Part 1 · Module 1
GCP diagnostic
Twenty-four questions on the revised guideline, the roles it defines, and what each principle means for the documents you write
Your scenario
You are asked to write a protocol section on quality management. You reach for the GCP training you did four years ago and describe monitoring visits and source data verification. The guideline it was based on has been replaced, and the framework you have just written is the one E6(R3) was revised to move away from.
Why this course exists now
ICH E6(R3) was finalised in January 2025, replacing the 2016 E6(R2) guideline. It became applicable in the European Union in July 2025, and other regions have followed on their own timetables. It is not a light revision — it is a restructure, with a different underlying philosophy.
Most GCP training in circulation was written for E6(R2). This course teaches the revised framework and, throughout, what each principle actually means for the documents a medical writer produces.
A note on currency and scope
E6(R3) is composed of an overarching Principles and Objectives document and Annex 1 (interventional clinical trials), both finalised. Annex 2, covering non-traditional interventional trials, was still in development at the time this course was written.
Implementation dates differ by region, and some trials will continue under E6(R2) through transition. Always confirm which version applies to the trial you are working on, and check the current status of Annex 2 before relying on anything about it.
Implementation dates differ by region, and some trials will continue under E6(R2) through transition. Always confirm which version applies to the trial you are working on, and check the current status of Annex 2 before relying on anything about it.
—
—
Your eight areas — study the red ones first
Before you move on
Write down your three weakest areas.
Module 1.1 complete
What E6(R3) changed
Part 1 · Module 2
What E6(R3) changed
A restructure with a different philosophy — and a set of consequences for the documents you write
Your scenario
A protocol you are drafting includes a monitoring section specifying 100% source data verification at every visit. A reviewer comments: “Where are the critical to quality factors?” You have written a monitoring plan from the old paradigm — thorough, expensive, and not what the current guideline asks for.
The structure
Figure 1.2 — The modular structure. The separation matters practically: the principles apply universally, while the annexes carry the trial-type-specific detail. It also means the guideline can be extended to new trial types without reopening the core.
The shift, and what it means for your documents
| From | To | Consequence for the writer |
|---|---|---|
| Uniform procedures applied to all trials | Proportionate, risk-based, fit for purpose | Protocols must justify the level of oversight, not just describe it |
| Quality checked after the fact | Quality built in at design | Critical to quality factors identified in the protocol |
| 100% source data verification as default | Targeted verification plus centralised monitoring | Monitoring sections describe a strategy, not a visit frequency |
| Paper-oriented record expectations | Technology-neutral data governance across the lifecycle | Data handling described by principle, not by medium |
| Site-based trial model assumed | Flexibility for decentralised and hybrid designs | Protocols can describe remote and local procedures without special pleading |
| Consent as a document | Consent as a process, with additional guidance | Consent materials and procedures described as a process in the protocol |
The mistake experienced people make
If your GCP knowledge is solid but predates 2025, the parts you know best — roles, consent, essential documents — have changed least. The part you are most likely to get wrong is quality management, because the old answer (more monitoring, more verification) is now the wrong answer.
Writing “100% SDV” into a protocol today signals that the author is working from a superseded framework.
Writing “100% SDV” into a protocol today signals that the author is working from a superseded framework.
Drills
Drill 1 of 3
What replaced the single-document structure of E6(R2)?
AA principles document with annexes by trial type
BA procedural checklist
CThree independent guidelines
DNothing — E6(R2) remains the primary document
Drill 2 of 3
A protocol specifies 100% source data verification at every visit for every participant. What is the issue?
ANone — it is the most thorough approach
BIt applies uniform effort rather than a risk-based, proportionate approach
CIt is too expensive
DSource data verification is no longer permitted
Drill 3 of 3
A trial began under E6(R2). Which version applies now?
AE6(R3), immediately and everywhere
BE6(R2) until the trial closes, in all cases
CIt depends on the region and the transitional arrangements — confirm and document
DNeither, during the transition period
Reflection
When did you last do formal GCP training, and which version was it based on?
Module 1.2 complete
GCP principles & risk-based quality management
Part 1 · Module 3
The principles in practice
A small set of principles, applied consistently — and what each one asks of a document you are writing
Your scenario
A protocol proposes a trial too small to answer its question. It is ethically reviewed, properly consented, well monitored and fully compliant in every procedural respect. It still breaches GCP, because a trial that cannot answer its question exposes participants to risk for no scientific gain.
The principles, and what each asks of your documents
| Principle | What it asks of a document |
|---|---|
| Participants' rights, safety and well-being prevail over the interests of science and society | Consent materials comprehensible; withdrawal rights stated; safety monitoring described; risks not understated in participant-facing text |
| Trials should be scientifically sound | The design must be capable of answering the question. Sample size justification, endpoint definition and analysis plan are ethical documents, not only technical ones. |
| Trials should be designed and conducted by qualified individuals | Delegation documented; training records maintained; roles defined in the protocol |
| Quality should be built into design and conduct | Critical to quality factors identified prospectively; risk mitigation described in the protocol |
| Approaches should be proportionate to risk | Oversight, monitoring and documentation justified by what they protect, not applied uniformly |
| Trial information should be reliable | Data governance across the lifecycle; traceable changes; records that permit reconstruction |
| Roles and responsibilities should be clear | Sponsor, investigator, delegate and vendor responsibilities documented, including for delegated activities |
| Trials should be registered and results reported | Registration before enrolment; results reported regardless of outcome |
The principle writers under-use
Scientific soundness is an ethical requirement. This is the principle that gives a medical writer standing to raise a design problem.
If a protocol's sample size cannot detect a clinically meaningful difference, or its endpoint does not measure what the objective claims, that is not merely a methodological weakness to be noted in limitations. It is a GCP concern, and framing it that way is how it gets taken seriously.
If a protocol's sample size cannot detect a clinically meaningful difference, or its endpoint does not measure what the objective claims, that is not merely a methodological weakness to be noted in limitations. It is a GCP concern, and framing it that way is how it gets taken seriously.
Drills
Drill 1 of 3
A trial is procedurally faultless but too small to answer its question. Is this a GCP issue?
ANo — GCP covers conduct, not design
BOnly if the ethics committee objects
COnly if the results are pooled later
DYes — scientific soundness is a GCP principle
Drill 2 of 3
A sponsor delegates data management entirely to a vendor. Where does responsibility sit?
AWith the sponsor, who must also oversee the delegated activity
BWith the vendor, once delegated
CShared equally, with no defined owner
DWith the investigators
Drill 3 of 3
A trial produced a negative result. What does GCP require regarding reporting?
ANothing — negative results need not be reported
BResults should be reported regardless of outcome
COnly commercially sponsored trials must report
DOnly if a journal accepts the manuscript
Reflection
Have you ever raised a design concern and had it dismissed as outside your remit? Would framing it as a GCP principle have changed the response?
Part 1 · Module 4
Risk-based quality management
The part of the guideline that changed most, and the part experienced people are most likely to get wrong
Your scenario
Asked to identify critical to quality factors for a trial, a team lists twenty-three items covering nearly every trial activity. Twenty-three critical factors is no critical factors — the point of identifying them is to concentrate effort, and a list that covers everything concentrates nothing.
Definition
Critical to quality factors
The attributes of a trial that are essential to participant safety and to the reliability of its results.
Identified prospectively, during design, by the people who know the trial. Effort, oversight and documentation are then concentrated on protecting them.
The test: if this were compromised, would the trial's conclusions be unreliable or would participants be at risk? If no, it is not critical — it may still matter, but not at this level.
Identified prospectively, during design, by the people who know the trial. Effort, oversight and documentation are then concentrated on protecting them.
The test: if this were compromised, would the trial's conclusions be unreliable or would participants be at risk? If no, it is not critical — it may still matter, but not at this level.
The cycle
Figure 1.4 — The quality management cycle. Prospective and iterative. The feedback loop matters: risk assessments made at design must be revisited as the trial proceeds, and the monitoring approach adjusted accordingly. A risk assessment written once and filed is not risk-based quality management.
