Selecting an eTMF When You Are Moving Off Paper and Shared Drives

Why Shared Drives Stop Working at Inspection

A trial master file (TMF) is the collection of essential records that lets a sponsor, a monitor, an auditor, or an inspector reconstruct how a clinical trial was run and judge whether it followed the protocol and Good Clinical Practice (GCP). The MHRA inspectorate describes it plainly as the story of how the trial was conducted and managed.⁶ An electronic TMF (eTMF) is simply a TMF held in a system built for that purpose.

The European Medicines Agency (EMA) guideline on TMF content, management and archiving makes a point that often surprises teams early in their first program: “The legislation does not differentiate between paper and electronic TMFs (eTMFs).”¹ The same basic requirements apply to paper, electronic, and hybrid files. So the case for an eTMF is not that regulators demand software. The case is that meeting the requirements with paper and a shared drive gets harder with every site, every amendment, and every vendor you add.

What the Rules Ask of Any TMF

Across the EU guideline, ICH E6(R3), and the FDA regulations, a small set of expectations repeats. The EMA guideline says the TMF should provide for document identification, version history, search and retrieval, and that after archiving any change to its content must be traceable.¹ ICH E6(R3), adopted by ICH in January 2025, asks the sponsor and investigator to keep a record of where essential records are located and says the storage systems used during the trial and for archiving should support identification, version history, search and retrieval, whatever the media.² It also asks that essential records stay complete, readable, readily available, and directly accessible to regulators, monitors, and auditors, with any alteration traceable.²

In the US, the investigational new drug regulations set retention rather than format. A sponsor must keep the records and reports required by Part 312 for 2 years after a marketing application is approved or, if no application is approved, until 2 years after shipment and delivery of the drug for investigational use is discontinued and FDA has been notified.¹² Investigators have a parallel duty.¹³ The EU Clinical Trials Regulation sets a much longer floor: at least 25 years after the end of the trial unless other EU law requires longer, as the EMA guideline quotes from Article 58.¹ For a biotech planning to file in both regions, the practical design target is the longer one.

What a Shared Drive Cannot Show

A well-organized shared drive can meet some of these expectations for a while. It usually fails on the ones that need evidence rather than good intentions:

• Traceability. Most file shares do not keep a reviewable audit trail of who uploaded, replaced, renamed, or deleted a document, and why. The EMA guideline lists an audit trail showing date, time, and user for creation, upload, deletion, and changes as a core eTMF control.¹
• Role-based protection of blinded content. Randomization codes and unblinded safety data need access limited by role. Folder permissions on a drive can do some of this, but they are easy to change without a record and hard to prove after the fact.
• Locking. The guideline expects a way to lock individual documents or the whole eTMF, for example at archiving, to prevent changes.¹
• Reliable dates. File-system dates shift when files are copied or moved, so they are a poor stand-in for a defined document date. The guideline asks for metadata that is formally defined, including a predefined document date and time zone where relevant.¹
• Inspector navigation. An inspector should be able to find documents without a guide, which depends on consistent naming, indexing, and search.

EMA’s GCP inspectors have also written about the productivity tools that often fill the gaps around a shared drive. Their Q&A on productivity applications notes that a common shortcoming is the lack of an audit trail or similar feature to make entries and changes traceable and attributable, and it expects a risk evaluation and mitigation where such tools touch records that matter.³

What Inspectors Keep Finding

The inspection record explains why TMF quality gets so much attention. In a 2016 presentation, a senior MHRA GCP inspector reported that 84% of commercial sponsor inspections in 2012 to 2013 had TMF findings, and 82% in each of the two following periods. In 2013 to 2014, 35% of those inspections needed extra days.⁷ The MHRA inspectorate blog had already noted that for commercial sponsors the most frequent major finding related to record keeping and essential documents, and that problems with access to and provision of the TMF had forced inspectors to add days to inspections.⁶

The EU picture is similar and more recent. EMA’s GCP Inspectors Working Group reported 720 deficiencies across the 67 inspections requested by the CHMP in 2023. Essential Documents accounted for 74 of them (42 minor and 32 major), the largest sub-category in the report’s breakdown of its three biggest finding categories.⁴ Among the examples of common critical and major findings, the report lists “Lack of inspection readiness: limitations in eTMF access.”⁴ Buying an eTMF, in other words, does not by itself fix the problem. How it is set up and who can reach it matters as much.

