Risk-Based Monitoring and the impact of ICH E6 (R3) on clinical trials

1. Introduction

Risk-Based Monitoring (RBM) has been recognized and recommended for several years by leading competent authorities in clinical research, including the ICH[1], Health Canada, FDA[2], EMA[3], and France’s ANSM[4] in France. While the concept itself is not new, its use is now widespread among pharmaceutical companies and contract research organizations (CROs) because it helps optimize resources, improve data quality, and protect patient safety.

In parallel, Revision 3 of the Good Clinical Practice guideline (ICH E6 [R3]) was adopted on 6 January 2025 and entered into force on 23 July 2025. This update is significant: it further formalizes RBM principles and promotes a more proactive, centralized, and proportionate approach to risk management, based on the nature and complexity of each trial. The changes introduced in ICH E6 (R3) therefore represent a key opportunity to align RBM practices with evolving regulatory requirements while granting sponsors greater flexibility in the management of clinical studies.

2. The principle of Risk-Based Monitoring

By definition, RBM focuses on strategically allocating resources according to the risks identified within a clinical study. This approach is built on four fundamental pillars:

The first pillar is to identify the trial’s critical data and risks during the study-design phase. In other words, it involves pinpointing the risks that could jeopardize the success of the clinical trial, for example, those affecting the reliability of the study results (such as the primary endpoints or specific study procedures), patient safety, and source data integrity.

The second pillar is centralized monitoring, enabled by technology such as electronic Case Report Forms (eCRFs), Electronic Data Capture (EDC) systems, and integrated study platforms. These tools allow remote, real-time analysis of data from investigator sites, automated detection of anomalies and risks through advanced algorithms (e.g., statistical outliers, abnormal values, threshold exceedances), and the prioritization of on-site monitoring visits. Centralized monitoring makes it possible to spot data inconsistencies or errors and to identify atypical or suspicious patterns of conduct. Because it directs teams to the sites that pose the greatest risk and triggers targeted monitoring visits or audits when needed, centralized monitoring is a cornerstone of the RBM model promoted in ICH E6 (R3).

The third pillar is targeted monitoring, which concentrates resources—on-site visits, data checks and reviews, audits—on sites identified as high-risk. Rather than applying a uniform, fixed monitoring schedule to every site, the recommended practice is to adjust visit frequency dynamically, drawing on continuous risk assessment and focusing on data that are truly Critical to Quality (CtQ). The regulations encourage Source Data Review (SDR) – a focused assessment of data integrity and consistency – over exhaustive, line-by-line Source Data Verification (SDV), which can generate large volumes of work and consume disproportionate resources for limited benefit. Targeted monitoring therefore replaces blanket coverage with an intelligent, proportionate strategy that maximizes oversight where it has the greatest impact on data quality and participant safety.

The fourth and final pillar is an integrated, cross-functional approach involving collaboration among the various stakeholders in the study: clinical operations, data management, biostatistics, investigator sites and their study staff, and the study sponsor or CRO. Close collaboration ensures information flows freely and that issues are addressed quickly once identified. Ongoing training is also essential so that teams can understand, evaluate, and manage the risks uncovered during the trial.

3. Implementing Risk-Based Monitoring

Putting RBM into practice follows a structured methodology built around a series of key steps. Taken together, these steps ensure optimal risk management throughout a clinical trial while meeting all regulatory requirements.

1. Initial risk assessment and identification of critical-to-quality factor: The implementation of risk-based monitoring begins with a comprehensive, trial-specific assessment to map out every factor that could affect quality or participant safety. The study team analyses the protocol’s complexity, the number of participants and sites, and each site’s capabilities, looking for areas where protocol deviations, data-quality issues, or safety concerns are most likely to arise, and determine an overall level of risk. Every foreseeable risk is then catalogued, assigned a criticality score that combines its likelihood and potential severity, and ordered from the most to the least critical.
2. Risk-based monitoring plan: With this hierarchy in hand, the team develops a risk mitigation plan that spells out exactly how the highest-priority threats will be controlled. For each critical risk, they define proactive measures that either lower the chance of the problem occurring, diminish its impact should it occur, or achieve both goals at once. All surveillance and mitigation activities are formalised in a Risk Management Plan (RMP) designed to drive any residual risk down to a negligible level.
3. Continuous surveillance and adjustment: Once the trial is under way, monitoring becomes a continuous, adaptive exercise. Real-time data feeds and predefined performance indicators, such as protocol-deviation rates or the timeliness of data entry, transform the initial assessment into a living process that evolves with the study. Continuous oversight allows the team to spot meaningful discrepancies quickly and to catch emerging trends, for example, a rise in serious adverse events, before they escalate. As new information surfaces, risk scores are recalibrated, monitoring intensity is adjusted, and every change is logged to preserve transparency and full regulatory compliance.

In practice, RBM is cyclical: it starts with an initial assessment, moves on to mitigation planning and execution, and then evolves through continuous monitoring and iterative adjustments.

