Risk-Based Monitoring Data Flows Under ICH E6(R3): Designing for Traceability

Where ICH E6(R3) Stands in October 2026

Before designing anything around a guideline, it is worth being precise about its status, because the answer differs by region and by part of the document.

European Union. The European Medicines Agency lists the ICH E6(R3) principles and Annex 1 as adopted, with an effective date of 23 July 2025. The same EMA page lists Annex 2 and a consolidated version of the guideline, both with an effective date of 15 January 2027.²

United States. FDA announced the availability of E6(R3) as a final guidance for industry in the Federal Register on 9 September 2025. The notice describes the final guidance as the principles document and Annex 1, and it refers to Annex 2 as a separate draft guidance. It also states plainly that FDA guidance documents do not establish legally enforceable responsibilities.³ As of this writing, FDA’s page for Annex 2 still presents the December 2024 draft.⁴ The legal requirement to monitor comes from the regulations, not the guidance: 21 CFR 312.50 makes sponsors responsible for “ensuring proper monitoring of the investigation(s),” and 21 CFR 312.56 requires the sponsor to monitor the progress of all clinical investigations under its IND.^{6, 7} Neither regulation says how monitoring must be done, a point FDA makes itself in its 2023 question-and-answer guidance on risk-based monitoring.⁸

United Kingdom. MHRA guidance states that compliance with the ICH E6 GCP principles became a legal requirement in the UK on 28 April 2026, under the amended clinical trials regulations. The legal requirement attaches to the principles, not the whole guideline. MHRA also says the annexes cannot be ignored, because they are relevant guidance that sponsors and investigators must have regard to.⁵

Premise Check

The premise of this article holds: E6(R3) is in force or adopted as current guidance in the three regions most of our readers work in, and its principles and Annex 1 contain the risk-based monitoring content we rely on. Two qualifications matter for how the rest of this article reads.

• E6(R3) does not use the term “key risk indicator.” It speaks of risks to critical to quality factors, pre-specified acceptable ranges (with quality tolerance limits at the trial level given as an example), centralized monitoring, and data analytics.¹ Key risk indicators (KRIs) are an industry practice that fits inside that framework. Nothing in the guideline requires a sponsor to use them.
• In the US, the monitoring expectations beyond the regulations are guidance. FDA’s 2013 guidance on risk-based monitoring and its 2023 question-and-answer guidance are nonbinding recommendations, alongside E6(R3).^{8, 10} They are still the clearest statement of what FDA expects to see.

Two earlier articles in this series cover related ground: one on the computerized system expectations in E6(R3) and one on tracing analysis datasets back to source. This article stays with monitoring: the data that feeds it, the decisions it produces, and the records that let someone else reconstruct those decisions later.

What ICH E6(R3) Asks For in Risk-Based Monitoring

The risk-based content in E6(R3) is spread across the principles, the quality management section, the monitoring section, and the data governance section. Reading them together gives a clearer picture than reading the monitoring section alone.

The Principles Set the Direction

Principle 6 says quality should be built into the scientific and operational design and conduct of trials, and that factors critical to the quality of the trial should be identified prospectively. Principle 7 says trial processes, measures, and approaches should be proportionate to the risks to participants and to the importance of the data collected, and should avoid unnecessary burden on participants and investigators. It adds that risks to critical to quality factors should be managed proactively and adjusted when new or unanticipated issues arise once the trial has begun.¹

The term “critical to quality factors” comes from ICH E8(R1), which describes them as attributes of a study whose integrity is fundamental to protecting participants, to the reliability and interpretability of the results, and to the decisions made from those results. E8(R1) also says that once these factors are identified, sponsors should determine the risks that threaten their integrity and decide whether to accept or mitigate them based on probability, detectability, and impact.⁹ That sentence is, in practice, the starting point for every indicator a monitoring team will ever compute.

