Data integrity and governance in a clinical trial

21 min read

Clinical-trial data governance protects the chain from the original observation to the final analysis data set. ICH E6(R3) sets out how investigators and sponsors should maintain data integrity, traceability, security and appropriate control of computerised systems.

Records, data and traceability

Data integrity is the degree to which data fulfil key criteria of being attributable, legible, contemporaneous, original, accurate, complete, secure and reliable such that data are fit for purpose.

Source records are original documents or data, including relevant metadata, or certified copies, irrespective of the media used. This may include trial participants' medical/health records/notes/charts; data provided/entered by trial participants (e.g., electronic patient-reported outcomes (ePROs)); healthcare professionals' records from pharmacies, laboratories and other facilities involved in the clinical trial; and data from automated instruments, such as wearables and sensors.

A data acquisition tool is a paper or electronic tool for collecting data and associated metadata from a trial data originator according to the protocol and reporting them to the sponsor.

The data originator may be a human (e.g., the participant or trial staff), a machine (e.g., wearables and sensors) or a computer system from which the electronic transfer of data from one system to another has been undertaken (e.g., extraction of data from an electronic health record or laboratory system).

Data acquisition tools include case report forms, interactive response technologies (IRTs), clinical outcome assessments (COAs), including patient-reported outcomes (PROs) and wearable devices, irrespective of the media used.

A case report form is a data acquisition tool for recording protocol-required information reported by the investigator to the sponsor for each trial participant.

Metadata provide the context needed to understand a data element. Metadata consist of structured information that describes, explains or otherwise makes it easier to retrieve, use or manage data. For ICH E6(R3), relevant metadata are those needed to allow the appropriate evaluation of the trial conduct.

An audit trail comprises metadata records that allow evaluation of the course of events by capturing details of actions (manual or automated) performed relating to information and data collection and, where applicable, to activities in computerised systems. The audit trail should show activities, initial entry and changes to data fields or records, by whom, when and, where applicable, why. In computerised systems, the audit trail should be secure, computer-generated and time stamped.

A trial participant identification code is a unique identifier that protects identity by replacing the participant’s name when the investigator reports adverse events or other trial data.

Proportionate governance

The quality and amount of the information generated in a clinical trial should be sufficient to address trial objectives, provide confidence in the trial's results and support good decision making.

The systems and processes that help ensure this quality should be designed and implemented in a way that is proportionate to the risks to participants and the reliability of trial results.

The following key processes should address the full data life cycle with a focus on the criticality of the data and should be implemented proportionately and documented appropriately:

(a) Processes to ensure the protection of the confidentiality of trial participants' data;
(b) Processes for managing computerised systems to ensure that they are fit for purpose and used appropriately;
(c) Processes to safeguard essential elements of the clinical trial, such as randomisation, dose adjustments and blinding;
(d) Processes to support key decision making, such as data finalisation prior to analysis, unblinding, allocation to analysis data sets, changes in clinical trial design and, where applicable, the activities of, for example, an independent data monitoring committee (IDMC).

Investigator responsibilities

In generating, recording and reporting trial data, the investigator should ensure the integrity of data under their responsibility, irrespective of the media used.

The investigator/institution should maintain adequate source records that include pertinent observations on each of the trial participants under their responsibility. Source records should be attributable, legible, contemporaneous, original, accurate and complete. Changes to source records should be traceable, should not obscure the original entry and should be explained if necessary (via an audit trail). The investigator should define which records are considered source records, the methods of data capture and their location prior to starting the trial and should update this definition when needed. Unnecessary transcription steps between the source record and the data acquisition tool should be avoided.

The investigator should be provided with timely access to data by the sponsor and be responsible for the timely review of data, including relevant data from external sources that can have an impact on, for example, participant eligibility, treatment or safety (e.g., central laboratory data, centrally read imaging data, other institution's records and, if appropriate, electronic patient-reported outcome (ePRO) data). The protocol may provide exceptions for access, for instance, to protect blinding.

The investigator should ensure that data acquisition tools and other systems deployed by the sponsor are used as specified in the protocol or trial-related instructions.

The investigator should ensure the accuracy, completeness, legibility and timeliness of the data reported to the sponsor in the data acquisition tools completed by the investigator site (e.g., case report form (CRF)) and in any other required reports (e.g., serious adverse event reports). The investigator should review and endorse the reported data at important milestones agreed upon with the sponsor (e.g., interim analysis).

