Operationalizing ICH E6(R3): Closing the Gap Between Guideline and Practice

If you have recently updated your quality management plan based on ICH E6(R3), you have done the part that demonstrates compliance with a guideline. The more challenging step though is how to implement that plan consciously and how that impacts your day-to-day work. Four critical pillars that can facilitate implementation include:‍

• Embed critical-to-quality factors into protocol design, so quality thinking shapes the trial instead of chasing it.
• Run a standing cross-functional oversight cadence instead of routing everything through the monitoring function.
• Capture the reasoning behind risk decisions, not only the decisions themselves.
• Review trial data for emerging safety information continuously as the trial runs, rather than waiting on periodic data pulls, provided that underlying data are sufficiently contextualized.

Embedding Critical-to-Quality Factors into Protocol Design

The first pillar pulls quality thinking earlier in the timeline. Under E6(R3), Quality-by-Design concepts of critical-to-quality factors and risk-proportionate oversight become norms: critical-to-quality (CtQ) factors that are “fundamental to the protection of participants, the reliability and interpretability of the trial results and the decisions made based on those trial results” should be identified and should determine how the trial is conducted, maintaining an appropriate balance between participant protection and the scientific validity of the study. Practically, this means:

1. Identifying which attributes of a trial are fundamental to participant safety and well-being.
2. Determining which data are necessary for the scientific validity of the study.
3. Pinpointing which risks could threaten scientific validity.

That alignment becomes the backbone of the monitoring plan. Each key risk indicator (KRI) earns its place by answering a named critical-to-quality risk, which replaces the older habit of tracking a metric for historic reasons.

Running a Risk-adapted Oversight Cadence

The second pillar potentially requires a structural shift.This matters because data supporting signals that matter most and decisions related to them may not be in the hands of one function. For example, data and the functions that operate on it, can remain siloed even when their integration is required to detect problems with patient safety implications: 

• a cluster of protocol deviations at a single site,
• an unusual screen-failure ratio, and
• a pattern of delayed adverse event entry.

Having an integrated view of these cross-domain patterns depends on timely availability of integrated and harmonized datasets. In a safety review, this means that data from at least four sources (CTMS, EDC, central labs, safety) have to be pulled, integrated, analyzed and reconciled just to understand if something went wrong. Relying on technical experts to compile and analyze data through a sequential handoff to the medical monitoring function risks turning an actionable signal into a missed one. Furthermore, in cases where different functions are viewing different data cuts, there’s a risk that the asynchrony and fragmentation leaves either the cross-domain signal undetected and potentially unrescuable. In contrast, running that same review on a unified intelligence layer that continuously integrates and harmonizes the data minimizes the risk for such missed signals.

This is also where centralized monitoring can complement or, where justified, substitute for site monitoring SDV-heavy workflows of the E6(R2) era. If your monitoring is already risk-based, the conceptual shift here is small, and what E6(R3) adds is a requirement to document the rationale for the chosen strategy and to adapt monitoring frequency as new risk information emerges. Either way, a monitoring plan under E6(R3) requires sponsors to address monitoring of critical data and processes performed outside the investigator site (e.g., central labs, imaging cores and other similar sources), not just site-level activity. Integrating these data streams into a timely, current view supports the risk-based approach §3.11.4 calls for, and is directly relevant where §3.11.4.1(a) requires monitoring frequency to be "modified as appropriate using knowledge gained" as an emerging risk develops.

Capturing the Reasoning behind Decisions

The third pillar is the clearest change in how oversight needs to be documented. E6(R3)'s risk management framework expects risk control measures to be documented and communicated to those involved in or affected by them, with the rationale for specific strategies documented where the guideline calls for it (e.g., the monitoring strategy under §3.11.4.3), and periodically reviewed to confirm they remain effective and relevant as new knowledge emerges. If a breach of a pre-specified acceptable range triggers an evaluation under §3.10.1.3 (Risk control), both the evaluation and the resulting action require documentation. 

In practice, this means the evaluation record should capture reasoning, not only the outcome. A practical way to capture this is to document:

• what the signal was,
• what the team concluded,
• what action was followed, 
• what remains under evaluation and why.

A rationale field on the risk log, used consistently, is one practical way to meet this.

For smaller organizations, this sounds like more work at a moment when no one has spare capacity. In practice the burden is front-loaded into the data, not the documentation. When the underlying trial data is already integrated and harmonized , the preparation that could take  days or weeks before a safety review meeting can be compressed to a matter of hours, especially if  the reconciliation is already done and what remains is deciding on an action to take and appropriate documentation. This matters because trial records increasingly serve as evidence of how oversight was actually exercised, not simply that required documents exist: a record of decisions without their reasoning is difficult to distinguish, on review, from oversight that lacked reasoning in the first place.

Timely Signal Review

The fourth change concerns timeliness. E6(R3) frames oversight around the trial's current state, not the last data cut.