The Risk Management Cycle in Section 3.10

Section 3.10 asks the sponsor to adopt a proportionate, risk-based approach to quality management and lays out six steps: risk identification, risk evaluation, risk control, risk communication, risk review, and risk reporting.¹ Three details in that section shape the monitoring data flow directly:

• Evaluation considers detectability. Risks are evaluated on likelihood, on the extent to which harm would be detectable, and on impact. Detectability is the part monitoring data influences most. A risk that centralized review can see quickly is a different risk from one only an on-site visit would find.
• Pre-specified acceptable ranges. Where relevant, the sponsor should set pre-specified acceptable ranges, with quality tolerance limits at the trial level as the example. When a deviation beyond these ranges is detected, the sponsor should evaluate whether there is a possible systemic issue and whether action is needed.
• Reporting in the clinical trial report. The sponsor should summarize important quality issues, including instances in which acceptable ranges were exceeded, along with the remedial actions taken, and document them in the clinical trial report.

The last point is easy to overlook. It means that some monitoring outputs are not just operational. They end up in a regulatory submission, and a reviewer can ask how they were produced.

The Monitoring Section Itself

Section 3.11.4 describes monitoring as one of the principal quality control activities. It lists a broad range of monitoring activities, including source data review, source data verification, data analytics, and visits. It notes that some activities, such as centralized monitoring, may be carried out by people in different roles, with a data scientist given as an example, as long as monitoring is performed by people not involved in the clinical conduct of the trial at the site being monitored.¹

The sponsor should determine the appropriate extent and nature of monitoring based on identified risks, taking into account factors such as the trial’s objective, design, complexity, blinding, number of participants, the investigational product, and endpoints. Centralized monitoring is defined as “an evaluation of accumulated data, performed in a timely manner, by the sponsor’s qualified and trained persons,” with a medical monitor, data scientist or data manager, and biostatistician given as examples. The guideline says centralized monitoring can complement and reduce the extent or frequency of site monitoring, or be used on its own, and that it may support the selection of sites and processes for targeted site monitoring.¹

For data review, section 3.11.4.5.4 asks monitoring to verify that data identified as of higher criticality in the monitoring plan are consistent with the source, to “Identify missing data, inconsistent data, data outliers, unexpected lack of variability and protocol deviations,” and to examine data trends such as range, consistency, and variability within and across sites.¹ Those three sentences describe most of what a centralized monitoring platform does.

The monitoring plan, under section 3.11.4.3, should describe the monitoring strategy, the monitoring activities of all parties, the methods and tools to be used, and the rationale for their use. Monitoring of important data and processes performed outside the investigator site, such as at central laboratories or central image reading facilities, should also be addressed in the plan.¹

Monitoring Reports and Recorded Decisions

Section 3.11.4.6 covers reporting. Reports should summarize what was reviewed, significant findings, conclusions, actions required, and follow-up, and reports of site or centralized monitoring should reach the appropriate sponsor staff in a timely manner. The last clause is the one this article is built around: “The sponsor should decide on the appropriate action to be taken, and these decisions and the resolution of the actions involved, where needed, should be recorded.”¹

The Data Governance Section Applies to Monitoring Data Too

Section 4 addresses data integrity, traceability, and security across the full data life cycle, with a focus on data criticality. It covers metadata and audit trails, planned and risk-based review of data and metadata, controlled data transfer with reconciliation, and the validation of computerized systems.¹ Nothing in section 4 exempts the data a monitoring team uses. If a centralized monitoring platform ingests trial data, computes indicators, and supports decisions about participant safety and data reliability, its inputs, its calculations, and its outputs fall within that section’s reach.

