ICH E6(R3) - Good Clinical Practice

ICH E6(R3) Annex 1 (Computer Systems Used in Clinical Trials) is the new section consolidating data integrity + electronic systems + computer system validation (CSV) - replacing scattered E6(R2) provisions. Scope: all computer systems used to collect + process + store + transmit clinical trial data and supporting documentation. Computer System Validation (CSV): GAMP 5 (Good Automated Manufacturing Practice) risk-based approach + USP/IPEC validation strategy + ICH Q9 quality risk management; fit-for-purpose validation; lifecycle (planning + URS + functional spec + design + implementation + testing + IQ/OQ/PQ + release + change control + retirement); risk-based scope (system criticality + complexity + customisation). Electronic Signatures (eSig): unique + biometric or PIN + timestamp + meaning of signature + audit trail of signatures + 21 CFR Part 11 + EU CTR + ICH E6 Annex 1; user authent

• CSV documentation per system + GAMP 5 risk-based + lifecycle + IQ/OQ/PQ + release
• eSignature configuration + 21 CFR Part 11 + EU CTR + audit trail + biometric/PIN + identity proofing
• Audit trail review programme + tamper-evident + retention + protection + review evidence
• ALCOA+ assessment per system + FDA/EMA/MHRA/WHO data integrity guidance alignment
• Access control role-based + segregation of duties + periodic review + offboarding + termination

• CSV without GAMP 5 alignment or lifecycle documentation
• eSignature without identity proofing or meaning indication
• Audit trail review reactive only (no periodic review programme)
• ALCOA+ checklist only at validation (no ongoing monitoring)
• Access control over-permissive (no periodic review)

ICH E6(R3) Annex 2 (Use of Decentralised Elements in Clinical Trials) is the new section establishing principles for decentralised clinical trial (DCT) elements - reflecting COVID-19 acceleration + technology enablement + patient-centric trial design. Decentralised elements: remote participant identification + recruitment + screening; eConsent + remote consent + multimedia + comprehension verification; remote/home-based study procedures + nurse visits; direct-to-patient supply (investigational product shipment to home); remote monitoring + visit substitution + ePRO + telemedicine; wearable devices + sensors + continuous data collection; eSource + EHR integration + real-world data; remote source document verification + investigator oversight + risk-based approach. R3 emphasises: investigator oversight + accountability remains + protocol design considers DCT element risks + benefits + scie

• DCT element register per protocol + risk-benefit + scientific validity + regulatory pre-discussion
• eConsent platform + validation + electronic signature + identity verification + R3 Annex 2 + 21 CFR Part 11
• Remote monitoring procedures + investigator oversight + risk-based triggers + on-site escalation
• Wearable device qualification + data integrity + algorithm validation + FDA SaMD + EMA
• RWE + EHR integration + data integrity + 21st Century Cures Act + FDA RWE Framework

• DCT elements deployed without R3 Annex 2 risk-benefit assessment
• eConsent without identity verification (privacy + integrity gap)
• Remote monitoring without investigator oversight (sponsor-led only)
• Wearable data collection without qualification or ALCOA+ alignment
• RWE used without regulatory pre-discussion (acceptability uncertain)

Data Management Plan (DMP) per ICH E6 + ICH E8(R1) (General Considerations for Clinical Studies) + ICH E9 (Statistical Principles): study database design + EDC system + data capture sources + data collection + data flow + database lock + transfer to statistics + retention; data validation + edit checks + range checks + cross-form checks + medical review + data review committee. External data sources: EHR + Electronic Patient Records + laboratory results + imaging + medical devices + wearables + ePRO + claims + registries; data integration + standardisation + mapping; CDISC standards (CDASH + SDTM + ADaM + SEND + Define-XML) for regulatory submission; data quality + completeness + traceability; data lineage. Real-World Data (RWD) + Real-World Evidence (RWE) per FDA + EMA + Health Canada + PMDA: hybrid + synthetic control arm + external comparator + post-marketing; 21st Century Cures Act +

• Data Management Plan + database design + validation + edit checks + medical review
• External data integration + EHR + lab + wearable + CDISC mapping + Define-XML
• RWE use + fit-for-purpose + pre-specification + regulatory feedback + FDA/EMA framework
• ICH family coordination matrix per study + E8 + E9 + E10 + M4 + M11
• Per-region regulatory submission + FDA IND + EMA CTA + PMDA + national CRO + adoption tracking

