Common Audit Findings in Decentralized Clinical Trials (DCTs)

Introduction: Why DCTs Pose New Audit Challenges

Decentralized Clinical Trials (DCTs) are reshaping clinical research by shifting trial activities from traditional investigator sites to patient-centric and technology-driven models. Features such as eConsent, remote monitoring, direct-to-patient IMP delivery, and telemedicine visits have introduced new compliance risks. Regulatory agencies like the FDA, EMA, and MHRA increasingly focus on how sponsors and CROs adapt their oversight and quality systems for DCTs.

Audit findings from recent DCT inspections reveal recurring issues with data integrity, patient confidentiality, SAE reporting, and Trial Master File (TMF) completeness. Because DCTs often involve multiple vendors, ensuring effective sponsor oversight and CAPA systems is critical for inspection readiness.

Regulatory Expectations for DCTs

Authorities expect sponsors and CROs to apply the same rigor to DCTs as to traditional site-based trials:

• Maintain complete and contemporaneous TMF documentation, including remote monitoring reports and eConsent records.
• Ensure SAE and SUSAR reporting timelines are met despite remote trial structures.
• Implement validated electronic systems with audit trails for eSource, eCRF, and eConsent platforms.
• Document oversight of vendors providing telemedicine, logistics, and digital tools.
• Protect patient confidentiality and data security in decentralized platforms.

The Japan Registry of Clinical Trials reinforces global expectations for transparency and quality in both traditional and decentralized trials.

Common Audit Findings in DCTs

1. Incomplete TMF Documentation

Auditors frequently cite missing remote monitoring reports, telemedicine logs, or eConsent documentation in TMFs.

2. SAE and SUSAR Reporting Delays

Delays in follow-up reports are common when multiple vendors manage pharmacovigilance systems without sponsor oversight.

3. Data Integrity and Audit Trail Gaps

Electronic systems used in DCTs often lack robust audit trails, raising concerns about unauthorized changes.

4. Vendor Oversight Deficiencies

Sponsors are often cited for failing to document oversight of logistics partners or telemedicine vendors.

5. Patient Confidentiality Risks

Findings frequently highlight insufficient encryption or weak safeguards in digital platforms managing patient data.

Case Study: EMA Audit of a Decentralized Oncology Trial

In a hybrid oncology trial, EMA inspectors identified major deficiencies in eConsent documentation and incomplete TMF archiving of telemedicine logs. Although corrective actions were promised, RCA was superficial, attributing issues to “vendor oversight gaps” without systemic solutions. As a result, the sponsor faced delays in regulatory review and was required to implement new SOPs and electronic tracking systems.

Root Causes of Audit Findings in DCTs

Recurring deficiencies in DCT audits often result from:

• Weak SOPs that do not address decentralized workflows or vendor oversight.
• Superficial RCA attributing issues to vendor error without addressing systemic sponsor responsibilities.
• Lack of validated electronic platforms with complete audit trails.
• Poor coordination between multiple vendors managing trial activities.
• Failure to integrate CAPA outcomes into sponsor quality management systems.

Emerging Trends in Internal Audits for Virtual and Decentralized Trials

Why Internal Audit Strategies Must Evolve with Virtual Trials

Virtual or decentralized clinical trials (DCTs) are transforming the research landscape by replacing or supplementing traditional on-site activities with digital tools. While this enhances patient access and operational efficiency, it introduces new challenges for internal quality assurance teams—especially in planning and executing internal audits.

Unlike conventional audits that focus on physical documentation, face-to-face consent, and on-site PI oversight, audits in virtual trials must navigate electronic platforms, remote source data verification, and decentralized workflows. As a result, QA professionals must adapt audit checklists, SOPs, and risk assessment models to reflect the realities of hybrid and site-less models.

Regulatory authorities such as the FDA and EMA have recognized the shift and emphasized the importance of data integrity, participant safety, and audit traceability in these digital ecosystems.

