Technical
January / February 2019

Clinical Trial Management Adaptation to ICH E6 (R2): Good Clinical Practice
Yumi Wakabayashi
Hitoshi Matsui
Masahiro Hayashi
Kohji Ikai
Keiichi Yamamoto
Article

This article presents an adaptation of clinical trial management to ICH E6 (R2). A case study assesses quality risks in a clinical data management system.

Yumi Wakabayashi, Hitoshi Matsui, Masahiro Hayashi, Kohji Ikai, and Keiichi Yamamoto, PhD
Yumi Wakabayashi, Hitoshi Matsui, Masahiro Hayashi, Kohji Ikai, and Keiichi Yamamoto, PhD

ICH has issued many guidelines to standardize technical documentation for medicinal product registration and reporting. ICH topics are categorized as quality (Q), safety (S), efficacy (E), and multidisciplinary (M). ICH E6 is an efficacy guideline on good clinical practice (GCP). It covers roles and expectations for all clinical trial participants.

In the past, regulatory authorities and the pharmaceutical industry monitored quality in clinical trials using GCP standards detailed in ICH E6(R1), which was first published in 1996. 1 The ICH E6 Expert Working Group E6(R1) began to revise E6(R1) in 2014, with a focus on risk-based monitoring and quality risk management. The revised guideline, ICH E6 (R2), published in November 2016, covers risk-based monitoring based on quality risk assessment and quality risk management (QRM). 2

QRM in Clinical Trials

Complex global-scale clinical trials must be managed by prioritizing crucial tasks, which can be determined by assessing quality risks. Clinical research associates (CRAs) monitor investigator sites to ensure that management of a clinical trial by a site team is in compliance with the trial protocol and documented procedures such as patient site visit timeliness, drug accountabilities, compliance with protocols and SOPs, adverse events handling, etc.

As regulation of global clinical trials has increased, so have their development costs. They now include travel expenses, transportation costs, computerized systems implementation and operation, training and education, laboratory tests, and so on. Manpower costs include experts with therapeutic area knowledge, clinical trial design, medical writing, clinical data management, monitoring, statistical analysis, project management, communication, and negotiation.

We, the five members of the Special Interest Group No. 3 of the GAMP Community of Practice, ISPE Japan Affiliate, have adapted clinical trial management to ICH E6 (R2) by considering QRM in clinical systems implementation and operation. We conducted a case study to assess quality risks in clinical data management systems (Table A).

We assumed that clinical data management system operation has high risks related to human error such as data checking mistakes and wrong programming. Mitigation measures of these risks were mainly to eliminate human error, e. g., training data managers, double programming, and program validation. Our results indicate that this could improve oversight and management of clinical trials, allocate time and resources more efficiently, improve patient safety, and protect subject anonymity.

Figure 1: General quality risk management process
General quality risk management process
Source
Source - Adapted from ICH “Quality Risk Management: Q9.” 9 November 2005. Copyright ICH. Reprinted with permission

Risk-Based Approach Case Study: Qrm

Introduced in ICH Q9 in 2005, 3 QRM is a framework to identify quality risks and mitigate them by taking suitable risk reduction measures. The QRM framework originated from good manufacturing practice (GMP) and fits manufacturing processes well, 3 , 4 but it is also employed in nonclinical and clinical arenas. A European Medicines Agency reflection paper illustrated QRM processes in clinical trials in 2013, 5 with a framework almost the same as the Q9 approach: critical process and data identification, risk identification, risk evaluation, risk control, risk communication, risk review, and risk reporting. Risk-based clinical operation has also been discussed by the US Food and Drug Administration (FDA). 6 , 7 The agency recommended monitoring plan factors such as scope, frequency, method, target sites, etc.

In QRM, communication and a common understanding are essential for all participants. In a clinical trial operation, for example, one quality risk is that investigators and/or site members could fail to follow the trial protocol because of misunderstanding. In such cases, one risk reduction measure could be a site-initiation meeting prior to the start of the trial. The CRA in charge should explain the trial protocol, operating procedures, medicinal products handling, and adverse events reporting to all team members. Training and review of procedures for clinical team members are additional risk reduction measures. If sponsors delegate some of these tasks to a supplier, risks can be mitigated by confirming the supplier’s quality management system (QMS) before the trial begins.

Risk mitigation programs must be monitored and reviewed to evaluate their effectiveness and appropriateness. They should be revised, if necessary, to mitigate newly identified risks.

