Risk-Based Monitoring in Clinical Trials: What It Is and What FDA and ICH E6(R3) Expect

At a glance

• Risk-based monitoring (RBM) sets the type, frequency and extent of trial monitoring from a documented assessment of what could harm participants or the reliability of the results, instead of visiting every site on a fixed cycle and checking every data point.
• FDA’s final guidance on RBM (August 2013) is a recommendation. The binding duty is in the regulation behind it: 21 CFR 312.50 requires a sponsor to ensure proper monitoring of the investigation.
• FDA recommends one order: identify the critical data and processes first, then assess the risks to them, then write a monitoring plan that targets the important and likely risks.
• ICH E6(R3) requires the sponsor to decide the extent and nature of monitoring from identified risks, and lets centralized monitoring complement site monitoring, reduce it, or be used on its own.
• FDA’s 2013 guidance reads the earlier ICH E6 as allowing a trial to rely entirely on centralized monitoring only in exceptional circumstances. E6(R3) contains no such limit. The two documents are not aligned on that point.
• FDA tells its inspectors to check whether monitoring was carried out in accordance with the sponsor’s monitoring procedures, and expects monitoring records detailed enough to show the plan was followed.

Risk-based monitoring (RBM) is a way of overseeing a clinical trial in which the sponsor first identifies the data and processes that matter most to participant safety and to the reliability of the results, assesses what could go wrong with them, and then sets the type, frequency and extent of monitoring to match those risks. The method comes from two places: FDA’s 2013 guidance Oversight of Clinical Investigations: A Risk-Based Approach to Monitoring, and ICH E6(R3), which builds risk-proportionate monitoring into Good Clinical Practice itself. Both put the same step first: decide which data and processes are critical before deciding how to monitor them, and write the reasoning into the monitoring plan.

Risk-based monitoring, defined

ICH E6(R3) defines monitoring as the act of overseeing the progress of a clinical trial and ensuring it is conducted, recorded and reported in accordance with the protocol, SOPs, GCP and the applicable regulatory requirements. RBM is a way of deciding how much of that oversight to apply, and where. E6(R3) section 3.11.4 states the rule in one line: the sponsor should determine the appropriate extent and nature of monitoring based on identified risks.

FDA describes the goal as focusing sponsor oversight on the most important aspects of study conduct and reporting. The guidance also heads off the most common misreading: a risk-based approach does not mean less vigilance. It focuses oversight on preventing or mitigating important and likely risks to data quality and to the processes that protect participants and trial integrity.

Two framing points from FDA are worth keeping in view:

• Monitoring is a quality control tool, and FDA states that monitoring alone cannot ensure quality. Quality has to be built into the trial before monitoring starts.
• RBM is FDA’s recommended route to an obligation that already exists. FDA’s regulations require sponsors to monitor the conduct and progress of their investigations but do not say how, so they are compatible with a range of approaches.

RBM vs RBQM. RBM is the monitoring part. Risk-based quality management (RBQM) is the wider system in ICH E6(R3) section 3.10: identifying, evaluating, controlling, communicating, reviewing and reporting risks across the whole trial, with monitoring as one of several controls. Our guide to risk-based quality management under ICH E6(R3) covers that system.

Risk-based vs traditional monitoring

FDA’s guidance describes the traditional model it set out to change: periodic, frequent visits to every site to review data for each enrolled participant, with on-site visits for major efficacy trials typically at intervals of about four to eight weeks. FDA attributes that pattern partly to a perception that frequent visits with 100% data verification were FDA’s preferred approach.

Question	Traditional monitoring	Risk-based monitoring
What sets visit frequency	A fixed calendar, the same for every site	The risk assessment, adjusted as the trial produces knowledge (ICH E6(R3) 3.11.4.1)
How much source data is verified	Usually all of it	The critical data, often on a sample of participants and visits (FDA III.B.3, ICH E6(R3) 3.11.4.5.4)
Where data review happens	Mostly at the site	Centrally and at the site, in a mix the plan justifies (FDA IV)
What triggers an extra visit	The next scheduled date	A finding, such as a site that differs markedly from the others (FDA IV.D.1)
What the plan must explain	The visit schedule	The methods, the risks each one addresses, and the rationale (ICH E6(R3) 3.11.4.3)

Reduced source data verification (SDV) is often the most visible result, but it is an output of the risk assessment, not the goal. Our page on source data verification covers how to scope targeted SDV.

