Essential Records and Quality Assurance

Memory is the first thing a trial loses. Two years on, nobody at the site can say from recall which protocol version governed March, why one participant's consent was taken twice, or where the fourth vial went. That is normal, and it is why the file exists. If anyone ever questions this trial — next month, or in twenty years — the person deciding whether it can be believed will be a stranger, reading what you filed.

Good clinical practice treats that stranger as a design constraint. A trial produces two things: an answer, and the evidence that the answer can be trusted. The first is written up once; the second is built record by record, from before the first participant until decades after the last.

This module walks the site's evidence system in order: what makes a record essential; where records live and how they are filed — the ISF and the TMF; where the data itself is born — source records and the ALCOA standard; who checks the work and who checks the system — QC, QA, and SOPs; what happens when Swissmedic reads your file; and how long it all must survive, which in Switzerland is a career: twenty years.

Learning Objectives

After this module, you can:

• Decide whether a record is essential — and say who will read it and why
• Keep an ISF that is complete, current, and version-controlled, with amendments, reports, and correspondence filed as they happen
• Recognise a source record, define your site's source records before the trial starts, and hold them to the ALCOA standard
• Distinguish quality control from quality assurance, place SOPs in the quality system, and respond to an audit or a Swissmedic inspection through to the corrective plan
• Apply the twenty-year rule: retain trial records under Swiss law, protect them from premature destruction, and hand over custody without breaking the chain

What Makes a Record Essential

A running trial asserts thousands of small facts: this participant existed and consented on this date; that dose left the pharmacy for the right person; this deviation was caught, explained, and prevented from recurring. Essential records are the documents and data — plus the data about the data, in any format — that let someone evaluate those claims later: whether the trial followed GCP and the law, and whether its results can be relied on. ICH E6(R3)

You are the file's first reader, because your own oversight of the trial runs on it. But the audience widens: the sponsor's monitor works from it, the sponsor's independent auditors examine it, regulatory inspectors assess the trial through it, and the ethics committee may review parts of it. Each of them arrives after the fact, and each reconstructs your trial from what the file can show. ICH E6(R3)

Under E6(R2) these were called essential documents, and the guideline carried a fixed minimum list of them, sorted by trial stage — you will still hear the term, and meet binders organised around that list. E6(R3) replaced both halves of the idea. "Documents" became records, because most of this evidence now lives as data in systems rather than paper. And the fixed list became a judgment, made trial by trial: essentiality.

Appendix C supplies the criteria for that judgment. A record is essential if, among other things: it was submitted to or issued by the regulatory authority or the ethics committee; it is a trial-specific procedure or plan; it is correspondence documenting an important trial-related decision; it documents consent, or the qualifications of the investigator and delegated staff; it traces the investigational product — which is how Module 10's accountability ledger earns its place in the file; or it substantiates that participants existed and that the data about them is real. ICH E6(R3)

An Essential Records Table of examples follows the criteria — signed protocol and amendments, the committee's dated approval, consent forms and the information given to participants, the enrolment log, source records, safety notifications. The table lives in Appendix C itself: a guideline reference you consult, not a record you file — the ISF's own index, its structured content list, does that job. The table is explicitly not exhaustive, and records that should generally exist before the trial starts are marked with an asterisk. If a listed record is produced, it is essential and it is retained. ICH E6(R3)

The ISF and the TMF: Who Files What

One trial, two keepers. The sponsor generates records and so does your site, and the guideline houses both in repositories: maintained by — or referred to from — each party for its respective records. Those repositories may together be called the trial master file (TMF); the one your site holds also has its familiar name, the investigator site file (ISF). ICH E6(R3)

The division of custody follows who made the record. Originals generally stay with the party that generated them; some records exist only on one side — those containing confidential participant information stay at the site, while records of purely sponsor work, like data analysis, stay with the sponsor. ICH E6(R3)

R3 also names what R2 left implicit: to run the trial, sponsor and site may need access to — or copies of — each other's relevant records. The guideline's own example is one you already know: SUSAR reports the site reads on a sponsor-provided portal. Those reports are not only the sponsor's records — they are the site's essential records too, because they document the safety information your site received. Which is why access is not custody: the portal is an access channel during the trial, not your archive, and at the end of the trial each party retains its own essential records — your own retained copies must exist by then. ICH E6(R3)