Case: A first KRI review for a first-in-class drug runs on a two-week-old export. On review, 2 of 10 enrolled patients show grade 2 CRS, at days 3 and 5.

Remediation:

A 20% Grade 2 CRS rate in a first-in-class cohort is exactly what a pre-specified acceptable range exists to catch the moment it's crossed — this should have triggered a QTL breach, not waited on the review calendar.

1. Recalibrate frequency, not just response. E6(R3) requires monitoring frequency itself be revisited once a signal emerges. The event also changes the "current knowledge of the safety profile" input §3.11.4 ties monitoring design to, so the extent/nature determination needs re-running, not just the cadence — continuously integrated, harmonized data is the practical foundation for this, especially for capacity-constrained teams.
2. The real failure was upstream. A first-in-class product with minimal existing safety knowledge should never have been on a generic, undifferentiated review cadence to begin with.

This is one of several concrete, correctable risks. Another: a missed or delayed IMP dose, caught only once a periodic report reaches the central team — by which point the rescheduling window may have closed. Timely review (the §3.11.4.2(a) standard for centralized monitoring) lets the team reach the site while the dose can still be rescheduled within protocol. The same applies to a missed time-sensitive sample: catching the gap early is the difference between a follow-up draw and a permanent hole in immunogenicity data. This reflects E6(R3)'s explicit proactive posture — risks to critical-to-quality factors "should be managed proactively and adjusted when new or unanticipated issues arise once the trial has begun" (Principle 7.3).

A case of what-might-have-been: the case of BioXcel

In June 2023, BioXcel's stock fell 63.8% in a day: the first in a series of events over two years that cost the company $9.75 million in a securities settlement and years of litigation, all traced back to one investigator site that quietly carried 40% of a pivotal Alzheimer's trial's enrollment. The warning signs were there: a delayed adverse-event report, incomplete case histories, informed consent drifting from protocol, each survivable alone, until a fabricated email surfaced during an FDA inspection and turned a documentation problem into a fraud allegation. What if an E6(R3)-based risk framework had been applied from day one?

The site's enrollment concentration alone should have triggered elevated monitoring and PI-level oversight from the outset. From there, the framework's named mechanisms follow in sequence: SAE-reporting timeliness checks, source-record verification, and informed-consent confirmation were positioned to catch these gaps as they formed, not after an FDA inspection forced disclosure. A metadata and audit-trail review — comparing the investigator's correspondence against the vendor's timestamped receipt log — could plausibly have exposed the fabricated email as a timing mismatch rather than a scandal. Instead, eighteen months separated internal awareness from public disclosure — and in that gap, $9.75 million in shareholder losses took root.

‍

Starting From Where You Are

Industry adoption was uneven going into E6(R3): a 2024 survey found risk-based practices implemented in roughly 57% of trials on average, with limited organizational knowledge cited as a common barrier. Mature programs have one real advantage and a smaller leap: they mainly need to formalize and document what they already do. E6(R3) doesn't introduce a new methodology so much as require the reasoning behind it to be visible. For everyone else, the path is the same, just longer. Five actions get you there, not specified by the guideline but consistent with what it requires:

1. Revisit oversight SOPs to reflect actual E6(R3) language
2. Define Critical-to-Quality factors at protocol level, with relevant functions involved
3. Set a regular oversight cadence and protect the time for it
4. Replace status updates with traceable, reasoned decisions
5. Bring centralized monitoring in early, focused on the earliest signals

None require a perfect program on day one: just starting one move at a time, on data you can see.

What ties them together: each ends up in the same record, which runs forward into the rest of the regulatory evidence trail. AE reporting should be consistent with what KRI monitoring was tracking, and aggregate safety reporting, including the DSUR, should reflect what oversight found as the trial progressed, not a narrative assembled when the report was due.

A safety report surfacing signals that were in the data but never caught during the trial is, before anything else, a sign oversight lagged the data it was meant to act on. That's the real test of the transition and one you can pass from wherever you start: when these actions are working, the annual safety report confirms what you already knew, because the practice behind it was already in place. This matches E6(R3)'s Audit Trail standard: documentation that allows reconstruction of the course of events is, ultimately, a trial record that can substantiate the oversight it claims.

References

1. International Council for Harmonisation. ICH E6(R3) Guideline for Good Clinical Practice. Final version adopted January 6, 2025; came into effect July 23, 2025 (EU/EMA). Available at: https://database.ich.org/sites/default/files/ICH_E6(R3)_Step4_FinalGuideline_2025_0106.pdf
2. U.S. Food and Drug Administration. Guidance for Industry: Oversight of Clinical Investigations — A Risk-Based Approach to Monitoring. August 2013. Available at: https://www.fda.gov/media/116754/download
3. Therapeutic Innovation & Regulatory Science. Study on industry adoption of Risk-Based Quality Management practices (companies implemented RBQM in approximately 57% of trials on average, with organizational knowledge cited as a barrier). 2024. https://link.springer.com/article/10.1007/s43441-024-00618-5

‍