Clinical trials glossary

US FDA regulation (Title 21 of the Code of Federal Regulations, Part 11) that sets requirements for electronic records and electronic signatures to be considered trustworthy, reliable, and equivalent to paper records and handwritten signatures. It requires controls such as audit trails, access controls, and system validation for regulated software. Applicable to sponsors and sites conducting FDA-regulated clinical trials.

US FDA regulation governing the Investigational New Drug (IND) application process, including requirements for sponsor responsibilities, investigator qualifications, study protocols, and safety reporting for investigational drug studies. It sets out the framework within which clinical investigations of new drugs and biologics may be conducted in the United States.

US FDA regulation governing the protection of human subjects in clinical research, establishing requirements for informed consent, including what information must be disclosed to participants and how consent must be documented. It applies to research conducted or supported by FDA and to clinical investigations regulated by FDA.

US FDA regulation requiring disclosure of financial interests and arrangements between clinical investigators and study sponsors, to help identify potential bias in the conduct or reporting of a clinical study. Sponsors must certify or disclose investigator financial interests when submitting marketing applications to FDA.

US FDA regulation governing the composition, operation, review, and recordkeeping requirements of Institutional Review Boards (IRBs), which are responsible for protecting the rights and welfare of human subjects in FDA-regulated research. It sets standards for IRB membership, meeting procedures, and types of review.

An active substance is the pharmacologically active ingredient in an investigational medicinal product (IMP) that is intended to produce the therapeutic, prophylactic, or diagnostic effect being studied. In EU regulatory parlance (EU CTR 536/2014), the active substance is distinct from excipients and is the primary basis on which a clinical trial is authorised.

ADaM (Analysis Data Model) is a CDISC standard that defines how clinical trial analysis datasets should be structured and documented to support statistical analysis and regulatory review. ADaM datasets are derived from SDTM-formatted source data and are designed to be traceable back to the raw data, enabling reviewers to verify every derived result. Most major regulatory submissions to the FDA and EMA are now expected to include ADaM-compliant analysis datasets.

Adaptive randomisation is a method of treatment allocation in which the probability of a participant being assigned to each arm is updated during the trial based on accumulating outcome data, typically to increase assignment to better-performing treatments. It is a subtype of adaptive trial design and must be pre-specified in the protocol and statistical analysis plan.

An adaptive trial design is a pre-planned framework that allows modifications to one or more aspects of a trial (such as sample size, treatment arms, or eligibility criteria) based on interim data, without compromising the trial's integrity or the validity of its conclusions. ICH E6(R3) and ICH E8(R1) support the use of adaptive designs provided changes are prospectively defined and appropriately controlled for Type I error.

An adequacy decision is a formal finding by the European Commission (or, for UK transfers, the UK government) that a third country provides a level of data protection essentially equivalent to that in the UK or EU, allowing personal data to be transferred there without additional safeguards. In clinical trials, adequacy decisions are relevant wherever participant data crosses borders — for example, sharing data with a US sponsor or overseas laboratory. Without an adequacy decision in place, organisations must rely on alternative transfer mechanisms such as standard contractual clauses.

An adverse drug reaction (ADR) is a response to a medicinal product that is noxious and unintended, and that occurs at doses normally used in humans for prophylaxis, diagnosis, or treatment of disease. Unlike an adverse event, causality to the investigational product is at least reasonably possible. ADRs are a subset of adverse events and carry specific reporting obligations under ICH E2A and applicable pharmacovigilance regulations.

An adverse event (AE) is any untoward medical occurrence in a participant administered an investigational medicinal product, regardless of whether there is a causal relationship to the treatment; it includes any unfavourable and unintended sign, symptom, or disease temporally associated with its use (ICH E6(R3)). An AE is distinct from a serious adverse event (SAE), which meets one or more seriousness criteria (death, life-threatening, hospitalisation, persistent disability, congenital anomaly, or medically important), and from a SUSAR, which is an SAE that is both unexpected and for which there is a reasonable possibility of a causal relationship to the IMP.

ALCOA is a data-integrity framework — standing for Attributable, Legible, Contemporaneous, Original, and Accurate — used by regulators including MHRA and FDA to evaluate whether clinical trial records can be trusted. Each principle sets a minimum standard: data must be traceable to the person who recorded it, readable, captured at the time of the activity, unaltered from its first recording, and free from errors. ALCOA compliance is a core requirement under GCP, 21 CFR Part 11, and EU/UK Annex 11 for any electronic system used to capture or store trial data.

ALCOA-C extends the ALCOA data-integrity framework by adding a sixth principle — Complete — meaning that no data should be missing and all results, including out-of-range values, must be retained. Regulatory bodies such as MHRA increasingly expect ALCOA-C compliance in inspections of electronic systems used in clinical research. The "Complete" criterion is particularly significant for audit trails, where deletions or gaps can indicate data manipulation.

A formal modification to an approved clinical trial protocol, informed consent form, or regulatory submission that must be submitted to and, where required, approved by the relevant competent authority and/or ethics committee before implementation. In the UK, substantial protocol amendments require MHRA and REC approval under the UK Clinical Trials Regulations; in the EU, substantial modifications are managed via CTIS under Regulation 536/2014.

Anonymisation is the process of irreversibly removing or altering identifying information so that an individual can no longer be identified, directly or indirectly. Under UK GDPR, truly anonymised data falls outside the definition of personal data and is therefore not subject to data-protection obligations. In clinical research, anonymisation is used when sharing datasets for secondary analysis or publication, and must be distinguished from pseudonymisation, which is reversible.

An API (Application Programming Interface) is a defined set of rules and protocols that allows one software system to request data or trigger actions in another. In clinical trials, APIs enable different eClinical systems — such as EDC, CTMS, safety databases, and site compliance platforms — to exchange data automatically rather than relying on manual export and re-entry.

Archiving is the process of transferring trial documents to a secure, controlled storage location at the end of a trial and retaining them for the regulatory-required period (typically 15 or 25 years depending on jurisdiction). ICH E6(R3) requires that essential documents are archived in a way that allows their retrieval and that their integrity is maintained throughout the retention period. Access must be restricted, documented, and auditable.

An arm is one of the groups into which trial participants are assigned to receive a particular intervention (or no intervention in the case of a control arm). A trial may have two or more arms, and the comparison between arms forms the basis of the study's primary analysis.

An audit is a systematic and independent examination of trial-related activities and documents to determine whether the evaluated trial-related activities were conducted, and data were recorded, analysed, and accurately reported according to the protocol, sponsor's SOPs, GCP, and applicable regulatory requirements (ICH E6(R3)). Audits may be conducted by the sponsor or a delegated third party and are distinct from regulatory inspections, which are carried out by competent authorities.

An audit trail is a secure, time-stamped, and user-attributed record of all actions taken on data or documents within a computerised system, including creation, modification, deletion, and access. Regulators such as MHRA, FDA, and EMA require audit trails under GCP, 21 CFR Part 11, and EU/UK Annex 11 to detect and investigate data-integrity issues; the trail must be retained for the full document-retention period and must not be modifiable by users.

Audit trail review is the systematic examination of electronic audit trail records to verify that data entries, modifications, and deletions in a computerised system are attributable, contemporaneous, and accurate (ALCOA principles). Under ICH E6(R3) and EU Annex 11, sponsors must ensure audit trails are enabled and periodically reviewed as part of data integrity oversight.

Baseline refers to the measurements or assessments taken from a participant before any study intervention is administered, which serve as the reference point against which subsequent measurements are compared. Accurate baseline data are essential for evaluating the effect of the investigational product and are a required element of the protocol under ICH E6(R3).

A Bayesian adaptive design is a type of adaptive trial design that uses Bayesian statistical methods to update the probability of hypotheses as data accumulate, allowing formal incorporation of prior knowledge and interim results into decision-making. These designs require pre-specification of priors, decision rules, and operating characteristics to satisfy GCP and regulatory requirements.

A benefit-risk assessment is a structured evaluation of the anticipated therapeutic benefits of an investigational product weighed against the known or potential risks to participants. It is a continuous obligation throughout a clinical trial and is a central consideration for ethics committees, competent authorities, and sponsors under ICH E6(R3) and EU CTR 536/2014.

Bioavailability is the fraction of an administered dose of an active substance that reaches the systemic circulation in an unchanged form, and the rate at which this occurs. It is a key pharmacokinetic parameter that determines appropriate dosing and is typically assessed in Phase I and bioequivalence studies.

Bioequivalence is demonstrated when two formulations of the same active substance show comparable bioavailability — that is, their rate and extent of absorption do not differ to a clinically meaningful degree under the same conditions. Regulatory agencies (including MHRA and EMA) use bioequivalence studies as the basis for approving generic medicines without requiring full clinical efficacy trials.

A biomarker is a defined characteristic that is measured as an indicator of normal biological processes, pathogenic processes, or responses to an exposure or intervention. Biomarkers may serve as primary or secondary endpoints, as patient selection criteria, or as safety monitoring tools, and their use must be validated and pre-specified in the protocol.

Biostatistics is the application of statistical methods to the design, analysis, and interpretation of biological and clinical research. In clinical trials, biostatistical input is required at the protocol stage to determine sample size, define endpoints, specify analysis populations, and produce the statistical analysis plan (SAP) in accordance with ICH E9 and ICH E9(R1).

Blinding (also called masking) is the process of withholding knowledge of treatment allocation from one or more parties — participants, investigators, or assessors — in order to reduce the risk of bias in a trial. Double-blind designs, in which neither the participant nor the investigator knows the treatment assignment, are generally considered the most rigorous for minimising performance and detection bias.

Breach notification is the legal obligation under UK GDPR to report a personal data breach to the Information Commissioner's Office (ICO) within 72 hours of becoming aware of it, where the breach is likely to result in a risk to individuals' rights and freedoms. If the breach poses a high risk to individuals, those individuals must also be notified without undue delay. Clinical trial sponsors and sites that act as data controllers must have documented breach-notification procedures.

Business continuity refers to the plans, processes, and systems an organisation maintains to ensure critical operations can continue — or be rapidly restored — following a disruptive event such as a cyberattack, power outage, or natural disaster. For clinical trial software, business continuity planning typically encompasses disaster recovery, backup schedules, recovery time objectives (RTOs), and recovery point objectives (RPOs), and is assessed as part of vendor qualification and computerised system validation.

A corrective and preventive action (CAPA) is a formal quality-management process used to investigate the root cause of a non-conformance, implement corrective measures to address the immediate problem, and introduce preventive measures to reduce the likelihood of recurrence. CAPA is a core element of ICH Q10 pharmaceutical quality systems and is expected by regulators at inspection as evidence that quality issues are systematically managed.

A case report form (CRF) is a paper or electronic record designed to capture data for each trial participant as specified in the protocol. CRFs are essential documents under ICH E6(R3) and must accurately reflect source data; any discrepancies must be documented and resolved through a query management process.

CDASH (Clinical Data Acquisition Standards Harmonisation) is a CDISC standard that specifies how data should be collected at the point of capture — typically on case report forms — to facilitate direct mapping into SDTM for regulatory submission. By standardising field names, formats, and question wording at collection, CDASH reduces the transformation work needed before data can be submitted to regulators.

CDISC (Clinical Data Interchange Standards Consortium) is an international non-profit organisation that develops and maintains open data standards for clinical research, including SDTM, ADaM, CDASH, and Define-XML. CDISC standards are required by the FDA and EMA for electronic regulatory submissions and are widely adopted across industry and academia to improve data quality, reuse, and comparability.

A CDMS (Clinical Data Management System) is software used to collect, clean, validate, and manage clinical trial data from collection through to database lock. Historically overlapping with EDC, the term CDMS is sometimes used for broader data management platforms that encompass query management, discrepancy resolution, and data transfer functions in addition to data entry.

Central monitoring is a remote, centralised evaluation of accumulating data from one or more sites performed by the sponsor (or its delegate) using statistical and risk-based techniques to identify data anomalies, protocol deviations, and safety signals that may not be detectable through on-site visits alone. ICH E6(R3) explicitly endorses centralised monitoring as a component of risk-based monitoring (RBM), allowing appropriate reduction of routine on-site visits when the approach is documented and justified.

A certified copy is a verified, exact reproduction of an original document — whether paper or electronic — that has been confirmed to be complete and accurate by a person authorised to do so. Under ICH E6(R3) and the DIA TMF Reference Model, certified copies carry the same regulatory standing as originals and must capture all information, including any annotations. The certification process itself must be documented and traceable.

Change control is a formal procedure for requesting, reviewing, approving, implementing, and documenting changes to validated systems, SOPs, processes, or trial documents, ensuring that changes do not inadvertently introduce errors or non-compliance. In GCP and GMP contexts, all significant changes to controlled items must pass through a documented change-control process before implementation.

Change management in a clinical-trial quality context refers to the organisational and procedural framework for planning, communicating, implementing, and reviewing changes to processes, systems, or organisational structures in a controlled manner that preserves compliance and data integrity. It encompasses both the formal change-control record and the broader communication and training activities needed to embed the change.

In UK clinical research, the Chief Investigator is the individual — usually a senior clinician or scientist — who takes overall responsibility for the design, conduct, and reporting of a multi-centre trial on behalf of the sponsor. The role is defined under the Medicines for Human Use (Clinical Trials) Regulations 2004 and is distinct from the Principal Investigator, who leads at an individual site. The CI is the named lead in IRAS applications and holds accountability to the HRA and ethics committee.

Clinical data management (CDM) is the discipline covering the collection, integration, validation, and preparation of clinical trial data for statistical analysis. Key activities include designing case report forms, managing data queries, performing medical coding, reconciling safety data, and locking the database ahead of analysis. CDM teams typically work closely with biostatistics and operations to ensure data are complete, accurate, and submission-ready.

An order issued by the US FDA to delay a proposed clinical investigation or to suspend an ongoing investigation where the agency has identified safety concerns or significant deficiencies in the clinical trial application. During a clinical hold, no new subjects may be enrolled and, in some cases, existing subjects may need to be taken off the investigational product.

A clinical outcome assessment (COA) is any measure used to assess how a patient feels, functions, or survives, and may be reported by clinicians, patients, caregivers, or derived from performance tests. COAs encompass patient-reported outcomes (PROs), clinician-reported outcomes (ClinROs), observer-reported outcomes (ObsROs), and performance outcomes (PerfOs). Regulators increasingly require robust COA strategies in trial protocols to demonstrate meaningful benefit to patients.

Clinical quality assurance (clinical QA) is the set of planned and systematic activities embedded in the quality system designed to provide confidence that the clinical trial is being conducted and data are being generated in compliance with GCP, the protocol, and applicable regulatory requirements. Clinical QA is distinct from quality control (QC), which involves the operational checks performed within a process, and includes oversight functions such as audit programmes, SOP management, and training systems.

A Clinical Research Associate (CRA) is a professional employed by or on behalf of the sponsor to perform site monitoring activities, verifying that the trial is conducted in accordance with the protocol, GCP (ICH E6(R3)), and applicable regulations. CRAs conduct site initiation, on-site and remote monitoring visits, and source data verification, and are responsible for reporting site findings to the sponsor. The role is sometimes called a clinical monitor.

A Clinical Research Coordinator (CRC) is a site-level staff member who supports the Principal Investigator in the day-to-day conduct of a clinical trial, including participant scheduling, consent procedures, data entry, and regulatory documentation. CRCs do not make clinical judgements but must have documented training and delegated duties recorded in the delegation log. The role may also be referred to as a research nurse or trial coordinator.

