The Investigator Site File as an Inspection-Ready Evidence System: Reconciling the ISF to the TMF, and the Four Failure Modes Inspectors Cite

At a glance

• The Investigator Site File (ISF) is not a separate regime: under the EMA TMF guideline it is the investigator/institution part of one TMF for the trial, and ICH E6(R3) treats it as the investigator/institution repository of essential records. Your job at the site is to keep that half complete, current, and reconcilable to the sponsor’s half.
• Inspectors rarely fail you for a binder that looks thin. They fail you for records that are missing, expired, contradictory, or unreconciled against the sponsor TMF, and for a delegation log that does not match who actually did the work.
• ICH E6(R3) requires essential records to be filed in a timely manner and kept complete, readable, and directly accessible on request. “Contemporaneous, not retrospective” is the standard, not an aspiration.
• The delegation-of-authority record is usually the first thing an inspector pulls. ICH E6(R3) requires the investigator to maintain a record of who was delegated which trial-related activities.
• An electronic ISF (eISF) inherits the EMA computerised-systems duties: validation that the system is fit for purpose, security and access control, an audit trail, and certified copies. Going electronic does not relax any ISF obligation; it adds system-level ones.
• The sponsor stays responsible for the trial overall, but the investigator/institution retains control of and responsibility for the essential records it generates. Software and process can enable an inspection-ready ISF; they cannot transfer that accountability away from the site.

This guide is written for the people who actually host the visit: CRCs, PIs, and site QA/regulatory coordinators preparing for, or recovering from, a monitoring visit or a BIMO/MHRA/EMA inspection. The pain it addresses is specific: “my binder looks complete, but I don’t know what an inspector will actually fault.” The answer is that inspectors do not assess your ISF as a contents list. They assess it as an evidence system, and they probe the four places sites predictably fail.

ISF vs TMF: the same essential records, two custodians, one file that must reconcile

Start with the relationship, because almost every downstream failure traces back to misunderstanding it. The EMA TMF guideline states that the TMF is usually composed of a sponsor TMF held by the sponsor and an investigator TMF held by the investigator/institution, that the investigator part is often called the investigator site file (ISF), and that there should be only one TMF for a clinical trial, comprising the sponsor and investigator parts. The ISF is therefore not a parallel archive. It is half of a single evidentiary record, and the two halves have to add up.

ICH E6(R3) describes the same arrangement from the records side: essential records are maintained in, or referred to from, repositories held by the sponsor and by the investigator/institution, the sponsor’s repository may be called the TMF and the investigator/institution’s repository may be called the ISF. The guideline is explicit that the investigator/institution should have control of all essential records it generates before and during the trial.

The practical consequence: documents the sponsor produces (protocol, Investigator’s Brochure, procedural manuals) must be present in your ISF in a form that lets the trial be reconstructed without reaching into the sponsor TMF. The EMA TMF guideline requires that superseded versions of sponsor-produced documents such as the protocol, IB, and eCRF be present in the investigator/institution TMF in a way that enables reconstruction without access to the sponsor TMF, with evidence of date of receipt, review or approval where necessary, and date of implementation by the site. Reconciliation, in everyday terms, means: if the sponsor TMF says protocol v4.0 was effective on a given date, your ISF should show you received it, when, and when you implemented it, with v3.0 retained, not discarded.

What belongs in the ISF, and the discipline of filing it contemporaneously

Treat the essential-records content of the ISF as the investigator/institution half of the TMF, not a freestanding checklist. ICH E6(R3)‘s Essential Records Table lists the records that, if produced, are considered essential and should be retained, and it is explicit that the list is not exhaustive. The table flags with an asterisk those records that should generally be in place before the trial starts, which is your start-up trigger set.

The table below is a working ISF index keyed to ICH E6(R3)‘s Essential Records Table. It doubles as your contents list, section map, and filing-trigger checklist. It is directional, not a substitute for the trial-specific content list your sponsor and site agree on.

Essential record (per ICH E6(R3) Essential Records Table)	ISF section	Typical owner at site	Filing trigger / timeline
Signed protocol and subsequent amendments	Start-up / ongoing	PI / regulatory coordinator	Before start (start-up); each amendment on implementation
Investigator’s Brochure (or product information)	Start-up	Regulatory coordinator	In place before start; updated on receipt
IRB/IEC approval, composition, and ongoing correspondence	Start-up / ongoing	Regulatory coordinator	On each approval/communication
Regulatory authority authorisation/approval (where required)	Start-up	Regulatory coordinator	Before start; on each amendment
CVs and documents evidencing qualifications of investigator(s)/sub-investigator(s)	Start-up / ongoing	Site QA	Before start; refresh when role or credentials change
Trial-specific training records	Start-up / ongoing	CRC / site QA	Before a person performs a delegated activity
Documentation of delegation of trial-related activities; signature/initials sheet	Start-up / ongoing	PI / CRC	Before delegation takes effect; update on staffing change
Signed, dated informed consent forms; participant ID code list; enrolment log	Conduct	CRC	Contemporaneously, per participant
Source records and data acquisition tools (with corrections traceable)	Conduct	CRC / investigator	Contemporaneously
Normal value(s)/range(s) and lab certification/accreditation	Start-up / ongoing	Site QA	Before start; refresh on expiry
IMP accountability, storage conditions, and disposition records	Conduct / close-out	Pharmacy	On each event (receipt, dispensing, return/destruction)
Site monitoring reports (selection, initiation, routine, close-out)	Ongoing / close-out	CRC	On receipt from monitor
Records of noncompliance, protocol deviations, and CAPA	Conduct	CRC / site QA	As events occur

