Documentation That Holds Up to Inspection

Part of Clinical Research Associate (CRA) Training: Data, Documentation and Trial Supplies.

About 6 minutes. Free, in your language, no account needed.

Why this matters

Accurate data are only half the story. How they are documented is the other half. Regulators expect trial records to show what happened, when, how and by whom, in a way that can be reconstructed and trusted.

This is the area where a CRA has the most influence over a site's behavior, because it is the area sites find least intuitive.

The attributes E6(R3) actually requires

Teach the guideline's list, not the acronym.

E6(R3) section 2.12.2 states that source records should be attributable, legible, contemporaneous, original, accurate and complete; that changes should be traceable, should not obscure the original entry, and should be explained if necessary via an audit trail.

The E6(R3) glossary definition of data integrity lists eight attributes:

• Attributable — it is clear who recorded the entry.
• Legible — another person can read and understand it.
• Contemporaneous — recorded at the time of the activity.
• Original — the first record, or a certified copy of it.
• Accurate — it reflects what actually happened.
• Complete — nothing required is missing.
• Secure — protected from unauthorized access and alteration.
• Reliable — it can be depended on for decisions.

ICH E6(R3) never uses the acronym ALCOA, ALCOA+ or ALCOA++. The acronym is industry shorthand, applied inconsistently — different organizations add complete, consistent, enduring, available, traceable or secure in different combinations. That inconsistency is itself a reason to teach the R3 list.

Use the acronym as a memory aid if a site finds it helpful. Never write "as required by ICH E6(R3)" beside it, and correct a site that does.

Define the source before the trial starts

E6(R3) section 2.12.2 requires the investigator to define what is considered a source record, the methods of data capture and their location, before the trial starts, and to update that definition when needed.

In practice this is a written source data location list. Check that it exists, that it covers every protocol data point, and that it matches what the site actually does. Many sites have never produced one, and it is a legitimate and useful finding.

The same section says unnecessary transcription steps between the source record and the data acquisition tool should be avoided. Every additional copy is a chance to introduce an error.

What compliant documentation looks like

Visit documentation shows the date and visit type, the assessments performed, any missed procedure and why, changes in medical history and concomitant medications, adverse events discussed and documented, and the investigator's assessment and decisions.

Consent documentation shows that the discussion occurred before any study-specific procedure, that the participant had the opportunity to ask questions, that the correct version was used with proper attributable signatures and dates, and that re-consent occurred where required.

Adverse event documentation appears consistently in source, in EDC, and — for serious events — in the sponsor's safety system, with onset date, description, severity, seriousness, causality, action taken and outcome matching across all of them.

Corrections and late entries

Paper. A single line through the incorrect entry so the original stays readable; the correct value beside it; initials and date; a short reason where it is not obvious. Never erase, never use correction fluid, never overwrite.

Electronic. Use the system's correction function so the audit trail records the change. E6(R3) defines an audit trail as metadata showing activities, the initial entry and changes to data fields, by whom, when and where applicable why.

Late entries. Dated the day they are written, clearly marked as late, with the date of the event and a brief explanation. Back-dating is falsification, and it is treated differently from an error.

The non-compliance you will find

• Missing signatures and dates, on progress notes, consent forms or filed reports. It becomes impossible to say who performed an assessment or made a decision.
• Illegible or unclear notes, including non-standard abbreviations. Data that cannot be read can be treated as if they do not exist.
• Late entries and back-dating. Late entries without explanation undermine reliability; altered dates are falsification.
• Improper corrections. Correction fluid, overwriting, electronic changes made outside the system's audit trail.
• Inconsistency across documents. Visit dates differing between source, EDC and product logs; dosing in EDC not matching pharmacy records; adverse event onset differing between notes and reporting forms.
• Undocumented deviations. An out-of-window visit or missed assessment with no explanation anywhere.

What a CRA does about it

• Reinforce the R3 attributes at initiation and at every visit, with concrete anonymized examples of compliant and non-compliant records.
• Show specific examples from that site, and explain what "good" would look like.
• Teach correction practice explicitly. Most sites have never been shown it properly.
• Address the cause of late documentation — understaffing, no workflow, no time blocked — rather than asking for more discipline.
• Support organization and filing, since good organization prevents lost documents and shortens every future visit.
• Track patterns over time, and escalate when problems persist or when falsification is suspected.

And model it. Your own reports and follow-up letters must be clear, specific, complete, timely, attributable and accurate. A CRA who writes vague reports late has no standing to ask a site for anything else.

In practice

Leah notices that at one VT-301 site, three consecutive participants have identical vital signs recorded at every visit: 120/80, pulse 72, temperature 36.5.

She does not accuse anyone. She asks the coordinator to walk her through how vital signs are taken and recorded, and then observes a real measurement.

The measurements are genuinely being taken. What is happening is that the worksheet is pre-populated from the previous visit as a template, and staff have been overwriting only the values that looked obviously different.

The finding is about the template, not about the staff. The site removes the pre-population, records readings on a blank field each time, and the investigator reviews the affected data with the sponsor.

Had Leah opened with an accusation, she would have got a defensive answer and never found the template.

Key takeaways

• The E6(R3) glossary definition of data integrity lists eight attributes, and the guideline never uses the acronym ALCOA, which is industry shorthand applied inconsistently.
• Section 2.12.2 requires the investigator to define the source records, capture methods and location before the trial starts, and its absence is a legitimate finding.
• Corrections use a single line-through with initials, date and reason on paper, and the system's correction function electronically; back-dating is falsification, not error.
• Identical repeated values across visits or participants usually have a process cause such as a pre-populated template, and are best investigated by asking the site to demonstrate the process.
• A CRA must model compliant documentation in their own reports and letters, or they have no standing to require it of a site.