Signs You Have Outgrown Paper and Drives

There is no single trigger, but a few conditions reliably mean the current setup will not hold:

• A second CRO or a second study starts, and nobody can say with confidence which organization holds which part of the file.
• You are preparing for a pivotal trial, a marketing application, or a partnering or acquisition process where the TMF will be reviewed by outsiders.
• The team cannot answer “where is the signed version of this, and who approved it?” within minutes.
• Unblinded content lives on the same drive as blinded study documents, protected only by folder permissions.
• A study closed on paper, and no one has decided how those records will stay complete and readable for the full retention period.

Decide the Operating Model Before the Vendor

The most important eTMF decision for a small sponsor is not which system to buy. It is who will hold the TMF, who will file into it, and how the sponsor will see and oversee the parts held by others. Settle that first, because it changes what you need from the software.

The Sponsor Stays Responsible

Under 21 CFR 312.52, a sponsor may transfer any or all of its obligations to a CRO, but the transfer must be described in writing, and any obligation not covered by the written description is treated as not transferred.¹⁴ The EU position is similar: EMA’s GCP Q&A quotes Article 71 of the Clinical Trials Regulation, which lets a sponsor delegate tasks by written contract without prejudice to its responsibility for participant safety and data reliability.³

For the TMF, the EMA guideline is specific. The sponsor remains responsible and must maintain oversight, which means access to the CRO-maintained part of the sponsor TMF, for example by remote access to an eTMF, or at least regular access to relevant documents from it.¹ The guideline also says there should be only one TMF for a clinical trial, made up of the sponsor and investigator parts.¹

Three Workable Models and One to Avoid

Most small and mid-size sponsors end up in one of three arrangements. None is right for everyone, and a fourth arrangement is worth naming because it is so common.

The EMA guideline speaks to Model C directly: when a CRO eTMF uploads documents into the sponsor eTMF, possibly through an intermediate system, the transfer process should be validated to prevent loss.¹ The MHRA inspector’s 2016 slides make the same point for linked systems and ask the question every sponsor should be able to answer: which one is the TMF?⁷

How to Choose Among Them

Four questions usually settle the model:

1. How many studies and CROs in the next three years? One study with one CRO leans toward Model A. Several studies, or a plan to change CROs between phases, leans toward Model B.
2. Who will own the TMF inside the company? Model B needs a named person with time to run TMF quality checks, manage access, and hold CROs to the plan. Without that person, a sponsor-owned system becomes a second shared drive.
3. Will outsiders review the file? If the company expects licensing or acquisition diligence, a sponsor-controlled file that spans programs is easier to present than a set of CRO exports.
4. What will the CRO agree to? Ask during CRO selection, not after. Some CROs work in sponsor systems routinely; others resist it or price it as extra work.

Whichever model you pick, write it into the CRO contract and a study TMF plan before first site activation. The next sections assume the model is known.

The Requirements That Matter Most

Every eTMF demo covers upload, workflow, and dashboards. Those matter less than a handful of requirements that decide how the system performs under inspection and over a retention period measured in decades.

