ICH E6(R2)/E6(R3) Good Clinical Practice: The Foundation of Clinical Trial Quality

Good Clinical Practice (GCP) is the international ethical and scientific quality standard for designing, conducting, recording, and reporting trials that involve human subjects. The reference text is ICH E6, the harmonised guideline produced by the International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use. When a regulator inspects a clinical trial, GCP is the yardstick they measure against. When a sponsor builds a quality system for clinical operations, E6 is the skeleton it hangs on. When data from a registrational trial supports a marketing application, the credibility of that data rests on whether GCP was followed.

This page covers what E6 actually requires, who is responsible for what, the documents that prove compliance existed, the 2016 R2 addendum that introduced risk-based thinking, and the R3 rewrite that restructured the whole guideline. The goal is that you can read this and then do the job: set up a study correctly, monitor it, survive an audit, or answer the questions an inspector will actually ask.

What ICH E6 is and why it exists

ICH E6 carries the title “Guideline for Good Clinical Practice.” The original consolidated version, E6(R1), was finalised in 1996 and adopted by regulators in the founding ICH regions. In November 2016 the ICH issued E6(R2), an “integrated addendum” that bolted new sections onto the R1 text rather than rewriting it. In 2023 the ICH released a draft of E6(R3), a full restructure built around principles and annexes. The R3 Principles and Annex 1 (interventional trials) reached Step 4 in January 2025; Annex 2 (additional considerations for nontraditional designs) followed and reached Step 4 on 3 June 2026, completing the R3 set. Regions adopt and apply ICH guidance through their own legal instruments, so the exact in-force version depends on the regulator: a sponsor running a global program needs to track which jurisdictions have moved to R3 and which still operate under R2.

The reason GCP exists at all is the dual obligation in clinical research. The first is to protect the rights, safety, and well-being of trial participants, an ethical duty that traces back to the Declaration of Helsinki. The second is to ensure that the data produced are credible and accurate, a scientific and regulatory duty so that decisions about a medicine’s benefit and risk rest on reliable evidence. E6 ties these together in one sentence that inspectors quote constantly: a trial should be conducted in compliance with the protocol that has received prior favourable opinion from an Institutional Review Board (IRB) or Independent Ethics Committee (IEC), and the rights and well-being of subjects take precedence over the interests of science and society.

GCP is not a standalone island. It sits inside the ICH “E” (efficacy) family. E8(R1), “General Considerations for Clinical Studies,” sets the framing for quality by design and critical-to-quality factors. E9, “Statistical Principles for Clinical Trials,” governs analysis. E2A and the rest of the E2 series govern safety reporting and pharmacovigilance. E6 is the conduct standard that ties protocol, ethics, data, and oversight into one operating model. For how those neighbours fit, see ICH E8/E9 trial design and statistics and pharmacovigilance and safety data integrity.

The GCP principles

The principles are the load-bearing part of E6. Everything else in the guideline is an elaboration of them. In E6(R2) there are 13 principles. In E6(R3) they were rewritten and reorganised into a set grouped under themes, but the substance carried over and expanded. Memorise the principles. An inspector who asks “what are the principles of GCP” is checking whether you understand the why, not just the procedures.

The E6(R2) set runs to 13 principles. The descriptions below are a working summary in our own words, grouped by what each one asks of a team day to day, not a reproduction of the guideline text. Read the principles section of the guideline itself for the exact wording.

Two of these (10 and 13) were sharpened by the R2 addendum, and that sharpening is the heart of modern GCP: records must support reconstruction of the trial (data integrity), and quality effort must scale with risk (no more treating a single-site low-risk study the same as a 200-site oncology program).

E6(R3) restated the principles with more explicit language on proportionality, the role of participants as partners, fit-for-purpose data, and the idea that quality should be built into design rather than inspected in at the end. If you are working under R3, read the principles section first and map your existing SOPs onto it.