Data reported to the sponsor should be consistent with the source records or the discrepancies explained. Changes or corrections in the reported data should be traceable, should be explained (if necessary) and should not obscure the original entry.

The investigator/institution should implement appropriate measures to protect the privacy and confidentiality of personal information of trial participants in accordance with applicable regulatory requirements on personal data protection.

Data reported to the sponsor should be identified by an unambiguous participant code that can be traced back to the identity of the participant by the investigator/institution.

For systems deployed by the investigator/institution that maintain and retain trial data and information, the investigator/institution should ensure that such data are protected from unauthorised access, disclosure, dissemination or alteration and from inappropriate destruction or accidental loss.

When using computerised systems in a clinical trial, the investigator/institution should do the following:

(a) For systems deployed by the investigator/institution, ensure that appropriate individuals have secure and attributable access;
(b) For systems deployed by the sponsor, notify the sponsor when access permissions need to be changed or revoked from an individual;
(c) For systems deployed by the investigator/institution specifically for the purposes of clinical trials, ensure that the computerised-system requirements are addressed proportionate to the risks to participants and to the importance of the data;
(d) Where equipment for data acquisition is provided to trial participants by the investigator, ensure that traceability is maintained and that participants are provided with appropriate training;
(e) Ensure that incidents in the use and operation of computerised systems, which in the investigator's/institution's judgement may have a significant and/or persistent impact on the trial data or system security, are reported to the sponsor and, where applicable, to the institutional review board or independent ethics committee (IRB/IEC).

(a) The sponsor should ensure the integrity and confidentiality of data generated and managed.
(b) The sponsor should apply quality control to the relevant stages of data handling to ensure that the data are of sufficient quality to generate reliable results. The sponsor should focus their quality assurance and quality control activities, including data review, on data of higher criticality and relevant metadata.
(c) The sponsor should pre-specify data to be collected and the method of its collection in the protocol. Where necessary, additional details, including a data flow diagram, should be contained in a protocol-related document (e.g., a data management plan).
(d) The sponsor should ensure that data acquisition tools are fit for purpose and designed to capture the information required by the protocol. They should be validated and ready for use prior to their required use in the trial.
(e) The sponsor should ensure that documented processes are implemented to ensure the data integrity for the full data life cycle.
(f) The sponsor should implement measures to ensure the safeguarding of the blinding, if any (e.g., maintain the blinding during data entry and processing).
(g) The sponsor should put procedures in place to describe unblinding, where applicable; these descriptions should include:
- (i) Who were unblinded, at what timepoint and for what purpose they were unblinded;
- (ii) Who should remain blinded;
- (iii) The safeguards in place to preserve the blinding.
(h) The sponsor should provide guidance to investigators/institutions, service providers and trial participants, where relevant, on the expectations for data capture, data changes, data retention and data disposal.
(i) The sponsor should not make changes to data entered by the investigator or trial participants unless justified, agreed upon in advance by the investigator and documented.
(j) The sponsor should allow correction of errors to data, including data entered by participants, where requested by the investigators/participants. Such data corrections should be justified and supported by source records around the time of original entry.
(k) The sponsor should ensure that the investigator has timely access to data collected in accordance with the protocol during the course of the trial, including relevant data from external sources (e.g., central laboratory data, centrally read imaging data and, if appropriate, ePRO data). This enables the investigators to make decisions (e.g., on eligibility, treatment, continuing participation in the trial and care for the safety of the individual trial participants). The sponsor should not share data that may unblind the investigator and should include the appropriate provisions in the protocol.
(l) The sponsor should not have exclusive control of data captured in data acquisition tools in order to prevent undetectable changes.
(m) The sponsor should ensure that the investigator has access to the required data for retention purposes.
(n) The sponsor should ensure that the investigator receives instructions on how to navigate systems, data and relevant metadata for the trial participants under their responsibility.
(o) The sponsor should seek investigator endorsement of their reported data at predetermined important milestones.
(p) The sponsor should determine the data management steps to be undertaken prior to analysis to ensure the data are of sufficient quality. These steps may vary depending on the purpose of the analysis to be conducted (e.g., data for IDMC, for interim analysis or the final analysis). Completion of these steps should be documented.
(q) For planned interim analysis, the ability to access and change data should be managed depending on the steps to achieve data of sufficient quality for analysis.
(r) Prior to provision of the data for final analysis and, where applicable, before unblinding the trial, edit access to the data acquisition tools should be restricted.
(s) The sponsor should use an unambiguous trial participant identification code that allows identification of all the data reported for each participant.
(t) The sponsor should implement appropriate measures to protect the privacy and confidentiality of personal information of trial participants, in accordance with applicable regulatory requirements on personal data protection.
(u) In accordance with applicable regulatory requirements and in alignment with the protocol, the sponsor should describe the process by which the participant's data will be handled when a participant withdraws or is discontinued from the trial.
(v) The sponsor should ensure that trial data are protected from unauthorised access, disclosure, dissemination or alteration and from inappropriate destruction or accidental loss.
(w) The sponsor should have processes and procedures in place for reporting to relevant parties, including regulatory authorities, incidents (including security breaches) that have a significant impact on the trial data.
(x) When using computerised systems in a clinical trial, the sponsor should:

For systems deployed by the sponsor:
- (i) Have a record of the important computerised systems used in a clinical trial. This should include the use, functionality, interfaces and validation status of each computerised system, and who is responsible for its management should be described. The record should also include a description of implemented access controls and internal and external security measures;
- (ii) Ensure that the requirements for computerised systems (e.g., requirements for validation, audit trails, user management, backup, disaster recovery and IT security) are addressed and implemented and that documented procedures and adequate training are in place to ensure the correct development, maintenance and use of computerised systems in clinical trials. These requirements should be proportionate to the importance of the computerised system and the data or activities they are expected to process;
- (iii) Maintain a record of the individual users who are authorised to access the system, their roles and their access permissions;
- (iv) Ensure that access permissions granted to investigator site staff are in accordance with delegations by the investigator and visible to the investigator;
- (v) Ensure that there is a process in place for service providers and investigators to inform the sponsor of system defects identified;
For systems used or deployed by the investigator/institution:
- (vi) Assess whether such systems, if identified as containing source records in the trial, (e.g., electronic health records, other record keeping systems for source data collection and investigator site files) are fit for purpose or whether the risks from a known issue(s) can be appropriately mitigated. This assessment should occur during the process of selecting clinical trial sites and should be documented;
- (vii) In situations where clinical practice computerised systems are being considered for use in clinical trials (e.g., electronic health records or imaging systems used or deployed by the investigator/institution), these systems should be assessed for their fitness for purpose in the context of the trial;
- (viii) The assessment should be performed before being used in the trial and should be proportionate to the importance of the data managed in the system. Factors such as data security (including measures for backup), user management and audit trails, which help ensure the protection of confidentiality and integrity of the trial data, should be considered as appropriate;
For all systems:
- (ix) Ensure that there is a process in place for service providers and investigator(s)/institution(s) to inform the sponsor of incidents that could potentially constitute a serious noncompliance with the clinical trial protocol, trial procedures, applicable regulatory requirements or GCP under ICH E6(R3)’s provisions on noncompliance.

Blinding during data handling

Maintaining the integrity of the blinding is important in particular in the design of systems, management of users' accounts, delegation of responsibilities with respect to data handling and provision of data access at sites, data transfers, database review prior to planned unblinding and statistical analysis across all appropriate stages of the trial.
Roles, responsibilities and procedures for access to unblinded information should be defined and documented by all relevant parties according to the protocol; this information may also be included in the data management plans and statistical analysis plans or other trial specific plans/instructions and site staff delegation records. For example, in blinded trials, sponsor staff or service providers who are involved in operation of the trial and directly or indirectly interact with investigator site staff should not have access to unblinding information except when justified by the trial design (e.g., use of unblinded monitors).
In such cases, suitable mitigation strategies should be implemented to reduce the risk of inadvertent unblinding of the blinded investigator site staff.
The potential for unblinding should be part of the risk assessment of a blinded trial. Any planned or unplanned unblinding, including inadvertent or emergency unblinding, should be documented. Any unplanned unblinding should be assessed for its impact on the trial results, and actions should be taken as appropriate.

The data life cycle

Procedures should be in place to cover the full data life cycle.

Capture

(a) When data captured on paper or in an electronic health record are manually transcribed into a computerised system (e.g., data acquisition tool), the need for and the extent of data verification should take the criticality of the data into account.
(b) Acquired data from any source, including data directly captured in a computerised system (e.g., data acquisition tool), should be accompanied by relevant metadata.
(c) At the point of data capture, automated data validation checks to raise data queries should be considered as required based on risk, and their implementation should be controlled and documented.