What the Guideline Leaves to the Sponsor

E6(R3) does not set a percentage of source data verification, does not name indicators, does not prescribe statistical methods, and does not specify tools. That is deliberate. The FDA guidances fill in some of the practical detail. The 2013 guidance encouraged greater use of centralized monitoring, with correspondingly less emphasis on on-site monitoring, and listed examples of centralized techniques: standard checks of range, consistency, and completeness; checks for unusual distributions within and between sites, such as too little variance; and analysis of site characteristics and performance metrics such as high screen failure or withdrawal rates, frequent eligibility violations, and delays in reporting data.¹⁰ It also made a point that is still worth repeating: “A risk-based approach to monitoring does not suggest any less vigilance in oversight of clinical investigations.”¹⁰

The 2023 question-and-answer guidance adds that sponsors should document their risk assessment, including the methods used, the conclusions reached, and how the assessment was used to make decisions on managing the risks identified. It notes that FDA may ask for the initial risk assessment and any updated risk assessments during an inspection.⁸ In other words, the reasoning is expected to be on file, not reconstructed after the inspector arrives.

Risk-Based Monitoring Is a Data Flow

Most discussions of risk-based monitoring focus on strategy: how much source data verification, how many visits, which sites. Those are real questions. But once a sponsor moves meaningful oversight into centralized review, monitoring becomes a data process. Data moves from source systems into a monitoring platform, gets transformed into indicators, triggers signals, and prompts decisions that change what happens at sites. The quality of the oversight depends on the quality of that flow.

E6(R3) already asks sponsors to describe the flow of trial data. Section 3.16.1 says that where necessary, additional details on data collection, “including a data flow diagram,” should be contained in a protocol-related document such as a data management plan.¹ FDA’s compliance program for inspections of sponsors and contract research organizations instructs investigators to determine the data flow from initial source generation to reporting in clinical study reports, and to collect a copy of the data flow diagram if one is available, including the location of servers that maintain study data.¹⁴ The monitoring data flow is a branch of that same diagram. It is rarely drawn.

Seven Stages, Seven Sets of Records

A risk-based monitoring data flow can be described in seven stages. Each stage produces records, and each set of records answers a question an inspector or auditor may ask.

Traceability Runs in Both Directions

Forward traceability starts with a risk and follows it through its indicator, its signals, and the actions taken. It answers the question “how did you control this risk?” Backward traceability starts from an outcome, such as a quality tolerance limit exceedance reported in the clinical study report or a site that was closed for noncompliance, and walks back to the signal, the data snapshot, and the indicator definition in force at the time. It answers “how do you know?”

Sponsors tend to design for forward traceability because it follows the order in which work is planned. Inspections tend to test backward traceability because they start from what happened. A monitoring data flow that is built well supports both.

What the Evidence Says About Centralized Monitoring

It is fair to ask whether building all of this is worth the effort. The published evidence is limited, but it is consistent. FDA’s 2013 guidance cited a review of on-site monitoring findings from a multi-center international trial which determined that centralized monitoring activities could have identified more than 90 percent of the findings from on-site visits.¹⁰

Two more recent analyses from a single large central monitoring platform looked at what happened after signals were raised and acted on. The first examined nine commonly used KRIs across 212 studies and 1,676 sites with KRI signals, from 23 sponsor organizations, and found improvement at the large majority of sites: 82.9 percent on the statistical score and 81.1 percent on the observed KRI value.¹² The second examined 1,111 sites flagged by statistical data monitoring in 159 studies from 23 organizations and found that quality metrics improved at 83 percent of sites, compared with 56 percent of sites in two historical studies that did not use statistical data monitoring during conduct.¹³

Two caveats belong next to those numbers. The authors of both papers include people affiliated with a central monitoring vendor, and the data came from that vendor’s platform. And, as the authors of the second paper state, they assessed improvement only for risks that the tool identified and the study team acted on, so the analysis does not show how well the approach finds all relevant issues.¹³ What the studies do show is that follow-up on signals is associated with measurable improvement. That makes the record of follow-up worth keeping well.

Designing Indicators From Critical to Quality Factors

An indicator is only as defensible as its link to a risk. The most common design weakness we see is an indicator library adopted wholesale from a vendor or a previous study, with the risk assessment written afterward to match.