Filing is a during-the-trial verb, not a close-out one. Records are collected and filed in a timely manner — the guideline is blunt that this "can greatly assist" the trial's management, and inspectors read filing dates too. The asterisked records — protocol, approvals, consent-form versions among them — are generally in place before the trial starts; the rest join the file as the trial produces them. ICH E6(R3)

Records are also identifiable and version-controlled where appropriate, carrying their authors, reviewers, and approvers with dated signatures. For no record does that matter more than the protocol. Module 9 owns the approval machinery for amendments; the file is where its output lands — the currently approved version in use, every superseded version retained and marked as superseded, and the committee's approval letter for each. ICH E6(R3)

The same logic covers the duties Module 9 taught you to send: the annual safety report, the end-of-trial notifications, the registration confirmation, the outcome summary the committee receives at the end. Sending them is that module's calendar; the ISF holds the proof of each — submission and, where you receive one, acknowledgement. Interim and annual reports to the committee and authorities are Essential Records Table entries in their own right. ICH E6(R3)

Source Records: Where the Data Is Born

Every number in the trial's database was once an event in a room: a blood pressure measured, a symptom described, a tablet count that didn't add up. The first place that event is captured — on paper, in a system, by a device — is a source record: original documents or data, including their relevant metadata, or certified copies of them. ICH E6(R3)

The category is wider than "the medical chart". Source records include participants' medical records and notes; data participants enter themselves, such as electronic patient-reported outcomes; pharmacy and laboratory records from every facility the trial touches; and data arriving straight from automated instruments, wearables and sensors included.

Two site duties attach. First, before the trial starts, the investigator defines what counts as a source record, where it lives, and how it is captured — and updates that definition when things change — so "where is the original?" never becomes a matter of opinion. Second, unnecessary transcription between the source and the data-collection tool (the form or system trial data is reported into) is avoided: every copying step is a fresh chance to introduce an error the original never had. ICH E6(R3)

The standard that source records are held to compresses into five properties and one addition: Attributable, Legible, Contemporaneous, Original, Accurate (ALCOA) — and complete. Changes are permitted but traceable: they never obscure the original entry, and are explained where necessary, through an audit trail — the record of who changed what, and when. ICH E6(R3)

One definition earns its precision before we move on. A certified copy is a copy — any medium — verified, by dated signature or by a validated process, to contain the same information as the original, relevant metadata included. Only a copy meeting that bar may permanently replace an original essential record. ICH E6(R3)

Module 12 takes it from here: the extended ALCOA+ scheme, good documentation practice, data-collection tools, and query management are its ground.

Checking the Work, Checking the System

Every site checks its own work. The harder question — the one this section exists for — is who checks that the checking works.

Quality control (QC) is the first layer: the operational techniques and activities that verify the quality requirements of trial work are actually fulfilled, applied close to the work, as it happens. At a site, that looks like consent documentation checked for completeness before filing, the accountability log reconciled on schedule, entries in the sponsor's data-collection tool checked against source. In the sponsor's system, monitoring and data management are the main QC activities — which places the monitor precisely: Module 14's visits are quality control, not quality assurance. ICH E6(R3)

Quality assurance (QA) stands one level up: the planned, systematic actions that establish the trial is conducted, and its data generated, documented, and reported, in compliance with GCP and the law. QA runs throughout the trial, risk-based, looking for potential or actual causes of serious noncompliance early enough to correct and prevent them. QC asks: was this consent form complete? QA asks: does this site's consent process produce complete forms? ICH E6(R3)

The sponsor's sharpest QA instrument is the audit: a review independent of, and separate from, routine monitoring — proportionate to the trial's risks, run by qualified auditors, its observations and findings documented. Independence is protected in both directions: the auditor stands outside the trial team, and authorities do not routinely request audit reports, precisely so audits can afford to be honest. Your duty when one arrives is the same as for monitoring and inspection: permit it. ICH E6(R3)

Standard operating procedures (SOPs) are where the quality system is written down — the documented way your site consents, dispenses, reports, files. Trial-specific procedures and plans are essential records; institution-level SOPs serving many trials are retained outside the trial's own repository but must still be producible. An SOP that no longer matches what the site actually does is not a formality problem: it converts routine work into documented noncompliance, one use at a time. ICH E6(R3)

Inspection: When the State Reads Your File

One morning the study inbox holds a short letter: Swissmedic announces a GCP inspection. The stranger from this module's opening stops being hypothetical and books a meeting room. Swissmedic is entitled to inspect any clinical trial of medicinal products, of the device-like products under the Therapeutic Products Act, or of transplant products — and it informs the responsible ethics committee and the other competent authorities in advance; they may take part. KlinV