Metadata and audit trails

The approach used by the responsible party for implementing, evaluating, accessing, managing and reviewing relevant metadata associated with data of higher criticality should entail:

(a) Evaluating the system for the types and content of metadata available to ensure that:
- (i) Computerised systems maintain logs of user account creation, changes to user roles and permissions and user access;
- (ii) Systems are designed to permit data changes in such a way that the initial data entry and any subsequent changes or deletions are documented, including, where appropriate, the reason for the change;
- (iii) Systems record and maintain workflow actions in addition to direct data entry/changes into the system.
(b) Ensuring that audit trails, reports and logs are not disabled. Audit trails should not be modified except in rare circumstances (e.g., when a participant's personal information is inadvertently included in the data) and only if a log of such action and justification is maintained;
(c) Ensuring that audit trails and logs are interpretable and can support review;
(d) Ensuring that the automatic capture of date and time of data entries or transfer are unambiguous (e.g., coordinated universal time (UTC));
(e) Determining which of the identified metadata require review and retention.

Review

Procedures for review of trial-specific data, audit trails and other relevant metadata should be in place. It should be a planned activity, and the extent and nature should be risk-based, adapted to the individual trial and adjusted based on experience during the trial.

Corrections

There should be processes to correct data errors that could impact the reliability of the trial results. Corrections should be attributed to the person or computerised system making the correction, justified and supported by source records around the time of original entry and performed in a timely manner.

Transfer, exchange and migration

Validated processes and/or other appropriate processes such as reconciliation should be in place to ensure that electronic data, including relevant metadata, transferred between computerised systems retains its integrity and preserves its confidentiality. The data exchange/transfer process or system migration should be documented to ensure traceability, and data reconciliation should be implemented as appropriate to avoid data loss and unintended modifications.

Finalisation before analysis

(a) Data of sufficient quality for interim and final analysis should be defined and are achieved by implementing timely and reliable processes for data capture, verification, validation, review and rectification of errors and, where possible, omissions that have a meaningful impact on the safety of trial participants and/or the reliability of the trial results.
(b) Activities undertaken to finalise the data sets prior to analysis should be confirmed and documented in accordance with pre-specified procedures. These activities may include reconciliation of entered data and data sets or reconciliation of relevant databases, rectification of data errors and, where possible, omissions, medical coding and compilation of and addressing the impact of noncompliance issues, including protocol deviations.
(c) Data extraction and determination of data analysis sets should take place in accordance with the planned statistical analysis and should be documented.

Retention and access

The trial data and relevant metadata should be archived in a way that allows for their retrieval and readability and should be protected from unauthorised access and alterations throughout the retention period.

Destruction

The trial data and metadata may be permanently destroyed when no longer required as determined by applicable regulatory requirements.

Computerised systems

The responsibilities of the sponsor, investigator and the activities of other parties with respect to a computerised system used in clinical trials should be clear and documented.

The responsible party should ensure that those developing computerised systems for clinical trials on their behalf are aware of the intended purpose and the regulatory requirements that apply to them.

It is recommended that representatives of intended participant populations and healthcare professionals are involved in the design of the system, where relevant, to ensure that computerised systems are suitable for use by the intended user population.

Procedures and training

Documented procedures should be in place to ensure the appropriate use of computerised systems in clinical trials for essential activities related to data collection, handling and management.

The responsible party should ensure that those using computerised systems are appropriately trained in their use.

Security

(a) The security of the trial data and records should be managed throughout the data life cycle.
(b) The responsible party should ensure that security controls are implemented and maintained for computerised systems. These controls should include user management and ongoing measures to prevent, detect and/or mitigate security breaches. Aspects such as user authentication requirements and password management, firewall settings, antivirus software, security patching, system monitoring and penetration testing should be considered.
(c) The responsible party should maintain adequate backup of the data.
(d) Procedures should cover the following: system security measures, data backup and disaster recovery to ensure that unauthorised access and data loss are prevented. Such measures should be periodically tested, as appropriate.

Validation

Computerised systems validation establishes and documents that a system’s specified requirements can be fulfilled consistently from design until decommissioning or transition to a new system. The approach to validation should be based on a risk assessment that takes into consideration the intended use of the system and the potential of the system to affect trial participant protection and the reliability of trial results.