TMF Reference Model Alignment, With Realistic Expectations

The TMF Reference Model, now maintained by CDISC and increasingly called the TMF Standard Model, gives a shared taxonomy and metadata for TMF content. The initiative started under the Drug Information Association and moved to CDISC in 2022.⁹ The most recent published version is v3.3.1, dated 11 August 2023.¹¹ CDISC describes a v4 project to address changes in user and regulatory requirements since the last major release in 2015, including optimized metadata for the digital TMF and formalized sub-artifacts.¹⁰ At the time of writing, CDISC’s v4 page describes community feedback under review rather than a final release.¹⁰

Two points from CDISC’s own FAQ matter for selection. First, the model is not meant to be used off the shelf; it can be adapted to an electronic or paper TMF and does not require any specific technology. Second, organizations are under no obligation to adopt it, and CDISC uses “standard” in its general sense rather than as a formal, enforceable standard.⁹

So “aligned with the TMF Reference Model” is where the evaluation starts, not where it ends. Ask each vendor:

• Which version of the model the default index uses, and how the vendor handled the move from earlier versions.
• How you add sponsor-specific artifacts or sub-artifacts without breaking the mapping back to the model.
• How the system will handle a new model version: whether existing documents are remapped, and whether the audit trail records that remapping.
• Whether the index, with your changes, can be exported as a readable document. Inspectors expect an overall TMF index.³

The model also matters for CRO work. If your CRO’s index and yours both map to the same model version, transfer and reconciliation become far simpler. If they do not, someone will build and maintain a crosswalk for every study.

Inspector Access Is a Functional Requirement

EMA’s GCP Q&A on TMF inspection readiness reads like a requirements list, and it should be used as one. It says direct access to the TMF is required and that “In case of eTMFs, the inspectors should have read-only access to all documents in the eTMF, without any restriction.”³ Inspectors should see the same TMF the study staff use. Access to existing eTMFs, live or archived, is expected promptly.³

The same Q&A says an eTMF should at least replicate the functions of a paper TMF, and review should not take longer than for paper. It asks particular attention for:³

• a folder display structure as well as searchable metadata;
• a naming convention that shows what each folder and document is, so inspectors do not need to open many documents to find one;
• the ability to open more than one document at a time for comparison;
• access to the same document type across studies or products;
• reliable and fast response time;
• access to the eTMF audit trail and the ability to export it;
• inspector training, if requested, that is brief, taking no more than an hour.

The MHRA inspectorate has written that it is common for sponsors to provide expert users to navigate inspectors around the eTMF, and that this should not be necessary after basic training. The blog also describes inspections where the organization’s own eTMF expert could not easily retrieve documents because of how they were named or filed.⁶ Its conclusion is worth keeping in view during every demo: “Issues we have seen on inspection generally relate to poor system design rather than changing expectations of the inspectors.”⁶

Core Controls

The EMA guideline lists the controls a primary sponsor or CRO eTMF should contain:¹

The guideline adds that these principles also apply to any other electronic system defined as part of the TMF, such as an SOP management system or a central email repository.¹ That point comes back in the migration section.

Metadata, Dates, and Dynamic Files

The EMA guideline asks that metadata be formally defined and consistent, including a predefined document date and, where appropriate, time based on a standard time zone, so files can be displayed in chronological order. For version-controlled documents, file names should not replace visible version details on screen and in printouts.¹ ICH E6(R3) adds that automatic capture of date and time should be unambiguous, with coordinated universal time (UTC) as an example.²

The guideline also warns against an eTMF limited to static files. Where dynamic files such as spreadsheets or SAS datasets need to be kept, the storage system should be able to hold them without forcing a PDF rendering, and when a PDF is made from a dynamic file in another system, the original dynamic file should stay in its original system.¹ Ask vendors which file types they store natively, which they render, and what they keep when they render.

Blinding and the Investigator Site File

Some eTMF products also offer an electronic investigator site file (eISF) or a site portal. If you plan to use one, read section 4.1.3 of the EMA guideline closely. It says the investigator TMF should be accessible under the control of the investigator or institution, independent of the sponsor, and that documents with direct identifiers of trial participants, such as signed consent forms and the subject identification code list, should stay under the investigator’s sole control.¹ A sponsor-hosted site file needs contract terms naming the investigator as owner of those documents and preserving continuous access, including if a party goes out of business.¹ That is a legal and procedural question as much as a feature question, so bring it to the selection early.

