The action to prioritize when managing computerized systems under ICH E6 R3 is to ensure data integrity by design: sponsors and investigators should first establish a risk-based, documented data governance framework that assigns clear ownership of each system and validates it proportionate to the risk it poses to trial participant safety and result reliability, then maintain audit trails and access controls continuously. ICH E6(R3) reframes computerized systems as part of a quality management ecosystem rather than a one-time validation checklist, so the priority is governance architecture before tool selection.
What "data governance" means inside a computerized system
ICH E6(R3) treats data governance as the set of accountabilities and controls that keep trial data attributable, legible, contemporaneous, original, and accurate from capture through reporting. The draft revision folds computerized system requirements into the broader quality management framework rather than quarantining them in a separate section. The practical consequence is that sponsors must own a system-level governance decision for every tool that touches participant data, including electronic case report forms, electronic consent, source-data capture platforms, and central laboratories.
The mechanism matters because governance is what makes validation meaningful. Validation confirms a system does what it claims; governance decides who is allowed to change it, how changes are approved, and how the record of those changes survives staff turnover. Without ownership, a validated system can drift into unvalidated use within months. An investigator site that adopts a new mobile app for recording trial data without sponsor approval has, in governance terms, created an ungoverned system no matter how secure the app is.
Why risk-based proportionality is the load-bearing mechanism
The core mechanism is proportionate control: the depth of validation, the strictness of access control, and the intensity of monitoring should scale with the system's influence on participant safety and data reliability. A system that randomizes participants or computes a primary efficacy endpoint warrants deeper control than a scheduling calendar. This is the same logic that underlies risk-based monitoring and centralized statistical review.
Data integrity by design means building the controls into the workflow rather than auditing them afterward. When an electronic data capture system enforces edit reasons at the point of change, the audit trail is complete by construction. When corrections are made by overwriting a field, the trail is reconstructive and fragile. The difference is architectural, not procedural, and no amount of downstream monitoring recovers a trail that was never captured.
A counterintuitive detail: a more elaborate system can increase risk. Each added integration, export, and vendor interface creates a new boundary where access control or audit trail can break. Governance therefore includes deciding what not to connect. The simplest system that satisfies the protocol is often the most defensible one.
Where the guidance sets thresholds and what they mean
ICH E6(R3) does not publish numeric validation thresholds. It uses qualitative proportionality, and this is a deliberate limit rather than an oversight. Sponsors and investigators must translate qualitative risk into their own documented decision rules. A common practice is a three-tier scheme: high-risk systems with direct impact on safety or primary endpoints receive full validation with independent review; moderate-risk systems receive documented risk assessment plus functional testing; low-risk systems receive configuration checks and verified vendor documentation.
The reconciliation point for readers comparing sources: some professional commentary translates "proportionate" into fixed test-coverage percentages or minimum audit-trail review frequencies. Those numbers are organizational policy, not guidance text. Adopt them as internal standards if useful, but do not cite them as ICH requirements. The governing obligation is risk justification, documented and defensible.
Timeline: how governance obligations map to trial phases
| Trial phase | Primary governance action | Artifact that demonstrates it |
|---|---|---|
| Protocol design | Identify systems affecting safety and primary endpoints | System inventory with risk tier per system |
| Before first participant | Validate or verify each system proportionate to tier | Validation plan and executed test records |
| Startup | Confirm access controls and audit trails enabled | Configuration record and role matrix |
| During conduct | Monitor trail completeness and change control | Periodic review log and change approvals |
| Data lock | Reconcile system records against reported data | Reconciliation record with sign-off |
| After database lock | Retain systems and records per retention policy | Archive and retrievability confirmation |
The first row is where most governance failures originate. A system that enters the trial without a risk tier never receives proportionate validation, and the gap is invisible until an inspection asks for the justification.
Red flags that indicate governance has broken down
Corrections to trial data made without a recorded reason or attributable user. Vendor upgrades deployed to a production trial system without documented sponsor review. Shared login credentials used to reduce licensing cost or staffing friction. Audit trails that can be disabled by site staff rather than locked by the sponsor. Spreadsheets used as interim data stores outside any governed, versioned system. No named owner for a system that captures source data.
Each of these is detectable. Each is cheaper to fix before enrollment than after an inspection finding. The audit trail flag is especially consequential because reconstructing lost attributability after the fact is often impossible.
How computerized systems compare with paper-based and hybrid records
| Record type | Attribution mechanism | Change capture | Governance burden |
|---|---|---|---|
| Paper source documents | Signature and initials | Manual correction with countersignature | Physical control and storage |
| Electronic data capture | Unique user accounts | System-enforced audit trail | Validation and access administration |
| Electronic source with e-signature | Credentialed identity | Locked trail with reason codes | Identity management and retention |
| Hybrid paper converted to electronic | Varies by process | Depends on conversion step | Dual control and reconciliation |
| Spreadsheet-based interim store | Often shared or unversioned | Frequently absent | High; discouraged unless governed |
The hybrid row is the professional caveat most thin explainers miss. The moment paper is scanned or transcribed, the electronic copy inherits a new governance obligation, and the conversion step becomes a system in its own right. Sponsors should specify which record is the source of truth at each stage. Ambiguity here is a common inspection vulnerability.
Practical actions sponsors and investigators can take now
Start with inventory. List every computerized system in the trial and assign each a risk tier with a one-sentence justification. This document is the spine of the governance framework and answers the most common inspector question before it is asked.
Next, verify access and trail configuration in writing before first enrollment. Confirm that unique accounts are enforced, that audit trails cannot be disabled at the site level, and that role assignments match the delegation log. Store the configuration record alongside the validation documentation.
Then set a change-control rhythm. Any vendor release, configuration change, or new integration should pass a documented sponsor review proportionate to the system's risk tier. Calendar the review rather than relying on vendor notification alone.
Finally, reconcile systems against reported data before database lock. Compare what the systems recorded against what appears in the analysis dataset, and record the reconciliation. This step catches drift that monitoring missed and produces a defensible close-out record.
Limitations and what the guidance leaves open
ICH E6(R3) sets obligations but does not prescribe specific platforms, validation test depths, or audit-trail review frequencies. Sponsors and investigators must document their own proportionate decisions, and the defensibility of those decisions depends on the quality of the risk rationale, not on adherence to a published number. Organizations should treat any external numeric standard as internal policy unless the regulatory text states otherwise.
The guidance also does not resolve every retention question across jurisdictions, and local requirements may exceed the international baseline. Reading E6(R3) in isolation is insufficient for multinational trials.
This article provides general educational information about clinical trial data governance under ICH E6(R3); it is not a legal opinion, a regulatory submission strategy, or a compliance certification. Sponsors and investigators should consult qualified regulatory affairs and legal professionals for decisions specific to their trials and jurisdictions.