QPPV.COM KNOWLEDGE ASSESSMENT

EudraVigilance Registration and Access Management

Test your understanding of the concepts covered by EudraVigilance Registration and Access Management.

Question 1 of 10Pass mark: 80%

Question 1 of 10 Which situation most clearly illustrates a segregation-of-duties concern?

One user views EVDAS analyses and another user performs ICSR submission. One user creates and submits reports, while a separate person performs oversight review. One user can create reports, approve them, modify records and perform the related oversight. An Org Admin maintains organisation details but does not perform safety operations.

Question 2 of 10 What is the most appropriate way to manage an exception in which a user retains privileged access after a periodic review?

Retain the access without explanation because privileged users are presumed to need it. Document the business justification, required approval, duration or review conditions and any compensating controls. Remove the user from the review population so the exception is not visible. Replace the user's individual account with a shared privileged account.

Question 3 of 10 An organisation cannot achieve complete segregation of duties because of its small team. What is the most appropriate governance approach?

Ignore the issue because segregation is never relevant to small organisations. Share credentials so that responsibility is distributed informally. Document the exception and implement appropriate compensating controls. Give all users identical permissions to ensure fairness.

Question 4 of 10 What is the main purpose of retaining account creation and role-change metadata such as creator, approver and timestamp?

To make the account appear more technically sophisticated. To establish an auditable history of how access decisions were made and implemented. To replace the need for documented role justification. To allow later users to inherit the same permissions automatically.

Question 5 of 10 Which set of records would most directly support an inspector's request to demonstrate that a user was onboarded and later deactivated?

The current organisational chart and a general IT security policy. The original access request, approvals, identity and training evidence, account creation log, termination or change trigger, deactivation record and post-change verification. Only the user's final deactivation email. A list of all historical employees without account identifiers.

Question 6 of 10 During a security incident involving a user account, what should the organisation generally do first?

Wait for the next scheduled periodic review before taking action. Immediately suspend the account pending investigation and document the actions taken. Delete all audit records to prevent further disclosure. Transfer the account to an Org Admin so activity can continue.

Question 7 of 10 Which feature most strengthens the inspection value of a periodic access review report?

It lists only the accounts that required no action. It maps the reviewed user export to each account's outcome and records reviewers, date, findings and remediation. It contains an undated screenshot of the organisation's access policy. It reports only the total number of users without identifying roles.

Question 8 of 10 Which approach best applies the principle of least privilege to a technical IT administrator?

Give the IT administrator safety reporting and signal-analysis permissions as a standard precaution. Provide technical account-management rights while restricting safety operations unless specifically authorised and supported by compensating controls. Use a shared IT account for all administrative and safety activities. Allow unrestricted access because technical administrators are automatically part of the PV function.

Question 9 of 10 A newly established pharmacovigilance service provider needs to submit reports on behalf of a marketing authorisation holder. What should occur before its individual staff members are given EudraVigilance access?

The provider should first be registered as an organisation and its regulatory role and authorised contacts documented. Individual staff should create personal accounts and the organisation can be registered later. Only the marketing authorisation holder needs to be registered because the provider is an external party. The provider should request administrator rights so that registration requirements can be bypassed.

Question 10 of 10 An organisation has comprehensive SOPs but cannot retrieve user approvals and review records within an inspection timeframe. What does this indicate?

The written procedures are sufficient even if they were not executed or cannot be evidenced. The organisation has a recordkeeping and operational-readiness weakness despite having documented procedures. The organisation should stop retaining access records because they are difficult to retrieve. The organisation has demonstrated stronger governance than one with retrievable evidence.

EudraVigilance Registration and Access Management

Cookie Settings