Exit and Long-Term Access

For a SaaS eTMF, the exit plan is part of the requirement set. The EMA guideline says access to documents and data must be maintained for the whole archiving period, whether by keeping the original system, emulating it, or migrating to a new format, and that any transfer or migration must be validated so the migrated data carry the same information, including metadata.¹ It also recommends that agreements with an external archive cover the situation where the sponsor or the archive goes out of business.¹

In practice, ask each vendor to show a full study export: documents, metadata, index, and audit trail, in open formats, with an explanation of how the pieces link. EMA inspectors have reported cases where audit trails were delivered as PDF flat files, which did not support producing a dataset that might be needed at inspection.³ A 25-year obligation will very likely outlast the contract with the vendor you pick now.

CRO Access and Shared Filing

For most small biotechs, the CRO creates the majority of TMF documents. The eTMF choice has to work for the people who do the filing, and the contract has to say how.

What the Contract Should Cover

The EMA guideline lists what the sponsor and CRO agreements should set out for the TMF.¹ For a small sponsor, the items that most often get skipped are these:

• which party holds the TMF, or which parts each party holds;
• the structure and indexing of the TMF;
• access arrangements for all parties;
• when an eTMF is used, the details of the system and its change control;
• how the TMF will be made available to competent authorities;
• end-of-trial arrangements, including transfer of the full set of documents to the sponsor;
• how the sponsor will carry out and record oversight of the TMF;
• retention times;
• what happens if a party closes its business.

EMA’s GCP Q&A on contracts with vendors of electronic systems describes what inspectors have seen when these points are vague: tasks partly described or not described at all, unclear responsibility for generating and archiving TMF content such as emails, meeting minutes, and trial-specific validation documents, and documents lost because of a lack of clarity about retention duties.³

Showing Oversight

EMA’s Q&A on sponsor oversight of delegated activities lists the kinds of evidence a sponsor can use, including documentation of access (for example an access log), logging of document review steps (for example an audit trail), recording significant decisions in meeting minutes, and archiving relevant communication.³ A sponsor-owned or sponsor-visible eTMF produces much of this evidence as a side effect of normal use, provided the sponsor’s reviewers work inside the system rather than on downloaded copies. That is a strong reason to confirm, before selection, that sponsor reviewers will have their own named accounts in whichever system holds the file.

Transfers Between Systems

If you choose Model A or Model C, plan the transfer before the study starts. EMA’s older Q&A on electronic TMFs says the process for moving TMF documents to another medium should be validated so that the entire content moves without loss, with a demonstrable one-to-one mapping between the original and the eTMF.³ The MHRA slides ask the follow-on questions sponsors should answer in writing: what records the CRO keeps, whether it provides them all to the sponsor, whether the sponsor keeps everything provided, and what happens to the sponsor’s own oversight records at the end.⁷

Migrating Legacy Paper and Shared-Drive Files

Migration is where most eTMF projects at small sponsors run late. The documents are rarely the hard part. The hard part is deciding what each file is, where it belongs in the index, what its real document date is, whether the copy can replace the original, and who confirms that it is complete.

Start With an Inventory, Not a Scanner

ICH E6(R3) asks sponsors to maintain a record of where essential records are located.² The EMA guideline goes further and asks the sponsor to identify all locations that may hold TMF documentation at the start of a trial, even across several departments and systems, and to keep the number of other systems low with priority on the primary TMF system.¹ It names typical examples: a central email repository, SOP system, central training records, software validation records, and documents that span trials such as the investigator’s brochure.¹

The scale can surprise people. The MHRA inspector’s 2016 slides describe a sponsor that identified more than 40 electronic systems relevant to its TMF at a UK inspection.⁷ A small biotech will have far fewer, but the same logic applies: list every place a document that proves trial conduct might live, including email and the drive, before deciding what moves.

