Data Safety Monitoring Plan vs. Medical Monitoring Plan vs. DSMB Charter: Which One Your Trial Needs, Who Signs It, and How They Fit Together

At a glance

• The medical monitoring plan (MMP), the data safety monitoring plan (DSMP), and the DSMB charter are three distinct instruments with different owners, triggers, and cadences. Treating them as one fill-in template is how plans fail inspection.
• The medical monitor does continuous, per-event clinical review: real-time causality and severity calls on each serious adverse event (SAE) as it arrives. The DSMB (also called a DSMC or IDMC) does scheduled aggregate review of accumulating data. One feeds the other; neither replaces it.
• Not every trial needs a DSMB. ICH E6(R3) §3.11.4.3 requires a risk-tailored monitoring plan for every sponsor; an independent data monitoring committee is one oversight option among several, not a universal mandate.
• The reporting timelines are the load-bearing detail: ICH E2A and 21 CFR §312.32 set 7 calendar days for unexpected fatal or life-threatening reactions and 15 calendar days for other serious, unexpected suspected adverse reactions. Your plan must name who hits those clocks.
• A generic template is never enough. Expectedness is judged against your Investigator’s Brochure, and escalation paths, stopping-rule references, and the named medical monitor are all protocol-specific.

A coordinator handed a new protocol and told to “produce the safety monitoring plan” usually starts from a downloaded NIH or academic PDF that conflates three different documents. The ranking results compound the confusion: they hand over one generic form labeled “DSMP / MMP” and call it done. That single template satisfies none of the obligations cleanly, because the regulations assign continuous medical review, aggregate data review, and independent oversight to different actors on different clocks. This guide disentangles the three instruments, shows which one your trial is actually required to have, and maps how the medical monitor’s real-time calls feed (but never substitute for) the committee’s periodic review.

Three instruments, not one

Medical monitoring plan (MMP). This governs the sponsor’s medical monitor: a qualified physician who reviews safety events as they arrive and makes the clinical judgment calls. ICH E6(R3) §3.4.1 requires that the sponsor have medical personnel readily available to advise on trial-related medical questions or problems. The MMP is the operational document that turns that requirement into a named person, a workflow, and an escalation path.

Data safety monitoring plan (DSMP). This is the broader, sponsor-owned monitoring strategy. Under ICH E6(R3) §3.11.4.3, the sponsor should develop a monitoring plan tailored to the identified potential safety risks and to risks to data quality and reliability, with particular attention to procedures relevant to participant safety. The plan describes the monitoring strategy, the activities of all parties, and the methods and tools used. In practice the DSMP often subsumes or references the MMP and defines the trigger for convening an independent committee.

DSMB charter. The data safety monitoring board (DSMB), also called a data safety monitoring committee (DSMC) or independent data monitoring committee (IDMC), is an independent body that reviews accumulating data on a schedule and can recommend continuing, modifying, or stopping the trial. ICH E6(R3) §3.6.1 treats the IDMC as a party the sponsor contracts with: agreements with an IDMC should be documented prior to initiating the activities. The charter is that governing document. Note the gap: no dedicated DSMB guidance is grounded in our in-scope corpus, so charter specifics here lean on E6(R3)‘s safety-oversight language rather than a committee-specific rule.

Instrument	Owner	Primary trigger	Cadence	Always required?	Signs off	Primary output
Medical monitoring plan (MMP)	Sponsor (medical monitor)	Each incoming SAE / safety signal	Continuous, per-event	Effectively yes: §3.4.1 requires available medical personnel	Sponsor medical monitor / medical lead	Real-time causality, severity, and expectedness calls; escalation decisions
Data safety monitoring plan (DSMP)	Sponsor	Trial start; updated as risks emerge	Continuous oversight + scheduled review	Yes: §3.11.4.3 requires a risk-tailored monitoring plan	Sponsor (QA / clinical-ops)	Monitoring strategy, methods, and the trigger to convene a committee
DSMB / DSMC / IDMC charter	Independent committee, contracted by sponsor	Risk profile warrants independent aggregate oversight	Periodic (scheduled interim reviews)	No: risk-dependent	Committee chair + sponsor (documented agreement, §3.6.1)	Recommendations to continue, modify, or stop

Which one does your trial actually need?

Every sponsor-run interventional trial needs a monitoring plan and accessible medical expertise. ICH E6(R3) §3.11.4.3 makes the monitoring plan a baseline expectation, and §3.4.1 makes available medical personnel a baseline expectation. So the MMP and the DSMP are not optional in any meaningful sense; the only question is how much they contain and who is named.