The chain RBM depends on: critical-to-quality factors, risks, acceptable ranges

RBM is the last link in a chain that starts at protocol design. If the earlier links are missing, the monitoring plan has nothing to point at.

1. Critical-to-quality factors (ICH E8(R1)). ICH E8(R1) section 3.2 defines critical-to-quality factors as attributes of a study whose integrity is fundamental to the protection of participants, the reliability and interpretability of the results, and the decisions made from them. It adds that these factors should be clear and should not be cluttered with minor issues. A list that includes every data field identifies nothing.
2. Risks to those factors (ICH E8(R1) and E6(R3)). E8(R1) section 3.2 says that once the factors are identified, the risks that threaten them should be judged on probability, detectability and impact, and either accepted or mitigated. E6(R3) section 3.10.1.1 requires the sponsor to identify those risks before the trial starts and throughout its conduct.
3. Acceptable ranges (ICH E6(R3)). Under E6(R3) section 3.10.1.3, the sponsor should, where relevant, set pre-specified acceptable ranges, such as quality tolerance limits at the trial level. A deviation beyond them calls for an evaluation of whether there is a systemic issue and whether action is needed.
4. The monitoring plan (FDA and ICH E6(R3)). Monitoring is one of the risk controls E6(R3) section 3.10.1.3 names, alongside protocol design, agreements and training.

The vocabulary shifts between documents. E8(R1) talks about critical-to-quality factors, while FDA’s guidance asks sponsors to identify critical data and processes. Our critical-to-quality factors guide shows how one feeds the other.

What FDA’s risk-based monitoring guidance recommends

The version in force is the final guidance dated August 2013.

Status. FDA guidance documents do not establish legally enforceable responsibilities. They describe the agency’s current thinking and are recommendations unless they cite a specific regulatory or statutory requirement. The guidance points to the binding text: 21 CFR 312.50 requires a sponsor to ensure “proper monitoring of the investigation(s)”, and 21 CFR 812.40 says the same for device studies.

The sequence. FDA section IV says sponsors should prospectively identify critical data and processes, then perform a risk assessment of the risks that could affect them, then develop a monitoring plan that focuses on the important and likely risks. No single approach to monitoring is appropriate for every trial, and FDA recommends a plan tailored to the specific participant protection and data integrity risks of the trial, ordinarily mixing centralized and on-site monitoring.

What counts as critical. FDA section IV.A lists the data and processes that should ordinarily be identified as critical:

• verification that informed consent was obtained appropriately
• adherence to eligibility criteria
• investigational product accountability and administration, including the integrity of randomization at the site where appropriate
• procedures and assessments for study endpoints and protocol-required safety assessments
• evaluating, documenting and reporting serious adverse events, deaths and withdrawals, especially withdrawals that may relate to an adverse event
• procedures essential to trial integrity, such as maintaining the blind, referring events for adjudication and allocation concealment

FDA says data such as concomitant treatments, demographic covariates and routine laboratory tests that do not address protocol-specified safety or efficacy endpoints often may be monitored less intensively. Its reasoning is about error types. A small number of errors in endpoint data can change study results, while a low rate of randomly distributed errors in baseline characteristics generally will not.

The risk assessment. FDA section IV.B asks sponsors to assess and prioritize each risk by the likelihood of errors occurring, their impact on participant protection and trial integrity, and the extent to which they would be detectable. It also notes that some risks are better handled outside monitoring, for example by modifying the protocol to remove the source of the risk, and that sponsors should periodically evaluate emerging risks.