A Clinical Research Organisation (CRO) is a company or other legal entity to which a sponsor has transferred, by written contract, some or all of its trial-related duties and functions (ICH E6(R3) 1.20). The sponsor retains ultimate responsibility for quality and integrity of the trial data. CROs may conduct monitoring, data management, regulatory submissions, or full trial management on behalf of the sponsor.

Clinical study design encompasses the methodological choices made when planning a trial — including the choice of control, blinding, randomisation, endpoints, sample size, and analysis approach — to ensure the study can answer its research question with adequate validity and efficiency. Sound design is guided by ICH E8(R1), which emphasises a quality-by-design philosophy from the outset. See also trial design.

A clinical study report (CSR) is a comprehensive technical document that integrates the pre-clinical and clinical data, statistical analyses, and conclusions of a completed trial, prepared in accordance with ICH E3. The CSR is a key submission document to regulatory authorities and must be consistent with the protocol, SAP, and the trial's essential documents.

A clinical trial is any investigation in human participants intended to discover or verify the clinical, pharmacological, or other pharmacodynamic effects of an investigational product, identify adverse reactions, or study absorption, distribution, metabolism, and excretion, with the aim of ascertaining safety or efficacy. The definition is formalised in EU CTR 536/2014 and ICH E6(R3), and determines the full scope of GCP obligations.

A legally binding contract between a trial sponsor (or their representative, such as a CRO) and a trial site or institution, setting out the terms under which the clinical trial will be conducted, including responsibilities, indemnity, financial arrangements, and intellectual property provisions. In the UK, NHS sites typically use a model Clinical Trial Agreement developed by the Association of the British Pharmaceutical Industry (ABPI) and NHS.

The regulatory approval granted by a competent authority permitting a clinical trial to begin. In the UK, a CTA is issued by the MHRA following review of the Clinical Trial Authorisation application; in the EU, the equivalent approval is granted through CTIS under Regulation 536/2014. Not to be confused with the acronym CTA when used to mean Clinical Trial Agreement in some contexts.

The EU-wide portal and database introduced under EU Clinical Trials Regulation 536/2014, through which sponsors submit and manage clinical trial applications, amendments, and results across EU/EEA member states. CTIS became mandatory for new trial applications in January 2023, replacing the previous EudraCT system for EU submissions.

Cloud security encompasses the policies, technologies, and controls used to protect data, applications, and infrastructure hosted on cloud platforms. In the context of clinical trials, cloud security considerations include data residency, encryption in transit and at rest, access controls, shared-responsibility models between the cloud provider and the software vendor, and compliance with frameworks such as NHS DSPT, Cyber Essentials, and G-Cloud procurement requirements.

The codification of permanent rules and regulations published by US federal government departments and agencies. For clinical research, the most relevant titles are Title 21 (Food and Drugs), which includes FDA regulations on INDs, informed consent, IRBs, and electronic records, and Title 45 (Public Welfare), which covers the Common Rule on human subjects protection.

A cohort is a group of participants sharing a defined characteristic or exposure who are followed over time. In clinical trials, a cohort may refer to a subgroup within the study population (for example, a specific dose cohort in a Phase I study); in epidemiology, cohort studies observe participants without intervention to assess the natural history of a condition.

A co-investigator is a qualified member of the site trial team who works alongside the Principal Investigator, sharing responsibility for the conduct of the trial at a given site. The role is not uniformly defined across all regulatory frameworks but is commonly documented in the delegation log and referenced in the site ethics application. Co-investigators must have appropriate training and GCP certification in place before undertaking delegated activities.

A mechanism that allows patients with serious or life-threatening conditions to access an unauthorised investigational medicinal product outside of a clinical trial when no satisfactory authorised treatment is available. In the EU, compassionate use is governed by Article 83 of Regulation (EC) No 726/2004; in the UK, the equivalent mechanism is known as the Early Access to Medicines Scheme (EAMS), overseen by the MHRA.

The national regulatory body responsible for authorising and overseeing clinical trials within a given jurisdiction. In the UK, the competent authority is the MHRA; in EU member states, each country has its own competent authority (e.g. BfArM in Germany, ANSM in France), operating under the framework established by EU Regulation 536/2014. In the US, the equivalent is the FDA.

Adherence to all applicable laws, regulations, guidelines, and protocol requirements relevant to the conduct of a clinical trial. In GCP terms (ICH E6(R3)), compliance encompasses both the sponsor's and investigator's obligations to follow the approved protocol, regulatory requirements, and the principles designed to protect trial subjects.

Computerised system validation (CSV) is the documented process of demonstrating that a computerised system consistently performs as intended and meets predefined specifications, regulatory requirements, and user needs. CSV is required under EU/UK GMP Annex 11 and FDA 21 CFR Part 11 for any electronic system used to create, modify, maintain, archive, or transmit regulated data. A typical CSV lifecycle includes design qualification (DQ), installation qualification (IQ), operational qualification (OQ), and performance qualification (PQ), supported by a validation master plan and traceability matrix.

Confidentiality in clinical research refers to the obligation to protect participant and commercially sensitive information from unauthorised access or disclosure. It encompasses both the ethical duty to protect trial participants' personal data and the contractual and legal obligations between sponsors, CROs, and sites under clinical trial agreements and data-processing agreements. Confidentiality controls include role-based access, encryption, and non-disclosure provisions, and are reinforced by UK GDPR and GCP requirements.

Connected compliance describes an approach to clinical-trial oversight in which quality, regulatory, and site-management processes are managed within a single, integrated software environment rather than across separate, disconnected systems. When data and workflows share a common platform, discrepancies between modules surface earlier and audit trails remain consistent across functions. See also connected platform, the system on which connected compliance is delivered.

A connected platform in clinical trials is a software system in which multiple trial-management modules — such as site files, quality management, and delegation records — are built on a shared architecture and exchange data natively, without custom integration work. This contrasts with point solutions that each hold siloed records and require manual reconciliation. See also connected compliance, the operating principle the connected platform delivers.

Consent management in clinical research covers the processes and systems used to obtain, record, update, and withdraw participant informed consent in compliance with GCP, UK GDPR, and applicable national law. Under UK GDPR, consent must be freely given, specific, informed, and unambiguous; withdrawal must be as easy as giving it. Electronic consent management tools must maintain a complete audit trail of consent status changes.

CONSORT (Consolidated Standards of Reporting Trials) is an evidence-based, international guideline providing a minimum set of recommendations for reporting randomised controlled trials, including a flow diagram tracking participant progress through each stage. Adherence to CONSORT is required or strongly recommended by most peer-reviewed clinical journals and improves the transparency and reproducibility of trial results.

Continuing review is the periodic reassessment of an ongoing clinical trial by an ethics committee (or IRB in the US) to confirm that the risk-benefit profile remains acceptable and that the study is proceeding as approved. Under UK practice, the Research Ethics Committee receives annual progress reports for studies still in recruitment; under FDA regulations (21 CFR 56.109), IRB continuing review is required at least annually. The frequency and format differ between the EU CTR framework and US regulations.

The control group is the comparator arm in a trial that receives either a placebo, an active comparator, or standard of care, against which the effects of the investigational product are measured. An appropriate control is essential to distinguish the true effect of an intervention from natural disease progression, placebo effects, or regression to the mean.

A controlled document is any document subject to formal version control, review, approval, and access management within a quality system. Examples include SOPs, protocols, and informed consent forms. Control ensures that only the current approved version is in use and that superseded versions are retained but clearly identified as obsolete.

A corrective action is a specific measure taken to eliminate the cause of a detected non-conformance or undesirable situation in order to prevent recurrence. Within GCP quality management, corrective actions are typically generated through the CAPA process and must be documented, assigned, tracked to completion, and verified for effectiveness.

In a cross-over design, each participant receives more than one treatment in sequence, with a wash-out period between treatments to allow any effects of the preceding intervention to dissipate. Cross-over designs can be efficient because each participant serves as their own control, but they are appropriate only for stable conditions and when carry-over effects can be excluded.

A clinical trial management system (CTMS) is software used by sponsors and research sites to plan, track, and report on the operational activities of a clinical trial — including site selection and activation, patient enrolment, visit scheduling, milestone tracking, and resource management. CTMS data provides a real-time operational picture of trial progress.

Shorthand for EU Clinical Trials Regulation 536/2014 (see EU CTR 536/2014), which replaced the Clinical Trials Directive 2001/20/EC and introduced a harmonised framework for authorising, conducting, and supervising clinical trials across EU/EEA member states, centred on the CTIS portal. Not to be confused with CTA (Clinical Trial Authorisation).

Cyber Essentials is a UK government-backed certification scheme that sets a baseline of cybersecurity controls across five technical areas: firewalls, secure configuration, user access control, malware protection, and patch management. Certification is awarded by an approved assessing body and demonstrates that an organisation has implemented fundamental protections against the most common cyber threats. G-Cloud suppliers and NHS procurement frameworks often require or favour Cyber Essentials certification.

A data controller is the natural or legal person (or organisation) that determines the purposes and means of processing personal data, as defined under UK GDPR and EU GDPR. In clinical trials, the sponsor is typically the data controller for participant data, whilst sites and CROs often act as processors or joint controllers depending on the arrangement. Identifying data controllers correctly is essential for establishing accountability, drafting data-processing agreements, and notifying the ICO.

Data governance is the framework of policies, roles, standards, and processes an organisation uses to ensure that data is accurate, available, consistent, secure, and used in compliance with regulatory and business requirements throughout its lifecycle. In clinical research, data governance spans data ownership, classification, quality standards, access rights, retention schedules, and audit mechanisms, and is assessed during MHRA inspections and vendor qualification audits.

Data integrity is the assurance that data is complete, consistent, accurate, and reliable throughout its lifecycle — from collection through archiving — and has not been altered or deleted without authorisation or record. Regulatory bodies including MHRA, FDA, and EMA have issued specific data-integrity guidance requiring organisations to identify and manage risks such as unauthorised data modification, missing audit trails, and inadequate access controls. ALCOA-C is the most widely cited data-integrity standard for clinical research.

Data lock (also called database lock) is the point in a clinical trial at which the trial database is declared complete and accurate, and no further changes to clinical data are permitted. It marks the transition from data management to statistical analysis and is a formal milestone requiring sign-off from data management, clinical operations, and often the sponsor. Any post-lock corrections require a formal unblinding procedure or database unlock process.

A data management plan (DMP) is a document that describes how clinical trial data will be collected, processed, stored, transferred, and archived throughout the life of a study. It specifies responsibilities, systems, validation requirements, quality control procedures, and timelines, and is typically prepared by the data management team before study start. Regulatory guidance and good clinical data management practice (GCDMP) expect a DMP to be in place for all interventional trials.

A data processing agreement (DPA) is a legally binding contract between a data controller and a data processor, required under Article 28 of UK GDPR, that specifies the subject matter, duration, nature, and purpose of the processing, the type of personal data and categories of data subjects, and the obligations and rights of the controller. In clinical trials, DPAs are required between sponsors and any vendor — including eTMF, eISF, or CTMS providers — that processes participant or staff personal data on the sponsor's behalf.

A data processor is a natural or legal person, public authority, or organisation that processes personal data on behalf of a data controller, as defined under UK GDPR. Processors must act only on documented instructions from the controller, implement appropriate technical and organisational security measures, and support the controller's obligations regarding data subject rights and breach notification. Clinical trial software vendors, CROs, and central laboratories commonly act as data processors.

A Data Protection Impact Assessment (DPIA) is a structured process, required under Article 35 of UK GDPR, for identifying and mitigating privacy risks before undertaking processing that is likely to result in a high risk to individuals' rights and freedoms. Clinical trials that involve processing sensitive health data, large-scale profiling, or systematic use of new technologies typically require a DPIA. The output is a documented risk assessment and mitigation plan that must be reviewed by the Data Protection Officer (DPO) where one is appointed.

A Data Protection Officer (DPO) is an individual designated under UK GDPR (Articles 37–39) to advise the organisation on data-protection obligations, monitor compliance, and act as a point of contact for the ICO. Certain organisations — including public bodies and those carrying out large-scale systematic monitoring or processing of sensitive data — are required to appoint a DPO. In clinical research, pharmaceutical companies and large NHS trusts typically have a DPO who must be consulted on DPIAs and data-breach responses.

Data reconciliation is the process of comparing data held in two or more systems — for example, safety data in a pharmacovigilance database versus adverse events recorded in an EDC — to identify and resolve discrepancies. It is a routine step in clinical data management and is required before database lock to ensure consistency across all trial data sources.

Data residency refers to the physical or geographic location where data is stored and processed. Many NHS and public-sector frameworks require that health and clinical trial data be stored within the UK or EEA to comply with data-sovereignty obligations and procurement requirements. G-Cloud suppliers are expected to be transparent about data residency, and sponsors must confirm residency arrangements when conducting vendor qualification.

Data sovereignty is the principle that data is subject to the laws and governance structures of the country in which it is located or from which it originates. For UK clinical trials, data sovereignty means that participant health data must be handled in accordance with UK GDPR, the Data Protection Act 2018, and, where NHS data is involved, NHS data standards — regardless of where a sponsor's head office is based. It is closely related to data residency and shapes decisions about cloud hosting, international data transfers, and vendor selection.

Data subject rights are the rights granted to individuals under UK GDPR, including the right to access their personal data, the right to rectification, the right to erasure (subject to legal exceptions), the right to restrict processing, the right to data portability, and the right to object. In clinical research, exercising these rights may conflict with the legal obligation to retain trial data for regulatory purposes — a tension that must be addressed in the participant information sheet and privacy notice, and which the data controller's DPO typically advises on.

A decentralised clinical trial (DCT) is one in which some or all of the trial activities take place away from the traditional trial site — for example, at participants' homes or via telemedicine — using digital tools and remote monitoring. DCTs can improve access and participant retention but require specific consideration of data integrity, eConsent, and local regulatory requirements as set out in EMA guidance and the updated ICH E6(R3).

Define-XML is a CDISC standard that provides machine-readable metadata describing the contents, structure, and derivations of SDTM and ADaM submission datasets. Submitted alongside the datasets themselves, Define-XML enables regulators to understand each variable's meaning and origin without reference to paper documentation. The FDA and EMA require Define-XML as part of electronic regulatory submissions.

A delegation log is a site-level document that records which trial-related tasks and responsibilities have been formally delegated by the Principal Investigator to named members of the site team. Under ICH E6(R3), sponsors are required to ensure that staff conducting trial-related duties have appropriate qualifications, and the delegation log provides the evidential record. Each entry typically captures the team member's name, role, signature, tasks delegated, and the dates of delegation.

Delegation of authority (DoA) is the formal process by which a Principal Investigator assigns specific trial tasks to suitably qualified and trained members of the site team. ICH E6(R3) requires that delegated staff are qualified by education, training, and experience, and that delegations are documented in writing. The DoA record is an essential document held in the Investigator Site File and is reviewed by monitors and inspectors as evidence of appropriate oversight.

Design qualification (DQ) is the first stage of the computerised system validation (CSV) lifecycle, in which documented evidence is generated that the proposed system design meets the user requirements specification (URS) and applicable regulatory requirements before the system is built or procured. DQ verifies that the selected solution is fit for purpose and forms the traceability baseline for subsequent qualification activities (IQ, OQ, PQ). It is required under EU/UK GMP Annex 11 and is referenced in CSV guidance from GAMP 5.