Start From the Risk Register, Not the Indicator Library

Standard indicators are useful. Many risks recur across studies: adverse event under-reporting, missed assessments, late data entry, high screen failure rates. But the order of work matters. Start with the critical to quality factors for this protocol, identify the risks to each, decide which risks are best detected centrally, and only then choose or build the indicator. Some risks will be better controlled by protocol design, site training, or system configuration than by any indicator. E6(R3) lists protocol design, monitoring plans, agreements, and training as places where risk mitigation may be built in.¹

When the order is reversed, two problems follow. Critical risks specific to the protocol, such as the timing of a primary endpoint assessment or a dose titration rule, go unmonitored because no standard indicator covers them. And generic indicators generate signals that no one can link to a protocol risk, which makes each decision harder to justify.

KRIs and Quality Tolerance Limits Do Different Jobs

A group of statisticians working on quality tolerance limits put the distinction plainly: “KRIs are typically measured at the site level to inform site monitoring activities, while QTLs are a higher-level indication of overall quality in a trial.”¹¹ Their paper gives premature treatment discontinuation, study discontinuation, and significant protocol deviations as examples of study-level parameters, and describes methods for setting limits, including observed-minus-expected charts, beta-binomial models, and Bayesian hierarchical models.¹¹

The difference matters for the data flow. Site-level indicators drive operational decisions: which site to call, which site to visit. Trial-level limits connect to E6(R3) section 3.10.1.3, which asks for an evaluation of possible systemic issues when a range is exceeded, and to section 3.10.1.6, which asks for exceeded ranges and remedial actions to be reported in the clinical trial report.¹ A trial-level limit therefore needs a stronger record: a pre-specified definition, a documented detection method, an evaluation record, and a path into the report.

Write an Indicator Specification

Each indicator should have a written specification that someone outside the monitoring team could use to recompute it. The specification is the link between the risk assessment and the data. At a minimum it should contain:

• Identifier and version, so every computed value can be tied to the definition in force at the time.
• Linked risk and critical to quality factor, taken from the risk assessment.
• Formula, with numerator and denominator defined down to the source system, form, and field.
• Data window: cumulative from the start of the trial, or incremental over a recent subset of records.
• Threshold and method: a fixed value, a statistical comparison with other sites, or a model-based limit, with the reason for the choice.
• Minimum data rule: how much data a site needs before the indicator is assessed.
• Refresh frequency and the expected delay between a source event and its appearance in the indicator.
• Expected response: who reviews a signal, how quickly, and what actions are typical.
• Blinding impact: confirmation that the indicator cannot reveal treatment assignment.

The published definitions of the nine common KRIs mentioned earlier show why the source-level detail matters. Each is a ratio or a cycle time, and several depend on data that is not in the clinical database at all.¹² The table below lists those indicators as the paper defines them. The right-hand column is our own annotation of where the underlying data usually comes from in a typical sponsor setup.

Three of the nine (auto-query rate, query response cycle time, and visit-to-entry cycle time) are built from metadata: query records and entry timestamps rather than clinical values. A fourth, the protocol deviation rate, usually depends on a log kept outside the clinical database. That has consequences for the data flow, which the next section covers.

Thresholds Are Configuration, and Configuration Needs Change Control

Indicator thresholds change during a study. A threshold set on historical data may produce too many signals once real data accumulates, or too few. Changing it is a reasonable decision, but it is a decision about how the sponsor detects risk, and it should be treated as one. The change needs a reason, an approval, an effective date, and an assessment of whether past signals would have been handled differently. Otherwise a later reviewer sees a site that was flagged in March and not in April with no way to tell whether the site improved or the threshold moved.

FDA’s compliance program asks investigators to determine whether the sponsor needed to modify the monitoring plan after the study started, and if so, to obtain the most recent plan and determine why the changes were made.¹⁴ Indicator definitions and thresholds referenced by the plan deserve the same discipline.

Centralized Monitoring Data Sources and Their Lineage

Centralized monitoring rarely draws from a single system. The more sources it uses, the more handoffs there are, and each handoff is a place where data can arrive late, arrive incomplete, or arrive changed.