(a) The responsible party is responsible for the validation status of the system throughout its life cycle. The approach to validation of computerised systems should be based on a risk assessment that considers the intended use of the system; the purpose and importance of the data/record that are collected/generated, maintained and retained in the system; and the potential of the system to affect the well-being, rights and safety of trial participants and the reliability of trial results.
(b) Validation should demonstrate that the system conforms to the established requirements for completeness, accuracy and reliability and that its performance is consistent with its intended purpose.
(c) Systems should be appropriately validated prior to use. Subsequent changes to the system should be validated based on risk and should consider both previously collected and new data in line with change control procedures.
(d) Periodic review may be appropriate to ensure that computerised systems remain in a validated state throughout the life cycle of the system.
(e) Both standard system functionality and protocol-specific configurations and customisations, including automated data entry checks and calculations, should be validated. Interfaces between systems should also be defined and validated. Different degrees of validation may be needed for bespoke systems, systems designed to be configured or systems where no alterations are needed.
(f) Where relevant, validation procedures (until decommissioning) should cover the following: system design, system requirement, functionality testing, configuration, release, setup, installation and change control.
(g) The responsible party should ensure that the computerised systems are validated as fit for purpose for use in the trial, including those developed by other parties. They should ensure that validation documentation is maintained and retained.
(h) Validation should generally include defining the requirements and specifications for the system and their testing, along with the associated documentation, to ensure the system is fit for purpose for use in the trial, especially for critical functionality, such as randomisation, dosing and dose titrations and reductions, and collection of endpoint data.
(i) Unresolved issues, if any, should be justified and, where relevant, the risks identified from such issues should be addressed by mitigation strategies prior to and/or during the continued use of the system.

Release

The trial-specific systems (including updates resulting from protocol amendments) should only be implemented, released or activated for individual investigator sites after all necessary approvals for the clinical trial relevant to that investigator site have been received.

Failure contingencies

Contingency procedures should be in place to prevent loss or lack of accessibility to data essential to participant safety, trial decisions or trial outcomes.

Technical support

(a) Where appropriate, there should be mechanisms (e.g., help desk support) in place to document, evaluate and manage issues with the computerised systems (e.g., raised by users), and there should be periodic review of these cumulative issues to identify those that are repeated and/or systemic.
(b) Defects and issues should be resolved according to their criticality. Issues with high criticality should be resolved in a timely manner.

User management

(a) Access controls are integral to computerised systems used in clinical trials to limit system access to authorised users and to ensure attributability to an individual. The security measures should be selected in such a way that they achieve the intended security.
(b) Procedures should be in place to ensure that user access permissions are appropriately assigned based on a user's duties and functions, blinding arrangements and the organisation to which users belong. Access permissions should be revoked when they are no longer needed. A process should be in place to ensure that user access and assigned roles and permissions are periodically reviewed, where relevant.
(c) Authorised users and access permissions should be clearly documented, maintained and retained. These records should include any updates to a user's roles, access permissions and time of access permission being granted (e.g., time stamp).

Noncompliance and writing errors

Woollen’s misconduct scale distinguishes three levels of noncompliance by intent and applies to both trial conduct and medical writing.

Ignorance: lack of understanding of an action’s regulatory consequences. The action is usually intentional, but the noncompliance is unintentional and usually does not aim to deceive. A clinical example is backdating a participant’s consent signature because the participant forgot to date the form. Writing examples include failing to identify and correct ambiguous terminology, definitions or methods, and describing study methods or procedures contrary to good clinical practice.
Surprising sloppiness: inaction, inattention to detail, inadequate staffing or lack of supervision. The action may be intentional or unintentional; the noncompliance is unintentional and usually repeated. A clinical example is inadvertently failing to obtain consent signatures related to an amendment. Writing examples include creating a protocol from a template without checking that all the text applies, assuming a statistician will notify the writer when tables, listings or figures are rerun, and accepting others’ content without checking its accuracy.
Malicious malfeasance: deliberate action to deceive or mislead, usually involving falsification by creating, altering, recording or omitting data so they no longer represent what occurred. A clinical example is creating data never obtained or substituting, altering or omitting actual data. Falsification can put all trial participants at possible safety risk and undermine the reliability of submitted or published data. It can lead to criminal prosecution and FDA action, including warning letters, restriction or disqualification from conducting clinical studies, or permanent debarment. Writing examples include deliberately reporting questionable data with a misleadingly positive interpretation, making unsubstantiated claims and purposely avoiding discussion of questionable or negative data.

Sources behind this topic

2 sources · 31 passages

PreviousRecording and managing data NextCoding clinical terms with MedDRA