Roles and responsibilities

GCP assigns duties to four parties: the IRB/IEC, the investigator, the sponsor, and (implicitly) the contract research organisation (CRO) acting on the sponsor’s behalf. Knowing who owns what is the single most useful thing to carry into an inspection, because findings are written against a responsible party.

The table below maps common trial activities to the four parties using a responsibility view: R = responsible (does the work), A = accountable (owns the outcome and cannot delegate that accountability away), C = consulted, I = informed. A CRO performing a transferred duty is responsible for the task, but the sponsor stays accountable, which is exactly the distinction inspectors probe.

The line that decides most findings is the accountable column for data quality and safety: it never leaves the sponsor and the investigator, no matter how much work a CRO does.

The IRB/IEC

An IRB (the term used in the United States) or IEC (the term used in much of the rest of the world) is an independent body that safeguards the rights, safety, and well-being of human subjects. E6 section 3 sets its responsibilities.

What it does: reviews and gives a documented favourable opinion on the protocol, the informed consent form, subject recruitment materials, and any payment or compensation to subjects, before the trial begins. It reviews the qualifications of the investigator. It conducts ongoing review at intervals appropriate to the degree of risk, at least once per year. It must have a composition, function, and operating procedures that meet GCP, including a documented membership list and written SOPs.

Acceptance criteria for an IRB/IEC review: written, dated approval/favourable opinion that names the protocol version and date, the consent form version, and other documents reviewed; documented quorum and membership at the meeting; no voting by members with a conflict of interest on that study.

The investigator

The investigator is the person responsible for the conduct of the trial at a trial site. If a team conducts the trial, the investigator is the responsible leader, the “principal investigator.” E6 section 4 is one of the most cited sections in inspections.

Core duties:

• Qualifications and resources. The investigator must be qualified by education, training, and experience, must be familiar with the Investigator’s Brochure (IB) and the protocol, and must have adequate time, staff, and facilities for the trial’s duration.
• Medical care of subjects. A qualified physician on the investigator’s team is responsible for trial-related medical decisions. The investigator ensures adequate medical care for any adverse event.
• Communication with the IRB/IEC. Obtain favourable opinion before enrolling; provide ongoing reports.
• Protocol compliance. Conduct the trial per the protocol agreed with the sponsor and approved by the IRB/IEC. Do not deviate without sponsor agreement and IRB/IEC approval, except to remove an immediate hazard to subjects.
• Investigational product accountability. Maintain records of delivery, inventory, use by each subject, and return or disposal. The product is used only per the protocol.
• Randomisation and unblinding. Follow the trial’s randomisation procedure; unblind only per protocol and document any premature unblinding.
• Informed consent. Obtain and document consent before any trial procedure, per section 4.8.
• Records and reports. Ensure source data and the case report forms (CRFs) are accurate, complete, legible, and timely. Maintain essential documents. Report serious adverse events (SAEs) to the sponsor immediately, except those the protocol identifies as not needing immediate reporting.
• Premature termination or suspension. Inform subjects, ensure their care, and notify the sponsor and IRB/IEC.

Acceptance criteria: the delegation log shows every task assigned to a qualified, trained, dated-and-signed team member; source documents support every CRF entry (the “if it isn’t documented, it didn’t happen” rule); consent was obtained before the first study procedure for every subject.

The sponsor

The sponsor is the individual, company, institution, or organisation that takes responsibility for initiating, managing, or financing a trial. E6 section 5 is where R2 made its biggest changes, and it is the area regulators have escalated most aggressively.

Core duties:

• Quality management. Implement a system to manage quality throughout all stages of the trial. R2 section 5.0 introduced this explicitly, with risk-based thinking baked in (covered in detail below).
• Quality assurance and quality control. Maintain QA and QC systems with written SOPs.
• CRO oversight. A sponsor may transfer trial-related duties to a CRO, but the ultimate responsibility for data quality and integrity always resides with the sponsor. Any transferred duty not specifically transferred in writing remains with the sponsor. This sentence is inspected hard.
• Medical expertise, trial design, trial management. Provide qualified medical and statistical expertise; design scientifically sound trials.
• Data handling and recordkeeping. When using electronic systems, ensure they are validated, maintain SOPs, keep audit trails, and protect blinding. R2 expanded this (section 5.5.3).
• Investigator selection. Select qualified investigators and sites; obtain agreements.
• Safety and adverse drug reaction reporting. Evaluate ongoing safety; expedite reporting of serious unexpected adverse drug reactions to regulators, investigators, and IRBs/IECs per applicable requirements (the E2A framework).
• Monitoring. Verify that subject rights are protected, data are accurate and complete and verifiable to source, and the trial is conducted per protocol and GCP. R2 rewrote the monitoring section (5.18) around risk-based monitoring.
• Audit. Conduct audits independently of routine monitoring/QC to evaluate compliance.
• Noncompliance. Act on noncompliance by an investigator or CRO; if persistent, secure prompt action up to termination and report to regulators where required.
• Investigational product supply and handling. Ensure characterisation, GMP manufacture, coding, blinding, and accountability.

Acceptance criteria for sponsor oversight: a written, current quality management plan or equivalent that identifies critical-to-quality factors; a monitoring plan that ties monitoring activity to identified risks; documented oversight of any CRO (not just a signed contract, but evidence the sponsor was actually watching).

For how these clinical duties intersect with the broader quality organisation, see GxP roles and responsibilities and clinical QA and GCP data integrity.

Informed consent: the procedure done right

Informed consent is where ethics becomes operational, and consent findings are among the most common and most serious in GCP inspections. E6 section 4.8 governs it.

What it is: a process by which a subject voluntarily confirms willingness to participate, after being informed of all aspects of the trial relevant to that decision. Documented by a signed and dated informed consent form (ICF).

Section 4.8.10 sets out the full list of items the form and discussion have to cover. In substance, a participant has to come away understanding that this is research and why it is being run, what treatments are involved and the odds of being assigned to each, what will happen to them (including anything invasive) and what is expected of them, what could go wrong and what is reasonably hoped to go right (and a frank note where they personally stand to gain nothing), what other options they have outside the trial, what they would be paid and what compensation or care they would get if the trial injures them, that taking part is their choice and they can walk away at any point without losing anything they are owed, that monitors, auditors, the ethics committee, and regulators may look at their records while keeping them confidential, that they will be told if something new comes up that might change their mind, who to call with questions, what could end their participation, how long it runs, and roughly how many people are taking part. Read 4.8.10 itself for the authoritative element-by-element list.

How to do it, step by step:

1. Use the current IRB/IEC-approved ICF version. Do not use a draft or an expired version.
2. A qualified, delegated team member gives the subject adequate time and opportunity to ask questions, with no coercion or undue influence.
3. The subject (or legally acceptable representative) personally signs and dates the ICF before any study-specific procedure, including screening procedures that exist only for the trial.
4. The person conducting the consent discussion also signs and dates.
5. The subject receives a copy of the signed ICF and any later amended versions.
6. If the subject cannot read, an impartial witness is present for the whole discussion and signs.
7. Re-consent when a new ICF version is approved that bears on continued participation.

The same process viewed as a decision path, which is the shape a monitor or auditor walks when they verify a single subject’s consent:

Acceptance criteria: the consent date is on or before the first protocol procedure for every subject; the version signed matches an IRB/IEC-approved version effective on that date; both subject and consenting staff signatures and dates are present; re-consent is documented when required.

The most common consent findings: a subject consented on a version that the IRB/IEC had superseded; a screening lab or wash-out done before the consent date; missing subject or staff signature or date; consent obtained by an unqualified or undelegated person; no documented re-consent after a safety-relevant amendment. These are not paperwork nitpicks to an inspector. A consent failure can mean a subject’s data are excluded and, in serious cases, that the trial’s ethical basis is questioned.

For the digital version of this process, see eConsent and decentralized trials.

The R2 addendum: risk, quality management, and electronic records

E6(R2), finalised 9 November 2016, did not replace R1. It added text. Three additions matter most, and they show up in every modern GCP inspection.

