ICH-GCP E6(R3) and CTMS: What Changes for Study Oversight

ICH-GCP E6(R3) changes study oversight from a task you perform to a system you design. The revised Good Clinical Practice guideline asks sponsors and sites to build quality into a trial from the start, focus attention on the factors that matter most to participants and results, and scale oversight to the risk each activity carries. A clinical trial management system is where that new expectation becomes daily practice, because it holds the live operational record E6(R3) wants teams to watch and act on.

Key Takeaways

• E6(R3) reached ICH Step 4 on 6 January 2025 and restructures GCP into overarching Principles, Annex 1 for interventional trials, and Annex 2 for non-traditional interventional trials.
• Quality by design and a risk-proportionate approach are the core shift. Oversight scales to the risk to participants and the importance of the data, rather than applying the same intensity everywhere.
• Data governance now has a dedicated focus. Sponsors keep oversight of data integrity, traceability and security across the whole trial lifecycle, including systems run by sites and third parties.
• The term “service providers” widens accountability. Sponsors may delegate duties to a CRO or vendor, yet they retain ultimate responsibility for the work.
• A CTMS turns these principles into evidence. Live risk signals, current delegation, proportionate monitoring records and connected deviation handling are what an inspector can actually review.

What Is ICH-GCP E6(R3), and Why Does It Change Study Oversight?

ICH-GCP E6(R3) is the current version of the international Good Clinical Practice guideline for designing, conducting, recording and reporting clinical trials. It reached Step 4 on 6 January 2025 and replaces the 2016 E6(R2) text. The guideline now has a media-neutral structure: a set of overarching Principles that apply to every trial, Annex 1 covering interventional trials, and Annex 2 covering non-traditional interventional designs such as decentralised trials.

The change matters for oversight because E6(R3) moves the emphasis from documenting every step uniformly to managing the risks that threaten participant safety and reliable results. The guideline asks teams to foster a quality culture, identify the factors critical to trial quality, and apply proportionate, risk-based control. Regulators have set clear adoption dates, so the expectation is live rather than aspirational.

The UK timing is the one to plan around first. The revised UK Clinical Trials Regulations become a legal requirement from 28 April 2026, and the MHRA has confirmed alignment with ICH E6(R3). Teams running UK studies should treat E6(R3) oversight expectations as the operating standard now.

What Does Quality by Design Mean Inside a CTMS?

Quality by design means the team decides, before the first participant is enrolled, which parts of the trial carry the most risk to safety and to the reliability of the primary results. These are the critical-to-quality factors. Oversight then concentrates on them, and a risk assessment records the reasoning so the plan is defensible later. Many teams capture this in a structured risk assessment tool such as a RACT (Risk Assessment and Categorisation Tool).

A CTMS is where those decisions become operational settings rather than a document filed and forgotten. If you are new to the category, our explainer on what a CTMS does sets out the basics. Under E6(R3), the system should hold the factors the team agreed to watch and surface them as live signals. Typical critical-to-quality factors a study team maps into the CTMS include:

• Informed consent currency: every participant consented on the correct version before any study activity.
• Eligibility and enrolment control: screening and randomisation tracked against protocol criteria and target.
• Visit-window adherence: assessments completed inside the protocol window, with out-of-window visits flagged.
• Delegation and training: each delegated task performed by a person authorised and trained for it, from the correct date.
• Primary-endpoint data flow: the data most critical to the result captured, queried and resolved on time.

The point is proportionality. A low-risk administrative field and a primary-endpoint measurement do not warrant the same oversight, and E6(R3) expects the difference to be deliberate.

How Does Risk-Proportionate Oversight Change What a CTMS Tracks?

Reactive oversight treats every study and every site the same, then discovers problems at the next monitoring visit. Risk-proportionate oversight sets the intensity of monitoring against the risk each activity carries and watches the critical factors continuously. The difference shows up in what a CTMS is asked to track and when.

Capacity is a practical example. A site that overcommits its staff and rooms raises the risk of protocol deviations and rushed data entry. Our guide on site capacity planning shows why a spreadsheet records commitments while a CTMS controls them at the point each one is made, which is exactly the proportionate control E6(R3) section 2.2 describes. The same logic applies to recruitment visibility, where live enrolment against target lets a study team act on a lagging site early rather than at quarter end.

What Does E6(R3) Expect for Data Governance?

E6(R3) introduces a clearer focus on data governance, reflecting how many systems and parties now touch trial data. The sponsor keeps oversight of data integrity, traceability and security across the whole lifecycle, from capture at site to the final analysis dataset. That oversight extends to systems deployed by investigators and by third parties, not only to systems the sponsor owns.