Typical critical to quality factors
| Factor | Why it is critical |
|---|---|
| Eligibility determination | Wrong population makes the results uninterpretable and may expose participants to unjustified risk |
| Informed consent process | Ethical foundation of the trial |
| Randomisation and allocation concealment | Loss of concealment destroys the comparison |
| Primary endpoint assessment | The result depends on it entirely |
| Investigational product handling and accountability | Wrong product or wrong dose affects safety and interpretation |
| Serious adverse event identification and reporting | Participant safety and regulatory obligation |
| Blinding maintenance | Unblinding introduces bias that cannot be corrected afterwards |
What is not a critical to quality factor
Site staff turnover · delayed query resolution · incomplete non-essential fields · minor visit window deviations · administrative filing delays.
These matter and should be managed. They do not threaten participant safety or the reliability of the conclusions, and elevating them dilutes the concept until it no longer directs effort anywhere.
These matter and should be managed. They do not threaten participant safety or the reliability of the conclusions, and elevating them dilutes the concept until it no longer directs effort anywhere.
Reflection
For a trial you know, name three critical to quality factors. Could you defend each against the test — safety or reliability?
Module 1.3 complete
Decentralized clinical trials & DHTs (E6(R3) Annex 2)
Week 1 · Module 4
Decentralized Clinical Trials & Digital Health Technologies
Operationalizing ICH E6(R3) Annex 2: eConsent, Direct-to-Patient logistics, wearables, and remote data oversight
Your scenario
Your clinical operations team is designing a hybrid Phase III trial in Heart Failure (Cardiology) incorporating continuous wearable ECG monitors, home nursing visits for subcutaneous IP administration, and electronic informed consent (eConsent). During protocol review, a clinical reviewer asks: “How do we maintain Principal Investigator (PI) oversight when study procedures occur in a patient's living room rather than a hospital?” Under ICH E6(R3) Annex 2, the PI remains ultimately responsible for participant safety and data integrity, regardless of whether procedures are decentralized. This module masterfully details the governance, risk mitigation, and regulatory documentation required for modern DCTs.
The Decentralization Spectrum & ICH E6(R3) Annex 2
Decentralization is not an all-or-nothing model; it represents a continuum of patient-centric trial modalities spanning conventional brick-and-mortar sites to fully virtual direct-to-patient programs:
- Traditional Model: All visits, blood draws, and IP dispensations occur at the physical trial site.
- Hybrid Model (Most Common): Core baseline and safety imaging visits occur at the hospital, while routine check-ins, PRO questionnaires, and follow-up safety labs occur via telemedicine, mobile nurses, and local laboratories.
- Fully Decentralized (Virtual): Recruitment, eConsent, direct-to-patient (DtP) drug shipment, digital endpoint capture (DHTs), and remote monitoring occur without physical site visits.
Regulatory Architecture ICH E6(R3) Annex 2: Core DCT Governance Principles
| DCT Domain | Regulatory Expectation & GCP Safeguard | Medical Writing & Protocol Implications |
|---|---|---|
| Principal Investigator Oversight | The PI retains non-delegable responsibility for participant safety and trial conduct, even when third-party home nurses or local labs are contracted by the sponsor. | Clear delineation of responsibilities in Delegation of Authority (DOA) logs and explicit Investigator Oversight Plans. |
| Digital Health Technologies (DHTs) | Wearables and sensors must be analytically validated, clinically validated, and fit-for-purpose (FDA DHT Guidance / EMA Reflection Paper). | Protocol must specify handling of missing data, sensor calibration failures, data latency, and device replacement protocols. |
| Direct-to-Patient (DtP) Drug Delivery | Continuous temperature tracking, proof of secure delivery to the participant (or LAR), and strict chain-of-custody documentation. | Pharmacy Manual must detail cold-chain excursion escalation pathways, quarantine procedures, and destruction/return logistics. |
| Remote Monitoring & Centralized SDV | Remote Source Data Verification (rSDV) must protect participant privacy (HIPAA/GDPR) while ensuring ALCOA++ verifiable audit trails. | Clinical Monitoring Plan (CMP) must balance on-site visits with statistical data surveillance and central trigger algorithms. |
Validation Requirements for Digital Health Technologies (DHTs)
When selecting a wearable sensor (e.g. continuous glucose monitoring in Endocrinology or continuous actigraphy in Neurology/Parkinson's Disease), sponsors must document the V3 Framework:
- 1. Verification: Does the sensor accurately measure the physical property (e.g. electrical conductance, acceleration)?
- 2. Analytical Validation: Does the algorithm accurately translate raw physical signals into physiological parameters (e.g. tremor count, gait velocity, step cadence)?
- 3. Clinical Validation: Does the digital measurement accurately capture a clinically meaningful aspect of the patient's health status or disease severity in the target patient population?
Drills
Drill 1 of 3
In a decentralised Phase III asthma trial, a mobile nursing service contracted by the sponsor fails to perform required spirometry safety checks before dosing 15 participants. At FDA inspection, who bears regulatory accountability for this protocol non-compliance?
AThe mobile nursing agency alone, as the party performing the procedure
BThe Principal Investigator (site medical oversight) and the Sponsor (vendor qualification and oversight)
CThe eConsent and telemedicine platform provider
DThe IRB / ethics committee that approved the DCT protocol
Drill 2 of 3
Under ICH E6(R3) Annex 2, which statement about electronic informed consent (eConsent) in a decentralised trial is correct?
AeConsent removes the requirement for a dialogue between participant and site staff
BA digital signature is universally accepted as equivalent to a wet signature
CThe eConsent process must provide accessible information, the opportunity to ask questions, and adequate time for consideration
DOnce eConsent is obtained, no re-consent is needed for protocol amendments because the process is digital
Drill 3 of 3
A Phase II oncology trial uses a wearable device to collect continuous actigraphy data as a secondary endpoint. Who is responsible for verifying that the device data meets the ICH E6(R3) standard for source data?
AThe wearable device manufacturer, through their device validation studies
BThe trial participants, as the wearers
CThe health authority, at the time of submission
DThe sponsor (technology validation and data integrity oversight) and the investigator (source data completeness at the site)
Module 1.4 complete
Roles and responsibilities
Part 2 · Module 1
Roles and responsibilities
Sponsor, investigator, ethics committee — who owns what, and why delegation never transfers responsibility
Your scenario
An inspection finds that a vendor mishandled data across four sites. The sponsor's position is that data management was contracted out. That is not a defence. Duties are delegable; responsibility for quality and integrity is not, and oversight of the delegated activity was itself a sponsor obligation.
The three roles
| Role | Owns | Common failure |
|---|---|---|
| Sponsor | Trial design, quality management, safety reporting, oversight of everything delegated, data integrity | Treating delegation as transfer of responsibility |
| Investigator | Conduct at the site, participant safety, informed consent, source data, supervision of delegates | Undocumented delegation; signing for work not overseen |
| Ethics committee / IRB | Protecting participants' rights, safety and well-being; review and ongoing oversight | Amendments implemented before approval |
Delegation, correctly done
Three requirements, and all three are inspected: the delegate is qualified for the task; they are trained on it; and the delegation is documented, usually on a delegation log with dates.
The person delegating retains responsibility. An investigator who signs a delegation log for tasks they do not supervise has documented their own failure of oversight rather than discharged it.
The person delegating retains responsibility. An investigator who signs a delegation log for tasks they do not supervise has documented their own failure of oversight rather than discharged it.
Before the first participant
| Must be in place | Held where |
|---|---|
| Ethics committee approval, with versions specified | Trial master file and site file |
| Regulatory authorisation, where required | Trial master file |
| Signed agreement between sponsor and investigator | Both files |
| Current investigator's brochure | Site file |
| Delegation log, signed and dated | Site file |
| Training records for all delegated staff | Site file |
| Trial registration | Public registry, before enrolment |
Drills
Drill 1 of 3
A CRO conducts monitoring badly across several sites. Who is answerable to the regulator?
AThe CRO alone
BThe sponsor, who retains responsibility and owed oversight
CThe investigators
DThe ethics committee
Drill 2 of 3
A protocol amendment is needed to remove an immediate hazard to participants. What is the sequence?
AWait for ethics approval before acting
BImplement and report at the next scheduled review
CImplement immediately, then report promptly and submit the amendment
DNote it for the end-of-trial report
Drill 3 of 3
A study nurse performs eligibility assessments. What must exist?
AVerbal instruction from the investigator
BSponsor written approval of that individual
CNothing — only the investigator may assess eligibility
DDocumented qualification, training records, and a signed delegation log entry
Reflection
Have you seen delegation treated as transfer of responsibility? What happened?
