Clinical Research and Regulatory Affairs

01Purpose and scope

• This manual supports the course Clinical Research and Regulatory Affairs and describes how the work is actually carried out in sponsor companies, contract research organizations, academic study offices and hospital research units. It is written as a working reference for study coordinators, regulatory specialists, monitors, data managers and the people who supervise them.
• The field covers the planning, submission, conduct and reporting of studies that test drugs, biologics, medical devices, diagnostics and behavioral interventions in people, along with the regulatory filings that allow products to be marketed or used. Regulatory affairs sits alongside this work as the function that interprets agency expectations, prepares submissions and keeps a product's legal status accurate over time. The two disciplines overlap heavily, and in small organizations one person often does both.
• Scope limits matter. Requirements vary by country, by product type and by sponsor policy. In the United States, the Food and Drug Administration sets many requirements in Title 21 of the Code of Federal Regulations, while in the European Union the framework includes the clinical trials regulation and related guidance. Local ethics committees, institutional review boards and national authorities add their own rules. Treat this manual as a description of common practice, and check the current text of any law, guidance or standard with the authoritative source before acting on it.
• Clinical research and regulatory work affects participant safety and public health. This guidance does not replace qualified professional judgment, approved standard operating procedures or the authorization of a responsible official such as a principal investigator, a sponsor medical monitor or a head of regulatory affairs.

02Core principles

• Participant protection comes first. Informed consent, minimizing risk and stopping a study when it becomes unsafe are not negotiable, and they set the boundaries for every other decision. The Declaration of Helsinki sets out the ethical basis that most national frameworks follow.
• Good clinical practice provides the shared language. The International Council for Harmonisation guideline E6 on good clinical practice describes responsibilities for sponsors, investigators and monitors, and most regulators accept it as the basis for trial conduct. Teams should know which parts of their local rules go beyond it.
• Data must be attributable, legible, contemporaneous, original and accurate, a set of expectations often summarized as ALCOA. Records are evidence. An inspector treats a result that cannot be traced to a source record as unreliable, however sound the science appears.
• Regulatory strategy starts early. The question of what evidence an agency will need is answered during protocol design, not after the data are in. A small change in an endpoint or study population can change whether a study supports a labeling claim.
• Decisions should be written down with their reasons. Auditors rarely challenge a decision that was documented at the time with a clear rationale. They tend to challenge the ones that appear to have no owner.

03Planning and preparation

• Start with a feasibility review. Before the protocol is final, the team checks whether enough eligible participants exist at the planned sites, whether the timeline matches site capacity and whether the budget covers screening failures and visit costs. Feasibility estimates usually rely on site questionnaires and prior enrollment data, and optimistic enrollment projections are one of the most common causes of delay.
• Map the regulatory pathway. Identify the authority, the submission type, the required application content and whether an early meeting with the agency is available or advisable. For devices, the pathway may depend on risk classification and whether a predicate exists. For combination products, more than one review office may be involved. Record the pathway in a regulatory strategy document and update it when agency feedback arrives.
• Prepare the core documents: protocol, investigator's brochure or device description, informed consent form, case report form design, monitoring plan, data management plan, statistical analysis plan and safety reporting plan. Each document carries a version number and an approval record. Consent forms should be written at a reading level suited to the target population, and translations are usually verified by a qualified translator where local rules or the ethics committee require it.
• Select sites and investigators with care. Check training records, prior inspection history, equipment, staffing and access to the patient population. Collect financial disclosure forms from investigators and keep them current. Site selection involves trade-offs: experienced academic centers often produce cleaner data but enroll more slowly, while community sites may recruit faster but need more monitoring support.

04Recommended workflow

1. 1
   : Confirm the regulatory strategy and submission type, then obtain ethics approval of the protocol and consent documents before any participant is approached. Confirm which registries require posting and by when.
2. 2
   : Prepare and submit the regulatory package, such as an investigational new drug application or a clinical trial application, including the protocol, investigator information, manufacturing summary and nonclinical data. Track the review clock and answer information requests within the time the agency sets.
3. 3
   : Activate sites. Execute site agreements and budgets, collect signed delegation logs, confirm that each staff member has current training and verify that the site holds the approved protocol and consent form.
4. 4
   : Begin enrollment. Screen against eligibility criteria, document the consent discussion using the version in effect and record each person in the screening log. Do not start study procedures before consent is signed.
5. 5
   : Monitor the trial. Monitors visit sites according to a risk-based plan, compare source documents with case report form entries, review investigational product accountability records and follow up on queries. Findings are logged, and corrective actions are assigned with due dates.
6. 6
   : Manage safety. Adverse events are recorded with severity, relationship to the product and onset date. Serious adverse events are reported to the sponsor and, where required, to the authority and ethics committee within the time frames set in the safety reporting plan and applicable rules. Expedited reports and periodic safety updates follow their own schedules.
7. 7
   : Prepare amendments, annual reports and deviation reports as the protocol and local rules require. Protocol amendments generally need ethics approval and regulatory notification before implementation, except for changes needed to remove an immediate hazard to a participant.
8. 8
   : Close out. Reconcile drug accountability, resolve open queries, lock the database, complete final statistical outputs, archive the trial master file and prepare the clinical study report and any final regulatory submission such as a marketing application.