The Usual Sources

A typical centralized monitoring platform for a phase 2 or 3 study takes data from some combination of the following:

• EDC: clinical data, visit dates, queries, and audit trail metadata.
• IRT: randomization, dispensing, and screening records.
• Safety database: serious adverse events, reconciled with EDC.
• eCOA and ePRO systems: participant-entered outcomes, with completion times.
• Central laboratory and imaging vendors: results, sample receipt dates, and read status.
• Clinical trial management system: site activation dates, visit reports, protocol deviations, and issue logs.

E6(R3) expects the monitoring plan to address monitoring of important data and processes performed outside the investigator site, and it expects investigators to have timely access to relevant external data such as central laboratory data and centrally read imaging.¹ Both expectations assume that data from these vendors flows reliably to the sponsor. The monitoring data flow depends on the same feeds.

Metadata Is Monitoring Data

E6(R3) section 4.2.1 says acquired data from any source should be accompanied by relevant metadata. Section 4.2.2 asks that systems log user access and data changes, that audit trails and logs be interpretable and able to support review, and that the automatic capture of date and time be unambiguous, with coordinated universal time given as an example. Section 4.2.3 says review of trial data, audit trails, and other relevant metadata should be a planned activity whose extent is risk-based.¹

FDA’s 2023 guidance makes the monitoring link explicit: by reviewing study data and metadata in real time across sites, sponsors may identify quality issues such as delays in entering data or incomplete entries earlier than with on-site monitoring alone.⁸ So metadata is not background material for the monitoring team. It is primary input. Visit-to-entry cycle time is computed from timestamps. If one source records local time and another records UTC, and nobody normalizes them, the indicator is wrong for every site outside the sponsor’s time zone. That is a data flow defect, not a statistical one.

Transfers, Snapshots, and Reconciliation

Section 4.2.5 asks for validated processes, or other appropriate processes such as reconciliation, to ensure that electronic data and relevant metadata transferred between systems keep their integrity, and for transfers and migrations to be documented to ensure traceability.¹ Where software problem reports raise significant concerns about data reliability, FDA’s compliance program directs investigators to review data transmission methods, the frequency of transfers and which transfers are retained, whether automated system-to-system exchanges were validated, and whether transferred files were locked or editable.¹⁴

For monitoring, “which transfers are retained” is the question that matters most. Indicator values change every time data refreshes. A signal raised on Tuesday may not be visible on Friday because the site entered missing data in between. If the platform keeps only the current state, the sponsor cannot show what the reviewer saw when they made their decision. Three design choices address this:

1. Keep dated snapshots of the input data, or keep enough history in the platform to reconstruct any past state.
2. Store computed indicator values with the snapshot identifier and the indicator version, so a value can be tied to both its inputs and its logic.
3. Reconcile each transfer: record counts, key fields, and a check that the latest extract is complete before indicators are refreshed. A partial load that shows a site with zero adverse events can create or hide a signal.

Blinding in the Monitoring Data Flow

Centralized monitoring teams work with pooled, accumulating data, which puts them close to information that could unblind them. E6(R3) section 4.1 asks that the integrity of blinding be considered in system design, user access, data transfers, and data review, and that the potential for unblinding be part of the risk assessment of a blinded trial.¹ FDA’s 2023 guidance says maintaining the blind is a critical process sponsors should consider in their risk assessment, and that deviations which could cause unintentional unblinding should be tracked as part of the monitoring plan.⁸

In practice this means checking each data feed for fields that carry treatment information, such as kit numbers that map to arms, dispensing records, or pharmacokinetic results, and confirming that indicators computed on pooled data cannot be split by arm. It also means that the unblinded roles, such as an unblinded pharmacist monitor, need a separate data path with its own access controls.

Draw the Diagram

The simplest control is the one E6(R3) already mentions: a data flow diagram. For monitoring, the diagram should show each source system, the transfer method and frequency, the landing area, the transformations applied, the platform that computes indicators, the place where signals and decisions are recorded, and the location of each component. FDA inspectors are instructed to ask for the trial’s data flow diagram, including server locations.¹⁴ Adding the monitoring branch to that diagram takes a few hours of a data manager’s time and closes a common gap.