Module 2.1 complete
Informed consent & vulnerable populations
Part 2 · Module 2
Informed consent
A process, not a form — and the document a medical writer most often has direct power to improve
Your scenario
A consent form runs to 24 pages at postgraduate reading level. Every required element is present and the ethics committee approved it. Participants sign without understanding it, which means the ethical requirement has not been met even though the procedural one has.
Consent is a process
Figure 2.2 — The consent process. Comprehension is the stage a medical writer directly controls, and the stage most often failed. Note the return path: consent is not a single event, and new safety information that could affect willingness to continue must trigger it.
Writing a consent document that works
| Principle | In practice |
|---|---|
| Layered structure | A short plain-language summary first, then detail. Most participants read the first two pages properly. |
| Reading level | Aim well below the general adult average — typically around age 12–14 reading age |
| Second person, active voice | “You will have a blood test”, not “Blood samples will be obtained from the subject” |
| Risks stated plainly | Natural frequencies: “about 4 in every 10 people”. Never soften a serious risk to avoid alarm. |
| Voluntariness explicit | Right to decline and to withdraw at any time, without giving a reason and without affecting their care |
| Uncertainty stated | That the treatment may not help them, and that the purpose is to find out |
| No therapeutic misconception | Avoid language implying the trial is treatment chosen for their benefit |
Therapeutic misconception
The belief that trial participation is individualised treatment chosen for one's own benefit. It is common, it undermines valid consent, and consent documents frequently cause it.
Phrases that feed it: your treatment, your therapy, this study will help you, your doctor has selected this for you.
Better: the study medicine, you will be assigned by chance to one of two groups, we do not know whether this medicine will help — that is what the study is trying to find out.
Phrases that feed it: your treatment, your therapy, this study will help you, your doctor has selected this for you.
Better: the study medicine, you will be assigned by chance to one of two groups, we do not know whether this medicine will help — that is what the study is trying to find out.
Drills
Drill 1 of 3
A 24-page consent form contains every required element and was approved. Is consent valid?
ANot necessarily — comprehension is required, not just disclosure
BYes — all elements are present and it was approved
COnly if it is under 10 pages
DYes, once signed
Drill 2 of 3
Which phrase should not appear in a consent document?
A“Taking part is your choice.”
B“Your doctor has chosen this treatment for you.”
C“We do not know whether this medicine will help you.”
D“You can stop at any time without affecting your care.”
Drill 3 of 3
A new safety finding emerges that could affect willingness to continue. What is required?
ANote it in the final report
BInform only participants not yet enrolled
CInform participants in a timely manner; re-consent may be required
DWithhold it to avoid unnecessary withdrawals
Reflection
Read any consent form you can find. Does it say anywhere that the treatment may not help the participant?
Module 2.2 complete
Independent oversight bodies: DMC & CEC charters
Week 2 · Module 3
Independent Oversight Bodies: DMC & CEC Charters
Establishing Data Monitoring Committees (DSMB) and Clinical Endpoint Adjudication Committees under ICH E6 & FDA/EMA Guidance
Your scenario
You are drafting the Data Monitoring Committee (DMC) Charter for an event-driven Phase III trial in Type 2 Diabetes and Chronic Kidney Disease (Endocrinology/Nephrology). The trial tests whether an investigational SGLT2-inhibitor reduces renal composite endpoints and cardiovascular mortality. The biostatistician asks you to draft the operational firewall provisions to ensure interim unblinded efficacy data do not leak to the sponsor's clinical team. If unblinded interim results leak, the entire trial's statistical integrity and regulatory acceptability will be permanently compromised.
The Two Critical Independent Oversight Committees
Modern clinical trials frequently require independent external expert bodies to protect patient safety and guarantee unbiased efficacy adjudication:
Comparative Analysis DMC vs. CEC: Core Distinctions
| Parameter | Data Monitoring Committee (DMC / DSMB) | Clinical Endpoint Committee (CEC / EAC) |
|---|---|---|
| Primary Purpose | Safeguard trial participant safety and evaluate trial integrity by periodically reviewing unblinded accumulating safety and efficacy data. | Standardize, validate, and adjudicate subjective or complex clinical endpoints in a blinded, consistent manner against pre-specified diagnostic criteria. |
| Blinding Status | Unblinded: Accesses unblinded treatment-arm level data (provided by an Independent Statistical Center [ISC]). | Strictly Blinded: Evaluates medical source records (ECGs, angiograms, imaging, pathology) without knowledge of assigned treatment. |
| Core Responsibilities | Recommends trial continuation, protocol modification, temporary hold, or early termination (due to safety concerns, overwhelming efficacy, or futility). | Classifies clinical events (e.g. adjudicating whether an event meets the definition of Non-Fatal MI, Ischemic Stroke, or CV Death in a 3-Point MACE composite). |
| Key Governing Deliverable | DMC Charter: Defines meeting cadence, voting thresholds, stopping boundaries (O'Brien-Fleming, Pocock), and communication firewalls. | CEC Charter: Defines clinical endpoint diagnostic criteria, required source dossier packages, voting rules, and discordance resolution. |
The DMC Operational Firewall & Information Flow
To prevent operational bias and maintain regulatory validity, the DMC operates behind an impenetrable statistical firewall:
- Open Session: Sponsor team, CRO, and DMC meet to discuss blinded overall accrual, demographic distribution, drop-out rates, and aggregate adverse event rates.
- Closed Session: Only independent voting DMC members and the unblinded Independent Statistical Center (ISC) biostatistician attend. Unblinded comparative safety and interim efficacy tables are reviewed.
- Executive Session: Only voting DMC members discuss and vote on formal recommendations.
- Communication to Sponsor: The DMC communicates with the sponsor only via written formal recommendations (e.g. "Continue trial without modification" or "Amend protocol to reduce dose in elderly subgroup") without revealing unblinded comparative effect sizes.
Drills
Drill 1 of 3
During a Phase III double-blind cardiology trial, the Clinical Endpoint Committee (CEC) adjudicates primary endpoint events. Who on the CEC is permitted to see a participant's randomised treatment assignment?
AOnly the CEC Chairperson and lead adjudicator
BNo one on the CEC — all members must remain blinded to treatment allocation
CAny voting physician member of the committee
DAll members, provided they sign a non-disclosure agreement
Drill 2 of 3
A Data Monitoring Committee (DMC) interim analysis shows a pre-specified stopping boundary for overwhelming efficacy has been crossed. Which person is authorised to receive the unblinded interim results?
AThe sponsor project team lead, under confidentiality
BAll Principal Investigators, so they can counsel participants
CThe DMC members and Independent Statistical Centre statisticians only
DThe health authority, so they can decide whether to halt the trial
Drill 3 of 3
The DMC issues a recommendation to place a temporary hold on enrolment pending review of an emerging safety signal. What is the sponsor's GCP obligation?
AThe sponsor may continue enrolment because the DMC recommendation is advisory only
BImplement the hold immediately, notify investigators and ethics committees, assess safety reporting obligations, and document all actions
CContinue enrolment while commissioning an independent analysis to verify the signal
DNotify investigators and allow each site to decide whether to continue enrolment
Module 2.3 complete
IP management & cold chain integrity
Week 2 · Module 4
Investigational Product Management & Cold Chain Integrity
Handling accountability, blinding integrity, temperature excursions, and Direct-to-Patient drug logistics
Your scenario
At an oncology trial site investigating a temperature-sensitive monoclonal antibody (stored at 2°C–8°C), a weekend power outage results in a 14-hour temperature spike to 18°C in the site pharmacy refrigerator. The site coordinator asks if they can still administer the vials to 4 scheduled patients on Monday morning. As a clinical quality and GCP specialist, what is the mandatory immediate action required under ICH E6 and GMP/GDP regulations? Administering compromised investigational product without sponsor stability clearance is a critical GCP non-compliance and patient safety violation.
The Lifecycle of Investigational Medicinal Products (IMP / IP)
Investigational Product (IP) management represents the critical intersection between Good Clinical Practice (ICH E6) and Good Manufacturing Practice (GMP / Annex 13). Every dose of investigational drug or device must maintain a complete, unbroken chain of custody from manufacturing release to patient administration or destruction.