• DMP only at start (no ongoing review during conduct)
• External data integrated without CDISC mapping (regulatory submission delay)
• RWE used without pre-discussion (acceptability uncertain)
• ICH family coordination siloed (E6 + E9 + M4 not integrated)
• Multi-region submission inconsistencies + missing local addendum

Section 8 establishes Essential Documents - the documents that individually and collectively permit evaluation of the conduct of a trial and the quality of the data produced; demonstrate compliance with GCP and applicable regulatory requirements. Essential Documents categorized by trial phase (before clinical phase commences + during clinical conduct + after completion or termination) and party (sponsor + investigator + IRB/IEC). Trial Master File (TMF): sponsor-side + investigator site file; essential documents collection + organisation + index + accessibility + integrity; ICH E6 + TMF Reference Model (DIA 2017 + updates) + EMA TMF Guidance + FDA. Electronic TMF (eTMF): increasing adoption + R3 supports + integrity + audit trail + access control + electronic signature; system validation per Annex 1; integration with EDC + safety + financial systems; metadata + workflow + version control

• Essential Documents inventory + categorisation by phase + party + GCP requirement
• TMF + ISF organisation + DIA TMF Reference Model + EMA TMF Guidance + index
• eTMF validation + access control + audit trail + electronic signature + R3 Annex 1 alignment
• Archive procedures + 15+ year retention + integrity check + destruction approval
• TMF audit trail + periodic completeness check + missing document register + closure

• Essential Documents missing (consent forms + delegation log)
• TMF not aligned with DIA Reference Model (no structure)
• eTMF without validation (paper + electronic mix without integrity)
• Archive medium degrading without integrity check
• Audit trail gaps or modification without justification

Section 3 establishes Institutional Review Board (IRB) and Independent Ethics Committee (IEC) responsibilities. IRB/IEC composition + qualifications + procedures + meeting documentation + records; protocol review + initial + continuing + amendment review; emergency procedure review; risk-benefit assessment + safeguards + subject protection. Informed Consent process: voluntary + informed + capacity + understanding + documentation + signed; process not document; information sheet content (purpose + procedures + alternatives + risks + benefits + confidentiality + compensation + insurance + contact + voluntariness + withdrawal); witness + impartial witness if subject illiterate; legally authorised representative for minors or incapacitated subjects; re-consent on new information or protocol amendment; ICH E6(R3) emphasises participant-centric communication + plain language + electronic conse

• IRB/IEC roster + qualifications + procedures + meeting minutes + decisions + amendments
• Informed consent forms + process + eConsent + multimedia + comprehension verification
• Vulnerable population protocols (assent + parental permission + ombudsperson + extra review)
• Continuing review at least annually + amendment review + safety triggers
• Declaration of Helsinki 2024 + Belmont + CIOMS alignment in protocol + informed consent

• IRB minutes incomplete or decisions not documented
• Consent process treated as form not dialogue (document but no understanding check)
• Vulnerable population safeguards generic not population-specific
• Continuing review delayed beyond 12 months
• Declaration of Helsinki + CIOMS not referenced in protocol

Section 4 establishes investigator responsibilities and qualifications. Investigator qualifications: education + training + experience + CV + current licence + GCP training + site-specific delegation log + delegation by name; site qualification + adequate facilities + adequate staff + adequate time + adequate resources; training records per study and ongoing. Communication: with IRB/IEC + Sponsor + Regulatory + Subjects + Site staff; protocol deviation reporting + Serious Adverse Event (SAE) reporting to Sponsor (within 24 hours initial + follow-up); Suspected Unexpected Serious Adverse Reaction (SUSAR) per ICH E2A + national requirements; Annual Safety Report + Development Safety Update Report (DSUR). Safety reporting: capture + assess + report adverse events + serious adverse events + SUSARs per protocol + GCP + national requirements; risk-based reporting in R3 (no longer mandatory 100

• Investigator CV + GCP certificate + licence + medical record system access + qualifications
• Delegation log per study + by name + role + training + signatures + dates
• SAE register + 24-hour notification + follow-up + closure + national reporting
• Source document verification per R3 risk-based methodology + critical data + statistical sampling
• Investigational product accountability + receipt + dispensing + return + destruction + GMP storage

• Investigator GCP training expired or not site-specific
• Delegation log missing tasks or unsigned
• SAE notification beyond 24 hours or follow-up incomplete
• 100 percent SDV still applied under R3 risk-based regime (waste)
• IP accountability gap (dispensing not tied to subject)