Quality management built in (section 5.0)

R2 introduced an explicit quality management system requirement for sponsors, structured as a cycle:

• Pin down what is critical. Work out which processes and which data points actually drive participant safety and result reliability, and focus quality effort there. Not everything in a trial carries equal weight; a missed pulse oximetry reading in a dermatology study is not the same as a missed primary-endpoint scan.
• Find the risks. Look both at the infrastructure (facilities, SOPs, computerised systems, vendors) and at the study itself (how the protocol is designed, how data are collected, how consent is run).
• Weigh them. Judge each risk against the controls already in place: how likely the error is, how easily it would be caught, and how much it would hurt participant safety or data reliability if it slipped through.
• Act on them. Decide what to mitigate and what to live with. Set quality tolerance limits (QTLs), the thresholds that signal a systematic problem, and decide ahead of time what happens when one is breached.
• Tell people. Write down the quality management work and share it with everyone who needs to act on it.
• Revisit. As the trial runs and you learn more, go back and check whether the controls are still right.
• Report it. Summarise the quality management approach in the clinical study report, including any QTL breaches and what was done about them.

This is the same logic as ICH Q9 quality risk management applied to clinical trials. If you know Q9, R2 section 5.0 will feel familiar. See quality risk management.

A worked QTL example. In a multinational cardiovascular outcomes trial, the team identifies a critical-to-quality factor: confirmation of the primary endpoint (adjudicated major adverse cardiac events). They set a QTL on the rate of events sent to the adjudication committee but missing source documentation needed to adjudicate. They set the limit at, say, a defined small percentage of submitted events agreed during protocol design. When the running rate approaches the limit, the issue is escalated, root cause is investigated across sites, and a corrective action (re-training, a source-document checklist) is deployed. The breach and the action are reported in the clinical study report. A QTL is not a target you must always hit; it is a tripwire for a systematic problem.

Risk-based monitoring (section 5.18)

R2 rewrote monitoring. The old default was 100% source data verification (SDV) at every site, which is expensive and, evidence shows, not where most errors live. R2 endorses a monitoring strategy that may combine on-site monitoring, centralised monitoring (statistical and data review at the coordinating centre to find anomalies, outliers, and trends), and reduced or targeted SDV focused on critical data and processes.

The sponsor develops a monitoring plan tailored to the trial’s risks. Centralised monitoring can identify sites with unusual data patterns (digit preference, low variability, improbable enrolment speed) and direct on-site visits to where they are needed. This is the single biggest operational shift in modern clinical trials. For the deeper mechanics, see risk-based monitoring in clinical trials and source data and SDV in clinical trials.

Electronic records and data integrity (sections 4.9, 5.5)

R2 brought GCP into line with the same data-integrity expectations long applied in GMP. Sponsors using computerised systems must ensure the systems are validated for their intended use, maintain SOPs for their use, ensure systems maintain a secure audit trail, and keep records of changes to data that document the who, what, when, and (where relevant) why. Source data must be attributable, legible, contemporaneous, original, and accurate (ALCOA), with the R2 emphasis that source documents and trial records be available and retrievable.

The ALCOA and ALCOA+ framework underpins all of this. See ALCOA+ in detail and data integrity foundations. For the regulatory rules on electronic records and signatures that sit alongside GCP, see 21 CFR Part 11 and EU Annex 11.

The R3 rewrite: what changed and why

E6(R3) is a structural redesign, not a patch. Where R2 was R1 with additions, R3 starts over. Its architecture:

• Principles. A revised, expanded principles section that leads the document and is meant to be media-neutral, applying whether data are paper or electronic and whatever trial design is used.
• Annex 1: Interventional clinical trials. The detailed requirements for sponsors, investigators, IRBs/IECs, and essential records for conventional interventional trials. This is where most of the old section 4 and 5 content now lives, reorganised.
• Annex 2: Additional considerations for nontraditional designs. Guidance for designs such as decentralised elements, pragmatic trials, and use of real-world data sources, which R2 did not address well. Annex 2 reached Step 4 on 3 June 2026, about eighteen months after the Principles and Annex 1, so teams running decentralised or pragmatic studies should treat it as the current, definitive reference for those designs rather than improvising from the interventional text.

