This pack holds four forms that a clinical site or a sponsor uses every week: a protocol-deviation log, a monitoring (site) visit report, a delegation-of-authority log, and a note-to-file. Each is a standalone controlled record with its own document-control header, so you can issue them together or one at a time. Replace every <<FILL: ...>> placeholder with your own specifics, set your form numbers under document control, and route each through your normal review and approval. A worked filled specimen follows each blank form so you can see how a completed version reads. Verify each cited regulation against the current source before you rely on it.

A note on why these four sit together: they form the spine of an inspectable clinical trial. The delegation log says who was allowed to do what. The monitoring visit report says the sponsor checked the work. The deviation log says what went off-plan and how it was handled. The note-to-file explains a single decision that does not belong on any other form. An inspector reads them as a set, so they should agree with each other and with the source documents and the trial master file.

Form 1: Protocol Deviation Log and Classification

Document control header

How this form works

A protocol deviation is any departure from the approved protocol, the consent process, or the applicable procedures and regulations. Log every deviation, not only the ones you judge important; the judgment of importance is the classification, and it is recorded separately so an inspector can see your reasoning. Keep the log current at the site and reconcile it against the deviations the sponsor and the monitor have recorded. Each row is one deviation. Repeat the row block for each deviation.

Per-deviation record

Classification guide

Classify by the effect on subject safety, subject rights, and the reliability of the trial data. Use the two questions in the record (safety affected, data or endpoint affected) to drive the tier, and write the rationale every time.

A run of non-important deviations of the same kind becomes important, because the pattern points to a process problem. Note the pattern when you see it.

Acceptance criteria for a completed log

• Every known deviation is logged, including the minor ones, with a date of occurrence and a date identified.
• Each deviation states the specific protocol requirement that was not met, not a vague label.
• The classification has a written rationale tied to safety and data impact, and patterns are escalated.
• Important deviations show sponsor notification and, where the protocol or local rules require it, IRB or EC notification, with dates.
• Each row is signed by the recorder and reviewed by the principal investigator.

References

ICH E6 Good Clinical Practice. Under E6(R2), sections 4.5 (compliance with protocol) and 5.20 (noncompliance): the investigator should document and explain any deviation, and the sponsor should secure agreement and document deviations. E6(R3) reached Step 4 in January 2025 and reorganized this material; where your region has adopted R3, map these requirements to the R3 principles and Annex 1. Cite whichever version applies to your trial. 21 CFR 312.60 and 312.66 (investigator responsibilities, including not deviating from the protocol except to protect subject safety, and IRB notification). 21 CFR 56.108(a)(3) and 56.108(a)(4) (IRB review of changes and reporting of deviations that affect subject rights or welfare). EU Clinical Trials Regulation 536/2014, Article 52 (notification of serious breaches by the sponsor) where the trial is conducted in the EU. ICH E6 record-retention and source-data expectations for the deviation log as part of the trial records.

Confirm the current version and clause numbers of each reference before issue.

Filled specimen: protocol deviation log

The following shows two rows completed for an example oncology trial, so you can see the level of detail an inspector expects. The protocol, site, and subjects are illustrative; replace them with your own.

In this example the first deviation looks minor (one day late) but is classified important because the primary endpoint depends on assessment timing, and the rationale says so. The second is a site-level event with no subject exposed, quarantined before anyone could be harmed. Both name the exact requirement, both reach the sponsor the same day, and both carry a CAPA that fixes the process, not the person.

Common inspection findings this form prevents

• Only the deviations someone judged serious are logged; the minor ones are missing, so the log does not match the source documents.
• Deviations are labeled major or minor with no rationale, and the classification does not match the safety and data impact.
• A pattern of the same minor deviation is never escalated to important.
• Important deviations show no sponsor or IRB notification, or the notification is undated.
• The log does not reconcile with the deviations the monitor recorded in the visit reports.