Core Governance Key IP Management Workflows
| IP Lifecycle Phase | GCP & Regulatory Mandate | Documentation Artifact |
|---|---|---|
| Receipt & Storage | Verify shipment integrity, tamper-evident seals, and continuous temperature data logger logs upon delivery at site. | IP Shipment Receipt Form, Certificate of Analysis (CoA), Temperature Logger Download. |
| Dispensation & Dosing | Dispense strictly in accordance with randomization code and protocol eligibility criteria. Verify patient ID, kit number, and expiry/re-test date. | Investigational Drug Accountability Log (IPAL), eCRF IP Administration Record. |
| Temperature Excursions | Immediately quarantine affected IP (label "QUARANTINED - DO NOT DISPENSE") and notify sponsor QA for stability assessment. | Temperature Excursion Report, Sponsor QA Disposition Authorization. |
| Emergency Unblinding | Unblinding at site is permitted only when immediate knowledge of the treatment is essential for emergency clinical management of the participant. | Interactive Response Technology (IRT/IWRS) Emergency Unblinding Log, PI Narrative Justification. |
| Reconciliation & Destruction | 100% reconciliation of received vs. dispensed vs. returned vs. destroyed vials/tablets before final trial closeout. | Final Drug Accountability Record, Certificate of Destruction. |
Emergency Unblinding vs. Routine Safety Reporting
A common regulatory misconception is that Investigators must unblind a patient before reporting a Serious Adverse Event (SAE) to the sponsor. This is false. Under ICH E6(R2/R3) and ICH E2A:
- The Investigator submits the SAE report to the sponsor under blinded conditions.
- The Sponsor's Global Safety / PV team unblinds the case in a secure, firewalled safety database for expedited regulatory reporting (SUSAR) without unblinding the Investigator, site staff, or trial monitoring team.
- Investigator unblinding must remain restricted strictly to life-threatening clinical emergencies where specific medical management depends on knowing active vs. placebo allocation.
Drills
Drill 1 of 3
A site pharmacist finds that an IP shipment of biologic vials triggered a temperature excursion alert during transit. What is the correct immediate sequence of actions?
ADiscard the vials immediately and request an emergency re-shipment
BQuarantine the shipment, label it DO NOT USE, download the temperature logger data, and notify sponsor QA for a stability assessment
CInspect the vials visually and administer if the solution appears normal
DContact the IRB/IEC for permission before taking any action
Drill 2 of 3
Which document provides the primary record of investigational product accountability at the site, tracking each unit from receipt through dispensing or return?
ACertificate of Analysis (CoA) from the manufacturer
BThe IP Accountability Log (also called the Drug Accountability Log or IPAL)
CThe electronic Case Report Form (eCRF) IP administration page
DThe randomisation code list held in the IRT system
Drill 3 of 3
A participant in a double-blind trial experiences a sudden anaphylactic reaction and the emergency physician needs to know whether they received active drug or placebo to guide treatment. Under ICH E6, which action is GCP-compliant?
AUnblind the case to complete the SAE report form to the sponsor
BWait for sponsor QA approval before accessing the treatment code
CUnblind immediately through the IRT/IWRS emergency function, document the rationale and persons involved, and notify the sponsor
DAccess the treatment code through the SAE reporting system
Module 2.4 complete
Clinical safety reporting (AE, SAE, SUSAR, RSI)
Part 2 · Module 4
Safety reporting
Who reports what, to whom, and how fast — plus the three-term vocabulary that gets confused constantly
Your scenario
An event is recorded as “serious” because it was graded severe. It required no intervention and no hospitalisation. Severity and seriousness are different things, and conflating them either inflates the safety database or, in the opposite direction, misses a reportable event entirely.
The vocabulary
| Term | Definition |
|---|---|
| Adverse event | Any untoward medical occurrence in a participant. No causal judgement. |
| Adverse reaction | An event where a causal relationship to the product is at least a reasonable possibility |
| Serious | A regulatory category: death, life-threatening, hospitalisation or its prolongation, persistent disability, congenital anomaly, or an important medical event |
| Severe | Intensity. A severe headache may be non-serious; an asymptomatic finding causing hospitalisation is serious |
| Unexpected | Not consistent with the reference safety information in the current investigator's brochure |
| SUSAR | Suspected unexpected serious adverse reaction — requires expedited reporting |
Three independent axes
Causality (event or reaction), seriousness (regulatory category), and expectedness (against the RSI) are assessed separately.
An event can be severe and not serious; serious and unrelated; related and expected. Only the combination of suspected plus unexpected plus serious triggers expedited reporting — which is why all three must be assessed rather than collapsed into a single judgement.
An event can be severe and not serious; serious and unrelated; related and expected. Only the combination of suspected plus unexpected plus serious triggers expedited reporting — which is why all three must be assessed rather than collapsed into a single judgement.
Who reports what
| Who | Reports what | To whom, when |
|---|---|---|
| Investigator | Serious adverse events | Sponsor, immediately, except protocol-specified exclusions |
| Investigator | Non-serious adverse events | Sponsor, per protocol timelines |
| Sponsor | SUSARs | Regulators, investigators, ethics committees — expedited |
| Sponsor | Annual safety review | Regulators — the development safety update report |
| Sponsor | Urgent safety measures and serious breaches | Regulators and ethics committees, promptly |
| Investigator | Anything affecting participant safety | Ethics committee, per local requirements |
Drills
Drill 1 of 3
A grade 3 headache resolves with paracetamol, no hospitalisation. How is it classified?
ASerious, because it is grade 3
BNeither severe nor serious
CSerious until it resolves
DSevere but not serious
Drill 2 of 3
A serious event occurs that is not listed in the reference safety information. What follows?
AIf suspected related, it is a SUSAR requiring expedited reporting
BRoutine reporting at the next data cut
CReport only if the investigator requests it
DNo obligation, since it is not in the RSI
Drill 3 of 3
Against what is expectedness assessed?
AThe clinical study report
BThe reference safety information in the current investigator’s brochure
CThe SmPC
DThe investigator’s clinical judgement
Reflection
Could you state the seriousness criteria from memory? They are the definitions most often paraphrased incorrectly.
Module 3.1 complete
Data governance and records (ALCOA++)
Part 2 · Module 3
Data governance and records
Data integrity across the lifecycle, and a trial master file that lets someone reconstruct what happened
Your scenario
An inspector asks to see how a value in the database traces back to its source. At one site the original entries were corrected by overwriting. The current values may well be correct — and nobody can demonstrate it, which for regulatory purposes is the same as their being wrong.
Integrity attributes
| Attribute | Means |
|---|---|
| Attributable | Who recorded or changed it is known |
| Legible | Readable and permanent, including the original after a correction |
| Contemporaneous | Recorded when the activity occurred, not reconstructed later |
| Original | The first capture, or a verified certified copy |
| Accurate | Reflects what actually happened |
| Complete | Nothing omitted, including inconvenient results |
Corrections
A correction must leave the original value visible, and record who changed it, when, and why.
On paper: a single line through the original, initialled and dated, with a reason. Never obliterated, never overwritten, never removed with correction fluid.
Electronically: the audit trail does this, provided it is enabled, protected and not edited. An audit trail that can be disabled or altered is not an audit trail, and vendor system qualification is where that gets established.
On paper: a single line through the original, initialled and dated, with a reason. Never obliterated, never overwritten, never removed with correction fluid.
Electronically: the audit trail does this, provided it is enabled, protected and not edited. An audit trail that can be disabled or altered is not an audit trail, and vendor system qualification is where that gets established.
The trial master file
| Requirement | Why |
|---|---|
| Permits reconstruction of trial conduct | An independent reviewer should be able to follow what was done and why |
| Contemporaneous | A TMF assembled before an inspection is itself a finding |
| Complete and current throughout | Not only at the end — it is a live record |
| Retained for the required period | Periods vary by region and by trial type |
| Accessible for inspection | Including for electronic systems and delegated vendors |
Technology neutrality
E6(R3) is written to apply regardless of how data are collected — paper, electronic case report forms, wearables, participant apps, or data drawn from health records.
The attributes do not change with the medium. What changes is how you demonstrate them: for an electronic system, that means system validation, access control, audit trail integrity and vendor qualification.
The attributes do not change with the medium. What changes is how you demonstrate them: for an electronic system, that means system validation, access control, audit trail integrity and vendor qualification.