Why the rewrite: trials changed. Decentralised and hybrid designs, wearables and sensors generating continuous data, electronic health record source data, and large pragmatic trials did not fit a 1996 framework cleanly. R3 emphasises fitness for purpose, proportionality, building quality into the design (the E8(R1) critical-to-quality factors approach), treating participants as partners rather than subjects of study, and a media-neutral stance so the guideline does not assume paper.

What this means practically: the spirit of R2 (risk-based, quality-by-design, data integrity) is retained and strengthened, but the organisation, terminology, and some specifics shifted. Regions moved on different clocks, so a global program has to track version by jurisdiction:

Confirm the current status for every region a study touches before you rely on a date; adoption timing continues to move. A practical compliance team maintains a mapping document: each internal SOP cross-referenced to both the R2 clause and the R3 annex clause it satisfies, so a single SOP set can serve studies under either version and the team can answer an inspector who cites either.

Do not throw away your R2 knowledge. R3 did not reverse the direction R2 set; it built on it.

Essential documents and the Trial Master File

Essential documents are those that individually and collectively permit evaluation of the conduct of a trial and the quality of the data produced. E6 section 8 lists them. They are the evidence that GCP was followed. The principle behind them is simple: if it is not documented, an inspector treats it as not done.

Essential documents are organised by trial phase: before the trial begins, during the trial, and after the trial completes or terminates. They are filed in the Trial Master File (TMF), kept by the sponsor, and the Investigator Site File (ISF), kept at the site. Increasingly the TMF is electronic (an eTMF), which brings Part 11 / Annex 11 controls into play.

A condensed view of what lives where:

How to manage the TMF, step by step:

1. Define a TMF index/structure at study start. Many teams use the TMF Reference Model, an industry-standard taxonomy, as a backbone.
2. Assign ownership for each artefact type (sponsor function, CRO, site).
3. File documents contemporaneously. “TMF completeness at the end” is a red flag; a TMF should be inspection-ready throughout, not assembled before a visit.
4. Run periodic TMF quality reviews: completeness (are expected documents present), timeliness (were they filed close to when they were generated), and quality (correct version, signed, legible).
5. Control versions and use controlled retention. Retention periods are set by regulation and the protocol; ICH and regional rules require retention for defined periods after marketing approval or trial discontinuation, often years, so confirm the exact requirement for each region rather than guessing.

Acceptance criteria: the TMF is complete, current, and contemporaneous; a reviewer can reconstruct the trial from it; documents are the correct approved versions; signatures and dates are present; an inspector can be handed the TMF index and find any document quickly.

Common TMF findings: missing or late-filed documents; superseded protocol or ICF versions still presented as current; investigator CVs or medical-licence documents out of date; missing IRB/IEC composition or approval letters; gaps between the TMF (sponsor) and ISF (site) that show the two were not reconciled. For the dedicated treatment, see eTMF / Trial Master File.

Source data, CRFs, and data integrity in trials

Source data are all the information in original records and certified copies of clinical findings, observations, and other activities needed to reconstruct and evaluate a trial. Source documents are where source data first appear: hospital records, clinical charts, lab notes, subject diaries, pharmacy records, the printouts from instruments.

The case report form (CRF) is the document used to record protocol-required information on each subject for the sponsor. The chain that inspectors trace is: source document, then CRF/eCRF, then the database, then the analysis, then the clinical study report. Each step must be traceable back to source.

Two rules dominate:

• Attribution of source. The protocol or a source-data agreement should define what the source is for each data point. If a value is entered directly into an electronic CRF with no prior paper or device record, that eCRF entry is the source and must be controlled as such. If it comes from a chart, the chart is source and the CRF must verify to it. Inspectors ask “what is your source for this number?” and a fumbled answer is itself a finding.
• ALCOA+. Every record should be Attributable, Legible, Contemporaneous, Original, Accurate, and (the “plus”) Complete, Consistent, Enduring, and Available. Backdating, transcription without traceability, and uncontrolled corrections all fail this. See ALCOA+ in detail and good documentation practices.