4. How ICH E6 (R3) moves beyond R2

To meet the challenges of modern clinical trials, ICH E6 (R3) revisits the very foundations of clinical research regulation. This update marks a significant milestone in the evolution of Good Clinical Practice (GCP), introducing recommendations and requirements that further strengthen study quality, participant safety, and operational efficiency. Compared with R2, the new text offers several key improvements:

• Sharper regulatory expectations: Sponsors and CROs are now required to establish robust risk-management systems based on objective and measurable data. The added clarity reduces ambiguity around individual responsibilities and helps ensure consistent operational compliance.
• Multi-level oversight: R3 places even greater emphasis on balancing traditional on-site monitoring with remote or centralized surveillance. This “hybrid” approach encourages sponsors and CROs to complement and, where appropriate, replace frequent travel to investigator sites with centralized data analyses, increasing efficiency while maintaining high standards of quality and compliance.
• Accelerated digitalization: Although not always spelled out explicitly, R3 assumes the integration of advanced analytics tools and real-time dashboards. This push toward digital technology aligns with the guideline’s focus on proactive, centralized oversight and reflects an industry-wide shift toward data-driven efficiency.
• Stronger focus on forward-looking quality management: Risk-Based Quality Management (RBQM) under R3 emphasizes anticipating and preventing risks rather than simply reacting to problems after they occur. This prospective orientation is directly aligned with RBM, making the two approaches complementary within the updated framework.

5. ICH E6 (R3) and its added value for risk management

One of the most significant changes introduced in ICH E6 (R3) is its systematic embrace of RBQM. Whereas RBM focuses mainly on study oversight, RBQM takes a broader view: it weaves quality into trial design, embeds risk management at every stage, identifies the factors that are truly critical to quality, and adapts the protocol accordingly. The goal is to foster proactive quality, moving beyond retrospective, end-of-study checks. From the earliest design phase onward, teams are expected to document risks proactively, identifying, assessing, controlling, and communicating these in order to anticipate issues and demonstrate transparency to regulatory authorities. This requires keeping clear traceability of every risk-related analysis, decision, deviation, corrective action, and monitoring activity throughout the trial’s life cycle.

To make such continual oversight feasible, R3 calls for a systemic approach underpinned by digital tools and processes for data capture, analysis, visualisation, communication, and traceability. Increasing reliance on electronic solutions—such as modern EDC platforms and automated dashboards—enables centralised analyses and real-time tracking of critical data. By integrating information from multiple sources, sponsors gain a consolidated view of site performance and associated risks, allowing faster, more proactive intervention and minimising delayed responses to emerging issues.

R3 also sharpens accountability by defining stakeholder responsibilities with greater precision. Sponsors must ensure that the RMP is effectively implemented, supported by appropriate organisational resources (training, communication) and technical tools (digital systems, reporting capabilities, audit trails). CROs are responsible for addressing identified risks within agreed timelines and for scheduling regular review meetings with the sponsor. Investigator sites, in turn, are obliged to act promptly and appropriately when issues are detected. This clear allocation of duties strengthens coordination among all parties and ensures that each actor contributes fully to proactive risk management.

Under ICH E6 (R3), the concept of RBM has been expanded into a broader RBQM framework. This shift embeds quality considerations from the earliest stages of trial design and extends risk management across every phase of the study, moving well beyond the traditional focus on monitoring alone.

6. Conclusion

RBM, together with the enhanced requirements of ICH E6 (R3), is essential in the conduct of clinical trials. This conceptual evolution, centered on proactive risk management and smarter resource allocation, aims to improve trial quality while optimizing efficiency.

For CROs, the new framework makes it imperative to adopt modern, data-driven technologies and algorithms. Equally important is the implementation of harmonized operational processes and encourage  stronger cross-functional collaboration between all stakeholders, including sponsors, sites, and regulators.

However, successfully integrating RBM and satisfying ICH E6 (R3) expectations involves more than technological upgrades. It also demands significant upskilling of personnel: comprehensive training in risk-based oversight principles, mastery of new analytical tools, and transparent communication of the transformation’s goals. In many cases, existing technology infrastructures must be revised or rebuilt to support real-time, GCP-compliant data management.

Ultimately, RBM and ICH E6 (R3) chart a path toward clinical trials that are safer, more efficient, and better aligned with contemporary research demands. For CROs and other stakeholders, success hinges on continued investment in technology, human expertise, and a corporate culture committed to operational excellence and process robustness.

Need help?

Our CRO can support every aspect of your clinical-trial management:

• Preparation of regulatory dossiers (scientific, methodological, regulatory) and submission to the authorities in France and across Europe.
• Coordination of all stakeholders (sponsors, investigators, data-management teams, statisticians, regulatory affairs, and more).
• Operational acceleration: site start-up, logistics, Risk-Based Monitoring, and development of a comprehensive Risk Management Plan.

We also offer tailored training programmes on ICH E6 (R3) and a dedicated Clinical Research Associate (CRA) course to strengthen skills in proactive risk management, digital-tool utilisation, and quality-driven processes.

Our goal: to ensure the optimal, compliant application of RBM principles, safeguard your projects, and maximise operational excellence in your clinical studies.

Feel free to contact us to tap into our expertise or discuss customised training options:
solutionprojectdelivery@efor-group.com

[1] ICH : International Council for Harmonisation

[2] FDA : Food and Drug Administration

[3] EMA : European Medicines Agency

[4] ANSM : Agence Nationale de Sécurité du Médicament et des produits de santé

References

1. International Conference on Harmonisation (ICH) E6(R2): Good Clinical Practice Update, 2021.
2. International Conference on Harmonisation (ICH) E6(R3): Proposed Guideline on GCP, 2025.
3. Smith, J. et al., “Risk-Based Monitoring Applications in Multi-Centric Trials,” Journal of Clinical Trials, 2023.
4. “Clinical Trial Technology and Digital Innovation: Transforming Medical Research,” The Silicon Review, 13 June, 2025