The ALCOA++ Data Integrity Framework for Clinical Trial Records
ICH E6(R3) and regulatory inspection frameworks (FDA 21 CFR Part 11, EMA GCP Inspectors Working Group) evaluate trial record authenticity using the ALCOA++ standard:
| Principle | Regulatory Requirement | Medical Writer / Trial Record Implication |
|---|---|---|
| Attributable | Traceable to the specific individual who observed and recorded the data. | Electronic signature logs, audit trails, user access credentials in EDC/eCOA. |
| Legible | Readable and accessible throughout the statutory record retention lifecycle. | Standardized fonts, clear scanned source uploads, non-corrupted PDF/eTMF archives. |
| Contemporaneous | Recorded in real time as the clinical event or assessment occurs. | Time-stamped audit logs. Late entries must be explicitly flagged with rationale. |
| Original | First recording of study data (or a certified exact copy). | Direct electronic capture (eSource/eCRF) or certified true copy of hospital paper charts. |
| Accurate | Truthful, verified, and free from transcription or computational errors. | Source Data Verification (SDV), automated EDC edit checks, medical review reconciliation. |
| + Complete | Includes all recorded data, repeated test runs, audit trails, and metadata. | No hidden testing, no selective deletion of out-of-range lab runs. |
| + Consistent | All data elements demonstrate chronological and methodological concordance. | No contradictory dates (e.g. visit date occurring prior to consent date). |
| + Enduring | Stored on durable media capable of surviving 25+ years without degradation. | Validated cloud storage, regular backup verification, climate-controlled physical archive. |
| + Available | Promptly retrievable for regulatory inspections, audits, and safety reviews. | Organized eTMF folder structures aligned with the DIA TMF Reference Model. |
Drills
Drill 1 of 3
A site corrects a paper source entry by covering it with correction fluid and writing the new value. What is wrong?
ANothing, if the new value is correct
BOnly a problem if not countersigned
CThe original is obliterated, destroying traceability
DPaper source records are no longer permitted
Drill 2 of 3
A TMF is assembled in the two weeks before an inspection. What is the problem?
ANone — it is complete when inspected
BOnly a problem if it took more than a month
COnly a problem for paper TMFs
DIt must be contemporaneous; retrospective assembly is itself a finding
Drill 3 of 3
Trial data are collected via a participant smartphone app. Which integrity attributes apply?
AAll of them — the attributes do not change with the medium
BNone — app data are not source data
COnly accuracy
DNew technologies are outside GCP
Reflection
Could you demonstrate the origin of every number in the last document you wrote?
Module 3.2 complete
Protocol deviations, serious breaches & CAPA
Part 3 · Module 1
Deviations, non-compliance and breaches
Three escalating categories, one judgement to get right — and the documents that record each
Your scenario
A site records forty-one visit-window deviations and one instance of enrolment before ethics approval. The deviation log treats them identically. Forty-one are noise; one is a serious breach requiring prompt reporting to regulators. A log that cannot distinguish them has hidden the one that mattered.
The three categories
| Category | Example | Action |
|---|---|---|
| Protocol deviation | Visit outside the window; a non-critical assessment missed | Recorded, monitored for patterns, addressed at site level |
| Significant deviation / non-compliance | Eligibility criterion not met at enrolment; repeated deviations affecting a critical factor | Root cause analysis, corrective action, reported per protocol and to the ethics committee where required |
| Serious breach | Enrolment before approval; consent not obtained; falsification; unblinding affecting the analysis | Prompt reporting to regulators and ethics committees, per regional requirements |
The test for a serious breach
Does it affect, to a significant degree, the safety or rights of participants, or the reliability and robustness of the data?
If yes, it is a serious breach, and reporting timelines are short. The judgement is not about how embarrassing it is or how many participants were affected — a single participant enrolled without consent meets this test.
If yes, it is a serious breach, and reporting timelines are short. The judgement is not about how embarrassing it is or how many participants were affected — a single participant enrolled without consent meets this test.
Patterns matter more than instances
A single visit-window deviation is noise. Forty visit-window deviations concentrated at one site is a signal — about site capacity, training, or a protocol that is not operationally feasible.
Risk-based quality management depends on detecting patterns, which is why deviations must be categorised consistently and analysed centrally rather than only logged.
Risk-based quality management depends on detecting patterns, which is why deviations must be categorised consistently and analysed centrally rather than only logged.
Drills
Drill 1 of 3
A participant was enrolled without documented consent. What is this?
AA protocol deviation, logged and monitored
BA serious breach requiring prompt reporting
CCorrectable by obtaining consent retrospectively
DOnly serious if more than one participant is affected
Drill 2 of 3
One site has 40 visit-window deviations in six months. What is the correct response?
ALog them; each is individually minor
BClose the site immediately
CInvestigate the pattern and address the root cause
DAmend the protocol to widen the windows
Drill 3 of 3
What is the test for whether a deviation is a serious breach?
AHow many participants were affected
BWhether it cost the sponsor money
CWhether it was intentional
DWhether it significantly affects participant safety or rights, or data reliability
Reflection
In a deviation log you have seen, could you distinguish noise from signal? Were categories applied consistently?
Module 3.3 complete
Essential documents & Trial Master File mastery
Week 3 · Module 4
Essential Documents & Trial Master File Mastery
Structuring the eTMF, navigating the DIA Reference Model, and ensuring inspection readiness
Your scenario
Prior to an FDA Bioresearch Monitoring (BIMO) pre-approval inspection, you are conducting an audit of the electronic Trial Master File (eTMF) for a global Phase III trial in Rheumatoid Arthritis (Immunology). In the Investigator Site Files (ISF), you discover missing Form FDA 1572 financial disclosure updates for 3 sub-investigators added 18 months ago, and multiple protocol signature pages lack timestamped audit trails. An eTMF is not merely a filing cabinet; it is the comprehensive legal and scientific record that reconstructs the “Story of the Trial” for regulatory inspectors.
What Are Essential Documents? (ICH E6 Section 8)
Under ICH E6 Section 8, Essential Documents are defined as those documents which individually and collectively permit evaluation of the conduct of a trial and the quality of the data produced. They serve to demonstrate the compliance of the investigator, sponsor, and monitor with the standards of GCP and with all applicable regulatory requirements.
eTMF Architecture The DIA TMF Reference Model Structure
The Drug Information Association (DIA) TMF Reference Model organizes trial documentation into 10 standardized zones:
| TMF Zone | Key Artifacts | Inspection Focus & Critical Verification |
|---|---|---|
| Zone 01: Trial Management | Trial Project Plan, Risk Assessment (RBQM), Communication Plan, Meeting Minutes. | Demonstrates ongoing proactive sponsor oversight and decision traceability. |
| Zone 02: Central Trial Docs | Core Protocol, Protocol Amendments, Investigator's Brochure (IB), Sample ICFs, CSR. | Version control history, author/statistician sign-offs, regulatory version alignment. |
| Zone 03: Regulatory | IND/CTA submissions, Health Authority Approval letters, Annual Safety Reports (DSUR). | Verification that trials were not initiated before statutory regulatory authorization. |
| Zone 04: IRB / IEC | IRB/IEC Approvals, Committee Rosters, Approved ICF versions, Annual Renewals. | Ensure site never enrolled patients prior to documented IRB/IEC favorable opinion. |
| Zone 05: Site Management | Form FDA 1572, CVs, Medical Licenses, Financial Disclosures, Delegation of Authority (DOA). | Qualifications of investigators, absence of conflicting financial interests, timely DOA updates. |
| Zone 06: IP & Trial Supplies | Certificates of Analysis (CoA), Sample Labels, IP Shipping/Receipt/Destruction records. | Continuous chain-of-custody and resolution of all temperature excursions. |
| Zone 07: Data Management | Data Management Plan (DMP), eCRF completion guidelines, Database Lock authorization. | Audit trails, data queries resolution, blinded database lock before unblinding. |
| Zone 08: Safety / PV | Safety Management Plan, Line listings, SUSAR submission acknowledgments, RSI versions. | Strict compliance with 7-day/15-day expedited health authority reporting clocks. |
| Zone 09: Imaging & Committees | DMC Charter, DMC Minutes (open vs closed), CEC Charter, Adjudication dossiers. | Strict blinding maintenance and adherence to pre-specified stopping boundaries. |
| Zone 10: Third Parties (CROs) | Master Services Agreements (MSA), Transfer of Regulatory Obligations (TORO / 1572), Audits. | Verification that sponsor maintained rigorous oversight of contracted CRO vendors. |
The Three Golden Rules of Inspection-Ready eTMFs
- 1. Contemporaneous Filing: Documents must be uploaded and QC-approved in real time as events occur, not back-filled weeks before an expected inspection.