Recording Decisions So They Can Be Reconstructed

Of the seven stages, decision recording is the weakest in most sponsors we talk to. The data and the indicators are handled by systems. The decisions are handled by people, often in meetings, and the record is whatever someone chose to write down.

What the Guidance Asks You to Record

Several sources point at the same set of records:

• E6(R3) section 3.11.4.6 asks for monitoring reports that summarize what was reviewed, significant findings, conclusions, actions, and follow-up, and for the sponsor’s decisions and their resolution to be recorded.¹
• E6(R3) section 3.10.1.6 asks for important quality issues, exceeded acceptable ranges, and remedial actions to be summarized in the clinical trial report.¹
• FDA’s 2023 guidance recommends that monitoring plans describe the types of issues that trigger immediate escalation, and an approach for deciding whether an issue found at one site may be present at others or points to a systemic problem. It says significant issues should be evaluated in a timely manner, followed by root cause analysis and appropriate corrective and preventive action, and that documentation of monitoring should include the date, the people involved, a summary of what was reviewed, deficiencies identified, and actions taken or recommended. It specifically includes centralized monitoring across sites in the activities to be documented.⁸
• FDA’s compliance program directs investigators to review monitoring reports and related records in the trial master file and clinical trial management system.¹⁴

Where Practice Falls Short

A survey by the Tufts Center for the Study of Drug Development, run from late 2022 to early 2023 and published in 2024, gathered 206 responses from people at an estimated 125 companies, covering 32 risk-based quality management practices across more than 12,000 trials. Respondents estimated the share of their trials using each practice. The overall mean adoption across all practices was 57 percent. Risk assessment and risk control planning was the most widely used practice at 79 percent of trials. The practices at the documentation end were used less: evaluation, follow-up, and resolution of each important quality tolerance limit deviation at 44 percent, and updates to the definitions of limits, KRIs, and other centralized monitoring detection components at 41 percent.¹⁵

These are self-reported estimates, and the survey was funded by a central monitoring vendor and a consulting firm, as the authors disclose. Still, the pattern is consistent with what we see: planning is done well, and the record of what happened during the trial is thinner.

A 2025 scoping review of central statistical monitoring reached a related conclusion from the research side. The authors, who went on to review 24 papers published from 2012 to 2022, started from the observation that sponsors have each decided which checks to run and how and when to run them, and that limited information is available on the methods used, with the results of checks not routinely reported.¹⁶ That is a statement about published literature, not about any sponsor’s files. But it describes the same habit: the analysis is done, and the record of it stays informal.

A Minimum Decision Record

A decision record does not need to be elaborate. It needs to be consistent, attributable, and linked to the data. The table below is the minimum set of fields we recommend for every signal, whether it came from a site-level indicator, a statistical test, or a trial-level limit.

Closing a Signal Is a Decision Too

Many signals turn out to be nothing: a site with a high screen failure rate because it serves a population with more exclusions, a slow query response during a site’s holiday period. Closing these signals is correct. But a closure without a rationale looks the same as a signal that was ignored. The central monitoring analyses described earlier depended on this distinction: the platform they studied lets the study team close a signal directly if they conclude it does not represent an actual issue, or open it for investigation and remediation.¹³ Both paths should leave a record. A one-line reason is enough when the reason is simple.

Keep the Record Where the Trial Record Lives

Decision records kept only inside a vendor’s platform are at risk when the contract ends. Monitoring reports and records of significant decisions belong in the trial master file, or in a system whose content is formally part of it. The platform can remain the working tool. But the sponsor should know, before the study starts, how signal and decision records will be exported or archived at the end, in what format, and who will confirm that the export is complete.

Validating the Monitoring Platform and Its Configuration

If the platform’s calculations drive decisions about site visits and participant safety, the platform is a computerized system used in the trial, and its calculations need to be right. E6(R3) is specific about what that means.