05Quality checks, risk controls and compliance

• Build quality into the plan. A risk assessment at the protocol stage identifies the factors most likely to affect participant safety or data integrity, such as complex dosing, vulnerable populations, remote data capture or outsourced laboratory testing. Each risk receives a control, an owner and a method for detecting failure. Risk-based monitoring uses central statistical monitoring and key risk indicators to decide where on-site visits are needed, and it is acceptable under good clinical practice when the rationale is justified and documented.
• Audit trails and access controls matter for electronic systems. Systems that capture trial data should record who entered or changed a value, when, and why, and they should restrict access by role. Validation is expected, and its depth should match the risk to participants and to the reliability of the data.
• Deviations need a response. Minor deviations are logged, assessed for impact and trended. Important deviations that affect safety, rights or data reliability need a root cause analysis, a corrective and preventive action and, in many cases, a report to the ethics committee or authority. Deviations should never be hidden to protect a site's performance metrics.
• Privacy rules apply to participant data. In the United States, research data may fall under HIPAA and the Common Rule, and in the European Union under the General Data Protection Regulation. Coded data, cross-border transfers and retention periods each carry specific requirements, so confirm them with the privacy office and the current texts for each jurisdiction involved.
• Inspections happen without much notice. Keep the trial master file current throughout the study so it can be presented at any point. Inspectors look for signed consent forms, delegation logs, training records, drug accountability and a clear link between source data and reported results.

06Collaboration and documentation

• The core team usually includes a sponsor clinical lead, a clinical operations manager, a regulatory specialist, a biostatistician, a data manager, a safety physician, a quality assurance representative and a medical writer. At sites, the principal investigator remains responsible for the conduct of the study, and the study coordinator manages daily work. Roles should be stated in a signed responsibility matrix that is kept current.
• Meeting rhythm keeps the team aligned. Weekly operational meetings address enrollment, queries and vendor issues. Monthly reviews examine risk indicators, budget and timelines. Decisions are recorded in minutes with named action owners. Vendors such as central laboratories, imaging core labs and randomization system providers need oversight through contracts, quality agreements and audits.
• Documentation is the deliverable that outlasts the study. The trial master file, regulatory binder, site essential documents and submission records should be organized so that another person can reconstruct what happened. Version control prevents superseded documents from being used. A common error is treating a document as finished once it is signed, when it must also be filed, indexed and checked.
• Communication with agencies and ethics committees should be consistent and written. Keep a log of all contacts, including phone calls, and summarize each in a file note. Answer questions with the specific information requested and point to the document and section where the answer can be found.

07Measures and continuous improvement

• Track indicators that reflect the real condition of the study. Useful measures include screen failure rate, enrollment against plan, consent form errors found at first review, query aging, protocol deviations per participant, time from site selection to first participant enrolled, time from submission to approval and the share of serious adverse events reported on time. Targets should come from the study's own plan and from past performance on similar work rather than from figures quoted in general sources.
• Use indicators to guide action, not to rank people. A high deviation rate at one site may signal an unclear protocol rather than poor staff performance. Review the data with the people who generate it, and check whether a single metric is driving behavior that undermines quality.
• Close the loop after each study. Hold a lessons learned session covering feasibility accuracy, site performance, submission timelines and agency feedback. Update templates, checklists and standard operating procedures based on what the review finds, and route changes through document control and training before they take effect.
• Practice changes across contexts. An industry sponsor running a multinational phase 3 program has dedicated vendors, systems and monitors. An academic investigator running a single-site study may have one coordinator and a shared regulatory office, yet still owes the same core obligations with fewer resources. Device studies, behavioral studies and studies involving children or pregnant women bring additional requirements and review pathways.

08Common mistakes and how to prevent them

• Starting procedures before consent or ethics approval is the most serious and most avoidable error. Prevent it with a pre-activation checklist that a second person verifies, and keep electronic systems locked to the site until activation is confirmed.
• Using outdated consent forms or protocol versions usually happens when copies are stored in personal folders. Keep one controlled repository, confirm the version in use at each site visit and retire superseded copies from circulation.
• Late or missing delegation logs leave staff performing tasks they were never authorized to do. Update the log before a new person starts work and check it at every monitoring visit.
• Relying on informal communication creates gaps in the record. A verbal agreement with a reviewer or a site is not evidence. Confirm it in writing and file the confirmation.
• Underestimating regulatory review time produces unrealistic timelines. Build buffer into the plan for information requests, and anticipate the second round of questions before the first one is answered.

09Practical checklist

• Confirm ethics approval and regulatory clearance for the current protocol version before any site activation.
• Verify that each site holds signed delegation logs, current training records and the approved consent form.
• Check that every consent form in the file was signed before the participant had any study procedure.
• Review the risk assessment and monitoring plan at least once per quarter and after any major amendment.
• Reconcile investigational product accountability at each monitoring visit and at study close.
• Confirm that serious adverse events were reported within the timelines in the safety reporting plan and applicable rules.
• Log every deviation, assess its impact and record the corrective action with an owner and due date.
• Keep the trial master file current so that it can be presented at short notice.
• Record agency and ethics committee contacts in writing with a file note.
• Hold a lessons learned review at study close and update the relevant SOPs through document control.

★Learning sources

• Micro Degree: Clinical Research and Regulatory Affairs
• Micro Degree: Healthcare Administration Practice
• Micro Degree: Physiotherapy Assistant Operations
• Micro Degree: Cardiac Care Support