- 2. Story Reconstruction: An external inspector with zero prior knowledge must be able to reconstruct every major trial decision, protocol change, and patient safety escalation solely from the TMF.
- 3. Certified Copy Integrity: Digitized copies of physical source records must adhere to ALCOA++ standards with verified metadata, full resolution, and certified authentication.
Drill 1 of 3
Which of the following documents MUST be present in the Investigator Site File (ISF) and eTMF BEFORE the first subject is screened at a clinical site?
AFinal Database Lock Authorization and blind break code
BDocumented IRB/IEC approval, Health Authority authorization, and signed Investigator Agreement / Form FDA 1572
CFinal Clinical Study Report (CSR) synopsis and publication plan
DCertificate of IP Destruction from the central pharmacy
Drill 2 of 3
An inspector discovers that a monitoring report in the eTMF was uploaded 3 weeks after the site visit it describes. Which ALCOA++ attribute does this most directly violate?
AAttributable — the document author cannot be identified
BContemporaneous — records must be created at the time of the activity
COriginal — the document is not the first recording of the data
DAccurate — the document contains incorrect visit dates
Drill 3 of 3
A Form FDA 1572, delegation of authority (DOA) log, and sub-investigator financial disclosure forms are all filed under which DIA TMF Reference Model zone?
AZone 02: Central Trial Documents
BZone 04: IRB / IEC
CZone 05: Site Management
DZone 07: Data Management
Module 3.4 complete
Multi-regional clinical trials & cross-jurisdictional ethics
Week 4 · Module 1
Multi-Regional Clinical Trials & Cross-Jurisdictional Ethics
Executing global trials under ICH E17: ethnic sensitivity (ICH E5), regional standards of care, and multi-country GCP harmonization
Your scenario
Your biopharma company is planning a 40-country Phase III registration trial in Non-Small Cell Lung Cancer (NSCLC - Oncology) across North America, the European Union, Japan, China, and Latin America. In Asia, background EGFR mutation prevalence is ~40%–50% compared to ~15% in Western populations, and standard-of-care first-line therapy varies significantly across participating regions. As a clinical development specialist, you must apply ICH E17 (MRCT) and ICH E5 (Ethnic Factors) to ensure that the global primary endpoint data can support concurrent regulatory filings across the FDA, EMA, PMDA, and NMPA without requiring redundant local trials.
The Strategic Imperative of ICH E17
Historically, sponsors conducted standalone regional clinical trials, leading to delayed patient access and redundant development expenditures. ICH E17 (General Principles for Planning and Designing Multi-Regional Clinical Trials) establishes global standards to ensure that data generated in a single multi-regional trial can be accepted simultaneously across all global regulatory authorities.
MRCT Framework Core Elements of ICH E17 Study Design
| Design Element | Regulatory Expectation & Requirement | GCP & Operational Safeguards |
|---|---|---|
| Intrinsic & Extrinsic Ethnic Factors (ICH E5) | Evaluate whether genetic/metabolic polymorphism (intrinsic) or diet, medical practice, and socio-economic factors (extrinsic) alter drug response. | Pre-specified pharmacokinetic/pharmacodynamic (PK/PD) bridging sub-studies and regional subgroup stratification in the SAP. |
| Regional Sample Size Allocation | Overall trial power is based on the global primary endpoint, but regional sample sizes must be pre-planned to evaluate treatment effect consistency. | Avoid severely underpowered regional cohorts; establish consistency margins (e.g. Japanese or Chinese sub-population consistency criteria). |
| Standard of Care (SoC) Harmonization | Control arm and background standard of care must represent acceptable medical practice across all participating regulatory jurisdictions. | Explicit protocol definition of permitted concomitant medications and rescue therapies to avoid confounding primary outcomes. |
| Cross-Jurisdictional Ethics & Consent | Ensure ethical standards comply with ICH E6/Declaration of Helsinki while respecting local legal nuances (e.g. biobanking laws, genetic data privacy). | Local ethics committee approvals must align with the core global protocol without introducing protocol deviations. |
Evaluating Regional Treatment Effect Consistency
A primary failure mode in MRCT regulatory submissions is the emergence of regional discordance (e.g. the global trial meets p < 0.05, but Region A shows no treatment benefit). ICH E17 mandates:
- Pre-specifying regional subgroup analyses in the Statistical Analysis Plan (SAP) before database lock.
- Evaluating consistency using forest plots and interaction tests rather than isolated hypothesis tests within underpowered local regions.
- Investigating whether apparent regional differences stem from baseline demographic imbalances, diagnostic staging variations, or differences in post-progression lines of therapy.
Drills
Drill 1 of 3
When designing a global Phase III MRCT for simultaneous submission to FDA, EMA, and Japan PMDA, what is the primary statistical requirement under ICH E17?
AEach participating country must be powered independently at 90% for the primary endpoint
BThe trial is powered for the overall global population, with pre-specified regional allocations to assess treatment effect consistency
CRegional data cannot be pooled under any circumstances
DThe control arm can vary between regions based on local physician preference
Drill 2 of 3
Under ICH E5, what is required before a drug approved in one ICH region can be registered in a second ICH region without repeating the full clinical development programme?
AThe complete Phase III programme must be repeated in the new region
BOnly pharmacokinetic data from the new region is required
CAn ethnic factor assessment evaluating intrinsic and extrinsic factors, with a bridging study if the data cannot be extrapolated directly
DAgreement between the originating and receiving regulatory authorities is sufficient
Drill 3 of 3
In an MRCT, regional subgroup analyses show that Region A has a much smaller treatment effect than the global result. According to ICH E17, what is the appropriate analytical response?
AExclude Region A from the primary analysis to protect the global p-value
BStop the programme and conduct a separate regional trial in Region A
CInvestigate the inconsistency using pre-specified forest plots and interaction tests, exploring potential explanatory factors such as baseline differences and regional practice variation
DReport the regional result as evidence of a separate treatment effect in Region A
Module 4.1 complete
Site audits & health authority inspections
Week 4 · Module 2
Site Audits & Health Authority Inspections
Navigating FDA BIMO inspections, Form 483s, Warning Letters, EMA GCP inspections, and CAPA remediation
Your scenario
Following the submission of a Biologics License Application (BLA) in Multiple Sclerosis (Neurology), the FDA Bioresearch Monitoring (BIMO) program arrives at the highest-enrolling investigator site for a routine 5-day pre-approval inspection. At the closeout meeting, the FDA investigator issues an FDA Form 483 with 4 inspectional observations: failure to adhere to the protocol inclusion criteria, uncertified paper source copies, delayed SAE reporting, and inadequate PI oversight of delegated coordinator tasks. The sponsor and PI have exactly 15 business days to submit a comprehensive, evidence-backed Corrective and Preventive Action (CAPA) response to prevent an official Warning Letter and delayed BLA approval.
The Health Authority Inspection Landscape
Regulatory inspections represent the ultimate test of GCP compliance, data integrity, and sponsor oversight. While quality audits are conducted internally by sponsors or independent QA teams, regulatory inspections are conducted by statutory government inspectors (FDA BIMO, EMA, MHRA, PMDA, CDSCO) with legal enforcement authority.
Regulatory Enforcement Inspection Classifications & Severity
| Regulatory Authority | Inspection Finding Classification | Definition & Regulatory Consequence |
|---|---|---|
| US FDA (BIMO) | NAI (No Action Indicated) | No objectionable conditions found. Clean inspection. |
| US FDA (BIMO) | VAI (Voluntary Action Indicated) | Objectionable conditions identified (Form FDA 483 issued), but agency does not recommend administrative or regulatory sanctions. Written CAPA required within 15 days. |
| US FDA (BIMO) | OAI (Official Action Indicated) | Critical violations identified. Triggers Warning Letter, disqualification of investigator, rejection of study data, or clinical hold on development program. |
| EMA / MHRA | Critical Finding | Conditions, practices, or processes that adversely affect the rights, safety, or well-being of subjects and/or the quality and integrity of data. May invalidate dossier data. |
| EMA / MHRA | Major Finding | Conditions, practices, or processes that might adversely affect subject rights, safety, or data integrity. Requires systematic CAPA remediation. |
| EMA / MHRA | Minor Finding | Conditions or practices that do not adversely affect subject safety or data integrity, but represent quality improvement opportunities. |
The Anatomy of an Audit-Proof CAPA Response
When responding to an FDA Form 483 or EMA Critical/Major Inspection finding, the written response must strictly follow the 4-Part CAPA Framework:
- 1. Immediate Correction (Containment): Immediate actions taken to rectify the specific observed deficiency (e.g. re-consenting affected subjects, updating missing logs).