The Development Safety Update Report (DSUR) is a periodic pharmacovigilance document that sponsors submit to regulatory authorities (typically annually) to provide a comprehensive review of safety data collected during the reporting period for an investigational medicinal product under clinical development. The DSUR format and content are defined in ICH E2F and replace the former Annual Safety Report (ASR).

Deviation management is the systematic process of identifying, recording, classifying, investigating, and resolving departures from the approved protocol, SOPs, or regulatory requirements. ICH E6(R3) requires sponsors to have documented procedures for managing protocol deviations; important deviations must be reported to the ethics committee and, where relevant, to the competent authority. Deviations are classified by potential impact on participant safety, data integrity, or rights.

The DIA TMF Reference Model is an industry-standard framework, maintained by the Drug Information Association, that defines a hierarchical structure for organising the Trial Master File — grouping essential documents into zones, sections, and artefacts. It provides a common taxonomy that sponsors, CROs, and sites use to structure both paper and electronic TMFs, making inspection readiness and completeness assessment consistent across organisations.

A delegation of authority (DoA) log records which study tasks each member of a site's investigator team is authorised to perform, and captures their training status and signatures. A digital DoA tool manages this log electronically, replacing paper forms with version-controlled, signature-tracked records that remain inspection-ready throughout the trial.

Disaster recovery (DR) refers to the documented plans, systems, and procedures that enable an organisation — or its software vendor — to restore IT systems and data following a catastrophic failure, cyberattack, or other major disruptive event. Key DR metrics include the recovery time objective (RTO, the maximum acceptable system downtime) and recovery point objective (RPO, the maximum acceptable data loss). For GxP-regulated systems, disaster recovery must be validated and tested periodically, with results documented.

Document control encompasses the procedures and systems used to manage the creation, review, approval, distribution, version tracking, and retirement of regulated documents throughout their lifecycle. Effective document control ensures that trial teams work from the correct, authorised version of any document and that a complete history of changes is retained for inspection purposes.

A document management system (DMS) is a software platform used to store, organise, track, and retrieve documents in a structured, controlled manner. In a clinical trial context, a validated DMS underpins the eTMF and supports document control, version management, certified-copy handling, and audit trail maintenance in accordance with GCP and regulatory requirements such as ICH E6(R3) and EU Annex 11.

Dose escalation is the systematic, stepwise increase of the dose administered to participants in a clinical trial, typically in Phase I or first-in-human studies, with the aim of characterising the safety and tolerability profile and identifying the maximum tolerated dose (MTD). Escalation rules must be pre-specified in the protocol and reviewed by an independent safety monitoring committee.

A double-blind trial is one in which neither the participant nor the investigator (or outcome assessor) is aware of the treatment allocation. Double-blinding is the standard approach for randomised controlled trials where it is operationally feasible, as it minimises both performance bias and detection bias.

Drug accountability is the documented tracking of investigational medicinal product (IMP) from receipt at site through dispensing to subjects and final reconciliation or destruction. Under GCP (ICH E6(R3)) sponsors and sites must maintain contemporaneous records that account for every unit of IMP, supporting both subject safety and regulatory inspection readiness. Records must be ALCOA-compliant: attributable, legible, contemporaneous, original, and accurate.

E2B(R3) is the current ICH standard for the electronic transmission of Individual Case Safety Reports (ICSRs) to regulatory authorities and between pharmacovigilance partners. It defines the data elements, structure, and format (based on HL7 v3 messaging) required for expedited and periodic ICSR submissions, replacing the earlier E2B(R2) format. Regulatory authorities including the EMA and MHRA accept or require E2B(R3)-formatted reports via their safety reporting portals.

eClinical is a broad term for the suite of electronic systems and technologies used to plan, conduct, manage, and report clinical trials. It encompasses platforms such as EDC, eISF/eTMF, CTMS, IRT/RTSM, eConsent, ePRO, and safety systems, along with the data standards (CDISC, HL7/FHIR) that enable these systems to interoperate. The shift from paper-based to eClinical processes has been driven by regulatory expectations, data quality requirements, and the operational demands of decentralised trials.

eCOA (Electronic Clinical Outcome Assessment) refers to the electronic collection of clinical outcome assessments — including patient-reported outcomes, clinician assessments, and observer reports — using devices such as smartphones, tablets, or web portals. Electronic collection improves data completeness, reduces transcription error, and enables real-time monitoring of patient-reported data compared with paper-based collection.

eConsent (Electronic Informed Consent) is the use of electronic systems to present informed consent information to prospective trial participants and to capture their consent digitally. eConsent platforms may include multimedia explanations, comprehension checks, and remote or wet-ink-equivalent electronic signature capture, and are particularly valuable in decentralised and multi-site trials to ensure consistent consent delivery.

An eCRF (Electronic Case Report Form) is the electronic equivalent of a paper case report form — the structured data collection instrument used to record each data point required by a clinical trial protocol for each participant. eCRFs are typically presented within an EDC system and include built-in validation rules, audit trails, and query workflows to improve data quality at the point of entry.

EDC (Electronic Data Capture) is a software system used to collect, manage, and validate clinical trial data electronically, replacing paper case report forms. EDC systems present eCRFs to site staff, enforce validation rules, generate data queries, and maintain audit trails of all data entries and changes. They are the primary system of record for clinical efficacy and safety data in most interventional trials.

An investigator site file (ISF) is the collection of documents a research site must maintain throughout a clinical trial to demonstrate that the study was conducted in accordance with GCP and the applicable protocol. An electronic ISF (eISF) manages these documents digitally, with version control, access permissions, and an audit trail in place of a physical binder.

An electronic health record (EHR) is a longitudinal digital record of a patient's health information managed by a healthcare provider, covering diagnoses, medications, test results, imaging, and clinical notes. In clinical trials, EHRs are often the primary source documents from which trial data are transcribed or — increasingly via eSource approaches — directly extracted into EDC systems.

An electronic medical record (EMR) is a digital record of a patient's clinical encounters within a single healthcare organisation, used interchangeably with EHR in many contexts but sometimes distinguished as more narrowly scoped to a single practice or department. In clinical research, EMRs serve as source documents and, where permitted by data governance arrangements, may be integrated with trial data systems to reduce duplicate data entry.

An electronic signature is a digital representation of a person's approval or attestation, which in a regulated trial context must comply with 21 CFR Part 11 (for FDA submissions) or EU/UK Annex 11 (for EMA submissions). A compliant electronic signature requires a unique user identity link (typically username and password or biometric), an indication of the meaning of the signature, and the date and time of signing — all captured in an unalterable audit trail. Electronic signatures must not be confused with simple "typed name" fields that lack these controls.

The EU regulatory agency responsible for the scientific evaluation, supervision, and safety monitoring of medicines for human and veterinary use across the European Union. The EMA coordinates clinical trial oversight within the EU framework established by Regulation 536/2014 and issues guidelines on clinical development through its scientific committees, including the CHMP.

Encryption is the process of transforming data into an unreadable format using a cryptographic algorithm, so that only authorised parties holding the correct decryption key can access the plaintext. In clinical research systems, encryption is applied both in transit (using protocols such as TLS 1.2 or higher) and at rest (using standards such as AES-256) to protect participant personal data and commercially sensitive trial information from interception or unauthorised access. Encryption at rest and in transit is expected under NHS DSPT, Cyber Essentials Plus, and ISO 27001, and is a common vendor-qualification criterion.

End of study (EOS) refers to the date of the last visit or last data collection point for the last participant in a trial, as defined in the protocol. It is a regulatory milestone under EU CTR 536/2014 that triggers reporting obligations, including submission of the end-of-study notification to the competent authority and ethics committee.

An endpoint is a pre-specified outcome variable used to evaluate the effect of an intervention in a clinical trial. Endpoints may be clinical (e.g., survival, hospitalisation), biomarker-based, or patient-reported, and must be clearly defined and measurable. The choice and hierarchy of endpoints (primary, secondary, exploratory) are central to the protocol and statistical analysis plan.

Enrolment is the process by which eligible participants are recruited into a clinical trial, having provided informed consent and met all inclusion and exclusion criteria. Enrolment rate is a key operational metric; slow enrolment is one of the most common causes of trial delay.

ePRO (Electronic Patient-Reported Outcome) refers to patient-reported outcome data collected electronically — typically via smartphone app, tablet, or web portal — rather than on paper. ePRO systems improve compliance, reduce missing data, enable real-time alerts for concerning responses, and are increasingly required by regulators as part of COA strategies in trials measuring patient experience or symptoms as primary or key secondary endpoints.

The ePSF (electronic Pharmacy Site File) is the controlled electronic file held by the site pharmacy for a clinical trial. It covers investigational medicinal product (IMP) receipt, storage and temperature monitoring, dispensing and accountability records, and returns and destruction documentation, alongside the pharmacy-held protocol and delegation records. It is the pharmacy counterpart to the Investigator Site File and must be kept inspection-ready and retained under ICH-GCP.

eSource refers to source data that are captured electronically at the point of origin — for example, direct entry into an EDC system at the time of a clinic visit — rather than recorded first on paper and then transcribed. ICH E6(R3) permits eSource provided the system meets GCP requirements for data integrity, traceability, and audit trail, and provided that certified copies can be produced for verification.

Essential documents are those that, individually and collectively, allow evaluation of the conduct of a trial and the quality of the data produced. ICH E6(R3) provides a reference list of essential documents to be held by the sponsor (in the TMF) and by the investigator (in the ISF), covering the periods before, during, and after a trial. Regulators expect essential documents to be complete, legible, and contemporaneous.

Ethics approval is the favourable opinion granted by an independent ethics committee — in the UK, a Research Ethics Committee (REC) — confirming that a clinical trial's design, consent process, and risk-benefit balance adequately protect the rights, safety, and wellbeing of participants. A favourable ethics opinion must be obtained before the trial may begin, alongside clinical trial authorisation from the competent authority (the MHRA in the UK), and is maintained through continuing review for the duration of the study.

An ethics committee is an independent body constituted to protect the rights, safety, and wellbeing of trial participants by reviewing and approving research protocols before the study begins and throughout its conduct. In the UK, the relevant body is the Research Ethics Committee (REC); in the US, the equivalent is the Institutional Review Board (IRB); the EU CTR uses the term ethics committee. Committees assess the scientific validity, risk-benefit ratio, and adequacy of consent procedures.

An eTMF is the electronic system used to create, collect, manage, and archive the Trial Master File — the complete set of essential documents for a clinical trial. An eTMF must be validated, maintain an audit trail, support certified copies and electronic signatures, and meet the requirements of ICH E6(R3), the DIA TMF Reference Model, and applicable regulations such as EU Annex 11 or 21 CFR Part 11.

Annex 11 to the EU Good Manufacturing Practice (GMP) guidelines, entitled "Computerised Systems", which sets out requirements for the validation and lifecycle management of computerised systems used in GMP-regulated activities. Although primarily a GMP document, its principles — including validation, audit trails, data integrity, and backup — are widely applied to clinical trial software by analogy and are referenced in EU GCP guidance. The UK MHRA's equivalent is MHRA GxP Data Integrity Guidance and Annex 11 as retained in post-Brexit UK regulations.

EU Regulation No 536/2014 of the European Parliament and of the Council on clinical trials on medicinal products for human use, which sets the legal framework for clinical trial authorisation, conduct, safety reporting, and transparency across the EU/EEA. It introduced the Clinical Trials Information System (CTIS) as the single submission and management portal and became fully applicable from January 2022. The UK retained this regulation's principles in its own clinical trials legislative framework following Brexit, subject to MHRA oversight.

The European Union Drug Regulating Authorities Clinical Trials database, which was the EU's clinical trial registration and information system prior to the introduction of CTIS under Regulation 536/2014. EudraCT assigned unique trial identification numbers and held information on all clinical trials authorised in the EU; new trial applications migrated to CTIS from January 2022, though EudraCT numbers assigned previously remain valid identifiers.

A unique identifier assigned to a clinical trial registered in the EudraCT database, in the format YYYY-NNNNNN-CC. EudraCT numbers were issued for all clinical trials authorised in EU/EEA member states prior to migration to CTIS; trials with pre-existing EudraCT numbers continue to use them as reference identifiers throughout their lifecycle, including for SUSAR reporting and annual safety reporting.

Exclusion criteria are the characteristics that disqualify a potential participant from entering a trial, even if the inclusion criteria are met. They are designed to protect participant safety, reduce confounding, and ensure the study population is appropriate for the research question; they must be pre-specified in the protocol and approved by the ethics committee.

An external audit is an audit conducted by an independent party outside the organisation being audited — for example, a sponsor auditing a CRO, a site, or a vendor, or a third-party QA firm auditing the sponsor itself. External audits provide objective assurance that contracted parties are conducting trial activities in accordance with GCP, applicable regulations, and contracted requirements.

The US federal agency within the Department of Health and Human Services responsible for regulating drugs, biologics, medical devices, food, and other products for safety and efficacy. For clinical trials, the FDA oversees INDs, clinical holds, investigator oversight, and the review of marketing applications; its regulations relevant to trials are codified primarily in Title 21 of the Code of Federal Regulations.

A feasibility assessment is a systematic evaluation of a site's capability and suitability to conduct a proposed clinical trial, covering factors such as patient population, investigator experience, staff capacity, infrastructure, and regulatory compliance history. Sponsors or CROs conduct feasibility assessments prior to site selection and initiation. The outputs inform the site selection decision and are typically retained as essential documents in the Trial Master File.

FHIR (Fast Healthcare Interoperability Resources) is an HL7 standard for exchanging healthcare information electronically, using modern web technologies such as REST APIs and JSON or XML data formats. FHIR is increasingly adopted in clinical research to enable EHR systems, trial platforms, and regulatory databases to share structured patient and trial data without bespoke point-to-point integrations.

A firewall is a network-security device or software that monitors and controls incoming and outgoing network traffic based on predefined security rules, forming a barrier between trusted internal networks and untrusted external networks. Firewalls are one of the five mandatory controls under the UK government's Cyber Essentials scheme and are a foundational component of any cloud-hosted clinical trial system's security architecture.

First patient first visit (FPFV) is a milestone marking the date on which the first participant in a trial attends their initial study visit and, in most definitions, provides informed consent or begins study procedures. It is a key project management milestone tracked against the planned timeline.

A first-in-human study is the clinical trial in which an investigational product is administered to human participants for the first time, usually in healthy volunteers or, where appropriate, patients. These studies focus on safety, tolerability, pharmacokinetics, and pharmacodynamics, and require stringent oversight given the absence of prior human data.

Follow-up is the period after the primary intervention during which participants continue to be observed and assessed for outcomes, adverse events, and long-term effects. The duration and frequency of follow-up are defined in the protocol and are selected to capture the clinically relevant time window for the endpoints of interest.

A follow-up visit is a scheduled contact — in person or remote — between the participant and the study team after the primary intervention, used to collect outcome data, assess safety, and support participant retention. Visit schedules and acceptable windows are pre-specified in the protocol.

G-Cloud is the UK government's digital marketplace framework through which pre-approved cloud software, platform, and infrastructure services can be purchased by public-sector bodies — including NHS trusts and government research funders — without the need for a full OJEU or Find a Tender procurement exercise. Suppliers must meet specific security, data-handling, and contractual standards to be listed; inclusion on G-Cloud is therefore a meaningful indicator of government-procurement readiness.