Decide What Moves, What Stays, and What Gets Referenced

Not everything needs to be copied into the new eTMF. ICH E6(R3) notes that some essential records are not trial-specific and may be kept outside trial repositories, for example SOPs, validation records, and master services agreements.² The EMA guideline says documents that apply to several trials do not need to be duplicated in each TMF.¹ What matters is that the index or mapping document says where they are and that those systems meet the same control expectations.

Correspondence needs particular thought. The EMA guideline says relevant emails and attachments should be readily available, that both sent and received messages should be filed, and that care is needed with email chains so the relevant strands and their attachments stay together.¹ The MHRA blog notes that the correspondence section of a TMF is often sparse, and that emails produced during an inspection to explain an issue raise the question of why they were not in the TMF already.⁶ A migration that ignores email will reproduce that finding.

Certified Copies and Scanning

ICH E6(R3) says that when a copy permanently replaces an original essential record, it must meet the requirements for a certified copy.² It defines a certified copy as a copy, in any media, verified by a dated signature or by generation through a validated process to have the same information as the original, including relevant metadata where applicable.²

The EMA guideline recommends risk-based quality checks of certified copies before originals are destroyed, covering:¹

• that the copy’s content matches the original;
• the accuracy of assigned metadata;
• the accuracy of the file name, including marking updated versions;
• image quality: readable resolution, color where color carries meaning, and legible wet-ink signatures, annotations, and handwriting;
• the eTMF audit trail for the document, where applicable;
• approval of the certification process, where applicable.

It also says image adjustments are acceptable only to improve legibility and must not remove or add material, such as removing a fax header.¹ Build these checks into the scanning procedure and the vendor’s upload workflow before the first box is opened.

Validate the Process, Then Decide on Originals

The EMA guideline says the process of digitization or transfer should be validated to ensure no information is lost or altered.¹ ICH E6(R3) says data transfer and system migration should be documented for traceability, using validated processes or other appropriate processes such as reconciliation, so that data and metadata keep their integrity.²

Only once certified copies meet those standards can originals be considered for earlier destruction. The EMA guideline gives two lower-risk examples: a paper printout of an electronic original that remains in the TMF, and paper documents without legally required wet-ink signatures, where the digitized version can serve as a certified copy.¹ Documents with legally required wet-ink signatures need a more careful decision, and keeping those originals in a qualified archive is the cautious default.

A Migration Sequence That Holds Up

Know What “Complete” Means Before You Start

A migration needs a completeness target, and that target should be risk-based. A cross-company working group of quality assurance experts from several large sponsors, publishing in GMS German Medical Science, rated 148 core document types from an earlier version of the TMF Reference Model by the impact a missing document would have on participant rights and safety and on data integrity, and by the effort needed to replace it.⁸ In their combined risk rating, 8% of document types fell into a very high risk category, 14% high, 38% medium, and 40% low. They set a tolerance of 0% missing for stand-alone documents such as the clinical trial protocol.⁸

You do not need to adopt their numbers. The useful idea is that migration quality checks and later TMF quality checks should concentrate on the documents whose absence would matter most, which is also what the EMA guideline means by risk-based quality checks.¹

Validation and Part 11: What the Sponsor Owns

Most small sponsors will buy a vendor-hosted eTMF. That does not move validation responsibility to the vendor. It changes how the sponsor meets it.