Clinical Systems

In many clinical trials, data is collected and managed through web-based clinical data management systems (CDMS) with electronic data capture (EDC). Clinical project management is conducted with the assistance of clinical trial management systems (CTMS). Both CDMS and CTMS are usually constructed using configurable software—category 4 software as defined in the GAMP® 5 Guide.8 A clinical system user can perform a system validation as shown in the GAMP® 5 Guide. 8 , 9 Risks related to data integrity should also be considered. 10

By leveraging information technologies such as EDC and cloud computing services, CRAs and data managers may conduct central monitoring and/or remote monitoring. CRAs should generate their monitoring plan prior to their first site visit. If an investigator doesn’t have enough experience in conducting a clinical trial, for example, the CRA would need to visit the site frequently. Monitoring frequency should be documented in the monitoring plan.

When a CRA goes through a trial database on data management system with EDC function, they can determine whether subjects are coming to the investigator sites on schedule or not. If no protocol violation is observed through the database checking, the CRA doesn’t need to visit the site as frequently. If some protocol violations are observed, however, the CRA should go to the site, meet the site team members, and provide a comprehensive explanation of the protocol again in person.

SOPs

According to ICH E6(R2), sponsor standard operating procedures (SOPs) should include system setup, installation, use, validation, functionality testing, data collection and handling, maintenance, security measures, change control, data backup, recovery, contingency planning, and decommissioning. 2 Nowadays it is common for sponsors to delegate their clinical operation tasks to clinical research organizations, technical suppliers, and/or other third parties. 11 , 12 When a clinical system is set up as a cloud computing service or software as a service (SaaS), some technical activities can be performed by the SaaS supplier. We identified task allocation to sponsors and SaaS service suppliers in Table B. In these cases, some risks can be mitigated by confirming the supplier’s QMS beforehand.

Future Clinical Trials

To deal with the effects of recent technology on clinical trial categorization, a January 2017 ICH reflection paper proposed an eventual renovation of ICH E6 and modernization of ICH E8. E8 was first issued in 1997 to clarify general considerations for clinical trials, focus on clinical trial categorization and timing, 13 and serve as a guide to other ICH standards on clinical trials. 14 Citing the Declaration of Helsinki, E8 also emphasizes protection of trial subjects and scientific approach in design and analysis. 15 One concern, for example, is that in the future investigators could use a database investigation to conduct a clinical “trial” and generate evidence without patients’ consent or participation. 16 , 17 , 18