An international ethical and scientific quality standard for the design, conduct, recording, and reporting of clinical trials that involve human subjects, as defined in the ICH E6 guideline. GCP ensures that the rights, safety, and wellbeing of trial subjects are protected, and that clinical trial data are credible. Compliance with GCP is required by regulatory authorities including MHRA, EMA, and FDA as a condition of marketing authorisation applications.

The General Data Protection Regulation (GDPR) is the EU regulation (2016/679) that governs the collection, processing, storage, and transfer of personal data of individuals within the European Economic Area. GDPR introduced strengthened rights for data subjects, mandatory data-breach notification, requirements for DPIAs for high-risk processing, and significant enforcement powers for supervisory authorities. For UK-based organisations, GDPR was retained and adapted as UK GDPR following the UK's departure from the EU; both regimes share the same core principles and obligations.

A quality system concerned with the organisational processes and conditions under which non-clinical (preclinical) health and environmental safety studies are planned, performed, monitored, recorded, archived, and reported, as defined by the OECD GLP Principles. GLP applies to preclinical safety studies submitted to regulatory authorities and is distinct from GCP, which applies to clinical trials in human subjects.

The system of quality assurance ensuring that medicinal products are consistently produced and controlled to the quality standards appropriate for their intended use and required by the marketing authorisation, clinical trial authorisation, or product specification. In the EU and UK, GMP is governed by EU GMP guidelines (incorporated into UK law post-Brexit) and supplementary Annexes; in the US, by 21 CFR Parts 210 and 211.

A framework for efficient, transparent, and consistent regulatory processes applied by regulatory authorities, particularly in the context of medicines regulation and clinical trial oversight. GRP encompasses procedural standards for regulatory decision-making, stakeholder engagement, and the management of regulatory submissions, and is promoted by ICH and international regulatory coalitions such as ICMRA.

Good Pharmacovigilance Practice (GPhP) refers broadly to the scientific and quality standards for performing pharmacovigilance activities, ensuring the quality of safety data and the systematic monitoring of benefit-risk profiles. The term is often used generically; in the EU, pharmacovigilance practice for authorised medicines is governed by the EMA's Good Pharmacovigilance Practices (GVP) modules, while ICH guidelines (E2A–E2F) govern the underlying scientific standards. See also GVP, the EU's codified Good Pharmacovigilance Practices.

Good Pharmacovigilance Practices (GVP) are a set of measures drawn up to facilitate the performance of pharmacovigilance in the European Union, established under Directive 2001/83/EC and Regulation (EC) No 726/2004. The EMA publishes GVP modules covering topics such as ICSR management, signal detection, periodic safety update reports, risk management plans, and post-authorisation safety studies; they apply to marketing authorisation holders and, where relevant, to sponsors of clinical trials operating within the EU. See also GPhP, used generically for good pharmacovigilance practice.

An umbrella term for the collection of "Good Practice" regulations and guidelines applicable to life sciences organisations, including GCP (clinical trials), GMP (manufacturing), GLP (laboratory), GDP (distribution), and GVP (pharmacovigilance). The "x" represents the variable practice area. Computerised systems used in regulated activities must typically be validated and maintained in compliance with the relevant GxP requirements for their context of use.

The UK body responsible for protecting and promoting the interests of patients and the public in health and social care research. The HRA oversees the Research Ethics Service (including the RECs), co-ordinates study-wide approval in England via the HRA Approval process, and works with MHRA on the combined review process under the UK Clinical Trials Regulations.

The systematic evaluation of the properties, effects, and/or impact of a health technology (such as a medicinal product, device, or procedure), comparing it with relevant alternatives to inform policy and reimbursement decisions. In the UK, the National Institute for Health and Care Excellence (NICE) conducts HTA; across the EU, the EU HTA Regulation 2021/2282 establishes joint clinical assessments coordinated by the EMA from 2025.

A healthy volunteer is a participant in a clinical trial who does not have the disease or condition under investigation and is enrolled primarily to generate safety and pharmacokinetic data, typically in Phase I studies. Their recruitment and protection are subject to GCP requirements, and the benefit-risk assessment must reflect the absence of direct therapeutic benefit.

HL7 (Health Level Seven) is an international standards development organisation that produces healthcare data exchange standards, most notably HL7 v2, HL7 v3, and the modern FHIR standard. HL7 standards define how clinical and administrative data are structured and transmitted between healthcare systems, and underpin the interoperability architecture of most hospital information systems and, increasingly, clinical trial platforms.

In a clinical trial, the hypothesis is a formal, pre-specified statement about the expected relationship between the intervention and the outcome, expressed in a form that can be statistically tested. The primary hypothesis, along with the chosen significance level and power, determines the sample size and the structure of the primary analysis.

An international body that brings together regulatory authorities from the EU, US, and Japan, together with pharmaceutical industry associations, to develop harmonised guidelines for the registration of medicines for human use. ICH guidelines, including E6(R3) on GCP and E8(R1) on general considerations for clinical studies, are adopted by regulatory authorities worldwide and form the scientific and procedural basis for clinical trial conduct.

The current revision of the ICH Guideline for Good Clinical Practice (GCP), finalised in 2023. E6(R3) introduced a principles-based and risk-proportionate approach to GCP, emphasising quality by design, risk-based monitoring, data integrity, and the use of technology in clinical trials. It supersedes E6(R2) and has been adopted by MHRA, EMA, and FDA as the applicable GCP standard.

The ICH Guideline on General Considerations for Clinical Studies, revised in 2021 to emphasise quality by design (QbD) in clinical trial planning. E8(R1) encourages early identification of the factors critical to trial quality and the use of a risk-based approach to design and oversight, and serves as the foundational companion to ICH E6(R3) in the current GCP framework.

Incident management is the process of identifying, recording, classifying, investigating, and resolving security or operational incidents — including potential or actual personal data breaches — in a controlled and documented manner. In a clinical trial context, robust incident management is required to meet the 72-hour breach-notification obligation under UK GDPR, to satisfy NHS DSPT requirements, and to demonstrate to inspectors that adverse events within regulated IT systems are handled according to documented procedures.

Inclusion criteria are the characteristics that a potential participant must possess to be eligible to enrol in a trial. Together with exclusion criteria, they define the study population; they must be clinically justified, clearly described in the protocol, and applied consistently across sites.

A contractual commitment by a sponsor (or their insurer) to cover costs arising from harm to trial participants attributable to trial participation, and to indemnify investigators and their institutions against liabilities arising from the sponsor's negligence. In the UK, NHS indemnity arrangements for commercial trials are set out in guidance from NHS Resolution and the ABPI model Clinical Trial Agreement.

An Independent Data Monitoring Committee (IDMC) — also referred to as a Data Safety Monitoring Board (DSMB) — is a group of independent experts convened by a sponsor to review accumulating safety and efficacy data during a trial and advise whether the trial should continue, be modified, or be stopped. The IDMC operates under a charter that defines its composition, meeting schedule, and decision-making rules. ICH E6(R3) and ICH E9(R1) address the IDMC's role in trial oversight.

An Independent Ethics Committee (IEC) is an independent body of medical professionals and non-medical members whose responsibility it is to ensure the protection of the rights, safety, and wellbeing of human subjects involved in a trial (ICH E6(R3) 1.27). The term is used in ICH guidelines and is broadly equivalent to the UK Research Ethics Committee (REC) or the US Institutional Review Board (IRB). All clinical trials involving medicinal products must receive a favourable IEC opinion before initiation.

An Individual Case Safety Report (ICSR) is a document that contains information relating to a single adverse event experienced by a single patient or subject. ICSRs are the fundamental unit of pharmacovigilance reporting to regulatory authorities and are transmitted in E2B(R3) format. Expedited ICSRs for suspected unexpected serious adverse reactions (SUSARs) must be submitted to the relevant competent authority within 7 days (fatal or life-threatening) or 15 days (other) of the sponsor becoming aware of the case, per ICH E2A.

The Information Commissioner's Office (ICO) is the UK's independent data-protection regulator, responsible for upholding information rights under the UK GDPR, Data Protection Act 2018, and related legislation. The ICO has powers to investigate complaints, carry out audits, issue enforcement notices, and impose fines of up to £17.5 million or 4% of global annual turnover for serious breaches. Organisations that process personal data in the UK (including clinical trial sponsors and sites) must register with the ICO and comply with its published guidance.

Informed consent is the process by which a potential participant voluntarily confirms their willingness to take part in a trial after having been informed of all aspects relevant to their decision, including the purpose, procedures, risks, benefits, and alternatives. It is a fundamental ethical and legal requirement under ICH E6(R3), EU CTR 536/2014, and the Declaration of Helsinki, and must be documented before any study-specific procedures are performed.

The informed consent form (ICF) is the written document through which a participant (or their legally authorised representative) provides their voluntary agreement to take part in a trial, after receiving and understanding the participant information sheet. The ICF must be approved by the ethics committee before use, version-controlled, and retained as an essential document.

A formal examination of clinical trial conduct, processes, records, and facilities by a regulatory authority (such as MHRA, EMA, or FDA) to verify compliance with GCP, applicable regulations, and the approved protocol. Inspections may be triggered by a marketing authorisation application, be routine, or be for cause; findings are classified by severity and must be addressed by the inspected party.

The ongoing state of preparedness of a sponsor, site, or CRO to undergo a regulatory inspection at short notice, including having complete, accessible, and accurate trial documentation, trained staff, and documented processes. MHRA and FDA both expect inspection readiness to be maintained throughout a trial, not only at close-out.

Installation qualification (IQ) is the second stage of the computerised system validation (CSV) lifecycle, in which documented evidence is generated that a system has been installed correctly in its operational environment and that all components (hardware, software, and infrastructure) are present and match the approved design. IQ follows design qualification (DQ) and precedes operational qualification (OQ). It is required for GxP-regulated systems under EU/UK GMP Annex 11 and GAMP 5 guidance.

An Institutional Review Board (IRB) is the US regulatory term for an independent committee that reviews, approves, and provides ongoing oversight of clinical research involving human subjects, as required under 21 CFR Part 56 and the Common Rule (45 CFR 46). The IRB is functionally equivalent to the Research Ethics Committee (REC) used in the UK, and the Independent Ethics Committee (IEC) referenced in ICH E6(R3). IRB approval must be obtained before enrolment of participants.

The UK online system that provides a single application form to apply for the permissions and approvals required for health and social care/community care research in the UK, including HRA Approval, Research Ethics Committee (REC) review, NHS R&D approval, and MHRA clinical trial authorisation. IRAS streamlines the submission process for clinical trials and other health research studies.

The intention-to-treat (ITT) principle specifies that participants should be analysed in the group to which they were originally randomised, regardless of whether they received the allocated treatment or completed the study. ITT analysis preserves the benefits of randomisation and provides a conservative estimate of treatment effect that reflects real-world conditions; it is the primary analysis approach required by regulators for confirmatory trials.

An interim analysis is a formal statistical analysis conducted before completion of a trial, using accumulating data to assess efficacy, safety, or futility. To preserve the overall Type I error rate, interim analyses must be pre-specified in the SAP, conducted according to pre-defined stopping rules, and ideally carried out by an independent Data Monitoring Committee (DMC/IDMC) blinded to the sponsor.

An internal audit is an independent examination of trial-related activities and documentation conducted by audit personnel within the sponsor organisation (or a contracted QA function acting on behalf of the sponsor), to assess compliance with GCP, SOPs, and the protocol. Internal audits are part of the sponsor's quality system and findings typically feed into the CAPA process; they are distinct from, and preparatory to, regulatory inspections.

Interoperability is the ability of different software systems to exchange, interpret, and use data without requiring custom development for each connection. In clinical trials, interoperability between eClinical systems — EDC, CTMS, safety databases, site file platforms, EHRs — reduces duplicate data entry, minimises transcription error, and enables a more complete real-time view of trial status. Standards such as CDISC, HL7, and FHIR provide the common language that makes interoperability possible.

A US FDA mechanism that allows an investigational medical device to be used in clinical studies to collect safety and effectiveness data required to support a Premarket Approval (PMA) application or a Premarket Notification (510(k)). Under 21 CFR Part 812, an IDE exempts sponsors from certain FDA device requirements while requiring IRB approval, informed consent, and adherence to GCP.

An investigational medicinal product (IMP) is any pharmaceutical form of an active substance or placebo being tested or used as a reference in a clinical trial. IMPs are subject to specific manufacturing (GMP), labelling, and accountability requirements under EU CTR 536/2014 and the associated EU GMP Annex 13; sponsors are responsible for supplying and accounting for all IMPs.

The dossier submitted to the competent authority as part of a clinical trial authorisation application, containing quality, non-clinical, and clinical information about the investigational medicinal product (IMP). The IMPD is the EU/UK equivalent of the US IND application's drug information sections and is required under EU Regulation 536/2014 and the UK Clinical Trials Regulations.

A US FDA application that must be submitted and become effective before a new drug or biological product may be shipped in interstate commerce for use in clinical investigations. The IND includes information on the drug's composition, source, pharmacology, toxicology, manufacturing, and clinical protocols; it remains active throughout the drug's development and must be updated with annual reports and safety reports.

In the context of clinical trials, an investigator is a person responsible for the conduct of a clinical trial at a trial site (ICH E6(R3) 1.34). Where a trial is conducted at a site by a team, the investigator leading the team is designated the Principal Investigator. Investigators must be qualified by education, training, and experience to assume responsibility for the proper conduct of the trial and must comply with GCP and applicable regulatory requirements.

The investigator site file (ISF) is the collection of essential documents held at the investigational site that enables evaluation of the conduct of a trial and the quality of data generated, as required by ICH E6(R3) section 8. It is the site counterpart to the sponsor's trial master file (TMF) and must be maintained throughout the trial and retained for the applicable regulatory period after completion.

A compilation of the clinical and non-clinical data on an investigational medicinal product that is relevant to the study of the product in human subjects, as defined in ICH E6(R3). The IB is prepared and maintained by the sponsor and provides investigators with the information needed to understand the rationale for and comply with key protocol elements, including dosing, administration, and safety monitoring requirements.

IP accountability (investigational product accountability) is the systematic documentation of all movements of the investigational product at site: quantities received, stored, dispensed to each subject, returned unused, and destroyed. GCP requires these records to allow reconciliation of every unit received against every unit accounted for, providing assurance that subjects received the correct product at the correct dose. IP accountability (the reconciliation record) is distinct from but closely related to IP management (the site-level handling processes).

IP management (investigational product management) encompasses the site-level processes for receiving, storing under specified conditions, dispensing, tracking, and returning or destroying investigational product in accordance with the protocol and applicable regulations. Effective IP management ensures product integrity, patient safety, and a complete accountability trail for inspection. IP management (the handling processes) is distinct from but closely related to IP accountability (the reconciliation record of every unit).

IRT (Interactive Response Technology) is the collective term for systems used to manage randomisation, treatment allocation, and investigational product supply in clinical trials. IRT encompasses both telephone-based (IVRS) and web-based (IWRS) systems, and is responsible for assigning participants to treatment arms, tracking IP inventory across sites, and managing blinding. Modern IRT systems are often integrated with EDC and CTMS to provide a unified operational picture.