How to adapt this form

1. Set your form number, linked SOP, protocol, and site in the header.
2. If your sponsor uses different tier names, relabel the classification field but keep the two driving questions (safety, data).
3. Set the IRB or EC notification rule to match your protocol and local regulation, and reference the SOP that defines it.
4. If deviations are captured in an electronic trial system, keep this log as the validated export or as a pointer to that system, and reconcile both.
5. Confirm every regulation in the references against the current published version before issue.

Form 2: Monitoring (Site) Visit Report

Document control header

How this form works

This report records a sponsor monitoring visit to a site: what the monitor checked, what they found, what they instructed, and what is still open. It is the sponsor’s evidence that it oversaw the trial and verified the data and subject protection at the site. Complete it during and immediately after the visit, send the follow-up letter to the site, and track the action items to closure before or at the next visit. Use the same form structure for the visit types you run (selection, initiation, routine or interim, and close-out) and mark the type at the top.

Section A: Visit identification

Section B: Subjects and consent reviewed

Section C: Source data verification and data review

Section D: Investigational product and site facilities

Section E: Findings and action items

List each finding once, classify it, and assign an owner and a due date. Carry forward any action item that is not yet closed.

Section F: Summary and sign-off

Acceptance criteria for a completed report

• The visit type, date, and objectives match the monitoring plan, and the report is completed promptly after the visit.
• Consent and eligibility verification for the sampled subjects is recorded with specific findings, not a bare yes.
• The monitoring approach (full or targeted) is stated, and the critical data verified matches the monitoring plan.
• Every finding has a classification, an owner, and a due date, and prior open items are carried forward.
• The report is signed by the monitor and reviewed by the responsible lead, and the site follow-up letter is logged.

References

ICH E6 Good Clinical Practice. Under E6(R2), section 5.18 (monitoring), including the monitoring plan (5.18.7), the monitor’s responsibilities (5.18.4), and risk-based and centralized monitoring (5.18.3); section 5.0 (quality management) supports the risk-based approach. E6(R3) reached Step 4 in January 2025 and restructured these sections around quality by design; where R3 is adopted in your region, cite the R3 principles and Annex 1 for monitoring and oversight. 21 CFR 312.50 and 312.56 (sponsor responsibilities, including monitoring the investigation). FDA guidance, A Risk-Based Approach to Monitoring of Clinical Investigations (final, 2013) and the 2023 questions-and-answers guidance on risk-based monitoring. EU Clinical Trials Regulation 536/2014 and ICH E6 expectations for sponsor oversight of trial conduct.

Confirm the current version and clause numbers of each reference before issue.

Filled specimen: monitoring visit report

The following shows a routine interim visit completed for an example trial, so you can see the level of detail an inspector expects. Names and numbers are illustrative.

Section A: Visit identification

Section B: Subjects and consent reviewed

Section C: Source data verification and data review

Section D: Investigational product and site facilities

Section E: Findings and action items

Section F: Summary and sign-off

In this example the monitor did not just tick boxes; the consent finding names the exact field, the delegation gap is escalated because work happened before the sign-off, and the IP excursion ties back to the deviation log. Each finding has an owner and a date, and the closed item is shown closed. That is what oversight looks like on paper.

Common inspection findings this form prevents

• Monitoring visits happened but no reports exist, or reports are written long after the visit.
• The report says consent and eligibility were verified but records no specific findings, so there is no evidence of what was actually checked.
• The monitoring approach is not stated, so an inspector cannot tell what was source-verified against the monitoring plan.
• Findings have no owner or due date, and open items are not carried forward between visits.
• Deviations the monitor saw are not reconciled with the site’s deviation log.

How to adapt this form

1. Set your form number and reference your monitoring plan in the header.
2. Keep one form skeleton and mark the visit type; trim the sections that do not apply to selection or close-out visits rather than maintaining four separate forms.
3. Align Section C with your monitoring plan’s critical data and your sampling rule for full or targeted source data verification.
4. If you monitor centrally or remotely, keep Section C honest about what was reviewed off-site versus on-site.
5. Confirm every regulation in the references against the current published version before issue.