The DSMB is the variable. ICH E6(R3) §3.11.4 frames monitoring extent and nature as something the sponsor determines based on identified risks, and §3.6.1 treats an IDMC as a contracted party rather than a default fixture. The drivers that push a trial toward needing one are familiar to anyone who has run a late-phase study: serious or life-threatening indications, vulnerable populations, designs where harm could accumulate before any single event looks alarming, and any study where unblinded interim review is the only way to catch a safety trend. A small, short, low-risk early-phase study with a well-characterized product and a vigilant medical monitor may legitimately not convene a board. Document the rationale either way; an undocumented “we decided we did not need one” is what inspectors flag.

What a medical monitoring plan must contain

The MMP is where the abstract duty to have medical expertise becomes an auditable workflow. A usable checklist, each item tied to a named obligation:

• The named medical monitor and qualifications. ICH E6(R3) §3.4.1 requires medical personnel readily available to advise on trial-related medical questions. “Readily available” implies named coverage, contact pathways, and backup, not a title on an org chart.
• The per-event review duty. ICH E6(R3) §1.2 states that participant safety should be reviewed in a timely manner as new safety information becomes available. The MMP defines what “timely” means for your risk profile and who performs the review.
• Causality assessment on every SAE. Investigators must report SAEs immediately to the sponsor and include an assessment of causality (ICH E6(R3) §2.7, the participant safety reporting section). Under 21 CFR §312.64(b), an investigator must immediately report any serious adverse event to the sponsor, whether or not considered drug related, and include an assessment of whether there is a reasonable possibility that the drug caused the event. The MMP defines how the medical monitor reviews, confirms, or revises that causality call.
• Expectedness determination. The medical monitor judges each serious reaction against the reference safety information. ICH E2A defines an unexpected adverse reaction as one whose nature or severity is not consistent with the applicable product information, and an event more specific or more severe than described in the Investigator’s Brochure is “unexpected.” This call decides whether expedited reporting clocks start.
• The escalation path and timeline. This is the single most common omission. The plan must say who escalates, on what timeline, and to whom: from SAE detection, to the medical monitor’s causality and expectedness call, to the sponsor’s expedited reporting, to (where one exists) the committee’s next aggregate review.
• Aggregate safety review by the sponsor. ICH E6(R3) §3.13.1 requires the sponsor to aggregate, as appropriate, and review relevant safety information in a timely manner. The MMP should name who performs this rollup and how it connects to any committee.

Trials that fail inspection rarely fail because the template was the wrong color. They fail because the plan named no medical monitor, or defined no escalation timeline, so when a signal arrived there was no documented owner and no clock.

Where the medical monitor stops and the DSMB starts

This is the line every conflated template erases. The two roles do not overlap; they hand off.

The medical monitor works at the level of the individual event, continuously. Each SAE arrives, the monitor assesses causality and severity, judges expectedness against the Investigator’s Brochure, and decides whether it triggers expedited reporting or a protocol action. This is the per-event clinical review channel.

The DSMB works at the level of accumulating data, periodically. It does not adjudicate single events in real time; it reviews aggregate, often unblinded, data on a schedule to detect trends no single event would reveal, and it can recommend stopping. ICH E6(R3) §3.13.2(b) is explicit that some reporting is aggregate: it allows, in some regions, periodic reporting of line listings with an overall safety assessment. That aggregate channel is the committee’s domain, and it is precisely why 21 CFR §312.32(c)(1)(i)(C) recognizes that an aggregate analysis showing events occurring more frequently in the drug group than in a control group can itself qualify as a reportable suspected adverse reaction. Some safety signals are only visible in aggregate.

The handoff: the medical monitor’s confirmed per-event causality calls become inputs to the data package the committee reviews. The committee’s aggregate findings can in turn change how the monitor weighs subsequent events. The medical monitor’s real-time review never substitutes for the committee’s aggregate review, and the committee’s scheduled review never substitutes for real-time per-event vigilance. A plan that assigns both jobs to the same continuous channel has a blind spot for trends; a plan that defers everything to the next board meeting has a blind spot for the urgent single event.

How SAE and SUSAR reporting timelines wire into the plan

The plan is only as good as the clocks it names. The reporting framework runs on definitions and deadlines from ICH E2A and 21 CFR Part 312, and the two in-scope sources align closely here.