An inspection is quality assurance with legal standing: an evaluation, on the state's behalf, of whether the trial is run in accordance with GCP and the law. Its scope is the conduct of the trial, not the contents of the application dossier — Swissmedic's own guidance notes that GCP inspections cover trials of every risk category, and that drug accountability, which is never part of the authorisation review, may well be assessed at a GCP inspection. Swissmedic CT Guidance

The best preparation is the absence of preparation: if the systems this module describes ran all along, the file already is what the inspector needs. During the inspection the duty is direct access — upon request, all requested trial-related records are made available, promptly and unfiltered. ICH E6(R3)

The inspection ends in writing: findings, and the site's written response — what will be corrected, how recurrence is prevented, by when. That response pattern has a name, CAPA — corrective and preventive action — and the guideline expects implementation to be documented, not just promised: records of noncompliance and of corrective and preventive actions implemented are themselves essential records. ICH E6(R3)

Behind the correspondence stands real power. Swissmedic may suspend or revoke the authorisation it itself granted — its own instrument, issued where the ordinance requires one, separate from the ethics committee's approval that every trial holds — or attach conditions to the trial's continuation. The listed grounds include endangered participant safety, poor quality of the collected data, conduct that departs from the approved application documents, and non-compliance with approval and reporting requirements.

Read that list twice: a records failure is not the paperwork version of a problem; it is a statutory ground for stopping a trial. Whatever measures follow are coordinated between Swissmedic and the ethics committee. KlinV

Twenty Years: Retention and Custody

The last participant's last visit was in January 2026. The documents from that trial may not be destroyed before January 2046 — a coordinator hired the week the trial closed could spend an entire career at the site and leave before the retention clock runs out.

Swiss law sets the number. The investigator retains all documents required for the identification and follow-up of participants, and all other original data, for at least twenty years after the trial's completion or premature termination. The sponsor's duty runs at least as long — twenty years, or until the expiry of the last supplied batch, whichever ends later. Twenty years is the floor for every trial under the ordinance, whatever the population; only trials of transplant products and of blood and blood products follow their own regime, under the Therapeutic Products Act. KlinV

GCP adds the tie-breaker for everything the ordinance doesn't fix: records are retained for the regulatory period or until the sponsor informs you they are no longer needed — whichever is longest. A sponsor agreement can extend the twenty years. Nothing shortens it. ICH E6(R3)

And retention is a quality, not a location. Through the whole period the records must remain complete, readable, and readily available — directly accessible on request — protected against unauthorised access and against accidental or premature destruction. Media age faster than obligations: an archive that survives only on a system nobody can open anymore has already failed, twenty years or not. ICH E6(R3)

Records outlive employment, which is why custody has its own rule. When the PI retires, the site closes, or the archive moves, the obligation does not fall to nobody: the investigator/institution keeps the sponsor informed of the name of the person responsible for the records throughout the retention period. Custody is handed over, documented — never dropped. ICH E6(R3)

This is the archive Module 9 showed the trial's records entering at close-out — and Module 10's accountability ledger is in these boxes too. The questions those records answer do not expire at the last visit; the file's job is to keep the answers alive for as long as the law says someone might ask.

Module Summary

The file is the trial's second life. Essentiality decides what enters it — could a stranger evaluate the trial without this record? The ISF and the TMF are where it lives, filed as the trial happens, version-controlled, each party keeping its own and reaching the other's where the work requires.

Source records are where the data is born, held to ALCOA from first capture. QC checks the work, QA checks the checking, SOPs write the system down. Inspection is the state reading the file — and twenty years is how long the file must stay readable after the trial stops generating it.

You can now:

• Decide whether a record is essential — and say who will read it and why
• Keep an ISF that is complete, current, and version-controlled, with amendments, reports, and correspondence filed as they happen
• Recognise a source record, define your site's source records before the trial starts, and hold them to the ALCOA standard
• Distinguish quality control from quality assurance, place SOPs in the quality system, and respond to an audit or a Swissmedic inspection through to the corrective plan
• Apply the twenty-year rule: retain trial records under Swiss law, protect them from premature destruction, and hand over custody without breaking the chain

Nobody keeps a file this carefully for the stranger alone. You keep it because the participants who lent the trial their bodies are owed an answer that outlasts everyone's memory of them — and because if the question ever comes, in whatever decade, the honest answer should already be sitting in the archive, readable, with a name on it.