The approval says it was the supervisor. Everyone on the floor knows three people use that shared login. Nobody has raised it, because the work gets done and the alternative was never made easy enough.
Shared logins are rarely anybody's plan. They arrive because signing in costs more than the work can absorb, and they persist because removing them means fixing that first.
Why do shared logins happen?
Because the system asks for something the work cannot give it. Picture a single terminal on a production floor, shared across shifts. Signing out and back in might cost a minute and a half. That minute and a half repeats every time somebody needs the system, and across a day it reaches a number somebody decides not to pay.
So one account stays open. It is not negligence, it is arithmetic, and any fix that ignores the arithmetic will fail the same way the last one did.
What does a shared login actually cost you?
Not security, at least not first. What it costs first is the meaning of everything that account touched.
An electronic signature is a claim that one specific person reviewed something and stood behind it. The moment three people can produce it, the claim stops being about a person and becomes a claim about a room. Every record that account approved carries the same ambiguity, as far back as the sharing goes.
That is the part that surprises people. The exposure is not the day somebody misuses the account. It is every day it worked exactly as intended, because nobody can attribute those records either.
What does a regulator do with an unprovable signature?
The requirement is explicit about attribution, so the signature does not meet the standard it was recorded to satisfy. The electronic signature requirements in 21 CFR Part 11 rest on a signature belonging to one identified person, which a shared account cannot deliver. And FDA guidance on data integrity approaches the same ground from the direction of whether a record can be relied upon at all.
The question that arrives is usually about a batch rather than about logins. Who approved this, and the inspector follows the answer. A shared account turns a two-minute answer into a conversation about controls, and those tend to expand.
We covered the wider obligations in our Part 11 compliance checklist, and the signature question sits at the centre of it.
Why does telling people to stop not work?
Because it addresses the wrong half. The sharing is a symptom of a sign-in that costs too much in a setting where seconds accumulate, and a policy does not change the arithmetic.
An instruction on its own tends not to hold. Not because anyone defies it, but because the work returns to the shape that lets it get done, and that shape has not changed.
The instruction holds once signing in as yourself becomes genuinely faster than sharing. Until then you are asking people to choose the slower option many times a day, on principle, and principle tends to lose that contest.
What actually ends shared logins?
Making individual sign-in quicker than the workaround. It sounds obvious, and it is the part an instruction cannot deliver.
On a shared terminal that means a sign-in taking a moment, rather than a password typed on a keyboard somebody is wearing gloves to use. A touch, a tap, a small physical object. Anything costing a second instead of a minute and a half. Once that is true, sharing ends without a memo, because each person's own account has become the path of least resistance.
That is the practical case for passwordless sign-in, and it has almost nothing to do with security theory. It is about whether the correct action is also the easy one. We take up what that looks like, including the options for people who cannot carry a phone onto the floor, in our piece on what replaces the password.
The other half is knowing what your records show today. If you are unsure which accounts are shared, asking is the slow route, since nobody enjoys answering. Look at the sign-in pattern instead. To work through what that would involve, talk to an expert, and our guide to user permissions sets out the wider model.