International standard specifying requirements for the design, conduct, recording, and reporting of clinical investigations of medical devices in human subjects, harmonising GCP requirements for medical device trials. ISO 14155:2020 is recognised by regulators including the EU (under MDR 2017/745) and MHRA as a standard for demonstrating compliance with clinical investigation requirements for devices.

ISO 27001 is the international standard for information security management systems (ISMS), published by the International Organisation for Standardisation (ISO) and the International Electrotechnical Commission (IEC). It specifies requirements for establishing, implementing, maintaining, and continually improving a risk-based ISMS, including controls covering access management, cryptography, physical security, incident management, and supplier relationships. ISO 27001 certification, awarded by an accredited certification body following an independent audit, is widely recognised as a benchmark of information security maturity and is referenced in NHS and pharmaceutical procurement frameworks.

An IWRS (Interactive Web Response System) is a web-based IRT system through which site staff access randomisation codes, record IP dispensing, and manage drug supply for clinical trial participants. IWRS has largely superseded the older telephone-based IVRS model and is the standard mechanism for randomisation and supply management in most contemporary trials.

A key performance indicator (KPI) is a quantifiable metric used to evaluate the performance of a trial, site, or operational function against predefined targets. In clinical trial management, KPIs may include enrolment rate, screen failure rate, data query resolution time, protocol deviation rate, or monitoring visit completion. Risk-based monitoring frameworks (ICH E6(R3)) rely on KPIs and key risk indicators (KRIs) to guide oversight decisions and resource allocation.

A key risk indicator (KRI) is a pre-defined metric used in risk-based monitoring to detect signals of emerging data quality, safety, or protocol compliance issues at a site or across the study. KRIs are derived from the study-specific risk assessment and monitored centrally against pre-specified thresholds; a breach triggers a defined escalation or site action. ICH E6(R3) and the EMA reflection paper on risk-based monitoring both describe KRIs as essential to a proportionate monitoring strategy.

All written, printed, or graphic information affixed to or accompanying a medicinal product or medical device. For investigational products, labelling requirements are defined by the relevant regulatory framework (e.g. Annex 13 of EU GMP Guidelines for IMPs; 21 CFR Parts 201 and 312 for US INDs) and must include sufficient information to ensure correct and safe use while maintaining blinding where applicable.

Last patient last visit (LPLV) is the milestone marking the date of the final study visit or data collection point for the last participant in a trial. LPLV triggers obligations such as database lock, preparation of the end-of-study report, and the start of the archiving retention period for essential documents.

A legal basis is one of the six lawful grounds under UK GDPR (Article 6) on which an organisation may process personal data: consent, performance of a contract, compliance with a legal obligation, protection of vital interests, performance of a task in the public interest, or legitimate interests. For clinical trial participant data — which is typically special category health data — an additional condition under Article 9 must also be met. Most UK-based clinical research relies on "public task" or "scientific research" as the legal basis and Article 9 condition, rather than consent, as withdrawing consent would undermine trial integrity.

Legitimate interest is one of the six lawful bases for processing personal data under UK GDPR (Article 6(1)(f)), applicable where the processing is necessary for the controller's or a third party's genuine and proportionate interest, provided those interests are not overridden by the data subject's rights and freedoms. Controllers relying on legitimate interest must conduct and document a three-part legitimate interests assessment (LIA): purpose test, necessity test, and balancing test. In clinical research, legitimate interest is sometimes used for processing limited staff or site contact data, but is rarely appropriate for processing participant health data.

A local laboratory is a clinical laboratory at or near the investigational site that processes samples collected from trial participants, as distinct from a central laboratory used across all sites. Results from local laboratories are considered source data and must be recorded, retained, and verified in accordance with GCP; normal ranges, accreditation details, and any updated reference ranges must be held in the site file.

The regulatory approval granted by a competent authority permitting a medicinal product to be placed on the market following demonstration of satisfactory quality, safety, and efficacy. In the EU, marketing authorisations are granted either centrally by the European Commission (via EMA) or nationally by member states; in the UK post-Brexit, by the MHRA; in the US, the equivalent is FDA approval (NDA, BLA, or PMA for devices).

A master protocol is a single overarching trial protocol designed to evaluate one or more investigational products across one or more disease populations, enabling multiple sub-studies (such as umbrella, basket, or platform trials) to operate simultaneously under shared infrastructure. Master protocols improve efficiency but require careful statistical planning to control error rates across simultaneous comparisons.

The maximum tolerated dose (MTD) is the highest dose of an investigational product that does not cause unacceptable adverse effects in a defined study population, as determined by a pre-specified dose-escalation scheme. Identifying the MTD is a primary objective of many Phase I oncology trials and informs the dose selected for subsequent phases.

The Medical Dictionary for Regulatory Activities (MedDRA) is the internationally recognised medical terminology standard used to code adverse events, diseases, diagnoses, signs, symptoms, and indications in clinical trials and post-marketing pharmacovigilance. Maintained by the ICH, MedDRA employs a five-level hierarchy (System Organ Class → High Level Group Term → High Level Term → Preferred Term → Lowest Level Term) and is required by regulatory authorities including the EMA and MHRA for ICSRs and clinical study reports.

Medical writing in clinical trials refers to the preparation of accurate, structured documents — including clinical study reports, protocols, investigator's brochures, and regulatory submissions — that communicate trial science and data to regulators, ethics committees, and other stakeholders. Good medical writing must be scientifically accurate, clearly reasoned, and formatted to applicable regulatory templates (such as ICH E3 for clinical study reports).

Metadata is data that describes the attributes of another data item — for example, the author, creation date, modification history, file format, and system origin of an electronic document or record. In regulated clinical systems, metadata is as important as the primary data itself: regulators require that metadata be retained alongside trial records to demonstrate data integrity and support reconstruction of events during an inspection. Loss of metadata — for instance, stripping audit-trail fields on export — is a common data-integrity finding.

The UK government agency responsible for regulating medicines, medical devices, and blood components for transfusion in Great Britain (with the Medicines & Healthcare products Regulatory Agency role in Northern Ireland governed by separate arrangements under the Windsor Framework). The MHRA issues clinical trial authorisations, conducts GCP inspections, and acts as the UK competent authority for the purposes of the UK Clinical Trials Regulations.

Monitoring is the act of overseeing the progress of a clinical trial and ensuring that it is conducted, recorded, and reported in accordance with the protocol, SOPs, GCP, and applicable regulatory requirements (ICH E6(R3)). Monitoring activities may be conducted on-site, remotely (central monitoring), or through a combination of both, and should be risk-proportionate as described in the study monitoring plan. The sponsor is responsible for implementing and maintaining a monitoring programme.

A multi-centre trial is a clinical trial conducted at more than one investigator site, under the same protocol and sponsor. Multi-centre trials can enrol participants more rapidly and produce more generalisable results, but require careful site initiation, training, and monitoring to ensure consistent protocol adherence across sites.

Multi-factor authentication (MFA) is a security mechanism that requires users to verify their identity using two or more independent factors — typically something they know (password), something they have (authenticator app or hardware token), and/or something they are (biometric). MFA significantly reduces the risk of unauthorised access resulting from compromised credentials and is required or strongly recommended under NHS DSPT, Cyber Essentials Plus, and GxP guidance on electronic systems used in clinical research.

The NHS Data Security and Protection Toolkit (DSPT) is an online self-assessment tool, mandated by NHS England, that organisations handling NHS patient data must complete annually to demonstrate compliance with the National Data Guardian's ten data-security standards and with UK GDPR. An "approaching standards" or "standards met" rating is required for organisations wishing to connect to NHS systems or access NHS patient data. The DSPT covers areas including data inventory, staff training, technical security controls, and incident reporting.

A non-clinical study (also called a pre-clinical study) is research conducted in laboratory systems or animals — rather than in human participants — to evaluate the biological activity, safety, and pharmacokinetic properties of an investigational product before it is administered to humans. Regulators require an adequate package of non-clinical data as a prerequisite for authorising first-in-human trials. See also pre-clinical, the term used interchangeably for this stage of research.

Non-compliance in a clinical-trial context refers to failure to adhere to the requirements of the protocol, SOPs, GCP, or applicable regulatory requirements. Non-compliance may range from minor protocol deviations to serious breaches that must be reported to ethics committees or competent authorities. Sponsors are required to maintain procedures for detecting, recording, investigating, and remediating non-compliance (ICH E6(R3)).

A non-inferiority trial is designed to demonstrate that a new treatment is not worse than an active comparator by more than a pre-specified, clinically acceptable margin (the non-inferiority margin). These trials are used when a placebo control would be unethical or impractical, and the choice of margin requires careful clinical and statistical justification as outlined in ICH E10 and regulatory guidance.

A non-interventional study is one in which the investigational product is prescribed or used in the normal clinical setting, the assignment of participants to a particular therapeutic strategy is not determined by a trial protocol, and no additional diagnostic or monitoring procedures are applied. Such studies include observational, epidemiological, and registry studies, and are generally subject to lighter regulatory requirements than interventional clinical trials.

An observational study is a type of non-interventional research in which the investigator observes and records data on participants without assigning or manipulating their treatments or exposures. Cohort, case-control, and cross-sectional studies are all observational designs; while they can generate valuable real-world evidence, they are subject to confounding and bias that limits causal inference.

On-site monitoring refers to monitoring visits conducted at the investigator's site by a clinical research associate (CRA) or monitor, involving direct review of source documents, essential documents, and trial procedures. ICH E6(R3) requires on-site monitoring to be risk-proportionate; not every visit need be a full SDV visit if central monitoring and risk indicators support a different approach. The findings and actions arising from on-site visits must be documented in monitoring visit reports.

An open-label trial is one in which both the participant and the investigator are aware of the treatment being administered. Open-label designs are used when blinding is impractical or unnecessary, and in Phase I dose-escalation studies; they carry a higher risk of performance and detection bias compared with blinded designs.

Operational qualification (OQ) is the third stage of the computerised system validation (CSV) lifecycle, in which documented evidence is generated that a system operates consistently within defined limits and in accordance with its approved functional specification across all planned operational ranges. OQ testing typically covers functional requirements, boundary conditions, and error-handling scenarios. It follows installation qualification (IQ) and precedes performance qualification (PQ), and is required under EU/UK GMP Annex 11 and GAMP 5 guidance.

A regulatory status granted to a medicinal product intended for the diagnosis, prevention, or treatment of a rare disease or condition, entitling the sponsor to various regulatory incentives including reduced fees, protocol assistance, and market exclusivity following authorisation. In the EU, orphan designation is granted by the EMA under Regulation (EC) No 141/2000; in the UK, the MHRA operates a UK Orphan Designation framework; in the US, the FDA grants Orphan Drug designation under the Orphan Drug Act.

Oversight in clinical trials refers to the systematic supervision and monitoring of trial activities by the sponsor and its delegates to ensure compliance with the protocol, GCP, and applicable regulations. ICH E6(R3) places explicit obligations on sponsors to maintain quality oversight throughout the trial lifecycle, including oversight of vendors and CROs to whom duties have been transferred. Oversight encompasses monitoring, auditing, risk-based quality management, and vendor governance.

A patient information sheet (PIS) is the written document provided to potential trial participants before consent is sought, explaining the study's purpose, procedures, risks, benefits, voluntary nature, and their rights. The PIS must be approved by the ethics committee, written in plain language accessible to a lay reader, and available in the participant's language.

Patient recruitment is the process of identifying, screening, approaching, and enrolling eligible participants into a clinical trial. It is one of the most operationally critical activities in trial management; recruitment shortfalls are a leading cause of trial delays and failures, making site feasibility assessment and recruitment strategy planning essential.

Patient retention refers to the strategies and efforts used to keep enrolled participants engaged and active in a trial through to completion. High dropout rates can bias results, reduce statistical power, and compromise the integrity of the intention-to-treat analysis; retention is therefore a key quality metric monitored throughout the study.

Patient safety in clinical research refers to the active protection of trial participants from harm, encompassing the identification, assessment, and management of risks posed by the investigational product or trial procedures, as well as the prompt reporting of safety events. The ethical and regulatory foundation for participant protection is set out in the Declaration of Helsinki, ICH E6(R3), and applicable national legislation; the investigator, sponsor, and ethics committee each bear defined responsibilities.

A patient-reported outcome (PRO) is any measure of a patient's health status that comes directly from the patient, without interpretation by a clinician. PROs capture symptoms, functional status, quality of life, and treatment satisfaction, and are increasingly used as primary or key secondary endpoints in trials where patient experience is the most relevant measure of benefit.

A patient-reported outcome measure (PROM) is the validated instrument or questionnaire used to collect a patient-reported outcome. PROMs must be developed and validated according to regulatory guidance to demonstrate they measure what they intend to measure, are reproducible, and are sensitive to clinically meaningful change; regulators review PROM development packages as part of clinical trial submissions.

Penetration testing is the discipline and practice of conducting authorised simulated attacks on computer systems to identify security weaknesses. It encompasses different methodologies — black-box (no prior knowledge), grey-box (partial knowledge), and white-box (full access to system documentation) — and may target network infrastructure, web applications, APIs, or social-engineering vectors. Results are documented in a penetration test report used to prioritise and track remediation. NHS DSPT and Cyber Essentials Plus require regular penetration testing of internet-facing systems.

Performance qualification (PQ) is the final stage of the computerised system validation (CSV) lifecycle, in which documented evidence is generated that a system consistently performs as intended in its actual operational environment and meets the user requirements specification (URS) under real-world conditions and loads. PQ is typically conducted with end users using production-representative data and serves as the final acceptance gate before a regulated system goes live. It is required under EU/UK GMP Annex 11 and GAMP 5 guidance.

The Periodic Safety Update Report (PSUR) is a pharmacovigilance document submitted by marketing authorisation holders to regulatory authorities at specified intervals, providing a comprehensive evaluation of the benefit-risk balance of an authorised medicinal product based on cumulative safety data. The format and content are defined in ICH E2C(R2). For investigational medicinal products in development, the equivalent document is the Development Safety Update Report (DSUR).

A per-protocol analysis restricts the primary analysis to participants who complied with the protocol — including receiving the allocated treatment and completing assessments as specified. It is typically presented alongside the intention-to-treat analysis as a supportive analysis, and may be primary in bioequivalence trials; however, it is subject to selection bias if non-compliance is related to outcome.

Personal data is any information relating to an identified or identifiable natural person (the "data subject"), as defined under UK GDPR. In clinical research, personal data includes participant names, dates of birth, NHS numbers, medical record numbers, biometric data, and any other information that could, alone or in combination, identify a trial participant or staff member. The same data in fully anonymised form falls outside this definition, but pseudonymised data (where re-identification remains possible using a code held by the sponsor) remains personal data.

Personally identifiable information (PII) is a term used predominantly in US regulatory and information-security contexts (including NIST guidelines and HIPAA) to describe information that can be used to identify a specific individual, either directly or indirectly. It is broadly equivalent to "personal data" under UK GDPR. In international clinical trials, both terms may be used depending on the regulatory jurisdiction of the sponsor, and organisations should map their data inventories against whichever definition applies in each territory where they operate.

Pharmacodynamics (PD) is the study of the biochemical and physiological effects of a drug on the body and the mechanisms by which those effects are produced, including the relationship between drug concentration and effect. PD data from early-phase trials are used to select the dose and dosing schedule for subsequent studies and to identify pharmacodynamic biomarkers.

