Risk-Based Monitoring is not simply a cost-reduction strategy. It is a precision quality management approach that concentrates oversight where the consequences of error are greatest — and proportionally reduces effort where they are not. For oncology trials, where eligibility criteria depend on molecular diagnostics, adverse events are frequent and serious, and biospecimen data drives endpoint decisions, RBM is not a luxury — it is the framework that makes complex studies manageable without compromising patient safety or data integrity.
With ICH GCP E6(R3) now formalising RBQM as the expected baseline approach (rather than an alternative), oncology CRAs, monitors, and PIs need a working understanding of how RBM is implemented in practice — not just in theory. This article covers the full RBM framework as it applies to oncology: risk identification, centralised monitoring signals, on-site visit triggers, the SDV/SDR distinction in practice, and what sites should have in place at all times.
Why Traditional 100% SDV Is No Longer the Standard
The original case for 100% source data verification was straightforward: verify every data entry against every source document, and errors will be caught. In practice, 100% SDV is resource-intensive, produces diminishing returns as a quality measure, and often displaces attention from the data that actually matters most. Multiple studies have demonstrated that intensive on-site monitoring detects relatively few errors in non-critical data fields, while critical data — primary endpoints, eligibility criteria, serious AEs — benefits most from focused, expert review.
ICH GCP E6(R3), published in May 2023, codified what many sponsors had already concluded: a risk-proportionate approach that concentrates SDV on critical data and uses centralised statistical monitoring for non-critical data is not only acceptable — it is the expected approach. Sponsors who still use uniform 100% SDV without a documented rationale are no longer aligned with the current guidance framework.
The RBM Framework in Four Stages
The RBQM cycle is a continuous process, not a one-time setup. Under E6(R3), sponsors are expected to document each stage formally, and sites are expected to understand and cooperate with the resulting monitoring plan.
Stage 1 — Risk Identification
The sponsor, often with input from the clinical team and site representatives, identifies risks to critical data and critical processes. In oncology, this includes risks specific to the therapeutic area (AE complexity, dose modifications), the patient population (performance status variability, prior therapy confounders), and the site (staff experience, laboratory capabilities, biospecimen handling history).
Stage 2 — Risk Evaluation
Each identified risk is assessed by likelihood and potential impact. Impact is weighted by the risk's ability to compromise subject safety, data integrity for primary endpoints, or regulatory acceptability of the submission. High-impact risks — those that could invalidate primary endpoint data or expose subjects to harm — receive the highest monitoring attention.
Stage 3 — Risk Control
Controls are designed proportionate to each risk. High-risk data fields receive targeted on-site SDV. Lower-risk fields receive centralised data review, trend monitoring, or remote SDR. Training and SOP requirements are specified for process risks. The monitoring plan defines the specific controls, visit frequency, SDV scope, and centralised monitoring parameters.
Stage 4 — Risk Review and Adaptation
Risk control effectiveness is assessed continuously — through monitoring visit reports, centralised monitoring outputs, deviation trends, and SAE patterns. The monitoring plan is adapted if signals emerge. E6(R3) explicitly expects this to be a documented, dynamic process, not a static document that is filed and forgotten.
Identifying Critical Data in Oncology Trials
The concept of critical data is the operational core of RBM. The sponsor must define, at protocol development, which data fields are critical — meaning that errors in those fields would materially affect subject safety assessments, eligibility determinations, or primary endpoint analyses. For oncology trials, this list is almost always longer than in other therapeutic areas.
Typically Critical in Oncology Trials
The following data categories are almost always designated critical in oncology trial monitoring plans — and should receive targeted SDV:
- Biomarker eligibility data — mutation status (KRAS, BRAF, EGFR, etc.), expression levels (PD-L1, HER2), chromosomal findings — any biomarker that determines protocol eligibility
- Primary efficacy endpoints — tumour response assessments (RECIST 1.1 or equivalent), overall survival event dates, progression-free survival determination
- Serious adverse event records — onset dates, attribution, severity grading, outcome, and reporting timeline compliance
- Dose modification decisions — dose reduction rationale, cycle delays, and the clinical basis for modifications must be fully traceable in the source record
- Informed consent documentation — correct version, date relative to study procedures, signatures, and re-consent events
- Key laboratory values used for eligibility or safety — baseline organ function labs, on-study safety labs that trigger dose modification thresholds
- Concomitant medications — particularly items that interact with the IMP or affect PK/PD endpoints
Typically Non-Critical — Monitored by SDR
Data fields that are collected for completeness but do not directly affect eligibility, primary endpoints, or safety assessments can be reviewed using SDR approaches — centralised data review, range checks, completeness monitoring — rather than requiring individual-entry SDV. Examples typically include medical history entries beyond eligibility criteria, quality-of-life questionnaire completeness checks, and ancillary demographic fields.