Factors that change the monitoring mix. FDA section IV.C lists what should move the type, frequency and extent of monitoring:

Factor	FDA’s direction (section IV.C)
Complex study design (adaptive, stratified, complex dose titration)	More intensive monitoring may be necessary
Interpretive or subjective endpoints	May require on-site visits. Objective endpoints such as death or lab values may suit remote verification
Seriously ill or vulnerable population	More intensive monitoring and consideration of on-site visits
Differences in medical practice or less established trial infrastructure in a region	More intensive monitoring and consideration of on-site visits
Investigators new to trials, or to a novel device or procedure	More intensive monitoring and frequent communication
Significant safety concerns, or no prior human experience (phase 1, device feasibility)	More intensive monitoring and consideration of on-site visits
Stage of the study	A tapered approach, more intensive at initiation and early on
Quantity of data	Some centralized tools become more useful as trial size, duration or site count grows

Centralized monitoring. FDA encourages greater use of centralized monitoring than has been the case historically, with correspondingly less emphasis on on-site monitoring. It also recognizes that this places more emphasis on centralized methods than appeared feasible when ICH E6 was finalized, and expects industry to keep using some on-site monitoring for the foreseeable future.

How strong the evidence is. FDA acknowledges there are limited empirical data on the relative value of monitoring methods, including on-site monitoring. As one supporting reference, it cites a review of a single multi-center international trial that found centralized monitoring could have identified more than 90% of the findings from its on-site visits.

Asking FDA. Drug sponsors may include specific questions about a monitoring plan in a request for a formal meeting with FDA, such as an end of phase 2 meeting. Device sponsors can use a Pre-Submission or contact CDRH’s Division of Bioresearch Monitoring.

ICH E6(R3) makes risk-proportionate monitoring part of GCP

E6(R3) makes proportionality a principle of GCP. Principle 7 says trial processes, measures and approaches should be implemented in a way that is proportionate to the risks to participants and the importance of the data collected, and that avoids unnecessary burden on participants and investigators.

Section 3.11.4 then sets the monitoring rules:

• When setting the extent and nature of monitoring from identified risks, the sponsor should consider factors such as the trial’s objective, design, complexity, blinding, number of participants, investigational product, current knowledge of its safety profile and endpoints.
• Monitoring should be performed by persons not involved in the clinical conduct of the trial at the site being monitored.
• Site monitoring may be performed on-site and/or remotely, and its frequency should be modified as appropriate using knowledge gained (section 3.11.4.1).
• Centralized monitoring is an evaluation of accumulated data, performed in a timely manner, by the sponsor’s qualified and trained persons, such as a medical monitor, data scientist or biostatistician (section 3.11.4.2(a)).
• Centralized monitoring can complement and reduce the extent or frequency of site monitoring, or be used on its own, and can support the selection of sites and processes for targeted site monitoring (section 3.11.4.2(b) and (c)).

For data, section 3.11.4.5.4 lets the accuracy and completeness check be done on samples supported by data analytics, with the sample adjusted after earlier monitoring results. Monitoring should verify data identified as higher criticality in the monitoring plan against source, and look for missing data, inconsistent data, outliers, unexpected lack of variability and protocol deviations.

Where FDA’s 2013 guidance and ICH E6(R3) are not aligned

Two differences matter for anyone writing a plan for a trial that falls under both.

Centralized monitoring on its own. FDA’s guidance (section II.A) describes ICH E6 and ISO 14155:2011 as allowing reduced or even no on-site monitoring, but making clear that relying entirely on centralized monitoring would be appropriate only in exceptional circumstances. FDA was describing the 1996 edition of E6. E6(R3) section 3.11.4.2(b) says centralized monitoring can be used on its own and attaches no “exceptional circumstances” condition. FDA’s guidance separately asks that a sponsor relying heavily on centralized monitoring identify in the plan when on-site visits would be indicated (section III.A.2). The current FDA guidance and the current ICH guideline therefore set different expectations for a monitoring model with no site visits.

What “remote” belongs to. FDA defines on-site monitoring as an in-person evaluation at the site and centralized monitoring as a remote evaluation at another location, and it lists remote verification of critical source data among centralized techniques (sections III.A and III.B). E6(R3) classes remote access to source records as site monitoring performed remotely (section 3.11.4.1(b) and (c)), separate from centralized monitoring of accumulated data. The same activity sits in a different category depending on which document the plan follows. Our guide to remote monitoring in clinical trials covers how remote site monitoring runs in practice.