Pharmacokinetics (PK) is the study of how the body processes a drug over time — encompassing absorption, distribution, metabolism, and excretion (ADME). PK data are essential for establishing safe and effective dosing regimens and are a primary objective of Phase I clinical trials and bioequivalence studies.

Pharmacovigilance is the science and activities relating to the detection, assessment, understanding, and prevention of adverse effects or any other medicine-related problems (WHO definition). In clinical trials, sponsor pharmacovigilance obligations include the collection and assessment of adverse events, expedited reporting of SUSARs to competent authorities and ethics committees, and submission of periodic safety update documents (DSURs). Applicable guidelines include ICH E2A (expedited reporting), ICH E2C(R2) (PSURs), and ICH E2F (DSURs).

Phase 0 is an exploratory first-in-human stage using sub-therapeutic microdoses to obtain early human pharmacokinetic and pharmacodynamic data without requiring full toxicology packages. Phase 0 studies are not formally defined in all regulatory frameworks and are not in themselves sufficient to support a full IND or CTA, but they can accelerate early candidate selection decisions.

Phase I trials are the first stage of testing in humans and primarily assess the safety, tolerability, pharmacokinetics, and pharmacodynamics of an investigational product, usually in a small number of healthy volunteers or patients. The dose-escalation design of most Phase I studies aims to identify the MTD and inform dose selection for subsequent phases.

Phase II trials evaluate the preliminary efficacy and further safety of an investigational product in a larger group of participants who have the condition of interest. They are used to determine optimal dosing, dosing regimen, and the clinical endpoints that will be used in definitive Phase III trials.

Phase III trials are large, typically randomised controlled trials designed to provide definitive evidence of the efficacy and safety of an investigational product in the intended patient population, in comparison with placebo or standard of care. Successful Phase III results form the primary basis for a marketing authorisation application to regulators such as the MHRA or EMA.

Phase IV trials are conducted after a product has received marketing authorisation, to gather additional information on the product's safety, efficacy, and optimal use in broader or specific populations. They may be required by regulators as a condition of authorisation (post-authorisation safety studies, PASS) or conducted voluntarily by sponsors.

A pilot study is a small-scale preliminary investigation conducted to assess the feasibility of a larger trial — evaluating elements such as recruitment rates, protocol adherence, data collection procedures, and variability of outcome measures. Pilot studies are not typically powered to detect a treatment effect and their results should not be used to re-estimate sample size without pre-specification.

A placebo is an inert substance or sham intervention that is identical in appearance to the investigational product but contains no active ingredient. Use of a placebo control allows separation of the pharmacological effect of the IMP from psychological and contextual effects, and is a requirement when no active standard of care exists and it is ethically permissible.

A placebo-controlled trial is one in which the comparator arm receives a placebo rather than an active treatment. Placebo-controlled designs provide the strongest evidence of absolute efficacy but are only ethically acceptable when participants would not be exposed to serious harm by withholding active treatment; this requirement is codified in the Declaration of Helsinki and reflected in ICH E10.

A platform trial is an adaptive, multi-arm master protocol design that allows multiple treatments to be evaluated simultaneously against a shared control, with arms able to enter and leave the trial over time based on pre-specified decision rules. Platform trials offer efficiency in both time and sample size compared to running separate trials for each intervention.

Post-market surveillance (PMS) is the systematic collection, recording, and analysis of experience gained with a medicinal product or medical device after it has received marketing authorisation. For medicinal products, PMS feeds into routine pharmacovigilance activities and may include Phase IV studies, patient registries, and spontaneous reporting. For medical devices, PMS is a regulatory requirement under the EU Medical Device Regulation (MDR 2017/745).

Pre-clinical refers to research conducted before a product enters human trials, typically in cell systems, animal models, or computational models, to characterise the pharmacology, toxicology, and mechanism of action of a potential investigational product. Regulatory authorities require a defined package of pre-clinical data before granting a clinical trial authorisation or IND. Pre-clinical is used interchangeably with non-clinical; see also non-clinical study.

A preventive action is a proactive measure taken to eliminate the cause of a potential non-conformance or undesirable situation before it occurs. Preventive actions are a component of the CAPA process and reflect a prospective quality-management approach: rather than responding only to actual deviations, organisations identify systemic risks and act on them in advance. Regulators expect evidence of preventive action within quality management systems at inspection.

The primary endpoint is the pre-specified outcome measure that the trial is principally designed and powered to assess, and on which the main conclusion of efficacy or safety will be based. It must be clinically meaningful, measurable, and defined in the protocol and SAP before the trial begins; any change after unblinding requires strong justification and regulatory discussion.

The Principal Investigator (PI) is the individual who takes responsibility for the conduct of a clinical trial at a specific site, as defined in ICH E6(R3) 4.1. In UK multi-centre trials, the PI at each site operates under the overall leadership of the Chief Investigator. The PI must be qualified by education, training, and experience, must delegate only to suitably qualified team members, and retains accountability for all activities conducted at their site.

Privacy by design is the principle — codified in Article 25 of UK GDPR — that data-protection measures should be built into the design of systems, products, and processes from the outset, rather than added as an afterthought. It encompasses seven foundational principles including data minimisation, purpose limitation, and default privacy settings. Regulators expect clinical trial software vendors and sponsors to demonstrate privacy-by-design thinking when developing or procuring electronic systems that process participant data.

A privacy notice (also called a privacy policy) is a document provided to data subjects that explains, in clear and plain language, who is collecting their personal data, the purposes and legal basis for processing, how long the data will be retained, who it will be shared with, and what rights the data subject has under UK GDPR. In clinical research, participants must receive a privacy notice before or at the point of consent; the notice is typically included in or alongside the participant information sheet (PIS).

The protocol is the formal document that describes the objectives, design, methodology, statistical considerations, and organisation of a clinical trial. Under ICH E6(R3), the protocol is a mandatory document that must be approved by the ethics committee and competent authority before the trial commences, and all substantive changes must be submitted as amendments.

A protocol amendment is a written description of a change to, or formal clarification of, the protocol. Substantial amendments — those likely to affect the safety or rights of participants, or the scientific value of the trial — must be approved by the ethics committee and, where required, the competent authority before implementation, under EU CTR 536/2014 and ICH E6(R3).

A protocol deviation is any departure from the procedures described in the approved study protocol that has not been prospectively approved by the sponsor (and, where required, ethics committee). Protocol deviations are classified by their potential impact: minor deviations have negligible effect on participant safety or data integrity; important deviations may affect these and must be reported to the appropriate oversight bodies. ICH E6(R3) requires sponsors to have documented procedures for identifying, documenting, and assessing protocol deviations.

A protocol synopsis is a concise summary of the key elements of a clinical trial protocol, typically used for regulatory submissions, ethics committee applications, or internal planning purposes. It is not a substitute for the full protocol but provides a structured overview of the study design, objectives, population, interventions, and endpoints.

A protocol violation is typically used to describe a more serious protocol deviation — a departure from the approved protocol that has, or could have, a significant adverse effect on the safety, rights, or well-being of a participant, or on the reliability or integrity of the trial data. The distinction between "deviation" and "violation" is not always applied consistently across organisations; ICH E6(R3) uses the term "important protocol deviation" to describe the most significant departures. Some sponsors and regulators use "violation" to trigger mandatory expedited reporting.

Pseudonymisation is the processing of personal data in such a way that it can no longer be attributed to a specific individual without the use of additional information — for example, replacing participant names with a code held separately. Under UK GDPR, pseudonymised data remains personal data (because re-identification is possible), but its use is encouraged as a risk-reduction measure and may be taken into account when assessing proportionality of security measures. Pseudonymisation is widely used in clinical research to protect participant identity during data analysis and publication.

The PSF (Pharmacy Site File) is the paper or electronic file maintained by the site pharmacy for a clinical trial, holding investigational medicinal product accountability, storage and temperature monitoring, dispensing records, and returns and destruction documentation. It is the pharmacy equivalent of the Investigator Site File and must be retained for the required regulatory period after study completion.

A Quality Management System (QMS) is the organisational structure, responsibilities, processes, procedures, and resources needed to implement quality management across the clinical-trial enterprise. ICH E6(R3) requires sponsors to establish and maintain a quality system that encompasses all aspects of the trial, from protocol design through study close-out; ICH Q10 provides a broader pharmaceutical QMS framework. A GCP QMS typically includes controlled SOPs, training management, deviation and CAPA tracking, audit programmes, and document control.

A quality agreement is a written contract between a sponsor and a vendor (such as a CRO, central laboratory, or IMP manufacturer) that defines each party's responsibilities for GCP- or GMP-related quality activities, oversight, and compliance. Quality agreements are required under ICH Q10 and GCP where a sponsor delegates trial activities; they do not transfer ultimate regulatory responsibility, which remains with the sponsor.

Quality assurance (QA) comprises all those planned and systematic actions that are established to ensure that the trial is performed and the data are generated, documented, and reported in compliance with GCP and applicable regulatory requirements (ICH E6(R3)). QA is an oversight function (typically performed by a QA unit independent of operational teams) and is distinct from quality control (QC), which consists of the operational verification activities performed within a process.

Quality control (QC) refers to the operational techniques and activities undertaken within a process to verify that the requirements for quality are being fulfilled (ICH E6(R3)). In clinical trials, QC activities include checks embedded in data entry, monitoring, and laboratory processes — for example, a CRA verifying source data against the eCRF during a monitoring visit. QC is distinct from quality assurance (QA), which provides independent oversight of the overall system.

Quality risk management is a systematic process for the assessment, control, communication, and review of risks to quality across the product or trial lifecycle. ICH Q9 and ICH E6(R3) both require sponsors to apply risk management principles; in GCP, this manifests as the risk-proportionate approach to trial design, monitoring, and oversight described in ICH E6(R3) Section 5.

A quality tolerance limit (QTL) is a pre-specified threshold for a trial-level parameter — such as the proportion of participants with a missing primary endpoint or the rate of important protocol deviations — beyond which the cumulative effect is considered to threaten the integrity of the trial results or participant safety. QTLs are a concept introduced in ICH E6(R3) and are intended to trigger a sponsor-level investigation and remediation when breached, distinct from site-level KRI triggers.

Query management is the process by which discrepancies, missing data, or inconsistencies identified in clinical trial data are flagged, investigated, and resolved. Queries are typically raised by data managers or the EDC system's validation rules and are sent to site staff for clarification or correction; all query activity is recorded in the audit trail. Efficient query management is critical to achieving a clean database ahead of lock.

Randomisation is the process of allocating participants to trial arms by chance, using a pre-defined and reproducible method, to minimise selection bias and confounding. Randomisation is the defining feature of the randomised controlled trial and is required to be documented as an essential element of the protocol and statistical analysis plan under ICH E6(R3).

The randomisation code is the sequence that determines the treatment assignment for each participant, generated by a validated system before the trial begins. Access to the unblinded randomisation code must be restricted and controlled; code-breaking procedures for emergencies must be pre-specified and every code break documented as a protocol deviation.

A randomised controlled trial (RCT) is a prospective study in which participants are randomly allocated to an intervention group or a control group to evaluate the causal effect of the intervention. RCTs are considered the gold-standard design for generating evidence of efficacy and are the primary basis for regulatory marketing authorisation decisions.

Real-world data (RWD) is data relating to patient health status and healthcare delivery collected outside the controlled setting of a conventional randomised clinical trial — for example from EHRs, claims databases, disease registries, and wearables. RWD is used by regulators, health technology assessment bodies, and sponsors to supplement or contextualise evidence from interventional trials and increasingly to support regulatory decision-making.

Real-world evidence (RWE) is the clinical evidence about the usage, benefits, or risks of a medical product derived from analysis of real-world data. RWE is generated through observational studies, pragmatic trials, and secondary analyses of routinely collected healthcare data, and is increasingly accepted by regulators and health technology assessment bodies to support expanded indications, post-market commitments, and comparative effectiveness evaluations.

The discipline within the pharmaceutical, biotech, and medical device industry responsible for ensuring that products meet regulatory requirements throughout their development lifecycle, from preclinical through to marketing authorisation and post-market surveillance. Regulatory affairs professionals manage submissions to competent authorities, interpret regulatory guidance, and advise on strategy for obtaining and maintaining market approvals.

Any national or supranational body with the legal mandate to regulate the development, approval, and post-market surveillance of medicines and medical devices, and to oversee the conduct of clinical trials within its jurisdiction. Examples include the MHRA (UK), EMA (EU), FDA (US), Health Canada, and TGA (Australia).

The state of meeting all applicable laws, regulations, guidelines, and standards imposed by regulatory authorities on the development, manufacture, or marketing of medicinal products and medical devices, and on the conduct of clinical research. For clinical trials, regulatory compliance encompasses adherence to GCP, protocol requirements, national clinical trial regulations, and applicable ethics requirements.

Any formal document or package submitted to a regulatory authority in connection with the development, authorisation, or post-market activities of a medicinal product or medical device. In clinical trials, regulatory submissions include IND applications, CTAs, substantial amendments, annual reports, safety reports (SUSARs, DSURs), and marketing authorisation applications (MAAs/NDAs/BLAs).

Remote data entry refers to the practice of capturing clinical trial data electronically from a location away from the central data management site — typically at the investigator site or by the patient — using web-based or mobile tools. The term overlaps with RDE and EDC and is often used to emphasise the distributed, site-facing nature of electronic data collection in decentralised or hybrid trial models. RDE was an early precursor to modern EDC, and the abbreviation RDE is often used interchangeably with the full term.

Remote monitoring is monitoring activity conducted off-site by a CRA or monitor, using electronic access to trial data held in systems such as EDC, eTMF, eISF, and CTMS, without a physical visit to the investigator site. Remote monitoring may include source data verification (where permitted by local regulations and ethics committee approval), data review, and communication with site staff. ICH E6(R3) explicitly recognises remote monitoring as a component of a risk-based monitoring strategy.

A Research Ethics Committee (REC) is the UK body that provides independent ethical review of research involving human participants, their tissue, or their data. RECs in England, Wales, Scotland, and Northern Ireland are governed by their respective national authorities, with the Health Research Authority (HRA) overseeing NHS research ethics in England. A favourable REC opinion is a mandatory prerequisite for initiating a clinical trial on a medicinal product in the UK, alongside MHRA authorisation.

The retention period is the minimum length of time for which trial documents must be kept after the completion or discontinuation of a study. Requirements vary by jurisdiction and document type: ICH E6(R3) specifies at least 15 years for essential documents in most cases, with longer periods for paediatric studies (25 years) or where national law requires more. Sponsors must ensure documents remain legible, accessible, and intact throughout this period. The obligation to preserve trial documents for these defined minimum periods is also referred to as document retention.

The right to erasure (also known as the "right to be forgotten") is a data-subject right under Article 17 of UK GDPR, allowing individuals to request deletion of their personal data where, for example, it is no longer necessary for the purpose for which it was collected or consent has been withdrawn. In clinical research, this right is subject to important limitations: trial data must be retained for regulatory purposes (typically 25 years for medicinal-product trials under ICH E6), and the right to erasure may be overridden by the legal obligation to maintain those records. Sponsors must address this tension explicitly in their privacy notices.

In clinical-trial quality management, a risk assessment is a systematic evaluation of potential sources of risk to participant safety, data integrity, or trial conduct, performed during study design and updated throughout the trial lifecycle. ICH E6(R3) requires sponsors to identify critical processes and data, assess the likelihood and impact of errors in those processes, and document the risk assessment to justify the monitoring strategy and other quality measures.