Form 3: Delegation of Authority Log

Document control header

How this form works

The delegation log records which trial tasks the principal investigator has assigned to which qualified staff, and for what period. It is one of the first documents an inspector asks for, because it answers a simple question: was the person who did this task allowed to do it, and were they qualified and trained at the time. Every person who performs a trial-related task that affects subjects or data should appear on the log, with a specific task list, a start date, a signature, and the PI’s authorizing signature. The PI signs each row, and the PI’s own signature establishes overall responsibility.

Set up a task key first, then list each person against the tasks they are delegated.

Task key (define once, reference by code)

Mark only tasks that require a licensed clinician (typically 4, and 1, 2, 8 where local rules require) as restricted, and confirm the delegate holds the qualification.

Delegation entries

Supporting records (confirm before the start date, do not record on this log)

• Current CV and, where required, medical license or professional registration on file in the investigator site file.
• Protocol-specific and GCP training completed and dated on or before the delegated start date.
• Financial-disclosure and any role-specific qualification on file where the protocol or sponsor requires it.

Acceptance criteria for a completed log

• Every person who performed a trial task that touches subjects or data appears on the log.
• Each delegated task is specific (by code), not a blanket “all study activities.”
• The start date is on or before the first day the person performed the task, and training and qualification were complete by that date.
• Tasks that require a licensed clinician are delegated only to qualified clinicians.
• Each row carries the delegate’s signature and the PI’s authorizing signature, both dated, and end dates are recorded when a person leaves the team.

References

ICH E6 Good Clinical Practice. Under E6(R2), sections 4.1 (investigator qualifications and agreements) and 4.2 (adequate resources), including 4.2.5 and 4.2.6 on supervising and ensuring that delegated trial-related duties go to qualified persons. E6(R3) reached Step 4 in January 2025 and reorganized the investigator responsibilities; cite the R3 Annex 1 investigator section where your region has adopted R3. 21 CFR 312.53 and the investigator commitments on Form FDA 1572 (the investigator personally conducts or supervises the investigation and ensures staff are informed of their obligations). 21 CFR 312.62 (investigator recordkeeping, including adequate and accurate records). FDA Compliance Program Guidance for clinical investigator inspections, which treats the delegation log and staff qualification as a routine review area.

Confirm the current version and clause numbers of each reference before issue.

Filled specimen: delegation of authority log

The following shows a delegation log completed for an example site, so you can see the level of detail an inspector expects. Names are illustrative.

Task key as defined above. Restricted tasks (require licensed clinician): 4; and 1, 2, 8 per local rule.

In this example the sub-investigator is delegated medical decision-making (task 4) because she is a licensed oncologist, the coordinator is not delegated tasks 4 or 8, the pharmacy technician is limited to drug handling, and the nurse who left has an end date that closes her delegation. Note that Dr. Mehta started on 02 June and the row is signed 02 June; the monitoring visit caught the case where the PI’s authorizing signature lagged behind the start, which is exactly the gap this log exists to expose.

Common inspection findings this form prevents

• A person recorded source data or assessed a subject but does not appear on the delegation log.
• Tasks are delegated as “all study procedures,” so it is impossible to tell who could do what.
• The delegated start date is after the date the person first performed the task, or training was completed after the start date.
• A non-clinician is delegated medical decisions or drug accountability without the required qualification.
• Staff who left the team have no end date, so the log does not reflect who was actually active.

How to adapt this form

1. Set your form number, protocol, site, and PI in the header.
2. Edit the task key to match the actual roles and procedures in your protocol; add protocol-specific procedures under code 9.
3. Mark which tasks require a licensed clinician under your local regulation, and check the qualification before delegating those.
4. Keep the supporting records (CV, license, training) in the investigator site file and reference them; do not duplicate them on the log.
5. Update the log promptly when staff join or leave, and reconcile it at every monitoring visit.
6. Confirm every regulation in the references against the current published version before issue.