ICH E6(R3) sets the filing standard plainly: the sponsor and investigator/institution should ensure that essential records are collected and filed in a timely manner. It also requires that some essential records generally be in place before the trial starts and may be updated during the trial. That is the regulatory backbone of “file contemporaneously, not retrospectively.” A record reconstructed the week before an inspection is not contemporaneous, and an experienced inspector can usually tell.

Ownership and the delegation-of-authority log: the first thing they pull

Ask any coordinator who has hosted an inspection what gets requested first, and the delegation log is near the top of the list. The regulation is the reason. ICH E6(R3) requires the investigator to ensure that a record is maintained of the persons and parties to whom the investigator has delegated trial-related activities, with delegation documentation proportionate to the significance of the activities. The guideline also requires the investigator to ensure that persons to whom activities are delegated are appropriately qualified and adequately informed about the protocol, the investigational product, and their assigned activities.

Crucially, delegation does not move responsibility. ICH E6(R3) states that the investigator may delegate trial-related activities but retains ultimate responsibility and should maintain appropriate oversight of those undertaking the delegated activities. A clean delegation log is therefore not paperwork for its own sake; it is the evidence that oversight existed and that the right, trained people did the right tasks.

The EMA TMF guideline reinforces where this lives: it lists the delegation log as part of the investigator/institution TMF. So the delegation log belongs in the ISF by design, not by local preference.

Where this fails in practice: a coordinator starts consenting participants before her training record or delegation entry is dated; a sub-investigator’s initials appear on source records for a task never delegated to him; the PI’s signature sheet lists three staff while the EDC audit trail shows five hands. A monitor flags these at a routine visit. An inspector escalates them, because a broken delegation chain calls the integrity of the underlying data into question, not just the tidiness of the file.

Currency, not just completeness: expired records and version drift

A complete ISF can still fail. ICH E6(R3) requires the sponsor and investigator/institution to retain essential records in a way that ensures they remain complete, readable, and readily available and are directly accessible upon request by regulatory authorities, monitors, and auditors, and it requires that any alteration to essential records be traceable. “Complete” and “current” are distinct tests. An expired medical license, a CV that predates a relevant qualification, a superseded ICF still being used to consent, or a lab normal-range certificate past its renewal each represents a currency failure even though the document is present.

Version drift against the TMF is the currency failure inspectors cite most. The mechanism is the one described above: the EMA TMF guideline requires superseded versions of sponsor documents to be present in the ISF with date of receipt, review/approval, and implementation. If the sponsor TMF shows the site moved to ICF v3.0 on a date but the ISF still files v2.0 as current, or shows no implementation date, the two halves of the single TMF no longer reconcile. The EMA TMF guideline frames the maintenance duty directly: the sponsor and/or investigator/institution should implement risk-based quality checks or review processes to ensure the TMF is being maintained up to date, that all essential documents are appropriately filed, and that documents are added in a timely manner. That QC duty is the control that keeps currency from quietly decaying between visits.

This is also where you should expect a clear stance: a site that runs its own periodic ISF QC against the latest sponsor-issued versions, rather than waiting for the monitor, is the site that survives the completeness-and-currency test. The siblings to read alongside this section are informed consent version control and source documents and ALCOA, since consent and source currency are where drift does the most damage.

Going electronic: what an eISF must satisfy

An electronic ISF does not lighten the load; it adds a layer. When the ISF becomes a computerised system, the EMA computerised-systems guideline applies on top of every ISF duty already described.

Four duties matter most for an eISF. First, validation: the EMA computerised-systems guideline requires that computerised systems used in a clinical trial be subject to processes confirming that specified requirements are consistently fulfilled and that the system is fit for purpose, with the validation approach based on a risk assessment that considers the system’s intended use and its potential to affect human-subject protection and the reliability of results. Note the careful phrasing the regulation forces: software does not make you compliant; a validated, fit-for-purpose system enables you to meet your obligations, and the site and sponsor remain responsible.

Second, security and access control: the EMA computerised-systems guideline requires security processes and features to prevent unauthorised access and unwarranted data changes, that checks ensure only authorised individuals have access with appropriate permissions, and that records of access authorisation with documented levels of access be maintained. Third, audit trail: the guideline defines the audit trail as a secure, computer-generated, time-stamped electronic record that allows reconstruction of events relating to creation, modification, or deletion of an electronic record, and treats audit-trail metadata as part of the original record. Fourth, certified copies: where copies replace originals, the EMA computerised-systems guideline requires that replacement of documents with copies is acceptable only if the copies are certified copies.

