Protocol Deviations Identified via eCRF Audit Trails in Clinical Trials

Introduction: The Link Between eCRFs and Protocol Compliance

Electronic Case Report Forms (eCRFs) are the backbone of data capture in clinical trials. Every data point recorded reflects protocol adherence, from dosing schedules to visit windows. Audit trails in eCRFs capture who entered or changed data, when, and why. Regulators such as the FDA, EMA, and MHRA increasingly rely on these audit trails to detect protocol deviations during inspections.

Protocol deviations identified through eCRF data often highlight discrepancies in dosing, visit schedules, laboratory assessments, or reporting timelines. Regulators classify such findings as major or critical when they affect participant safety or data integrity. For example, an FDA inspection of a Phase II oncology trial revealed that 12 protocol deviations—missed visit windows and unapproved dose adjustments—were only discovered through eCRF audit trail reviews.

Regulatory Expectations for Detecting Protocol Deviations

Agencies have clear expectations for identifying and managing protocol deviations via eCRFs:

• All data changes in eCRFs must be captured with a complete audit trail.
• Audit trails must be regularly reviewed as part of monitoring and quality assurance.
• Deviations must be documented, investigated, and categorized (major vs. minor).
• Corrective actions must be applied and reported in the Trial Master File (TMF).
• Sponsors must ensure oversight even when CROs manage eCRF systems and monitoring.

The EU Clinical Trials Register emphasizes the role of transparent deviation management in maintaining trial credibility and regulatory compliance.

Common Audit Findings Related to Protocol Deviations in eCRFs

1. Missed Visit Windows

Audit trails often reveal that patient visits occurred outside of protocol-specified windows but were not reported as deviations.

2. Unauthorized Dose Adjustments

Inspectors frequently identify dosing changes made without protocol-defined approval, documented retrospectively in eCRFs.

3. Missing Documentation of Deviations

Many deviations discovered in audit trails are not recorded in deviation logs or reported to regulators, a common audit finding.

4. CRO Oversight Failures

Sponsors often fail to verify whether CROs review audit trails consistently, leading to undetected protocol deviations.

Case Study: MHRA Audit on Protocol Deviations Detected via eCRFs

In a Phase III cardiovascular study, MHRA inspectors reviewed eCRF audit trails and identified 25 protocol deviations, including missed ECG assessments and unreported concomitant medications. The sponsor had not reconciled these deviations with site deviation logs. The finding was categorized as critical, requiring immediate CAPA and submission of updated safety analyses.

Root Causes of Protocol Deviation Audit Findings

Root cause analysis frequently identifies the following:

• Lack of SOPs mandating routine audit trail review for protocol compliance.
• Insufficient training of monitors and site staff on deviation management.
• Poor integration of eCRF systems with deviation tracking tools.
• Over-reliance on CRO monitoring without sponsor verification.
• Inadequate escalation of deviations affecting participant safety.