Form 4: Note to File

Document control header

How this form works

A note to file records a single fact, clarification, or decision that does not have a home on another form. Use it to explain a discrepancy, document a one-time circumstance, or memorialize a decision so the record reads correctly later. A note to file is a clarification, not a fix; it does not correct source data (you correct source data by the controlled correction method, with a single line through the error, the correction, the initials, and the date) and it does not replace a deviation report, a CAPA, or a protocol amendment. If the situation needs one of those, raise that instead and reference it here.

Keep notes to file rare and specific. A file full of notes that explain away problems is itself a finding. One event, one note, one signature.

Note record

What a note to file should and should not do

Acceptance criteria for a completed note

• The note describes one event or fact, written on the date it is made, with the event date stated separately.
• It names the specific record it relates to, so it can be found alongside that record.
• It states the reason an inspector would need, not just the conclusion.
• It honestly answers whether a deviation, CAPA, or amendment is required, and references it when one was raised.
• It is signed and dated by the author and acknowledged by the PI or designee, and it is not used to alter source data.

References

ICH E6 Good Clinical Practice. Under E6(R2), sections 4.9 (records and reports, including source documents and ALCOA-aligned data attributes) and 8 (essential documents), under which a note to file is filed with the record it clarifies. E6(R3) reached Step 4 in January 2025 and carries the same data-attribute and essential-records expectations in its restructured text; cite the R3 sections where your region has adopted R3. 21 CFR 312.62 (investigator recordkeeping, accurate and complete records). FDA guidance on electronic source data and on data integrity expectations (attributable, legible, contemporaneous, original, accurate), which a note to file must respect rather than circumvent. MHRA GxP Data Integrity Guidance, on correcting records by the controlled method and on not using explanatory notes to mask data changes.

Confirm the current version and clause numbers of each reference before issue.

Filled specimen: note to file

The following shows a note to file completed for an example clarification, so you can see the level of detail an inspector expects. Names and numbers are illustrative.

In this example the note does the right things: it does not back-date a signature or alter the consent form, it states the actual circumstance and why the line is blank, it confirms the consent itself was valid and timely, and it cross-references the monitoring finding rather than pretending nothing was missed. It also honestly decides that no deviation is needed and says why. That is the difference between a clarifying note and a note that tries to hide a problem.

Common inspection findings this form prevents

• A note to file is used to “correct” source data instead of the controlled correction method.
• A note to file substitutes for a deviation, CAPA, or amendment that the situation actually required.
• The note is back-dated, or the note date and the event date are conflated to make a problem look contemporaneous.
• The note states a conclusion (“this is acceptable”) without the facts and reason an inspector would need.
• The file is full of notes to file that, taken together, reveal a recurring process problem no one escalated.

How to adapt this form

1. Set your form number, protocol, and site in the header.
2. Keep the “should and should not” table on the form so authors are reminded what a note to file is for.
3. Make the deviation/CAPA/amendment decision field mandatory, so every note forces an honest answer about whether a controlled record is needed.
4. Train staff that the note date is the date written and that source data is corrected only by the controlled method.
5. Periodically review the volume and pattern of notes to file as a quality signal; a rising count is a process flag.
6. Confirm every regulation in the references against the current published version before issue.

Using the four forms together

These records are strongest as a set. At a monitoring visit (Form 2), the monitor reconciles the site deviation log (Form 1) against what they observed, checks that everyone performing tasks is on the delegation log (Form 3) with the right dates, and confirms that any note to file (Form 4) clarifies rather than conceals. A single chain runs through the filled specimens above: a sub-investigator started before the PI signed her delegation row, the monitor caught it as a finding, and the surrounding records (delegation log, deviation log, note to file) either fix or honestly document it. Build the same internal consistency into your own records and an inspector will find a trial that oversaw itself.