A worked correction example. A coordinator records a systolic blood pressure of 142 in the source chart, then realises it should be 124. The GCP-correct fix: draw a single line through 142 so it remains legible, write 124 next to it, add initials and the date, and where the system requires it a reason. Never overwrite, never use correction fluid, never erase. In an electronic system the equivalent is an audit-trailed change that preserves the original value, captures the new value, the user, the timestamp, and the reason. The original is never destroyed.

For the systems angle, see clinical data management and CDISC and clinical systems GCP digital quality.

Audits and inspections

Two distinct activities are easy to confuse. An audit is conducted by or on behalf of the sponsor, independent of and separate from routine monitoring and QC, to evaluate trial conduct and compliance (E6 section 5.19). An inspection is conducted by a regulatory authority, an official review of documents, facilities, records, and other resources (section 1).

GCP inspections commonly cover the sponsor, the CRO, and the clinical sites. Inspectors examine: the consent process and ICFs; the TMF/ISF; source-to-CRF traceability; SAE reporting timelines; IP accountability; protocol-compliance and deviation handling; sponsor oversight of the CRO and sites; computerised-system validation and audit trails; and the quality management and risk-based monitoring approach introduced by R2.

How to prepare a site or sponsor for a GCP inspection:

1. Confirm the TMF/ISF is current and complete; reconcile sponsor and site files.
2. Walk the consent trail for a sample of subjects: right version, signed before first procedure, re-consent where due.
3. Trace several data points from source to database and back.
4. Verify SAE reporting timelines were met and documented.
5. Check IP accountability reconciles (received, dispensed, returned, destroyed).
6. Confirm the delegation log matches who actually did what, with training records to back it.
7. Confirm CRO-oversight evidence exists (the sponsor was watching, not just contracted).
8. Run a mock inspection and remediate findings before the real one.

See GCP audits and inspections, FDA inspection readiness, managing a live inspection, and mock inspection program.

Common mistakes and inspection-finding patterns

Generic patterns that recur across GCP inspections and warning letters, with no company names:

• Consent failures. Wrong or expired ICF version; procedures before the consent date; missing signatures or dates; consent taken by undelegated staff; no re-consent after a safety amendment. This is consistently among the highest-frequency and highest-severity categories.
• Protocol noncompliance. Eligibility violations (subjects enrolled who did not meet inclusion/exclusion criteria); prohibited concomitant medications; visits or assessments out of window without justification; deviations not reported.
• Inadequate records / data integrity. Source data that cannot reconstruct the trial; CRF entries that do not verify to source; uncontrolled corrections; missing or disabled audit trails; no defined source for direct-entry data.
• SAE underreporting or late reporting. Serious adverse events not reported to the sponsor immediately, or expedited safety reports to regulators and IRBs/IECs missing their timelines.
• Weak sponsor oversight (the R2 pressure point). A signed CRO contract but no evidence the sponsor actually oversaw the work; monitoring not following the plan; quality management activities not documented; QTLs absent or never reviewed.
• Investigational product accountability gaps. Dispensing and return records that do not reconcile; temperature excursions not assessed; expired product use.
• IRB/IEC gaps. Continuing review lapsed past a year; conduct of amendments before approval; missing approval or composition documentation.
• Delegation and training gaps. Tasks performed by staff not on the delegation log; training records missing for procedures actually performed.

The unifying lesson: most serious findings trace to two roots, a broken consent/ethics trail or a broken data trail. Build your quality system to make both unbreakable.

For related deviation and CAPA handling, see deviation management, root cause analysis techniques, and what is a CAPA.

Interview-ready questions and answers

These are the questions interviewers and inspectors actually ask on GCP. Strong answers below.