- 2. Root Cause Analysis (RCA): Determining why the breakdown occurred using 5-Why analysis or Fishbone diagrams (e.g. lack of training, ambiguous SOP, inadequate staffing).
- 3. Corrective Action: Systematic fixes implemented across the entire organization to prevent recurrence (e.g. SOP revisions, automated IRT system guardrails, mandatory retraining).
- 4. Preventive Action & Effectiveness Check: Proactive surveillance to confirm long-term adherence (e.g. scheduled independent QA re-audits at 3, 6, and 12 months).
Drills
Drill 1 of 3
Following an FDA clinical site inspection, an FDA Form 483 is issued with observations. Within how many business days must the site or sponsor submit a formal written response to prevent the FDA issuing a Warning Letter?
A5 calendar days
B15 business days
C30 calendar days
D60 calendar days
Drill 2 of 3
After a GCP inspection, FDA classifies a site as Official Action Indicated (OAI). What does this classification mean in practice?
ANo significant GCP violations were found; the site can proceed as normal
BMinor violations were found; corrective action is suggested but not required by the agency
CSignificant violations were found requiring regulatory action; site data may be excluded from the marketing application and a Warning Letter may follow
DAutomatic criminal prosecution of the Principal Investigator
Drill 3 of 3
Which scenario would most likely trigger a for-cause GCP inspection rather than a routine (surveillance) inspection?
AA site is selected randomly as part of the agency's routine annual inspection programme
BA site enrolled significantly more participants than any other site in the trial
CA whistleblower complaint alleges that informed consent was not properly obtained at the site
DA sponsor's internal audit identified minor filing gaps at the site
Module 4.2 complete
The GCP-medical writer interface
Week 4 · Module 3
The GCP-Medical Writer Interface
Authoring audit-ready protocols, CSR Section 9.1 GCP compliance statements, protocol deviation summaries, and patient safety narratives
Your scenario
You are authoring the Clinical Study Report (CSR - ICH E3) for a pivotal Phase III registration trial. In CSR Section 9.1 (Ethics and Regulatory Compliance), you must write the formal declaration of GCP compliance. However, during the trial, Site 104 experienced a serious breach involving 12 subjects dosed with expired IP, and Site 208 was closed early due to fraudulent data falsification. A novice medical writer might omit these details or write a generic compliance claim. A senior regulatory writer knows how to transparently document GCP compliance, summarize serious protocol deviations, and detail patient exclusion from the Per-Protocol (PP) analysis set while defending the overall integrity of the Intent-to-Treat (ITT) population.
Where GCP Directly Drives Regulatory Writing
Medical writers are not detached wordsmiths; they are the primary architects who translate clinical trial GCP execution into regulatory submissions (ICH E3 CSRs, CTD Clinical Overviews, and Health Authority Briefing Books).
CSR & GCP Mapping Key GCP Sections in ICH E3 Clinical Study Reports
| CSR Section | GCP & Regulatory Subject Matter | Medical Writer Execution Standard |
|---|---|---|
| Section 9.1: Ethics & GCP Compliance | Declaration of adherence to ICH E6, Declaration of Helsinki, IRB/IEC favorable opinions, and regulatory authorizations. | Explicitly state compliance. If serious breaches or site terminations occurred, provide cross-references to deviation summaries and corrective actions taken. |
| Section 9.8 / 10.2: Protocol Deviations | Categorization of Important / Major Protocol Deviations (IPDs) affecting participant eligibility, IP compliance, or primary endpoint capture. | Reconcile deviation tables against the Per-Protocol analysis set exclusions. Summarize root causes and impact on data integrity. |
| Section 12.2: Safety Narratives | Detailed patient-level case summaries for all Deaths, Other Serious Adverse Events (SAEs), and Discontinuations due to AEs (DAEs). | Draft standardized, chronological narratives reconciling CIOMS/eCRF source data: medical history, IP timeline, event onset, dechallenge/rechallenge, and PI vs Sponsor causality. |
| Section 16: Appendices & Signatures | Investigator signature page (ICH E3 Annex 1), IRB rosters, sample ICFs, randomisation codes, and audit certificates. | Verify 100% completeness and audit-trail verification of all essential document appendices. |
Authoring an Audit-Proof Patient Safety Narrative (ICH E3 Section 12.2.2)
Every patient safety narrative in a regulatory CSR must follow a strict, standardized 5-paragraph structure:
- Paragraph 1 (Patient Demographics & Exposure): Patient ID, age, sex, race, randomized treatment arm, dose, duration of exposure prior to event onset.
- Paragraph 2 (Relevant Medical History & Baseline Medications): Baseline disease status, pre-existing comorbidities, concomitant medications.
- Paragraph 3 (Adverse Event Chronology & Clinical Course): Detailed timeline of AE signs/symptoms, diagnostic workup, hospital course, interventions given.
- Paragraph 4 (Laboratory / Diagnostic Findings): Key baseline vs on-treatment lab values (e.g. ALT, AST, Bilirubin, Creatinine), ECGs, pathology.
- Paragraph 5 (Action Taken, Outcome & Causality Assessment): Dose modification/discontinuation, final outcome (recovered, fatal, sequelae), Investigator causality assessment, and Sponsor causality assessment.
Drills
Drill 1 of 3
Under ICH E3 Section 12.2, which clinical trial events mandate the authoring of an individual Patient Safety Narrative in the Clinical Study Report?
AAny mild Grade 1 adverse event that resolved without medication
BAll deaths, all SAEs, and any adverse event leading to permanent study drug discontinuation
CAny protocol deviation including missed visits or rescheduled assessments
DAll participants who completed the full trial, to document the absence of adverse events
Drill 2 of 3
An investigator identifies a fatal suspected adverse drug reaction in a blinded Phase III trial. Under ICH E2A, what are the expedited reporting timelines to the health authority?
A15 calendar days for all suspected unexpected serious adverse reactions regardless of outcome
BFatal or life-threatening SUSARs: 7 calendar days (with a 15-day follow-up); non-fatal SUSARs: 15 calendar days
C24 hours for fatal events, 7 days for all other serious events
D30 calendar days for all SUSARs, consistent with periodic safety update requirements
Drill 3 of 3
When assessing whether an adverse reaction is "unexpected" for SUSAR reporting purposes, what is the primary reference document?
APublished peer-reviewed literature on the drug class
BThe clinical trial protocol safety section
CThe current Reference Safety Information: the Investigator's Brochure for investigational products or the Summary of Product Characteristics for marketed comparators
DThe approved drug label from the originating regulatory authority
Module 4.3 complete
Master capstone and exit assessment
Part 3 · Module 2
Capstone and exit assessment
A trial with sixteen GCP problems across design, conduct, records and safety
How to do this
Timer at 45 minutes. Produce a findings list, classifying each as deviation, significant deviation or serious breach, with the action. Pass mark 12 of 16. Do not read the rubric first.
The trial
Review and find every GCP problem.
Design and set-up
· Protocol monitoring section specifies on-site visits every 6 weeks with 100% source data verification. No critical to quality factors identified.
· Sample size assumes a hazard ratio of 0.50; the largest previously reported for this class is 0.78.
· The trial was registered four weeks after the first participant was enrolled.
· Consent form is 26 pages; states "your physician has selected this therapy as appropriate for you".
Conduct
· At site 12, two participants were enrolled before ethics approval was documented.
· A research fellow consented 14 participants; no delegation log entry exists for them.
· An amendment shortening the washout period was implemented at four sites two weeks before approval.
· Site 07 has 38 visit-window deviations in five months; all logged individually, no analysis.
Records
· Two coordinators at site 21 share an eCRF login.
· A site holds photocopied source records; originals discarded, no certification documented.
· The TMF was assembled in the three weeks before the inspection.
· Audit trail on the ePRO system was disabled for eight weeks during a system upgrade.