Table A: Case study of risk assessment: possible errors, risks, and mitigation measures in clinical data management processes
  Process Steps Possible error and risk Mitigation measure(s) Supplier*
1-1 Clinical database
setup and trial
preparation		 Setup according to trial protocol; data
definition		 Poor data definition Training and skill improvement of data
manager		  
1-2   Setup according to trial protocol; interface preparation and eCRF preparation Data entry is difficult because of poorly organized eCRF Training and skill improvement of data
manager		  
1-3   Setup according to trial protocol; edit
checking (univariate)		 Mistake on edit checking program • Training and skill improvement of clinical
programmer
• Double programming		  
1-4   Setup according to trial protocol; edit
checking (multivariate)		 Mistake on edit checking program • Training and skill improvement of clinical
programmer
• Double programming		  
1-5   General Bugs with the software Confirmation of supplier’s QMS** Software
developer
1-6   Site-initiation meeting Team members are reluctant to attend the meeting • Meeting scheduling
• Communication skill improvement of
clinical leader		  
2-1 Clinical data processing Investigator input data to eCRF Data entry error • Annotated CRF
• Training for investigator
• Frequent monitoring		  
2-2   Investigator input data to eCRF Data entry by unauthorized access or identity spoofing Training for investigator and co-worker(s)  
2-3   Investigator input data to eCRF Data alteration by unauthorized access Confirmation of supplier’s QMS Data center
provider
2-4   Automatic edit checking during data entry via
computer program		 Computer programming error Program validation  
2-5   Data transfer from eCRF database server to
central server at Sponsor		 Transfer failure because of computer
programming error		 Program validation  
2-6   Data checking by data manager with
computer program		 Checking mistake because of computer programming error Program validation  
2-7   Data checking by data manager manually Checking mistake by data manager Skill improvement of data manager  
2-8   Source document verification by CRA Discrepancy unsolved because of wrong procedures • Skill improvement of CRA
• Manager to supervise CRA’s operation		  
3-1 Data acquisition from central lab Lab test results report delivered to
investigator		 Test results with mistake because of central lab system error • Reporting system maintenance
• Confirmation of supplier’s QMS		 Central lab
3-2   Investigator input comments of lab data
to eCRF		 Data entry error • Annotated CRF
• Source document verification by CRA		  
3-3   Investigator input comments of lab data
to eCRF		 Data entry by unauthorized access or identity spoofing Training for investigator and co-worker(s)  
3-4   Investigator input comments of lab data
to eCRF		 Data alteration by unauthorized access High security  
3-5   Lab test results to be downloaded from lab
server to sponsor server		 Download failure because of computer programming error Program validation  
3-6   Lab test results to be downloaded from lab
server to sponsor server		 Operation mistake Training for operator  
4-1 Patient-related
data acquisition
via ePRO		 Patients input relevant data electronically
to ePRO device		 Operation mistake Training for patient  
4-2   Date transfer from ePRO device to
third-party server		 Transfer failure because of computer
programming error		 • Program validation
• Confirmation of supplier’s QMS		 ePRO device
provider
4-3   Date transfer from third-party server to
sponsor server		 Transfer failure because of computer
programming error		 • Program validation
• Confirmation of supplier’s QMS		 Data center
provider
5-1 Clinical data
processed to
clinical study report
and M5 dossier		 Dataset for statistical analysis generated by
data manager with computer program		 Dataset generation failure because of
computer programming error		 • Program validation
• Training and skill improvement of
clinical programmer		  
5-2   Statistical analysis results, subjects list,
tables, and figures to be generated by
statistician with computer program		 Statistical analysis failure because of
computer programming error		 • Program validation
• Training and skill improvement of
clinical programmer		  
5-3   Clinical study report preparation Documentation error Double-checking  
5-4   M5 dossier preparation based on clinical
study report		 Publication error Double-checking  
6-1 Technical
maintenance		 Data backup or server mirroring Backup failure because of technical error Confirmation of supplier’s QMS Data center
provider

*Relevant supplier is indicated if applicable ** Supplier’s QMS may be confirmed during supplier assessment
eCRF: electronic case report form QMS: quality management system CRA: clinical research associate PRO: patient reported outcome

Obviously it is important for researchers to utilize a well-organized and reliable medical database. The National Cancer Institute’s SEER (Surveillance, Epidemiology, and End Results) program, for example, is a source for cancer statistics in the United States that has generated many successful studies. Database study with real-world data is quite new and likely to increase in the future.

The General Data Protection Regulation (GDPR)19 focuses on patient information handling and anonymization in the EU. It became effective in May 2018, but anonymization rules have not yet been clearly defined nor agreed globally. Under GCP, subject identification codes are commonly used for anonymization in clinical trial operations, but it is unknown whether this is sufficient under the GDPR.

Conclusion

We discussed and investigated the adaptation of clinical trial management and system to the ICH E6 (R2) guideline. The ICH E6 (R2) guideline affects both clinical operation and clinical systems validation activities. We conducted a case study to assess quality risks of clinical data management system and its operation. Training for clinical team members and operation procedures review are important risk-reduction measures. A sponsor may delegate some tasks related to clinical system to a supplier, relevant risks can be mitigated via ensuring the supplier’s QMS. The supplier’s QMS should be confirmed through supplier assessment beforehand.

Table B: Electronic data processing system and task allocation items to be included in sponsor SOPs
Item* Task allocation
Cloud computing (SaaS) System on the premises
System setup Service supplier Sponsor
System installation Service supplier Sponsor
System use Sponsor Sponsor
System validation Sponsor Sponsor
Functionality testing Service supplier mainly
Sponsor partially (only functions to be used in their business processes)		 Sponsor
Data collection and handling Sponsor Sponsor
System maintenance Service supplier Sponsor
System security measures Sponsor Sponsor
Change control Service supplier mainly Sponsor
Data backup Service supplier mainly Sponsor
Recovery Service supplier mainly Sponsor
Contingency planning Sponsor Sponsor
Decommissioning Service supplier mainly Sponsor

* Items are cited from ICH E6(R2) 2

Acknowledgment

We appreciate the kind support of the ISPE Japan Affiliate officers.