This is a ready-to-use pair of records for central monitoring: a register that defines every key risk indicator (KRI) and quality tolerance limit (QTL), and a signal disposition log that captures what happened each time a threshold was crossed. Together they answer the single most common risk-based monitoring inspection question: you had the data, what did you do about it? Replace every <<FILL: ...>> placeholder and maintain the log continuously. A filled specimen follows. This is general guidance to adapt and verify, not legal or regulatory advice.
Part A: KRI register (definitions)
A KRI is a per-site metric with a threshold and a defined action. Every KRI here must have all columns filled; a KRI without a threshold or an action does not belong in the register.
| KRI ID | KRI name | What it signals | Data source | Threshold logic (green/amber/red) | Review cadence | Defined action on red |
|---|---|---|---|---|---|---|
<<FILL: KRI-01>> | <<FILL: screen failure rate>> | <<FILL: eligibility manipulation / recruitment pressure>> | <<FILL: EDC>> | <<FILL: vs study mean, > 2 SD>> | <<FILL: biweekly>> | <<FILL: central review, corroborate, trigger visit>> |
<<FILL: KRI-02>> | <<FILL: enrollment rate vs plan>> | <<FILL: recruitment fraud / low engagement>> | <<FILL: CTMS>> | <<FILL: outlier vs peers>> | <<FILL: biweekly>> | <<FILL: assess eligibility signal>> |
<<FILL: KRI-03>> | <<FILL: query rate / aging>> | <<FILL: data quality / responsiveness>> | <<FILL: EDC>> | <<FILL: aged > X days>> | <<FILL: weekly>> | <<FILL: site follow-up>> |
<<FILL: KRI-04>> | <<FILL: data entry lag>> | <<FILL: contemporaneity / overwhelmed site>> | <<FILL: EDC>> | <<FILL: median > X days>> | <<FILL: biweekly>> | <<FILL: remote check>> |
<<FILL: KRI-05>> | <<FILL: SAE reporting timeliness>> | <<FILL: safety reporting compliance>> | <<FILL: safety database>> | <<FILL: any late report>> | <<FILL: continuous>> | <<FILL: safety escalation>> |
<<FILL: KRI-06>> | <<FILL: AE/SAE rate vs expected>> | <<FILL: under-reporting or safety signal>> | <<FILL: EDC>> | <<FILL: far from pooled rate>> | <<FILL: biweekly>> | <<FILL: medical review>> |
<<FILL: KRI-07>> | <<FILL: protocol deviation rate>> | <<FILL: conduct quality / training gap>> | <<FILL: deviation log>> | <<FILL: above peer sites>> | <<FILL: monthly>> | <<FILL: retraining / CAPA>> |
Part B: QTL register (trial-level)
QTLs are few. A breach is assessed for root cause and impact and may be reported in the clinical study report.
| QTL ID | Parameter | Limit | Rationale (critical-to-quality factor) | Escalation and reporting on breach |
|---|---|---|---|---|
<<FILL: QTL-01>> | <<FILL: overall rate of a specific important protocol deviation>> | <<FILL: e.g. NMT X%>> | <<FILL>> | <<FILL: assess root cause/impact; CSR note>> |
<<FILL: QTL-02>> | <<FILL: rate of important eligibility violations>> | <<FILL>> | <<FILL>> | <<FILL>> |
<<FILL: QTL-03>> | <<FILL: rate of incomplete primary endpoint data>> | <<FILL>> | <<FILL>> | <<FILL>> |
Keep the QTL count small; a long QTL list usually means site-level KRIs have been mislabeled as trial-level limits.
Part C: Signal disposition log
One row per signal, per site, per review. “Reviewed, no action” is a valid, documented disposition; an undocumented red flag is not.
| Field | Format | Required | Who | When |
|---|---|---|---|---|
| Signal ID | Text/ID | Yes | System / central monitor | At detection |
| Date detected | Date | Yes | System | At detection |
| Site | Site ID | Yes | System | At detection |
| KRI / QTL / statistical check | Reference | Yes | Central monitor | At review |
| Value vs threshold | Text | Yes | Central monitor | At review |
| Assessment (real risk vs artifact; corroborating KRIs) | Text | Yes | Central monitoring meeting | At review |
| Action chosen | Text | Yes | Central monitoring meeting | At review |
| Action owner and due date | Text/Date | Yes | Central monitoring meeting | At review |
| Outcome / closure | Text | Yes | Owner | At closure |
| Linked query / deviation / CAPA | Reference | If raised | Owner | At closure |
Retention: retain with the trial master file per <<FILL: retention period>>.
Acceptance criteria
- Every KRI in the register has a data source, a threshold, a cadence, and a defined action.
- QTLs are few and each has a rationale and an escalation path.
- Every red signal appears in the disposition log with an assessment, an action (or a documented no-action), and an outcome.
- No signal in the log is left open past its due date without a recorded reason.
References
ICH E6(R2) Good Clinical Practice, sections 5.0 and 5.18.3; ICH E6(R3) Annex 1. FDA guidance, A Risk-Based Approach to Monitoring of Clinical Investigations (2019) and its Questions and Answers (2023). ICH E8(R1) for critical-to-quality factors underpinning QTLs.
Confirm the current status of each reference before use.
Filled specimen
The following shows one KRI register row and one disposition-log entry for an example study. Illustrative only.
KRI register row: KRI-06, AE/SAE rate vs expected, signals under-reporting or a safety signal, source EDC, red if a site’s per-subject AE rate is below half the pooled rate, reviewed biweekly, action on red is medical review and consider a triggered visit.
Signal disposition log entry:
| Field | Entry |
|---|---|
| Signal ID | SIG-2026-0087 |
| Date detected | 15 June 2026 |
| Site | Site 014 |
| KRI / check | KRI-06 (AE rate 0.4 vs pooled 1.9); corroborated by KRI-01 (screen failure 11% vs 34%) and KRI-02 (enrollment 3x peers) |
| Value vs threshold | Red on KRI-06; amber/red cluster across three KRIs |
| Assessment | Pattern consistent with eligibility manipulation and AE under-reporting; not an artifact of small n (18 subjects enrolled) |
| Action chosen | Triggered focused on-site visit within 10 business days; targeted SDV of consent, eligibility, and AE source for all enrolled subjects; coordinator interview |
| Owner and due date | Lead CRA; due 29 June 2026 |
| Outcome / closure | Visit completed 26 June; 2 eligibility deviations and 4 unreported AEs found; site retrained; CAPA opened |
| Linked query / deviation / CAPA | DEV-2026-0233, CAPA-2026-0041 |
This entry is exactly the audit trail an inspector wants: a signal detected, corroborated, assessed as real, acted on within a defined time, and carried through to a documented outcome and CAPA.
Common inspection findings this log prevents
- KRIs computed but never acted on, with no disposition record.
- A red signal handled in email or a personal spreadsheet, so the decision trail cannot be reconstructed.
- QTLs confused with KRIs, or 40 “QTLs” that are really site metrics.
- A recurring cross-site signal patched site-by-site with no root cause or CAPA.
- Signals left open indefinitely with no owner or due date.
How to adapt this log
- Populate the KRI register from your monitoring plan; every KRI there must appear here with full definitions.
- Keep QTLs aligned to your critical-to-quality factor register and keep the count small.
- Wire the disposition log to your central monitoring meeting so entries are made at review, not reconstructed later.
- Link outcomes to your query, deviation, and CAPA systems by reference.
- Confirm the regulatory status of each reference before use.