ICH E6(R3) sets the same certified-copy bar from the records side: when a copy is used to permanently replace the original essential record, the copy should fulfil the requirements for certified copies. The two regulations align here, which is worth saying plainly: scanning a wet-ink consent form into your eISF and shredding the paper is acceptable only if the scan is a certified copy, under both ICH E6(R3) and the EMA computerised-systems guideline.

One reconciliation nuance the eISF makes sharper. The EMA TMF guideline warns that uploading investigator/institution-generated essential documents onto a sponsor- or CRO-maintained eTMF system carries the risk that the investigator loses control of and continuous access to its documents, and it requires that the investigator/institution maintain continuous access to and control of its files. So a sponsor-hosted portal can serve your ISF only if the arrangement preserves your independent control. That is the point where the convenience of a shared system and the regulation’s insistence on site control have to be deliberately reconciled, not assumed away.

The four ISF failure modes inspectors cite, and the control that prevents each

This is the framing that distinguishes an inspection-ready ISF from a tidy binder. The table maps each failure mode to the in-scope provision behind it and the control that prevents it.

Failure mode	What an inspector escalates	Governing provision	Preventive control
Missing or expired documents	A required essential record absent, or present but expired (license, CV, lab cert, ICF)	ICH E6(R3): records kept complete, readable, directly accessible; EMA TMF: QC that the file is up to date	Periodic site-run ISF QC against the current sponsor-issued versions and an expiry tracker, not just at monitor visits
Broken delegation-of-authority chain	Tasks performed by undelegated or untrained staff; signature sheet not matching the audit trail	ICH E6(R3): maintain a delegation record; delegated staff qualified and informed; investigator retains oversight	Delegation and training dated before the activity; reconcile the log to source/EDC activity
ISF-vs-TMF version drift	ISF filing a superseded version as current, or no implementation date	EMA TMF: superseded sponsor versions present with receipt/review/implementation dates; one TMF must reconcile	Version-control discipline tied to receipt-and-implementation logging; reconcile to the sponsor TMF
Unvalidated or uncontrolled eISF	eISF with no validation evidence, weak access control, or no audit trail; uncertified copies replacing originals	EMA computerised systems: validation/fit-for-purpose, security and access control, audit trail, certified copies	Documented validation, role-based access records, an audit trail, and certified-copy procedures before the eISF goes live

The pattern across all four: a monitor flags the symptom at a routine visit; an inspector asks what it implies about the reliability of the data and the integrity of trial conduct. The control in every row is ownership and timing, not volume of paper.

Retention and archiving: how long, in what state, and who is accountable

The ISF does not stop being your responsibility at close-out. ICH E6(R3) requires the investigator/institution to retain the essential records for the required retention period in accordance with applicable regulatory requirements, or until the sponsor informs the site they are no longer needed, whichever is longest, and to take measures ensuring availability, accessibility, and readability and preventing unauthorised access and accidental or premature destruction. It also requires the investigator/institution to keep the sponsor informed of who is responsible for maintaining the essential records during the retention period, for example when the site closes or an investigator leaves.

For the duration figure under EU rules, the EMA TMF guideline points to Article 58 of the Clinical Trials Regulation (EU) No 536/2014: unless other Union law requires longer, the sponsor and the investigator shall archive the content of the clinical TMF for at least 25 years after the end of the clinical trial, with subjects’ medical files archived per national law. Retention is also a currency-and-state question, not only a duration one: the EMA TMF guideline requires that archiving be undertaken after the investigator/institution and sponsor have reviewed that their filed TMF documentation is complete, and it ties final accountability for the investigator/institution records to the investigator/institution.

ICH E6(R3) closes the loop on the purpose of all this retention: essential records should be retained securely by sponsors and investigators for the required period and should be available to regulatory authorities, monitors, auditors, and IRBs/IECs on request, to enable evaluation of trial conduct and the reliability of results. That is the whole point of treating the ISF as an evidence system: years after the last participant, it still has to reconstruct the trial on demand.

A note on alignment and tension across the in-scope regulations. On the core duties, the three regulations agree and reinforce each other: ICH E6(R3) and the EMA TMF guideline both treat the ISF as the investigator/institution half of one TMF, and ICH E6(R3) and the EMA computerised-systems guideline set the same certified-copy bar for copies that replace originals. The one place to watch is retention duration: ICH E6(R3) deliberately defers to “applicable regulatory requirements” rather than naming a number, while the EMA TMF guideline names at least 25 years under Article 58 of Regulation (EU) No 536/2014. These are not contradictory, but they are not interchangeable. The EU figure is a specific legal floor; ICH’s open reference means your actual retention period is set by the regulatory framework governing your trial, which may be longer. Resolve it for your specific trial; do not assume one number covers every jurisdiction.

Sources

• ICH E6(R3) Good Clinical Practice (ICH), version r3 — https://www.ich.org/page/efficacy-guidelines
• EMA Guideline on the content, management and archiving of the clinical trial master file (EMA), version 2018
• EMA Guideline on Computerised Systems and Electronic Data in Clinical Trials (EMA), version 2023 — https://www.ema.europa.eu/en/documents/regulatory-procedural-guideline/guideline-computerised-systems-and-electronic-data-clinical-trials_en.pdf