The EU Position

The EMA guideline says eTMF systems should be validated to show their functions are fit for purpose, with formal procedures in place, and that all staff using the system should be trained.¹ EMA’s 2020 notice to sponsors on computerized systems in clinical trials is direct about who carries the burden: “The sponsor is ultimately responsible for the validation of the computerised system and for providing adequate documented evidence on the validation process.”⁵

The notice allows sponsors to rely on vendor qualification documentation if the vendor’s work has been assessed as adequate, with additional sponsor activities based on a documented risk assessment.⁵ It also says sponsors must be able to give EU inspectors access to validation documentation regardless of who performed the work, and that if a vendor will not allow measures such as access to requirement specifications, pre-qualification audits, or access for GCP inspectors, systems from that vendor shall not be used in clinical trials.⁵ For eTMF selection, that turns vendor audit rights and inspector access to validation records into pass or fail criteria, not negotiating points.

The US Position

21 CFR Part 11 sets the FDA’s requirements for electronic records and electronic signatures. FDA’s 2003 guidance on its scope and application says the agency narrowly interprets Part 11’s scope and intends to exercise enforcement discretion on certain requirements, including validation, audit trails, record retention, and record copying, while records must still meet the underlying predicate rules.¹⁵ The guidance recommends basing validation and audit trail decisions on a justified and documented risk assessment, and notes that audit trails can be particularly appropriate when users are expected to create, modify, or delete regulated records during normal operation.¹⁵ An eTMF is a system where users do exactly that every day.

FDA’s compliance program for inspections of sponsors and CROs shows what investigators look at. It directs them to review monitoring records that may be in the TMF or clinical trial management system, and to describe the electronic systems used to manage critical data and study procedures, including whether each system was owned and controlled by the sponsor or a third party.¹⁸ It also says compliance with recordkeeping, record copying, and record retention will be evaluated against the predicate rules.¹⁸

Two Part 11 provisions are worth testing in any eTMF that captures approvals. Signed electronic records must show the printed name of the signer, the date and time of signing, and the meaning of the signature, such as review or approval, and those items must appear in any human-readable form of the record.¹⁶ Electronic signatures must be linked to their records so they cannot be excised, copied, or transferred to falsify a record by ordinary means.¹⁷ Check both on screen and in an exported PDF.

A Proportionate Validation Package

An eTMF is not a system that calculates results, so the validation effort should be proportionate. The main risks are in configuration, permissions, audit trail, signatures, and data movement, not in the vendor’s core code. A sensible package for a small sponsor usually includes the items below.

Vendor release cadence deserves its own line in the selection. SaaS products are updated on the vendor’s schedule, not yours. The EMA guideline expects the sponsor and CRO agreements to cover the details of the system and its change control when an eTMF is used.¹ Ask each vendor how much notice it gives before a release, whether there is a validation sandbox that receives releases first, and what evidence it provides for each release.

Selection Mistakes That Surface Later

The mistakes below rarely show up during the demo. They show up at the first inspection, the first CRO change, or the first diligence request.

Choosing by the Filing Demo

Demos show the filer’s view: drag, drop, classify, approve. Inspectors use a different view. Ask the vendor to set up an inspector role and walk through finding a signed protocol amendment, an ethics approval, and a monitoring visit report across three sites, using only the folder display and search. Time it. The EMA expectation is that review should not take longer than for a paper TMF.³

Buying Before the Operating Model Is Settled

A sponsor that buys an eTMF and then signs a CRO contract assuming the CRO’s own system has paid for two systems and created a transfer problem. Decide the model, then select the eTMF and the CRO with that model in the requirements.

Treating the Default Index as the TMF Plan

A reference model index tells you what types of documents can exist. It does not tell you which ones your study needs, who files each one, when they are due, or who checks them. The EMA guideline expects timelines for submission and filing to be defined in procedures or TMF plans, particularly where several parties are involved.¹ Budget time to write the plan.

Forgetting the Systems Around the eTMF

SOPs, training records, email, and validation records are part of the TMF even when they live elsewhere.¹ EMA inspectors listed insufficient assessment of the suitability of storage locations for essential documents, and undefined locations of documents, among the common findings in 2023.⁴ The selection should include how the eTMF will point to those systems, and whether those systems meet the same controls.