Definitions. ICH E2A defines a serious adverse event as any untoward medical occurrence that at any dose results in death, is life-threatening, requires or prolongs inpatient hospitalization, results in persistent or significant disability, or is a congenital anomaly. 21 CFR §312.32(a) carries an essentially equivalent definition of “serious,” judged in the view of either the investigator or the sponsor. On causality, ICH E2A requires a causality assessment for clinical investigation cases and treats a “reasonable suspected causal relationship” as the threshold; 21 CFR §312.32(a) defines a suspected adverse reaction as any adverse event for which there is a reasonable possibility that the drug caused it. These align: build the plan on the shared “reasonable possibility” standard.

Expectedness. ICH E2A determines expectedness against the relevant source document, with the Investigator’s Brochure as the reference, and an event more specific or severe than described counts as unexpected. 21 CFR §312.32(a) likewise defines “unexpected” as not listed in the investigator brochure, or not listed at the observed specificity or severity. Again, aligned. A SUSAR (suspected unexpected serious adverse reaction) is the intersection: suspected, unexpected, and serious.

The clocks. This is where the plan must be exact. ICH E2A requires that fatal or life-threatening unexpected ADRs be reported as soon as possible but no later than 7 calendar days after the sponsor’s first knowledge, followed by a complete report within 8 additional calendar days. 21 CFR §312.32(c)(2) sets the same 7-calendar-day deadline for any unexpected fatal or life-threatening suspected adverse reaction. For all other serious, unexpected reactions, ICH E2A sets a deadline of no later than 15 calendar days after first knowledge, and 21 CFR §312.32(c)(1) sets the same 15-calendar-day deadline for serious and unexpected suspected adverse reactions. The two regimes agree on both clocks; the plan should state them as the single operative deadlines and name the role responsible for each.

A note on direction of flow: the sponsor’s expedited reports go to the regulatory authority, and under ICH E6(R3) §3.13.2(b) the sponsor expedites SUSARs to regulators in accordance with ICH E2A. Investigators, separately, report to the sponsor: 21 CFR §312.64(b) requires the investigator to report SAEs to the sponsor immediately, and §312.66 requires the investigator to promptly report to the IRB all unanticipated problems involving risk to human subjects. The plan must keep these two flows distinct.

Where teams get it wrong

• Copy-pasting one template for all three instruments. The downloaded form usually encodes neither the per-event/aggregate split nor a real escalation timeline. Because expectedness is judged against your Investigator’s Brochure, a generic template cannot pre-fill the most consequential field.
• Naming no medical monitor, or naming a title instead of a person. ICH E6(R3) §3.4.1 requires readily available medical personnel. A plan with no named, reachable monitor has no owner for the causality call that starts every clock.
• Omitting the escalation timeline. A plan that lists duties but not deadlines leaves the 7-day and 15-day clocks of ICH E2A and 21 CFR §312.32 with no assigned owner.
• Collapsing the medical monitor and the DSMB into one channel. This is the conceptual error the whole article exists to fix. Continuous per-event review and scheduled aggregate review catch different failures; one cannot do the other’s job.
• Assuming a DSMB is mandatory, or assuming it is never needed. ICH E6(R3) §3.11.4 makes oversight extent risk-based. The defensible position is a documented decision either way, not silence.
• Treating “we have a plan” as “we are compliant.” Regulations set requirements; a plan enables you to meet them, but the sponsor remains responsible for actually meeting them. A document on the shelf that no one executes against satisfies nothing.

For the adjacent mechanics, see the sibling explainers on this site covering SAE versus SUSAR expedited reporting in depth, protocol deviation triage, and risk-based monitoring, which sit alongside this guide in the safety-oversight cluster. This article disambiguates the instruments; those go deeper on each reporting pathway. Stopping-rule and interim-analysis statistics are deliberately out of scope here: know that stopping rules exist and live in the protocol and the DSMB charter, but the boundary math belongs in a statistical analysis plan, not this guide.

Sources

• ICH E6(R3) Good Clinical Practice, version r3 (ICH, 2025) — https://www.ich.org/page/efficacy-guidelines
• ICH E2A Clinical Safety Data Management: Definitions and Standards for Expedited Reporting, version r1 (ICH) — https://database.ich.org/sites/default/files/E2A_Guideline.pdf
• 21 CFR Part 312 Investigational New Drug Application, version 2026-04 (FDA)