Centralised Statistical Monitoring: What It Detects and How
Centralised monitoring (CM) is the engine of RBM. It uses statistical and data-quality algorithms applied to the trial database to detect signals that individual on-site visits might miss — including patterns across sites, unusual data distributions, and outlier site behaviour. For monitors and sites, understanding what CM looks for helps anticipate what will trigger a visit or a query.
Key Centralised Monitoring Signals
| Signal Type | What It Looks Like | Implication for Sites |
|---|---|---|
| Enrollment velocity anomaly | Site screening or enrolling faster or slower than projected; sudden rate changes | May trigger eligibility review — unusually fast enrollment can indicate screening shortcuts |
| Screen failure rate outlier | Site's screen failure rate substantially below the trial average | Flags potential eligibility inflation — may trigger targeted SDV of eligibility criteria |
| AE rate outlier | Site reporting substantially fewer or more AEs than comparable sites | Under-reporting raises patient safety concerns; over-reporting may indicate attribution errors |
| Data entry timing anomalies | Consistent late eCRF entries; data entered in implausible bursts | Suggests source documents may not exist contemporaneously — retrospective documentation risk |
| Digit preference | Unusual clustering of values at round numbers (e.g., vital signs ending in 0 or 5) | May indicate data fabrication or imprecise measurement — triggers targeted review |
| Missing data patterns | Systematic missingness in specific fields, time periods, or patient subgroups | May reflect process failures — often resolved by targeted retraining or SOP clarification |
| Protocol deviation clustering | Multiple similar deviations in a short window, or deviations concentrated in one staff member's patients | May reflect training gap or protocol misunderstanding — triggers root cause analysis |
When centralised monitoring flags a signal, the response is proportionate to its severity. Minor data query signals may be resolved through eCRF queries and remote data review. More significant patterns — especially those affecting critical data fields or patient safety — will trigger an escalation to a targeted on-site visit.
On-Site Visit Triggers in Oncology Trials
A risk-based monitoring plan typically distinguishes between routine oversight visits (which occur at defined intervals regardless of signals) and triggered visits (which occur in response to specific events or centralised monitoring alerts). In oncology, the following events most commonly result in a triggered or accelerated on-site visit:
Safety Signal Triggers
New SAE or cluster of similar SAEs; a death on study; unexpected toxicity not previously seen at the site; discrepancy between verbally communicated SAE information and eCRF data entries.
Eligibility Integrity Triggers
Centralised monitoring flags site as outlier on screen failure rate; biomarker result timestamps inconsistent with enrollment date; eligibility review query not resolved within SLA window.
Staff Change Triggers
PI resignation or leave of absence; loss of sub-I covering a significant proportion of enrolled patients; coordinator turnover that creates ISF management risk; new staff enrolled before training records are confirmed.
Compliance Pattern Triggers
Repeated similar protocol deviations; missed visit windows across multiple patients; deviation CAPAs that have not been implemented or have not resolved the root issue; IRB or regulatory finding.
SDV vs SDR: What Each Looks Like in Practice
The SDV/SDR distinction is one of the most practically important concepts in RBM, and one of the most commonly misunderstood. SDV and SDR are not competing approaches — they are complementary tools applied to different data fields based on their criticality classification.
| Approach | What Is Checked | How It Is Performed | Applied To |
|---|---|---|---|
| 100% SDV Legacy |
Every eCRF entry verified against every source document | On-site, by monitor reviewing paper or EHR source | All data fields — now used only where explicitly required or justified |
| Targeted SDV Current Standard |
Only critical data fields verified against source documents | On-site or remote (for eSource-enabled sites) by monitor | Critical data: eligibility, primary endpoints, SAEs, dose modifications, consent |
| SDR — Remote RBM Standard |
Trends, completeness, plausibility, cross-field consistency | Centrally by data management or monitoring team; may involve automated checks | Non-critical data fields; general data quality monitoring |
| Centralised Monitoring RBM Standard |
Statistical patterns, outlier detection, missing data patterns across sites | Automated algorithms applied to trial database; reviewed by data surveillance team | All enrolled data across all sites simultaneously |
| Remote SDV eSource Sites |
Critical data fields verified against EHR or electronic source without site visit | Monitor accesses EHR remotely via sponsor-authorised system | Critical data at sites with eSource capability and remote access agreement |
Practical Implication for Site Staff
Under a risk-based monitoring plan, a monitor's on-site visit may cover a much smaller proportion of the eCRF than under legacy SDV. This is intentional — not a sign of reduced scrutiny. What changes is where the scrutiny falls. The monitor will spend more time on critical fields and less time on administrative entries. Sites should ensure that source documentation for critical data fields is particularly thorough, clearly structured, and contemporaneous.