Risk management in a clinical-trial context is the coordinated application of policies, procedures, and practices to identify, assess, control, and monitor risks to participant safety, data quality, and regulatory compliance throughout the trial. ICH E6(R3) embeds risk management as a core sponsor responsibility; ICH Q9 provides the foundational pharmaceutical risk-management methodology. Effective risk management reduces both unnecessary procedural burden and undetected quality failures.

A risk register is a documented log of identified risks to a trial or programme, recording each risk's description, likelihood, potential impact, risk owner, and current mitigation or control measures. In GCP quality management, the risk register is updated iteratively as new risks are identified or existing risks change, and it informs the monitoring plan and CAPA programme.

Risk-based monitoring (RBM) is a monitoring strategy, explicitly endorsed in ICH E6(R3), that uses a prospective risk assessment to determine the type, frequency, and extent of monitoring activities — replacing the historical default of 100% source data verification at every site visit. RBM combines on-site visits, centralised monitoring, and statistical data review, proportionate to the complexity and risk profile of the trial; critical data and processes receive the most monitoring attention.

In clinical trial governance, a role is a defined set of responsibilities assigned to an individual or function within the trial team, underpinned by the qualifications, training, and delegated authority required to carry out those responsibilities. GCP (ICH E6(R3)) requires that roles are clearly assigned, that individuals accept responsibility by signature, and that the boundaries of each role are documented in trial plans and delegation logs.

Role-based access control (RBAC) is a security model in which access permissions to systems, data, and functions are granted based on a user's organisational role rather than assigned individually. RBAC reduces the risk of unauthorised access and data leakage by ensuring that users can only access the records and actions their role requires ("least privilege"). It is a core control under NHS DSPT, Cyber Essentials, and GxP electronic-systems guidance, and is assessed during vendor qualification audits.

Root cause analysis (RCA) is a structured investigation method used to identify the fundamental cause(s) of a deviation, non-conformance, or adverse event — as opposed to addressing only symptoms. Common RCA methodologies include the "5 Whys", fishbone (Ishikawa) diagrams, and fault tree analysis. In GCP quality management, RCA is a mandatory step in the CAPA process: corrective and preventive actions must be causally linked to the identified root cause rather than assumed.

RTSM (Randomisation and Trial Supply Management) is an IRT system that combines both randomisation management and investigational product supply chain management in a single platform. RTSM systems handle treatment allocation, IP dispensing records, resupply triggers, returns tracking, and — in adaptive trials — dynamic re-randomisation, and are the operational backbone of blinded drug accountability in most Phase II–III trials.

A run-in period is a phase before randomisation in which all participants receive the same treatment (active or placebo) or undergo observation, used to assess eligibility, achieve steady-state, improve baseline stability, or remove prior medication effects. Data collected during run-in are generally excluded from the primary efficacy analysis.

The Safety Analysis Set (SAF) is the population of trial participants included in the safety analyses, typically defined as all participants who received at least one dose of the investigational medicinal product. The SAF definition is pre-specified in the statistical analysis plan (SAP); it differs from the intention-to-treat (ITT) population, which is used for efficacy analyses. AE incidence rates, exposure data, and other safety summaries are presented for the SAF in the clinical study report.

Safety monitoring refers to the ongoing surveillance of participant safety data throughout a clinical trial, including adverse event collection, assessment of severity and causality, signal detection, and escalation to the IDMC, sponsor safety team, or regulatory authorities as appropriate. Safety monitoring is a continuous sponsor obligation under GCP (ICH E6(R3)) and pharmacovigilance regulations; it spans both site-level AE reporting and study-level aggregate safety review.

A safety review committee is an internal or external group convened by a sponsor to provide ongoing review of aggregate safety data arising from a clinical trial or development programme, distinct from the independent IDMC. The committee may include clinical, regulatory, and statistical experts and advises on whether emerging safety signals require protocol amendments, dose modifications, or trial suspension. The terms safety monitoring committee and safety advisory board are used interchangeably in practice.

A safety signal is information that arises from one or multiple sources (including observations and experiments) that suggests a new potentially causal association, or a new aspect of a known association, between an intervention and an event or set of related events, either adverse or beneficial, that is judged to be of sufficient likelihood to justify verificatory action (ICH E2C(R2) / EMA GVP Module IX). Signal detection is conducted through pharmacovigilance databases and statistical methods; confirmed signals may lead to label changes, risk minimisation measures, or trial amendments.

Sample size is the number of participants required for a trial to have sufficient statistical power to detect a clinically meaningful treatment effect with a specified level of confidence. Sample size calculations must be documented in the protocol and SAP, and are based on the primary endpoint, expected effect size, variability, significance level, and desired power, in accordance with ICH E9.

Screening is the process of evaluating potential trial participants against the inclusion and exclusion criteria before enrolment. Screening may involve medical history review, physical examination, laboratory tests, or other assessments as specified in the protocol; all screened individuals must be logged, including those who are not enrolled and the reasons for ineligibility.

A screening failure occurs when a potential participant is assessed for eligibility but does not meet the inclusion/exclusion criteria or withdraws consent before being formally enrolled. Screening failure rates affect recruitment planning and must be tracked in the screening log; they do not in themselves represent a safety concern unless the failure is due to an adverse event during screening procedures.

A screening log is a site-level document that records all individuals who were assessed for eligibility for a clinical trial, including those who did not enrol, with the reason for screen failure noted. Maintaining a screening log is an ICH E6(R3) essential document requirement and allows sponsors and regulators to assess enrolment ratios, evaluate eligibility criteria, and detect potential selection bias.

SDTM (Study Data Tabulation Model) is a CDISC standard that defines how clinical trial data should be organised into standardised datasets — called domains — for submission to regulatory authorities such as the FDA and EMA. SDTM provides a consistent structure for raw collected data (as opposed to ADaM, which structures analysis-ready data), making it possible for regulators to review submissions using standard tools and without needing study-specific programming knowledge.

A secondary endpoint is a pre-specified outcome measure that provides supportive evidence to complement the primary endpoint, or addresses additional questions of clinical interest. Secondary endpoints must be defined in the protocol and SAP; any inferential claims from secondary endpoints must account for the risk of multiplicity.

Security information and event management (SIEM) is a category of software that aggregates and correlates log data and security events from across an organisation's IT infrastructure — including servers, applications, and network devices — to detect anomalies, generate alerts, and support incident investigation and compliance reporting. SIEM tools are used by security operations teams to identify potential breaches in near real time and to produce audit evidence for regulators and assessors under frameworks such as ISO 27001 and NHS DSPT.

Sensitive personal data (referred to in UK GDPR as "special category data") is a defined subset of personal data that warrants heightened protection because of the particular risks its misuse could pose to individuals. Under UK GDPR Article 9, special categories include data concerning health, genetic data, biometric data used for unique identification, racial or ethnic origin, religious beliefs, and sexual orientation. Clinical trial participant health data is almost always sensitive personal data, requiring an additional lawful condition under Article 9 in addition to a legal basis under Article 6.

A serious adverse event (SAE) is any untoward medical occurrence that, at any dose, results in death, is life-threatening, requires inpatient hospitalisation or prolongation of existing hospitalisation, results in persistent or significant disability or incapacity, is a congenital anomaly or birth defect, or is considered medically important by the investigator or sponsor (ICH E6(R3); ICH E2A). SAEs are distinct from adverse events (AEs) in that they meet one or more of these seriousness criteria; all SAEs must be reported by the investigator to the sponsor in an expedited timeframe defined in the protocol, and must be assessed for expectedness and causality to determine whether SUSAR reporting to the competent authority is required.

A breach of GCP or the trial protocol likely to affect to a significant degree the safety or rights of a trial subject, or the reliability and robustness of the data generated in the trial. Under the UK Clinical Trials Regulations and EU Regulation 536/2014, sponsors are required to notify the MHRA (or relevant EU competent authority) of a serious breach without undue delay and within seven days of becoming aware of it.

The regulatory obligation on sponsors (and, where applicable, chief investigators) to report to the competent authority — in the UK, the MHRA — any serious breach of GCP or the trial protocol within the prescribed timeframe (seven days of becoming aware). Serious breach reporting is distinct from safety reporting (SUSARs, SAEs) and relates specifically to procedural or data integrity failures with potential to affect subject safety or trial reliability.

Signal detection is the process of identifying new or changed safety signals from pharmacovigilance data sources — including clinical trial databases, spontaneous adverse reaction reports, literature, and registries — using statistical and clinical methods. In the EU, signal detection for authorised products is conducted by MAHs and EMA on an ongoing basis under GVP Module IX. During clinical development, sponsors are expected to monitor cumulative safety data for emerging signals as part of their pharmacovigilance obligations.

Single sign-on (SSO) is an authentication mechanism that allows a user to log in once with a single set of credentials and gain access to multiple applications and systems without re-authenticating for each one. SSO reduces password fatigue and the risk of weak or reused passwords, and simplifies access de-provisioning when a user leaves an organisation. In NHS and pharma environments, SSO is typically implemented using identity providers (IdPs) compatible with SAML 2.0 or OpenID Connect standards.

A single-blind trial is one in which only one party — typically the participant — is unaware of the treatment allocation, while the investigator or outcome assessor knows which treatment is being given. Single-blinding reduces participant bias but does not eliminate investigator or observer bias.

In clinical trials, a site (or investigational site) is the physical location — typically a hospital, clinic, or research unit — where the trial is conducted and where participants are recruited, consented, treated, and followed up. Each site operates under the oversight of a principal investigator and must be approved by the sponsor and, where required, by the relevant regulatory authority before enrolment begins. In multi-centre trials each participating hospital or research unit is a separate trial site, each with its own investigator site file and site-specific regulatory documentation.

Site activation is the process by which a clinical trial site is formally authorised to begin enrolling participants, following completion of all required regulatory approvals, ethics approval, contract execution, staff training, and system set-up. A site is considered activated — and the first patient first visit (FPFV) milestone can be achieved — only once all activation conditions defined by the sponsor are satisfied.

A site assessment is a formal evaluation carried out by the sponsor or CRO to determine whether a potential investigational site has the facilities, staff, patient population, and organisational capacity to conduct a specific clinical trial. Assessments typically occur at feasibility and pre-qualification stages, and findings inform the decision to select or reject a site.

Site close-out is the process of formally concluding a clinical trial at an investigational site after the last subject visit is complete. It includes final reconciliation of investigational product, retrieval or archiving of essential documents, resolution of outstanding queries, and confirmation that the site file is complete and inspection-ready before the close-out visit report is finalised.

Site feasibility is the preliminary evaluation of a potential site's suitability to participate in a clinical trial, typically conducted via questionnaire and review of patient population data, staffing, facilities, and prior trial experience. Feasibility data inform site selection decisions and help sponsors estimate enrolment timelines and resource requirements before committing to a site.

The site initiation visit (SIV) is a formal visit conducted by the sponsor or CRO to an investigational site before enrolment begins, to ensure that all staff are adequately trained on the protocol and study procedures, that required equipment is in place, and that the site file contains all necessary essential documents. Completion of the SIV is typically a prerequisite for site activation.

Site management encompasses the ongoing oversight activities carried out by sponsors and CROs to ensure that investigational sites conduct the trial in accordance with GCP, the protocol, and applicable regulatory requirements. It includes monitoring visits, remote data review, query resolution, protocol deviation management, and communication with the principal investigator and site staff.

The site qualification visit (SQV) is a visit conducted by the sponsor or CRO to a potential investigational site prior to site selection, to verify in person that the site has the personnel, facilities, and patient population necessary to conduct the trial. Findings from the SQV are documented and used alongside feasibility data to support the final site selection decision.

Site selection is the process by which a sponsor identifies and formally chooses the investigational sites that will participate in a clinical trial, based on feasibility assessments, qualification visit findings, regulatory requirements, and strategic considerations such as patient access and prior experience. Selected sites proceed to the contracting, approval, and activation pathway.

Site staff training is the instruction provided to all personnel at an investigational site who carry out or oversee trial-related duties, covering the protocol, GCP principles, study procedures, and the use of trial systems. GCP (ICH E6(R3)) requires that training be documented and that only trained, delegated staff perform assigned trial tasks; training records are essential documents held in the site file.

A site visit is any formal visit to an investigational site by a sponsor representative, CRO monitor, or regulatory inspector to review the conduct of a trial, verify source data, inspect the site file, and assess protocol compliance. Site visits may be routine monitoring visits, triggered visits following a deviation, or regulatory inspection visits; each must be documented with a visit report.

System and Organisation Controls (SOC) is a suite of audit frameworks developed by the American Institute of Certified Public Accountants (AICPA) to assess the controls of service organisations. SOC 2, the most relevant report for cloud software vendors in clinical research, evaluates controls relating to security, availability, processing integrity, confidentiality, and privacy. A SOC 2 Type II report, covering a defined period of operation, provides sponsors with independent third-party evidence that a vendor's controls are both designed and operating effectively — a common vendor-qualification requirement. SOC is the parent suite of frameworks; see also SOC 2, the specific report most relevant to cloud software vendors.

SOC 2 is an audit standard developed by the AICPA that evaluates a service organisation's controls against the Trust Services Criteria — covering security, availability, processing integrity, confidentiality, and privacy. A SOC 2 Type I report assesses control design at a point in time; a Type II report provides evidence that controls operated effectively over a defined period (typically six to twelve months). SOC 2 Type II reports are increasingly requested by pharmaceutical sponsors and CROs during vendor qualification of cloud-based clinical trial systems. SOC 2 is one report within the broader SOC suite; see also SOC.

Source data are the original records and certified true copies of original records of clinical findings, observations, and other activities in a clinical trial, as defined in ICH E6(R3). They form the basis for the data entered in the case report form (CRF) and must be attributable, legible, contemporaneous, original, and accurate (ALCOA) to meet GCP data integrity requirements. Examples include hospital records, laboratory reports, and diaries completed directly by participants.

Source data verification (SDV) is the process by which a monitor or sponsor representative confirms that data entered in the case report form (CRF or eCRF) accurately reflect the original source data held at site. ICH E6(R3) permits risk-based approaches to SDV, meaning that 100% verification is not always required; the extent and nature of SDV should be documented in the monitoring plan.

A source document is any original paper or electronic record in which source data are first captured — for example, a hospital medical record, a laboratory report, a subject diary, or a nursing note. Source documents must be retained for the required regulatory period after trial completion, and monitors must have access to them (with appropriate consent and data protection measures in place) to perform source data verification.

Special category data is the term used in UK GDPR (Article 9) for the most sensitive types of personal data — including health, genetic, biometric, racial or ethnic origin, religious belief, trade union membership, sex life, and sexual orientation data — which attract enhanced legal protections. Processing special category data requires both a lawful basis under Article 6 and one of the specific conditions listed in Article 9 (such as explicit consent, vital interests, or scientific research). Clinical trial participant data almost always constitutes special category data, making rigorous access control, encryption, and DPIA obligations particularly important.

SPIRIT (Standard Protocol Items: Recommendations for Interventional Trials) is an evidence-based international guideline specifying a minimum set of items that should be addressed in a clinical trial protocol. SPIRIT is widely endorsed by journals, funders, and regulators as a tool for improving protocol completeness and transparency, and includes a corresponding explanation and elaboration document (SPIRIT-PRO for patient-reported outcomes).