Safety
· The IB on file at six sites is one edition out of date.
· A case of acute pancreatitis (not in the RSI), hospitalised, assessed possibly related, was reported in the routine monthly listing.
· An investigator recorded a grade 3 headache with no intervention as "serious".
· A participant died; the investigator attributed it to disease progression and did not report it, since it was unrelated.
· Protocol monitoring section specifies on-site visits every 6 weeks with 100% source data verification. No critical to quality factors identified.
· Sample size assumes a hazard ratio of 0.50; the largest previously reported for this class is 0.78.
· The trial was registered four weeks after the first participant was enrolled.
· Consent form is 26 pages; states "your physician has selected this therapy as appropriate for you".
Conduct
· At site 12, two participants were enrolled before ethics approval was documented.
· A research fellow consented 14 participants; no delegation log entry exists for them.
· An amendment shortening the washout period was implemented at four sites two weeks before approval.
· Site 07 has 38 visit-window deviations in five months; all logged individually, no analysis.
Records
· Two coordinators at site 21 share an eCRF login.
· A site holds photocopied source records; originals discarded, no certification documented.
· The TMF was assembled in the three weeks before the inspection.
· Audit trail on the ePRO system was disabled for eight weeks during a system upgrade.
Safety
· The IB on file at six sites is one edition out of date.
· A case of acute pancreatitis (not in the RSI), hospitalised, assessed possibly related, was reported in the routine monthly listing.
· An investigator recorded a grade 3 headache with no intervention as "serious".
· A participant died; the investigator attributed it to disease progression and did not report it, since it was unrelated.
The sixteen problems
Design and set-up (4)
1. No critical to quality factors; 100% SDV at fixed intervals. The monitoring approach is from the superseded framework. Rewrite with prospectively identified factors and a risk-based strategy.
2. Sample size assumes HR 0.50 against a class maximum of 0.78. Breaches scientific soundness — the trial is underpowered for any plausible effect. Raise as a GCP concern, not a preference.
3. Registered after first enrolment. Breaches the transparency principle and jeopardises later publication. Serious breach in most frameworks; report.
4. Consent: 26 pages, and "your physician has selected this therapy as appropriate for you" — therapeutic misconception. Restructure with a plain-language summary and remove the phrase.
Conduct (4)
5. Enrolment before ethics approval, site 12. Serious breach. Report promptly; assess those participants' data and safety.
6. 14 consents by an undelegated fellow. Serious breach — the validity of 14 consents is in question, not just the paperwork.
7. Amendment implemented before approval at four sites. Serious breach. Not an immediate-hazard exception; a shortened washout may also affect safety.
8. 38 visit-window deviations logged with no analysis. Individually deviations; the failure to analyse the pattern is the finding. Root cause investigation required.
Records (4)
9. Shared eCRF login. Attributability lost for every entry under that login. Escalate; assess scope.
10. Photocopies held, originals discarded, no certification. Original attribute breached; source no longer exists for those records.
11. TMF assembled before inspection. Not contemporaneous — a finding in itself, and it undermines confidence in everything the TMF is meant to evidence.
12. Audit trail disabled for eight weeks. Eight weeks of ePRO changes untraceable; system validation status in question.
Safety (4)
13. Out-of-date IB at six sites. Sponsor obligation. Consequence: expectedness assessments at those sites may be wrong, so this is a safety finding, not a filing one.
14. Pancreatitis: serious, unexpected, possibly related = SUSAR. Reported in a routine monthly listing instead of expedited. The most serious finding here.
15. Grade 3 headache recorded as serious. Severity and seriousness conflated; inflates the safety database and suggests site training is needed.
16. Death not reported because considered unrelated. Wrong — deaths are reported as serious adverse events regardless of attribution. The causality assessment is recorded, not used to suppress the report.
Scoring
12–16 — pass. You can review a trial against the current framework.
8–11 — close; note whether you missed design or records.
Under 8 — work through Parts 1 and 2 again.
Escalation order: item 14 first — a missed SUSAR is a live participant-safety and regulatory failure. Then 5, 6 and 7, which are serious breaches with reporting clocks running. Then 13, because it may be generating further wrong expectedness assessments right now. The design findings (1 and 2) matter but are not urgent in the same way.
The two most often missed: item 16, because “unrelated” feels like it removes the obligation; and item 2, because a sample size assumption feels like a statistical matter rather than a GCP one. It is both.
Design and set-up (4)
1. No critical to quality factors; 100% SDV at fixed intervals. The monitoring approach is from the superseded framework. Rewrite with prospectively identified factors and a risk-based strategy.
2. Sample size assumes HR 0.50 against a class maximum of 0.78. Breaches scientific soundness — the trial is underpowered for any plausible effect. Raise as a GCP concern, not a preference.
3. Registered after first enrolment. Breaches the transparency principle and jeopardises later publication. Serious breach in most frameworks; report.
4. Consent: 26 pages, and "your physician has selected this therapy as appropriate for you" — therapeutic misconception. Restructure with a plain-language summary and remove the phrase.
Conduct (4)
5. Enrolment before ethics approval, site 12. Serious breach. Report promptly; assess those participants' data and safety.
6. 14 consents by an undelegated fellow. Serious breach — the validity of 14 consents is in question, not just the paperwork.
7. Amendment implemented before approval at four sites. Serious breach. Not an immediate-hazard exception; a shortened washout may also affect safety.
8. 38 visit-window deviations logged with no analysis. Individually deviations; the failure to analyse the pattern is the finding. Root cause investigation required.
Records (4)
9. Shared eCRF login. Attributability lost for every entry under that login. Escalate; assess scope.
10. Photocopies held, originals discarded, no certification. Original attribute breached; source no longer exists for those records.
11. TMF assembled before inspection. Not contemporaneous — a finding in itself, and it undermines confidence in everything the TMF is meant to evidence.
12. Audit trail disabled for eight weeks. Eight weeks of ePRO changes untraceable; system validation status in question.
Safety (4)
13. Out-of-date IB at six sites. Sponsor obligation. Consequence: expectedness assessments at those sites may be wrong, so this is a safety finding, not a filing one.
14. Pancreatitis: serious, unexpected, possibly related = SUSAR. Reported in a routine monthly listing instead of expedited. The most serious finding here.
15. Grade 3 headache recorded as serious. Severity and seriousness conflated; inflates the safety database and suggests site training is needed.
16. Death not reported because considered unrelated. Wrong — deaths are reported as serious adverse events regardless of attribution. The causality assessment is recorded, not used to suppress the report.
Scoring
12–16 — pass. You can review a trial against the current framework.
8–11 — close; note whether you missed design or records.
Under 8 — work through Parts 1 and 2 again.
Escalation order: item 14 first — a missed SUSAR is a live participant-safety and regulatory failure. Then 5, 6 and 7, which are serious breaches with reporting clocks running. Then 13, because it may be generating further wrong expectedness assessments right now. The design findings (1 and 2) matter but are not urgent in the same way.
The two most often missed: item 16, because “unrelated” feels like it removes the obligation; and item 2, because a sample size assumption feels like a statistical matter rather than a GCP one. It is both.
Retake the diagnostic
Return to Module 1.1 and take the 24-item diagnostic again. The difference from your baseline is the only honest measure of what changed.
What to do next
Four habits. Confirm which version of E6 governs the trial you are working on. Ask what the critical to quality factors are before writing any quality or monitoring section. Assess causality, seriousness and expectedness as three separate questions. And treat scientific soundness as the principle that gives you standing to raise a design problem.
Then pair it with the rest. Reading Source Documents covers navigating the protocol, SAP and CSR that GCP governs; Writing the Manuscript covers reporting the results; Medical Information covers the reference safety information from the other direction.
And keep it current. Annex 2 was still developing when this course was written, and regional implementation continues. Check the ICH and your regional regulator's current position rather than relying on this or any other course indefinitely.
Then pair it with the rest. Reading Source Documents covers navigating the protocol, SAP and CSR that GCP governs; Writing the Manuscript covers reporting the results; Medical Information covers the reference safety information from the other direction.
And keep it current. Annex 2 was still developing when this course was written, and regional implementation continues. Check the ICH and your regional regulator's current position rather than relying on this or any other course indefinitely.
Final reflection
Your diagnostic score at the start, and now. Which module changed how you would read a protocol most?
All modules complete
ICH-GCP in Practice