Section 6 establishes Clinical Trial Protocol structure and content per E6 Section 6: title + background + objectives + design + selection + inclusion/exclusion + treatment + assessments + safety + statistics + quality control + ethics + data handling + monitoring + publication + supplementary; protocol amendments + versions + IRB/IEC re-approval. Section 7 Investigator Brochure (IB): compilation of clinical and non-clinical data + product overview + physicochemical + non-clinical (PK/PD/toxicology) + clinical (PK/PD/efficacy/safety in humans to date) + marketing experience + summary of risks; updated at least annually + after new safety information + sponsor obligation to distribute to investigators. Clinical Study Report (CSR) per ICH E3: structure + executive summary + objectives + methodology + results + safety + integrated discussion + conclusions + appendices; ICH E6(R3) emphasises

• Protocol per E6 Section 6 structure + amendments + IRB approval + version control
• Investigator Brochure + annual update + safety updates + distribution evidence
• Clinical Study Report (CSR) per ICH E3 + harmonised reporting + lifecycle integration
• Plain language summary per EU CTR + FDA + WHO + participant accessibility
• Trial registration ClinicalTrials.gov + EudraCT + WHO ICTRP + results disclosure

• Protocol amendments without IRB re-approval
• IB not updated annually or after safety signal
• CSR without harmonised reporting or lifecycle integration
• Plain language summary missing (CTR + FDA now mandatory)
• Trial registration delayed beyond protocol approval

ICH E6 Good Clinical Practice (GCP) is the international ethical and scientific quality standard for designing + conducting + recording + reporting trials that involve participation of human subjects. Developed by International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use (ICH) - founded 1990 + tripartite (regulators + industry) global standardisation body. ICH E6 history: E6 original 1995-1996; E6(R1) post-Step 4 editorial corrections 2009; E6(R2) Integrated Addendum (Step 4 dated 9 November 2016) - introduced quality risk management + risk-based monitoring + electronic systems; **E6(R3) Step 4 finalised 6 January 2025** - SUPERSEDES E6(R2) - completely restructured with: 5 Principles (P1-P5) emphasising risk-based + proportionate + decentralised + electronic + data integrity by design; Glossary (Section 2); IRB/IEC (Section 3); Investigator (Sec

• E6(R3) applicability assessment per trial + transition timeline from R2 with regulatory anchoring
• 5 R3 Principles implementation evidence (stakeholder + risk + critical-to-quality + technology + participant)
• Risk-based quality management plan + critical-to-quality factor identification + risk register
• Decentralised Clinical Trial (DCT) elements + eConsent + remote monitoring + wearables
• Regulatory adoption tracking per ICH region + ANVISA + Swissmedic + Health Canada + non-ICH

• E6(R3) gradual transition without clear timeline or critical-to-quality assessment
• 5 R3 Principles treated as aspirational not operational
• Risk-based approach paper-only (still 100 percent monitoring)
• DCT elements deployed without Annex 2 alignment + regulatory pre-discussion
• Stale R2 reference in protocol despite R3 effective

Section 5 establishes sponsor responsibilities and quality management. Sponsor must implement a Quality Management System (QMS) per R3 covering: risk identification + assessment + mitigation + acceptance + monitoring + review; critical-to-quality factor identification (data quality + subject safety + scientific validity); proportional + risk-based approach to: monitoring + data management + safety reporting + audit; documented Quality Tolerance Limits (QTLs) per critical-to-quality factor. Risk-based monitoring (RBM): R3 modernised from R2 - centralised + remote + on-site monitoring blend; targeted SDV (critical data only); statistical monitoring of data trends; risk-based site selection; trigger-based escalation. Contract Research Organisation (CRO) oversight: sponsor retains responsibility + accountable; written agreement + scope + transfer of obligations register; CRO qualification +

• Sponsor Quality Management System charter + procedures + responsibility + reporting
• Critical-to-Quality Factor (CTQF) identification per study + risk register + QTLs
• Monitoring plan + RBM methodology + central + remote + on-site + targeted SDV + frequency
• CRO transfer of obligations register + qualification + audit + KPI + escalation
• Vendor qualification + SLA + KPI + ongoing performance review + change control + audit

• Sponsor QMS only for sponsor company, not extended to CROs/vendors
• Critical-to-Quality Factor identification weak or absent (still 100 percent everything)
• Risk-based monitoring on paper only (still 100 percent SDV in practice)
• CRO oversight only at contract (no ongoing audit + escalation)
• Vendor agreements without SLA or audit right