A sponsor is an individual, company, institution, or organisation that takes responsibility for the initiation, management, and financing of a clinical trial (ICH E6(R3) 1.53; EU CTR 536/2014 Art. 2(14)). The sponsor holds regulatory accountability for compliance with GCP, holds the clinical trial authorisation, and must ensure the safety of participants and the integrity of trial data. In UK academic trials the sponsor is typically the university or NHS trust, not the funder. The term "trial sponsor" is used interchangeably with "sponsor" in most regulatory contexts.

Standard contractual clauses (SCCs) are model contract terms approved by the European Commission (for EU transfers) or the UK government's ICO (the UK's International Data Transfer Agreement, IDTA, for UK transfers) that provide an appropriate safeguard for transferring personal data to third countries that have not received an adequacy decision. In clinical trials, SCCs or IDTAs are commonly used when sharing participant data with sponsors, CROs, or laboratories based outside the UK or EEA.

Standard of care is the accepted treatment or intervention that a patient with a given condition would ordinarily receive outside of a clinical trial, based on current clinical guidelines and evidence. It is used as the active comparator in clinical trials when placebo control would be unethical, and serves as the baseline against which a new treatment's added value is assessed.

A standard operating procedure (SOP) is a detailed written instruction designed to achieve uniformity in the performance of a specific function (ICH E6(R3)). SOPs are a fundamental component of a GCP quality system: they document how key trial processes (such as adverse event reporting, monitoring, and data management) are to be performed, trained for, and reviewed. SOPs must be version-controlled, periodically reviewed, and available to relevant staff.

A statistical analysis plan (SAP) is a pre-specified technical document, more detailed than the protocol, that describes the planned statistical analyses for the primary and secondary endpoints, including methods for handling missing data, multiplicity, and subgroup analyses. The SAP must be finalised and locked before unblinding of the study data, and any deviations from it must be documented and justified.

Stopping rules are pre-specified criteria for terminating a clinical trial early — for efficacy, futility, or safety — based on interim analysis results. They must be defined in the protocol and SAP before the trial begins; in confirmatory trials, stopping rules are typically implemented by an independent DMC/IDMC using formal alpha-spending functions to control the overall Type I error rate.

Stratification is the practice of dividing participants into subgroups (strata) based on pre-specified prognostic or demographic factors before randomisation, so that each arm receives a balanced distribution of those factors. Stratified randomisation reduces chance imbalance and can increase statistical power, particularly in smaller trials.

A study coordinator is a site-level professional who provides day-to-day operational support to the investigator in managing trial activities, including scheduling visits, facilitating consent, entering data, and maintaining regulatory files. The study coordinator's specific delegated tasks must be documented in the site's delegation log with appropriate training records. The role is operationally equivalent to a clinical research coordinator (CRC) and the terms are used interchangeably. The broader term "coordinator" is sometimes used for any site or sponsor staff member with delegated administrative or operational duties; all such roles must be documented in the delegation log with appropriate training records.

The study population is the group of participants enrolled in a clinical trial, defined by the protocol's inclusion and exclusion criteria. It should be representative of the target population for whom the treatment is intended, and the appropriateness of the study population is assessed by the ethics committee and competent authority at the time of authorisation.

The study team comprises all individuals at the sponsor, CRO, and site levels with defined roles and responsibilities in the conduct, oversight, or management of a clinical trial. Each member must have documented training appropriate to their role, and their responsibilities must be recorded in trial plans, charters, or delegation logs as applicable. GCP (ICH E6(R3)) requires that team structure and accountability are clearly established before the trial begins. The term "trial team" is used interchangeably to describe the same group of individuals contributing to a specific trial.

A sub-investigator is any member of the clinical trial team at a site who performs trial-related procedures or makes important trial-related decisions under the supervision of the Principal Investigator, as defined in ICH E6(R3) 1.56. Sub-investigators must be listed on the relevant regulatory documentation and delegation log, with evidence of GCP training. Typical sub-investigators include junior doctors, research nurses, and pharmacists who perform delegated clinical tasks.

A surrogate endpoint is a biomarker or measure that is intended to substitute for a clinically meaningful endpoint (such as survival or disease progression), based on epidemiological, therapeutic, or pathophysiological evidence that it predicts clinical benefit. Surrogate endpoints may support accelerated regulatory approval but typically require subsequent confirmation of clinical benefit.

A SUSAR (Suspected Unexpected Serious Adverse Reaction) is a serious adverse reaction to an investigational medicinal product that is both unexpected (not consistent with the reference safety information, such as the Investigator's Brochure) and for which there is a reasonable possibility of a causal relationship to the IMP (ICH E2A). SUSARs occupy a distinct regulatory category from AEs and SAEs: sponsors must report fatal or life-threatening SUSARs to competent authorities and ethics committees within 7 calendar days (with follow-up within a further 8 days), and other SUSARs within 15 calendar days.

System validation is the overarching process of providing objective evidence — through documented testing and review — that a computerised system consistently meets its intended purpose and specified requirements throughout its lifecycle. It encompasses computerised system validation (CSV) activities including design, installation, operational, and performance qualification, as well as ongoing change-control and periodic review. System validation is required for GxP-regulated electronic systems under EU/UK GMP Annex 11, FDA 21 CFR Part 11, and ICH Q10.

The target population is the broader group of patients with the disease or condition of interest whom the investigational product is ultimately intended to treat, and to whom the trial results are intended to generalise. The study population (enrolled in the trial) should be as representative of the target population as is safely and practically feasible.

The Trial Master File is the collection of essential documents that records the conduct and oversight of a clinical trial, held by the sponsor. Together with the Investigator Site File held at each investigative site, it enables reconstruction of the trial conduct, demonstrates compliance with GCP and applicable regulations, and is the primary record examined during regulatory inspections. ICH E6(R3) defines the sponsor's obligation to establish and maintain the TMF.

TMF completeness refers to the degree to which all expected essential documents are present, filed, and up to date within the Trial Master File at any given point in the trial. The DIA TMF Reference Model defines expected artefacts by trial phase, enabling completeness metrics to be calculated. Regulators expect a trial's TMF to be complete and contemporaneous — not assembled retrospectively at the point of inspection.

A TMF inspection is a formal review carried out by a regulatory authority — such as the MHRA, EMA, or FDA — to verify that the Trial Master File is complete, accurate, and demonstrates GCP-compliant trial conduct. Inspectors assess whether essential documents are present, legible, version-controlled, and contemporaneous. Deficiencies in the TMF can result in findings that affect marketing authorisation applications.

A TMF plan is a document prepared by the sponsor that sets out how the Trial Master File will be established, maintained, and archived throughout the trial lifecycle. It defines document responsibilities, filing timelines, the system to be used (paper or electronic), naming conventions, and quality review processes. Having a documented TMF plan is considered best practice under the DIA TMF Reference Model and supports GCP compliance.

TMF quality review is a systematic process of checking the Trial Master File to verify that documents are complete, correctly filed, legible, and consistent with the trial record — before, during, and after the study. Quality reviews are used to identify and resolve issues proactively rather than awaiting regulatory inspection. They may be carried out internally by the sponsor or by an independent quality assurance function.

TMF structure refers to the hierarchical organisation of essential documents within the Trial Master File, typically defined using the DIA TMF Reference Model's taxonomy of zones, sections, and artefacts. A well-defined structure ensures consistent filing, supports completeness assessment, and makes documents readily locatable during inspections. The structure should be agreed and documented in the TMF plan before the trial starts.

In clinical trials, training encompasses the documented instruction that all trial personnel must receive before undertaking their assigned roles, covering GCP requirements, the trial protocol, the investigational product, and any systems used in the trial. ICH E6(R3) requires that investigators and staff are qualified by education, training, and experience; sponsors and sites must retain training records as essential documents. Training must be updated when the protocol is amended or when staff join the trial team.

A transfer impact assessment (TIA) is a documented evaluation required before transferring personal data to a third country using standard contractual clauses or other transfer mechanisms, to assess whether the legal and practical circumstances in the destination country would undermine the effectiveness of those safeguards. TIAs became mandatory following the Schrems II judgment (2020) and apply equally to UK international data transfers under IDTA guidance. Clinical trial sponsors transferring participant data across borders — for example, to a US CRO or data management centre — must document a TIA as part of their data-transfer compliance record.

Treatment allocation is the process by which participants are assigned to a study arm, most commonly through randomisation. The method of allocation (e.g., simple, block, stratified, adaptive) must be pre-specified in the protocol, and the allocation sequence must be generated and maintained in a way that prevents foreknowledge of assignments by investigators or participants.

Trend analysis in clinical-trial quality management is the systematic review of quality metrics over time — such as deviation rates, CAPA cycle times, KRI trends, or monitoring findings — to identify patterns that may indicate systemic issues requiring intervention. ICH E6(R3) encourages sponsors to use trend analysis as part of ongoing quality management; it is also a standard expectation during regulatory inspections of sponsor quality systems.

Trial design refers to the overall methodological framework of a clinical study, encompassing decisions on the type of control, blinding, randomisation, study arms, endpoints, and analysis strategy. Good trial design is fundamental to producing valid, interpretable, and regulatorily acceptable evidence; ICH E8(R1) provides guidance on fit-for-purpose design principles. See also clinical study design.

The act of recording a clinical trial in a publicly accessible registry before or at the time of enrolment of the first participant, as required by the ICMJE, the Declaration of Helsinki, and many regulatory and ethics bodies. Registration provides transparency about trial existence, design, and outcome measures, enabling detection of reporting bias and outcome switching.

A publicly accessible database in which clinical trials are registered, typically before or at enrolment of the first participant. Recognised registries include ClinicalTrials.gov (maintained by NIH/NLM), ISRCTN Registry (UK and international), the EU Clinical Trials Register (EU), and WHO-accredited registries forming the International Clinical Trials Registry Platform (ICTRP).

A Type I error (also called a false positive or alpha error) occurs when a statistical test incorrectly rejects the null hypothesis — concluding that a treatment effect exists when it does not. The acceptable probability of a Type I error (significance level, alpha) is pre-specified in the SAP, conventionally at 0.05 (two-sided) for confirmatory trials; multiple comparisons increase the risk and must be controlled for.

A Type II error (also called a false negative or beta error) occurs when a statistical test fails to reject the null hypothesis — concluding that no treatment effect exists when one is actually present. The acceptable probability of a Type II error (beta) is the complement of power; sample sizes are typically calculated to achieve at least 80% power (beta ≤ 0.20), as specified in ICH E9.

UK GDPR is the retained version of the EU General Data Protection Regulation (2016/679) as it applies in the United Kingdom following Brexit, incorporated into UK law by the European Union (Withdrawal) Act 2018 and amended by the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019. UK GDPR operates alongside the Data Protection Act 2018 and is enforced by the ICO. It imposes broadly the same obligations as EU GDPR — including lawful basis requirements, data subject rights, DPIA obligations, and breach notification — but the ICO is the supervisory authority rather than EU regulators.

Unblinding is the disclosure of treatment assignment to one or more parties who were previously blinded. Planned unblinding occurs at the end of the trial or at a pre-specified interim analysis; unplanned unblinding (code breaks) may be required for urgent safety reasons and must be documented as a protocol deviation. Accidental unblinding must also be reported and its impact on data integrity assessed.

User acceptance testing (UAT) is the final stage of software testing in which end users — such as clinical research coordinators or data managers — verify that a system meets their requirements and is fit for purpose in the actual operational environment before it goes live. In a GxP context, UAT is typically the user-facing component of performance qualification (PQ) within the CSV lifecycle, and test scripts, test evidence, and sign-off must be documented and retained as part of the validation record.

Validation in a regulated clinical-research context is the documented process of establishing objective evidence that a system, process, or method consistently produces results meeting predetermined specifications and quality attributes. For computerised systems, validation encompasses the full CSV lifecycle (DQ, IQ, OQ, PQ) and ongoing change-control activities. For analytical methods or clinical procedures, validation may involve different frameworks (e.g., ICH Q2(R1) for analytical methods). Regulators require validation evidence to be available for inspection and retained for the life of the system plus the applicable regulatory retention period.

Vendor oversight is the sponsor's obligation under GCP (ICH E6(R3) 5.2) to supervise any contracted third party — such as a CRO, central laboratory, or technology provider — to which trial-related duties have been delegated, ensuring they meet required quality standards. A written contract must define the tasks transferred, and the sponsor must audit, monitor, and review vendor performance throughout the trial. Regulatory inspectors routinely assess the adequacy of sponsor vendor oversight programmes.

Version control is the practice of systematically tracking and managing changes to documents, ensuring that each revision is uniquely identified, the history of changes is preserved, and only the current approved version is active. In the context of clinical trials, version control of protocols, consent forms, and other essential documents is required under GCP to prevent use of superseded versions and to support reconstruction of trial conduct.

A visit window is the pre-specified acceptable time interval around a protocol-scheduled visit within which the visit can occur without being considered a deviation. Visit windows must be defined in the protocol and are used to assess protocol adherence; visits outside the window may need to be reported as minor deviations depending on sponsor and site SOPs.

In the context of clinical trials, a volunteer is an individual who freely participates in a study without coercion, typically in Phase I studies as a healthy volunteer, but also applicable to patients participating in any trial. Participation must be based on fully informed, voluntary consent, and participants retain the right to withdraw at any time without penalty, as required under ICH E6(R3) and the Declaration of Helsinki.

A vulnerability assessment is a systematic process of identifying, quantifying, and prioritising security weaknesses in a computer system, network, or application, typically using automated scanning tools combined with manual review. Unlike penetration testing, a vulnerability assessment stops at discovery and does not involve active exploitation. Vulnerability assessments are a standard component of an information-security programme, required under NHS DSPT and relevant to Cyber Essentials, and are typically conducted periodically and after significant changes to a system.

A vulnerable population comprises individuals who may have diminished capacity to protect their own interests in the context of research participation — such as minors, individuals who lack mental capacity, prisoners, or those in dependent relationships with investigators. Additional safeguards are required when enrolling vulnerable participants, including independent consent assessment and ethics committee scrutiny, under ICH E6(R3) and EU CTR 536/2014.

A formal written communication from the US FDA to a regulated entity (such as a sponsor, investigator, or manufacturer) notifying them of significant violations of FDA-regulated requirements that may result in enforcement action if not corrected. Warning letters are publicly posted by the FDA and represent a serious finding; the recipient is required to respond within 15 working days with a corrective action plan.

A wash-out period is the interval between treatment phases in a cross-over trial or between prior treatment and study enrolment during which no study treatment is given, allowing the effects of the previous treatment to dissipate before the next is administered. The duration of the wash-out period is determined by the pharmacokinetic and pharmacodynamic properties of the treatments involved.

A wet-ink signature is a handwritten signature applied directly to a paper document by the signatory. In clinical trial practice, wet-ink signatures remain valid for documents not yet brought into an electronic workflow, but regulatory guidance (including ICH E6(R3) and EU Annex 11) increasingly supports the use of electronic signatures as equivalents, provided the system meets specified validation and audit requirements. Certified copies of wet-ink-signed documents may be held electronically.

Withdrawal is the voluntary or involuntary discontinuation of a participant from a clinical trial, either from study treatment or from the trial entirely, prior to the planned completion of their participation. Reasons for withdrawal must be documented, and participants must be informed of their right to withdraw at any time without consequence; the handling of data from withdrawn participants must be pre-specified in the SAP.