The ALCOA+ principles remain the practical test of data quality. A CTMS supports them where operational data is concerned:

• Attributable: every entry and change carries the user and time, so authorship is never in doubt.
• Contemporaneous: actions are recorded as they happen, not reconstructed later from memory.
• Original and accurate: the system holds the source record, with an audit trail of any correction.
• Complete and enduring: the record survives staff changes and remains readable for the retention period.

Data governance also depends on the systems themselves being fit for use. E6(R3) expects computerised systems used in a trial to be validated for their intended purpose. Our guide to computerised system validation explains the risk-based approach and the evidence an inspector looks for. A connected record helps here too, because the same event does not have to be reconciled across a CTMS, a separate TMF completeness tracker and an email chain.

How Does E6(R3) Handle Service Provider and Site Oversight?

E6(R3) uses the term “service providers” to cover every third party that performs trial-related activities, including CROs and specialist vendors. The sponsor may delegate the work, yet it retains ultimate accountability for how the work is done. Oversight obligations apply broadly, whatever the type of provider, so the sponsor needs a clear view of what each party is doing and how well.

Site oversight follows the same logic. Delegation is a common inspection weakness, and the control is timing as much as signature. An activity performed before a person’s authorised effective date is unauthorised regardless of a later signature, which is why the delegation of authority record has to be current and dated, not merely present.

Example. A coordinator runs an eligibility assessment on 3 March. Their delegation is signed on 10 March with an effective date of 10 March. The assessment sits seven days outside authorisation. A live delegation record in the CTMS would have shown the person as not yet authorised on 3 March, so the task would have been reassigned or held.

Looking for a quick reference? Our downloadable oversight guides collect these controls in one place. Find my guide to see how the checks fit together across a study.

Which Oversight Signals Should a Study Team Watch in a CTMS?

Risk-proportionate oversight needs signals a team can see and act on, not a report assembled after the fact. A CTMS built for E6(R3) surfaces the critical factors as a live picture, so the study team spends its attention where the risk is. The most useful oversight signals include:

• Enrolment against target per site, with lagging sites flagged early.
• Visit-window compliance, so out-of-window assessments are caught as they occur.
• Delegation currency, showing who is authorised for which task today.
• Query and data ageing on the fields critical to the primary result.
• Open deviations and their route to corrective and preventive action.
• Document completeness against the expected set, with named owners for each gap.

The figure below shows how these signals read as a single readiness picture for one study. The illustration uses fictional NHS demo data, and it makes a weak domain, deviation and CAPA handling at 54 percent, visually undeniable against strong neighbours such as data governance at 90 percent.

Also Read: What is inspection readiness in clinical trials?

What Should Sites and Sponsors Change Before the UK Deadline?

The revised UK framework is a legal requirement from 28 April 2026, so the window to adapt oversight is defined and short. Teams do not need a wholesale rebuild. They need to make risk-proportionate oversight visible and evidenced. A practical starting checklist:

• Document critical-to-quality factors for each study and record why they were chosen.
• Set monitoring intensity to risk, and keep the reasoning where an inspector can follow it.
• Make delegation current and dated, with a live view of who is authorised for each task.
• Confirm system validation for the computerised systems that hold trial data.
• Connect deviations to CAPA, so a finding leads to root cause and a verified fix.
• Map service-provider oversight, naming who checks each delegated activity.

These are the same areas the MHRA writes up most often. Our review of common MHRA GCP inspection findings shows how delegation gaps, data-integrity weaknesses and TMF incompleteness recur, and how a control for each prevents the finding. A connected quality management system and CAPA process close the loop from signal to action.

Also Read: CTMS vs spreadsheets: why site capacity planning breaks without one

How Does AQ Support E6(R3) Study Oversight?

AQ is a connected platform that keeps study operations, documentation and quality in one record. For E6(R3) oversight, the AQ CTMS holds the critical-to-quality factors a team agrees to watch and surfaces them as live signals: enrolment against target, visit-window adherence, delegation currency, query ageing and open deviations. Because the CTMS, eISF, eTMF, ePSF, QMS, CAPA and Digital DoA modules share one record, a signal in one place carries its context into the next, so a delegation gap or a deviation does not have to be reconciled across separate systems.

AQ does not make the risk judgements for you. The study team decides which factors are critical, sets the proportionate level of oversight, and owns the clinical and quality decisions. The platform makes those decisions operational and evidenced, and it keeps the audit trail an inspector expects. AQ is built around ICH-GCP E6(R3), MHRA and ALCOA+ expectations and is aligned to G-Cloud, DSPT and Cyber Essentials. It supports compliance rather than certifying it, because compliance is a property of how a trial is run, not of a system alone.

See how connected oversight works in practice. Book a 30-minute product tour and we will walk through E6(R3) study oversight on the platform.