Audit Planning in the Era of Decentralized Operations

Internal audits for DCTs require a reimagined planning process. Key considerations include:

• ✅ Digital Platforms: Identify all eClinical systems in use—eConsent, ePRO, eCOA, telemedicine portals, etc.
• ✅ Data Sources: Determine where source data originates—patient mobile apps, wearable sensors, home nurses
• ✅ Personnel Roles: Clarify responsibilities when site activities are distributed (e.g., home nurses vs PI)
• ✅ Accessibility: Ensure auditors have access to virtual systems, role-based permissions, and training

Pre-audit questionnaires and technology walkthroughs should be part of audit initiation. Where feasible, hybrid audit models can combine remote data review with physical visits for pharmacy or sample storage inspections.

Common Internal Audit Findings in Virtual Trials

As virtual trials grow, certain themes are emerging in audit observations:

• ✅ Incomplete eConsent records: Missing timestamps, unverified identity, or version mismatches
• ✅ PI oversight gaps: PIs unaware of remote activities delegated to third parties
• ✅ Data integration issues: Wearable or app data not syncing with EDC, affecting traceability
• ✅ Decentralized SOP confusion: Home care providers unaware of protocol deviations reporting
• ✅ Audit trail limitations: eSource systems lacking change logs or user authentication logs

To illustrate:

During an internal audit of a virtual oncology study, the auditor discovered that the eConsent platform did not capture patient IP addresses or confirmation of identity. The PI assumed the vendor handled compliance, but no delegation document existed. This was classified as a Major finding under ICH E6(R2) 4.8.10.

Redesigning Audit Checklists for DCTs

Traditional audit checklists need to be updated to include virtual-specific checks. Suggested additions include:

• ✅ Confirmation of eConsent process flow (identity verification, version control)
• ✅ Remote delegation of duties logs (home nurse responsibilities)
• ✅ Cross-system reconciliation (EDC, eCOA, wearables)
• ✅ eSource validation (PDF exports, audit trail completeness)
• ✅ Data privacy compliance (GDPR, HIPAA for telemedicine)

Internal QA teams must validate that all systems used in the virtual workflow are either validated internally or come with vendor certification of compliance with GxP and 21 CFR Part 11 standards.

Adaptations in Report Writing and Risk Categorization

Report formats must reflect virtual environment constraints. Observations should describe:

• ✅ Platform-specific issues (e.g., eConsent audit trail gap)
• ✅ Participant-level data flow (e.g., wearable data mismatch in two systems)
• ✅ Vendor oversight failures (e.g., third-party eCOA provider didn’t update version)

Risk ratings should consider systemic impact—for example, missing consent data for 1 out of 100 subjects may be Minor, but missing audit trail for all eSource files is Critical.

QA teams should document platform demos, data extracts, and screenshots as annexes to audit reports to support findings in virtual environments.

CAPA Trends and Best Practices in Virtual Audit Remediation

Corrective and Preventive Actions (CAPAs) for DCTs often involve multiple stakeholders, including vendors. Best practices include:

• ✅ Formal vendor CAPA coordination process
• ✅ Revalidation of impacted systems after configuration updates
• ✅ Training refreshers for all virtual stakeholders
• ✅ Version control alignment across systems
• ✅ Enhancements to SOPs specific to DCT environments

All CAPAs should be tracked with traceability to audit findings and stored within the sponsor QMS for inspection readiness.

Conclusion

Internal audits for virtual trials require more than remote access—they demand a rethinking of audit scope, tools, and techniques. As technology continues to reshape clinical research, QA professionals must evolve to maintain GCP compliance in the digital space. By incorporating platform checks, verifying decentralized delegation, and strengthening documentation practices, internal audits can remain robust, adaptive, and impactful in the virtual era.

References:

• ICH E6(R2) & E6(R3) Draft GCP Guidelines
• FDA Guidance on Conduct of Clinical Trials of Medical Products during COVID-19
• EMA Considerations for DCTs and Remote Oversight