Risk-Based Approaches to Trial Design and Conduct

Part of Good Clinical Practice (GCP) — ICH E6(R3): Risk Management and Quality by Design.

About 6 minutes. Free, in your language, no account needed.

Why this matters

A trial that treats every data point as equally important spends effort in the wrong places. The trivial gets checked twice. The dangerous gets missed. International Council for Harmonisation (ICH) guideline E6(R3) for Good Clinical Practice (GCP) asks you to direct attention to where the risk actually sits. Sites feel this directly: fewer routine checks on low-value data, sharper attention on eligibility, consent, safety and the primary endpoint.

What a risk-based approach means in E6(R3)

The Introduction to E6(R3) states that the guideline "encourages a risk-based and proportionate approach to the conduct of a clinical trial."

Proportionality is Principle 7. Its headline reads:

"Clinical trial processes, measures and approaches should be implemented in a way that is proportionate to the risks to participants and to the importance of the data collected and that avoids unnecessary burden on participants and investigators."

Three sub-points of Principle 7 shape day-to-day work.

• Principle 7.1 — risk means two different things at once. It means risk to the rights, safety and well-being of participants. It also means risk to the reliability of the trial results. Both must be managed.
• Principle 7.2 — for trials involving patients, "the focus should be on risks that go beyond those associated with usual medical care." A blood draw that a patient would have received anyway is not the risk you should be managing.
• Principle 7.4 — trial processes should be operationally feasible. They should avoid unnecessary complexity, procedures and data collection. The guideline says plainly that the sponsor "should not place unnecessary burden on participants and investigators."

Under the previous revision, R2, risk-based quality management was added to the sponsor's obligations. R3 goes further. Proportionality is now one of the eleven overarching Principles, and it applies to everything in the guideline, not only to sponsor monitoring.

The six named steps of risk management

E6(R3) section 3.10.1 sets out risk management in six named steps. Learn the names. They are the structure a sponsor and a regulator will both use.

1. 3.10.1.1 Risk Identification — the sponsor identifies risks that may have a meaningful impact on critical to quality factors. This happens before the trial starts and continues throughout conduct. Risks are considered across processes and systems, including computerized systems.
2. 3.10.1.2 Risk Evaluation — each risk is evaluated against three criteria.
3. 3.10.1.3 Risk Control — mitigation proportionate to the importance of the risk.
4. 3.10.1.4 Risk Communication — risks and mitigations are documented and communicated to the people who act on them or are affected by them.
5. 3.10.1.5 Risk Review — periodic review of whether the controls remain effective and relevant.
6. 3.10.1.6 Risk Reporting — important quality issues and remedial actions are summarized in the clinical trial report.

Steps 1 and 2 are the ones that shape the trial you receive. Steps 3 to 6 are covered in lesson 3 of this module.

Risk identification: where E6(R3) tells you to look

Section 3.10.1.1 names examples of where risk should be considered. The list is worth memorizing, because it maps onto site work:

• trial design
• participant selection
• informed consent process
• randomization
• blinding
• investigational product administration
• data handling
• service provider activities

Many organizations group risks into operational categories such as study design, participant safety, data integrity, regulatory compliance and external factors. That grouping is useful practice. It is not ICH wording. Use it as a prompt, then map each risk back to the E6(R3) list above.

Risk evaluation: the three criteria

Section 3.10.1.2 requires the sponsor to consider existing controls and then evaluate:

• (a) Likelihood — how likely is the harm or hazard to occur?
• (b) Detectability — to what extent would the harm or hazard be detected?
• (c) Impact — what would the effect be on participant protection and on the reliability of results?

Detectability is the criterion teams forget. A rare error that nobody would ever notice can outrank a common error that is caught the same day.

What this looks like at your site

Risk-based thinking reaches sites mostly through monitoring. E6(R3) section 3.11.4.3 requires a monitoring plan tailored to the identified risks, and says "The plan should focus on aspects that are critical to quality." Section 3.11.4.2 describes centralized monitoring, which "can complement and reduce the extent and/or frequency of site monitoring or be used on its own."

Section 3.11.4.5.4(b) says that checking reported data against source records "can be done on the basis of using samples and supported by data analytics, as appropriate." So the industry has moved away from the traditional 100% source data verification model toward a targeted, risk-based one. E6(R3) does not require 100% source data verification.

In practice

ABC Pharmaceuticals is running a Phase II trial of a new medicine for type 2 diabetes. It is multi-site, aiming for 400 participants over one year. Maria is the coordinator at a mid-sized site.

The sponsor's risk assessment identified three high-ranking risks: protocol deviations around visit windows, slow recruitment, and delayed recognition of hypoglycaemia. Applying section 3.10.1.2, the sponsor scored the hypoglycaemia risk highest. The likelihood was moderate, the impact on participants was high, and detectability was poor because symptoms could be reported late.

The controls followed the ranking. Maria's site receives extra training on hypoglycaemia recognition, a participant-facing symptom card, and weekly centralized review of glucose data. Meanwhile the sponsor removed two exploratory laboratory tests from the schedule. They added burden and answered no key question.

Maria notices what a risk-based trial feels like. The monitor spends less time re-reading routine demographics and more time on eligibility, consent and glucose safety data.

Key takeaways

• E6(R3) treats risk as covering both participant rights, safety and well-being and the reliability of the trial results, under Principle 7.1.
• For trials in patients, Principle 7.2 directs the focus to risks that go beyond those of usual medical care.
• Section 3.10.1 names six risk management steps: identification, evaluation, control, communication, review and reporting.
• Risk evaluation under 3.10.1.2 uses three criteria: likelihood, detectability and impact.
• Section 3.10.1.1 requires risk identification before the trial starts and throughout trial conduct, not once at the planning stage.
• E6(R3) permits sampling and data analytics for source data checking, so 100% source data verification is not a GCP requirement.
• Effort spent where there is no risk is effort stolen from where there is.