Ignoring Exit Until Renewal

If the export is poor, the vendor holds the stronger position at every renewal and every change becomes a project. Test a full study export during selection, not after signature. Confirm that the audit trail comes out as data and that document links to the index survive.

Over-Configuring on Day One

Small teams sometimes try to encode every preference into workflows and custom fields. Each configuration item becomes something to specify, test, and maintain through vendor releases. Start close to the vendor’s standard configuration and the reference model, then change based on evidence from the first study.

No Owner for TMF Quality

The EMA guideline expects risk-based TMF quality checks covering completeness, correct location, timeliness, correct indexing, access matching roles, and audit trail review, plus routine quality assurance such as system audits.¹ Software can report on these, but someone has to act on the reports. If no one in the company owns that role, a sponsor-owned eTMF will fall behind in the same way the shared drive did.

A Practical Selection Process for a Small Team

A small biotech does not need a year-long procurement. It needs a short process that tests the right things and records the decision so it can be explained later, including to an inspector who asks how the system was chosen.

Who Should Take Part

Keep the group small: clinical operations (the main user and usually the owner), quality assurance (validation, vendor assessment, and inspection readiness), IT or whoever manages identity and vendor security reviews, and a representative from the CRO if Model B or C is likely. Regulatory affairs should review the retention and archiving approach, and legal should review data ownership, exit, and site file terms.

A Scorecard Built on the Sources

The weights below are a starting point for a sponsor moving off paper and drives with one to three studies planned. Adjust them to your operating model.

Price is deliberately left out of the weighted score. Compare the weighted results first, then look at total license and service fees for the shortlist. That keeps a low price from hiding a weak export or an inspector view that nobody tested.

Questions to Send Before the Demo

Send these in writing so the answers go on file:

1. Which TMF Reference Model version does your default index follow, and how have you handled past version changes for existing customers?
2. Can an inspector be given read-only access to all documents in a study, including archived studies, within a day? Show us the steps.
3. What does your audit trail capture for upload, replacement, metadata change, deletion, and permission change? Can it be exported as data?
4. How do you prevent unblinded document titles from appearing in search, reports, or notifications for blinded users?
5. What file types do you store natively, and what do you keep when you render a file to PDF?
6. Will you allow a sponsor audit, provide your requirement specifications and test evidence, and give regulatory inspectors access to validation records if requested?
7. How often do you release, how much notice do you give, and do customers get a validation sandbox that receives releases first?
8. What does a full study export contain, in what formats, and how are documents linked to index and audit trail entries?
9. How do CRO users get access, and how do you keep a CRO user who works for several sponsors from seeing the wrong study?
10. If you offer an investigator site file, how do you keep investigator-controlled documents out of sponsor view?

Record the Decision

Write a short selection report: the operating model, the requirements, the scorecard, the vendor assessment outcome, open risks, and the reasons for the choice. File it in your quality system. It becomes the first document in your validation package and the answer to the question an auditor or inspector may ask about how this system was chosen and qualified.

Conclusion

Moving off paper and shared drives is a good decision for most biotechs by the time a second study or a second CRO arrives, but the software is the smaller part of it. The regulations treat paper and electronic files the same. What they ask for is a file that is complete, current, traceable, and directly accessible, with the sponsor able to show where every part lives and how it was overseen. The inspection record shows that those expectations are missed more often through unclear ownership, weak navigation, and poor transfers than through missing features. A sound eTMF selection for biotech sponsors starts with the operating model, tests the inspector’s view and the exit path as hard as the filer’s view, migrates legacy content through a validated certified-copy process, and keeps validation evidence under the sponsor’s control even when the system is hosted by someone else.

Sakara Digital works with pharma and biotech organizations setting up clinical systems that inspectors and diligence reviewers will examine. If you are planning an eTMF selection or a move off paper and shared drives and want an independent view of the operating model, requirements, or validation approach before you commit, we are happy to have that conversation.

For Further Reading