Oncology-Specific Risk Signals That Monitors Prioritise
Beyond the generic RBM framework, oncology trials carry a set of recurring risk themes that experienced monitors focus on at every visit — regardless of what the centralised monitoring has flagged. Sites that understand these priorities are better prepared and generate fewer findings.
AE Attribution in Oncology
Adverse event attribution — determining whether an event is related to the investigational medicinal product, the disease itself, or a concomitant medication — is one of the most complex and contested areas in oncology trial data. Disease progression and treatment toxicity can present identically. Monitors will scrutinise attribution decisions, particularly for Grade 3 and 4 events, looking for clear clinical rationale documented in the source record by the responsible clinician. Patterns of systematically low IMP attribution can generate a centralised monitoring flag.
Dose Modification Traceability
Every dose modification must be traceable from a clinical decision in the source record to the eCRF entry, to the subsequent dispensing record, and to any associated toxicity grade that justified the modification. This chain of documentation is a critical audit pathway. Missing links — for example, a dose reduction recorded in the eCRF without a documented clinical rationale — are among the most common findings at oncology sites.
Biomarker Eligibility Integrity
In biomarker-stratified or biomarker-selected oncology trials, the laboratory report confirming the qualifying mutation or expression result must be present in the ISF before the patient can be randomised or receive study drug. The date on the laboratory report must be contemporaneous with the screening window. Monitors will verify: the original certified report is filed (not a photocopy or verbal confirmation), the laboratory performing the test meets sponsor specifications, and the result was reviewed by the PI or sub-I before study procedures commenced.
Biospecimen Collection and Processing Records
Where biospecimen data contributes to endpoints — tumour biopsy samples, PBMC isolation for immunological endpoints, serial blood draws for ctDNA analysis — the collection, processing, and shipment records are treated as critical data. Processing delays, temperature excursions, or chain-of-custody gaps are recorded as deviations and may affect sample acceptability at the central lab.
Site Documentation Expectations Under RBM
Sites often ask what they should have in place between monitoring visits under a risk-based plan. The answer is that RBM does not reduce documentation standards — it changes who reviews what, and when. The following documentation should be current, complete, and retrievable at all times:
ISF Readiness Checklist — Critical Items
Conducting and Preparing for a Monitoring Visit Under RBM
Under a risk-based monitoring plan, pre-visit preparation is more targeted than in traditional SDV-based monitoring. The monitor will typically communicate in advance which patients are being reviewed, which data fields will receive SDV, and what specific concerns (if any) have been flagged by centralised monitoring. Sites should use this information to prepare efficiently rather than reviewing every patient's chart in anticipation of 100% SDV.
Before the Visit
- Review any open action items from the previous monitoring report and update the action item tracker
- Confirm the ISF is current — check delegation log, consent form version, and lab certifications
- Pull source documentation for the specific patients and fields flagged by the monitor
- Check for any new protocol deviations since the last visit and ensure they are logged and CAPAed
- Ensure the PI has reviewed and acknowledged all pending items requiring PI oversight
During the Visit
- Make source documents accessible promptly — delays in retrieving charts generate their own findings
- Be transparent about any issues identified since the last visit — monitors respond better to proactive disclosure than to discovering unreported deviations
- Involve the PI for any clinical clarification questions — do not have the coordinator interpret clinical decisions on behalf of the physician
- Ensure the monitor has a private workspace and access to the eCRF and source simultaneously
After the Visit
- Track all action items from the monitoring report and assign owners with completion dates
- Implement any CAPAs before the next monitoring contact (remote or on-site)
- PI should review and sign the monitoring report acknowledgment — this is a regulatory document
- File the monitoring report in the ISF under the appropriate study section