When on-site monitoring still earns the trip

RBM moves effort toward risk, and at some sites that means more visits. The situations below come from FDA sections III.A.1, IV.C and IV.D.1 and ICH E6(R3) section 3.11.4.2(c):

• On-site monitoring can be particularly helpful early in a study, especially when the protocol is complex and includes procedures investigators may not know.
• Interpretive or subjective endpoints may need a visit, so the monitor can review the full participant record and the investigator’s use of protocol definitions.
• A seriously ill or vulnerable population, or a product with significant safety concerns or no prior human experience, calls for more intensive monitoring and consideration of on-site visits.
• The same applies to inexperienced investigators and to regions with different standards of medical practice or less established trial infrastructure.
• A site that stands out in central review should be considered for a targeted on-site visit. FDA’s example is an investigator who differs markedly from the others in safety-related findings, enrollment rate, number of protocol deviations or rate of missing CRFs.

Our article on clinical trial site monitoring covers the visit types themselves.

Risk-based monitoring examples

Three patterns that come straight from the guidance show how the method changes the work.

Targeted SDV. FDA section III.B.3 gives the example of a protocol that collects concomitant medications, body temperature and body weight. The sponsor may decide these are not critical, because a small error rate in them would not affect the outcome, and that comparing 100% of source data to CRFs adds little. It may be enough to check the most critical data points for a sample of participants and visits.

Central review that aims the visit. FDA section III.B lists checks that work better from the center than at a single site: missing and inconsistent data, outliers, range and completeness checks, unusual data distributions within and between sites such as too little variance, and site metrics such as high screen failure or withdrawal rates, frequent eligibility violations and delays in reporting data. Sites flagged by these checks become candidates for targeted on-site work. ICH E6(R3) section 3.11.4.5.4 lists the same kinds of signal, including unexpected lack of variability.

Tapered monitoring. For a complex study, FDA section IV.C describes intensive, on-site monitoring at initiation that steps down once site procedures are established. The same taper can apply to relatively inexperienced investigators. ICH E6(R3) section 3.11.4.1(a) supports the adjustment by asking that monitoring frequency be modified using knowledge gained.

Quality tolerance limits, key risk indicators and central signals

These three terms get used as synonyms, but they work at different levels.

	Quality tolerance limit (QTL)	Key risk indicator (KRI)	Central monitoring signal
Level	The whole trial	Usually a site or region	Any level, from one record upward
Source	ICH E6(R3) 3.10.1.3, pre-specified acceptable ranges such as QTLs at trial level	Industry practice, not a defined term in ICH E6(R3), E8(R1) or FDA’s guidance	ICH E6(R3) 3.11.4.2, evaluation of accumulated data
A breach means	Evaluate whether there is a systemic issue and whether action is needed	Look harder at that site, possibly with a targeted visit	Investigate, and decide whether it points to a site or a trial problem
Reported in	The clinical trial report, under E6(R3) 3.10.1.6	Monitoring reports and dashboards	Centralized monitoring reports

A KRI tells you which site to look at. A QTL tells you whether the trial as a whole has a problem that has to be evaluated and reported. FDA’s 2013 guidance does not use the term QTL. Its nearest idea is in section IV.D.1, where it says that establishing acceptable variation for particular critical data and processes helps identify significant deviations. Our page on quality tolerance limits covers how to set and document them.

The risk-based monitoring plan: a checklist

ICH E6(R3) section 3.11.4.3 requires a monitoring plan tailored to the identified risks to safety, data quality and the reliability of results. It describes the monitoring strategy, the activities of all parties involved, the methods and tools to be used and the rationale for their use. FDA section IV.D lists what the plan’s components might include. Together they give this checklist:

• A brief description of the study, its objectives, and its critical data and procedures, with attention to procedures that are unusual in routine care and need site training (FDA IV.D).
• The specific risks the monitoring addresses (FDA IV.D) and the critical-to-quality focus of the plan (E6(R3) 3.11.4.3).
• Each monitoring method, how it addresses the important risks, and the rationale for using it (FDA IV.D.1, E6(R3) 3.11.4.3).
• Criteria for the timing, frequency and extent of planned monitoring (FDA IV.D.1).
• The events or results that trigger a change to planned monitoring for a site (FDA IV.D.1).
• The quantity and types of source records to verify or corroborate (FDA III.B.3).
• Possible deviations or failures critical to study integrity, and how they are recorded and reported (FDA IV.D.1). Our guide to protocol deviation management covers that process.
• Monitoring of important data and processes performed outside the site, such as central laboratories or central image reading (E6(R3) 3.11.4.3).
• How monitoring results are communicated, including immediate reporting of significant issues (FDA IV.D.2).
• How noncompliance is handled, including root cause analysis and corrective and preventive action for important deviations (FDA IV.D.3).
• Training for everyone doing monitoring, including central and statistical reviewers, and planned audits of monitoring (FDA IV.D.4).
• The events that would prompt a plan revision, such as a protocol amendment or new risks to study integrity (FDA IV.D.5).
• How each monitoring activity is documented, on-site or central (FDA IV.D.1 and V).

On documentation, FDA section V says monitoring records should include enough detail to verify that the monitoring plan was followed. Under E6(R3) section 3.11.4.6, a monitoring report should include a summary of what was reviewed, the significant findings, the actions required and follow-up on earlier findings. Our articles on the clinical monitoring plan and the monitoring visit report go further on both documents.

Handing RBM to a CRO

Many sponsors delegate monitoring. FDA section VI.C notes that 21 CFR 312.52 requires any transfer of obligations to a CRO to be in writing, and that the sponsor keeps responsibility for overseeing the CRO’s work. FDA also says the sponsor should share information that shapes the CRO’s monitoring decisions, such as the findings of the risk assessment, and should prospectively evaluate monitoring plans the CRO develops. In practice, the risk assessment has to travel with the contract. Our guide to clinical trial sponsor responsibilities covers the wider duty.

What an RBM tool needs to do, and what it can’t do for you

RBM software runs the centralized side of the program. Judge a tool on whether it can:

• run FDA’s central data checks for missing, inconsistent and outlying data and unusual distributions, across all sites at once (FDA III.B, ICH E6(R3) 3.11.4.5.4)
• compare site performance metrics, so that a site differing markedly from its peers is flagged (FDA IV.D.1)
• hold your trial-level acceptable ranges and show when one is exceeded (ICH E6(R3) 3.10.1.3)
• record what was reviewed, what was found and what action followed, in a form that lets an inspector check the plan was followed (FDA V, ICH E6(R3) 3.11.4.6)

FDA notes that electronic data capture systems able to assess quality metrics in real time could help identify higher-risk sites for more intensive monitoring, and that some centralized tools become more useful as the quantity of data grows. A small, short study may get little from a platform built for a large multi-site program.

What no tool can do is decide what is critical. ICH E8(R1) section 3.2 gives that job to the sponsor and others designing quality into the study, and section 3.3.1 encourages dialogue about what is critical to quality that goes beyond sole reliance on tools and checklists. A tool configured before the critical data are defined will monitor whatever its default settings measure.

Where RBM programs fail

Buying the tool before defining the risks. The vendor’s default KRI library goes live, and nobody can say which critical-to-quality factor each indicator protects. Ask that question of every indicator on the dashboard. An indicator with no answer is noise, and one with no defined action on breach is decoration.

Setting the risk assessment once. ICH E6(R3) section 3.10.1.5 requires the sponsor to periodically review risk control measures to check that they remain effective and relevant. FDA section IV.B asks sponsors to periodically evaluate emerging risks and whether monitoring needs to change. A plan last touched at study start does neither.

Writing a plan nobody follows. E6(R3) section 3.11.4.4 says persons performing monitoring should follow the sponsor’s monitoring plan. FDA section VI calls a sponsor’s compliance with its monitoring plans a fundamental component of quality monitoring. When the visit log, the central review records and the plan tell different stories, an inspector will find it.

Losing site training when visits drop. On-site visits have historically been where monitors trained site staff and gave feedback. FDA section VI.B says sponsors planning less frequent or limited on-site monitoring should build in time for discussion, feedback and training, and may need alternative training and communication methods to do it.

Sources

• FDA Guidance for Industry: Oversight of Clinical Investigations — A Risk-Based Approach to Monitoring (final, August 2013)
• ICH E6(R3) Good Clinical Practice
• ICH E8(R1) General Considerations for Clinical Studies