What is ICH E6 and what is the difference between R1, R2, and R3? E6 is the ICH guideline for Good Clinical Practice. R1 (1996) is the original consolidated text. R2 (2016) is an integrated addendum that added risk-based quality management, risk-based monitoring, and stronger electronic-records and data-integrity expectations on top of R1. R3 is a full restructure: a principles section plus Annex 1 for interventional trials (both reached Step 4 in January 2025) and Annex 2 for nontraditional designs (Step 4 on 3 June 2026), media-neutral and built around quality by design. R3 strengthens R2’s direction rather than reversing it.

Name the GCP principles. There are 13 in R2. Lead with the ethical ones: trials follow the Declaration of Helsinki and GCP; risks are justified by benefits; subject rights, safety, and well-being prevail over science and society. Then the operational ones: sound science and a clear protocol; prior IRB/IEC approval; qualified people and qualified medical care; informed consent before participation; reliable, verifiable records; confidentiality; GMP for investigational product; and quality systems proportionate to risk. Naming a handful precisely beats listing all 13 vaguely.

What is the difference between source data and a CRF? Source data are the original records (chart, lab report, device output, diary). The CRF is what the sponsor collects from those sources. The CRF must verify to source. Where data are entered directly into an eCRF with no prior record, the eCRF is the source and must be controlled accordingly.

Who holds ultimate responsibility for data integrity when a CRO runs the trial? The sponsor, always. A sponsor can transfer duties to a CRO in writing, but any duty not specifically transferred stays with the sponsor, and the ultimate responsibility for the quality and integrity of the data never transfers.

What is risk-based monitoring and why did R2 introduce it? A monitoring approach that targets effort at the data and processes most critical to subject safety and result reliability, combining centralised monitoring (statistical anomaly detection) with on-site visits and targeted, rather than 100%, SDV. R2 introduced it because blanket 100% SDV is costly and does not catch the systematic errors that centralised data review does.

What is a quality tolerance limit? A predefined threshold on a parameter important to the trial. Crossing it flags a possible systematic problem and triggers investigation and action. Breaches and the actions taken are reported in the clinical study report. A QTL is a tripwire, not a pass/fail target.

Walk me through a GCP-compliant data correction. On paper: single line through the error so it stays legible, the correct value next to it, initials, date, and reason where required. Never obscure the original. Electronically: an audit-trailed change preserving the original value, with new value, user, timestamp, and reason. The original is never lost.

What are essential documents and where are they kept? The documents that let you evaluate trial conduct and data quality (E6 section 8), organised by phase. Sponsor keeps the TMF; the site keeps the ISF. They should be contemporaneous and inspection-ready throughout, not assembled before a visit.

What is the most common serious GCP finding and how do you prevent it? Informed-consent failures and broken data trails. Prevent consent failures with strict version control, consent-before-any-procedure discipline, delegation/training checks, and documented re-consent. Prevent data-trail failures by defining source for every data point, controlling corrections, and keeping audit trails on.

Practical tips

• Keep a living version-control map of every protocol, ICF, and IB version with effective dates. Most consent findings come from version confusion.
• File TMF documents as they are created. A scramble before an inspection is itself evidence of a weak system.
• Define source for every critical data point in a source-data agreement at study start, before the first subject is enrolled.
• Make CRO oversight visible. Save the oversight: minutes, issue logs, escalations, your review of their monitoring reports. A contract is not oversight.
• Treat QTLs as design decisions, set during protocol development with statistical input, not as afterthoughts.
• Map your SOPs to both R2 and R3 clauses during the transition so one SOP set serves studies under either version and you can answer an inspector citing either.
• Learn the neighbours. GCP does not stand alone; E8(R1) frames quality by design, E9 governs statistics, the E2 series governs safety reporting, and Q9 supplies the risk vocabulary R2 imported.

For the wider clinical quality picture, see clinical QA and GCP data integrity, GCP audits and inspections, risk-based monitoring in clinical trials, source data and SDV in clinical trials, eTMF / Trial Master File, and ICH E8/E9 trial design and statistics.