What Section 4.3.4 Requires

Section 4.3.4 places responsibility for validation status on the responsible party throughout the system’s life cycle. The validation approach should be based on a risk assessment that considers the intended use of the system, the purpose and importance of its data, and its potential to affect participants and the reliability of results. The section states that both standard system functionality and protocol-specific configurations and customizations, including automated data entry checks and calculations, should be validated, and that interfaces between systems should be defined and validated. Changes should be validated based on risk and should consider both previously collected and new data, in line with change control.¹

For a monitoring platform, “protocol-specific configurations and calculations” means the indicator logic for this study. The vendor’s validation of its product covers the standard functions: user management, audit trails, the statistical engine. It cannot cover the formula a study team configured last month to count missed primary endpoint assessments. That formula has to be checked by whoever configured it, against known data, before its results are used.

What FDA Inspectors Look At

When software problem reports show significant concerns about data reliability, FDA’s compliance program lists the kinds of electronic systems for which investigators should determine whether the sponsor has validation procedures and documentation. The list includes systems used for statistical analyses and for data integration.¹⁴ The program also directs investigators to review software problem reports and helpdesk records, and to determine whether root cause analysis and corrective and preventive action followed for each anomaly.¹⁴ A monitoring platform whose indicator miscounted for three weeks is exactly the kind of anomaly those records should capture.

A Proportionate Split of Validation Effort

Proportionality applies here as it does elsewhere in E6(R3). Not every part of the monitoring stack needs the same level of evidence. We find it useful to separate four layers.

Layer 2 is where effort matters most and where it is most often missing. A study configuration is usually built quickly, near first patient in, by people under time pressure. A short, disciplined test of each indicator against known data takes a day or two and prevents the worst outcome: a sponsor making monitoring decisions for months on a miscalculated number.

Revalidation When Indicators Change

Because section 4.3.4 asks that changes consider previously collected data, a threshold or formula change during the study raises a specific question: does the change alter the interpretation of past signals? If a revised formula would have flagged a site that the old formula missed, the team should look back at that site. The change control record should say whether a look-back was needed and what it found.

A Build Sequence for Sponsors

None of this requires a new platform. It requires deciding, before first patient in, how the monitoring data flow will work and what records it will leave. The sequence below is what we would apply to the next study a sponsor starts. It can also be applied mid-study, starting at step three.

What Good Looks Like

Common Mistakes to Avoid

• Treating the platform as the record. A dashboard shows the current state. It is not a record of what someone saw last quarter unless history is preserved.
• Over-flagging, then ignoring. Too many low-value indicators produce more signals than the team can review, and unreviewed signals become evidence that monitoring was not followed. Fewer, better-linked indicators are easier to defend.
• Separating the data manager from the monitoring lead. The people who understand the source data and the people who make monitoring decisions need to review the data flow together. E6(R3) expressly allows centralized monitoring to be done by data scientists and data managers, which makes this collaboration easier to justify.
• Leaving trial-level limits to the end. An exceedance discovered at database lock, with no evaluation record from the time it happened, is hard to report credibly in the clinical study report.

Conclusion

ICH E6(R3) did not invent risk-based monitoring, and it does not prescribe the indicators, methods, or tools sponsors use. What it does is place monitoring inside a quality management system that starts with critical to quality factors, asks for monitoring proportionate to risk, and expects decisions and their resolution to be recorded. Combined with its data governance section, that turns the risk-based monitoring data flow into something that needs the same care as any other regulated data flow: defined inputs, reproducible calculations, validated configuration, and records that let someone else reconstruct what happened and why. The sponsors who handle this well are not the ones with the most sophisticated analytics. They are the ones who can answer a simple question about a single site on a single date without calling a meeting.

Sakara Digital works with pharma and biotech organizations on the data and system side of clinical operations, including the data flows, validation, and records behind risk-based monitoring. If you are setting up centralized monitoring for a new study, or want an independent look at whether your current monitoring records would hold up to the reconstruction test, we are happy to have that conversation.

For Further Reading