ‘Joiners’. When a new employee or external partner begins their role, appropriate access must be granted in accordance with their job responsibilities.

• Intended Use Risk Assessment: Align the access rights with the intended use of the software by assessing the risks associated with the new role. This ensures that access is limited to what is necessary for the user to fulfill their responsibilities.
• Documentation: Document the justification for the access level granted, including any risk assessments conducted.
• Review and Approval: Permit access only after gaining regulatory and managerial approvals.

Movers: Changes in User Roles

As employees transition internal positions or departments—a scenario termed ‘Movers’—their access rights could require revision. For instance, an employee shifting from a data entry role to a financial oversight position may necessitate broader access to certain programs.

• Configuration Management: Update user permissions to reflect the new responsibilities while adhering to an established configuration management process.
• Change Control: Utilize formal change control procedures to document the modifications made to user access, ensuring a clear audit trail.
• Periodic Assessment: Regularly evaluate user roles and access to affirm that the current permissions are appropriate.

Leavers: Departing Employees

‘Leavers’, or employees who are departing from the organization, pose significant security risks if their access is not promptly revoked. In the validation of computer systems, finalizing access management for leavers requires careful attention to regulatory compliance measures.

• Audit Trail Review: Evaluate the audit trails for lingering user sessions or access post-departure, as significant processes may carry residual access.
• Revocation Protocols: Implement clearly defined protocols for revoking access as soon as a user leaves the organization.
• Data Retention and Archive Integrity: Ensure that while user accounts are deactivated, any related data is archived properly, complying with data retention policies.

Implementation of User Access Reviews

Implementing an effective User Access Review process requires a structured approach. This section will focus on developing a step-by-step plan that ensures compliance and effectiveness in user management.

Step 1: Define User Roles and Access Levels

The first step in the UAR process is to clearly define user roles within the organization. Each role should be tied to specific access levels based on the principle of least privilege, ensuring that users only have access to the information necessary for their roles.

• Create role descriptions that detail responsibilities and required access.
• Map these roles to organizational objectives and compliance requirements.

Step 2: Develop a UAR Schedule

A well-defined User Access Review schedule is essential for continuous monitoring. Establish a schedule that incorporates:

• Regular reviews (e.g., quarterly or semi-annually).
• Specific timelines for reviewing new joiners, movers, and leavers.

Step 3: Implement Automated Tools

Many organizations are adopting automated tools to manage access reviews effectively. These can simplify the process of tracking and reviewing user activity. Consider the following:

• Integration of tools that support audit trail functionality.
• Capabilities for automated notifications when access requires review.

Step 4: Training and Communication

Ensure that all staff involved in the UAR process are trained adequately. Communication channels should also be established to report issues encountered during reviews:

• Conduct training sessions on compliance standards relevant to user access.
• Provide a framework for reporting and addressing potential discrepancies during reviews.

Step 5: Documentation and Record-Keeping

Maintaining thorough documentation of the User Access Review process is crucial for compliance. Documentation should include:

• Records of user access levels and any changes made.
• Reports generated from automated tools, if applicable.
• Audit trail reviews and assessments of any exceptions.

Conclusion

User Access Reviews based on the joiners, movers, and leavers framework are fundamental in supporting the integrity and compliance of computer systems in the pharmaceutical industry. Adopting a structured process ensures that user access aligns with regulatory standards and organizational goals. By implementing risk assessments, configuration management, and change control procedures, organizations can successfully navigate the complexities of CSA and CSV in a cloud-based environment.

Compliance with regulations such as 21 CFR Part 11 and Annex 11 is paramount. As digital transformations continue in the pharmaceutical sector, the processes described here will remain critical to protecting sensitive data and ensuring compliance.