Segregation of duties (SoD), sometimes called the four-eyes principle, separates incompatible responsibilities so that one person cannot complete a critical activity alone. The analyst who produced a result does not approve it; the operator who ran a batch does not release it; the administrator who configures a system does not use that access to change GMP data.
Why it matters in GMP
GMP is built on independent checks. 21 CFR 211.22 gives the quality control unit responsibility to approve or reject, separately from production, and EU GMP Chapter 2 expects the heads of production and quality control to be independent of each other. Data integrity guidance adds that system administrator rights should be separate from people who generate or approve data.
On paper, SoD depends on reviewers noticing that the same initials appear twice. In a computerised system it can be enforced: the software simply refuses to let the same account perform two incompatible steps.
- Define incompatible duties for each workflow: prepare, review, approve, verify, release.
- Enforce them on the server, so the rule cannot be bypassed from the screen.
- If an emergency override exists, record it on the record and on its printout.
- Review user access and role assignments periodically, so SoD stays effective as people change jobs.
How Swat iQua Suite handles it
Swat iQua Suite enforces segregation of duties on the server in 25 modules. Typical rules are preparer ≠ reviewer ≠ approver, verifier ≠ performer, and batch executor ≠ QA releaser, and most quality workflows have no admin bypass at all. Where an administrator override is allowed, it is recorded and shown on the record and its print.