vaayaa Inclusive Education
Healthcare risk assessment

Clinical Research and Regulatory Affairs Risk Assessment: Participant Safety, Data Integrity and Compliance Controls

A worked example of how a small clinical research team finds, scores and controls the risks that threaten participant safety, consent, data integrity, regulatory compliance and continuity of study work.

Updated November 2026 8 hazards assessed Review every 6 months Highest risk: Critical to Medium
See the Clinical Research and Regulatory Affairs course

Executive summary

This assessment shows how a small clinical research team can find, rate and control the risks that matter most to participant safety, consent, data integrity and regulatory standing. Eight risks were chosen because they are plausible in everyday study work. Missed adverse events are the most serious, with a high chance of harm if recognition and reporting slip. Consent gaps, documentation errors, storage problems and privacy breaches carry significant but more controllable scores. Each risk is scored before controls and again after existing and added controls. Most risks fall to Medium or Low once the added controls are in place, but adverse event recognition stays at Medium because the potential harm to participants remains serious. The first actions are a recorded weekly safety review, a current consent version check, a two person dispensing check and a tested backup freezer plan. The study is a teaching example, so every score illustrates method, not a real trial.

Focus area
Clinical research and regulatory affairs
Setting
Clinical research site and sponsor regulatory team running an early-phase study in a healthcare setting
Method
Five by five likelihood and impact risk register

Scope

This assessment covers a single early-phase study run by a clinical research site, from participant screening and consent through dosing, follow-up, safety reporting, data handling and regulatory submissions. It does not cover treatment decisions for patients outside the study. Jurisdiction, study design, sponsor arrangements and systems are not specified, so they are treated as assumptions for teaching only.

Context

The site has a principal investigator, a study coordinator, research nurses, a pharmacy team that holds investigational product, a data manager and a regulatory affairs lead who keeps approvals and submissions current. Visits are recorded in an electronic data capture system and in source documents kept at the site. Each risk is scored before controls to show its natural level, then again after existing controls and the additional controls that are proposed.

Objectives, assets and stakeholders

The objective is to protect participants from avoidable harm, keep consent valid, produce reliable data, meet regulatory and ethical duties, and keep the trust of participants, sponsors and regulators. The assets in scope are participant safety, investigational product, source records and trial data, coded and identifiable personal information, laboratory samples, equipment and the reputation of the research team. Stakeholders include participants and their families, investigators and study staff, pharmacy and laboratory teams, the sponsor, the ethics committee and regulatory authorities. Every risk has one owner role, and the principal investigator reviews the register with the team each month.

Risk matrix: before and after controls

Each cell shows hazard numbers placed by likelihood and impact. Compare the two grids to see how controls move each hazard.

Before controls

Inherent risk

Risk before controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely Likelihood 4, impact 5, score 20, critical: H01
3 Possible Likelihood 3, impact 3, score 9, medium: H03 H07 Likelihood 3, impact 4, score 12, high: H02 H05 H06 Likelihood 3, impact 5, score 15, high: H04
2 Unlikely Likelihood 2, impact 4, score 8, medium: H08
1 Rare

After controls

Residual risk

Risk after controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely
3 Possible
2 Unlikely Likelihood 2, impact 2, score 4, low: H03 H07 Likelihood 2, impact 3, score 6, medium: H02 H05 H06 Likelihood 2, impact 4, score 8, medium: H01 H04
1 Rare Likelihood 1, impact 4, score 4, low: H08
  • Low 1 to 4
  • Medium 5 to 9
  • High 10 to 16
  • Critical 17 to 25

Hazard register

A summary first, then the detail for each hazard.

Summary of hazards with scores before and after controls
No.HazardBeforeAfterOwner
H01 Missed or delayed recognition and reporting of adverse events 20 Critical 8 Medium Principal investigator
H02 Gaps in informed consent and participant understanding 12 High 6 Medium Regulatory affairs lead
H03 Protocol deviations and inaccurate source documentation 9 Medium 4 Low Study coordinator
H04 Investigational product storage, accountability and dispensing errors 15 High 8 Medium Pharmacist responsible for study medicines
H05 Privacy breach and loss of participant records 12 High 6 Medium Data protection lead for the site
H06 Regulatory submission and inspection readiness failures 12 High 6 Medium Regulatory affairs lead
H07 Staffing gaps, unclear handovers and competence lapses 9 Medium 4 Low Principal investigator
H08 Sample handling, equipment failure and infection exposure 8 Medium 4 Low Laboratory manager
H01

Missed or delayed recognition and reporting of adverse events

Safety Before 20 After 8

A participant has a side effect or deterioration that is not recognized, recorded or reported to the sponsor and ethics committee in time, so harm goes untreated and the study continues with unsafe dosing.

Who or what is affected: Study participants, investigators and the sponsor safety team

Causes

Subtle early signs, busy clinic days and reliance on free text notes rather than coded terms.

Consequences

Delayed treatment, serious harm to participants, late reporting breaches and suspension of the study.

Existing controls

  • Research nurses check participants against a scheduled safety checklist at each visit.
  • Serious events are logged in the safety database and reviewed by the principal investigator.

Control gaps

The weekly safety listing review is not yet recorded, and reporting timelines are not tracked against a calendar.

Additional controls

  • Prevent: Use a structured symptom checklist and a trained escalation step at every dosing visit.
  • Detect: Review safety listings each week and compare them with source notes for missing entries.
Likelihood 4 x impact 5 before; 2 x 4 after Owner: Principal investigator Target: Within 30 days Early warning: Safety listing entries older than the agreed reporting window without a documented assessment.
H02

Gaps in informed consent and participant understanding

Legal and compliance Before 12 After 6

Consent is taken by someone not trained to take it, uses an outdated information sheet, or is not repeated when new safety information arises, so participants may not understand what they agree to.

Who or what is affected: Participants, consent takers and the ethics committee

Causes

High workload, version control based on paper copies and participants who are unwell or under pressure.

Consequences

Invalid consent, withdrawal of data, ethics findings and loss of participant trust.

Existing controls

  • Each consent form is signed and dated before any study procedure begins.
  • Consent takers are listed on a delegation log approved by the investigator.

Control gaps

Paper copies of old information sheets remain in clinic rooms, and version checks are not logged.

Additional controls

  • Prevent: Check the current approved version of the information sheet before every consent discussion.
  • Respond: Re-consent participants promptly when new safety information or an amendment affects them.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Regulatory affairs lead Target: Within 30 days Early warning: Consent forms carrying a version number that is not the current approved version.
H03

Protocol deviations and inaccurate source documentation

Operational Before 9 After 4

Visits are performed outside the protocol window, or results are recorded without source notes, so the data cannot be verified and the study findings are weakened.

Who or what is affected: Sponsor, data users, monitors and participants whose data is used

Causes

Complex visit schedules, staff holidays and copy-forward habits in electronic records.

Consequences

Protocol deviations, data queries, delays in analysis and rejected results.

Existing controls

  • Monitors compare a sample of entries with source records each month.
  • Visit schedules are kept in the study calendar and checked by the coordinator.

Control gaps

Deviation trends are not summarized, so repeated patterns are noticed late.

Additional controls

  • Prevent: Build visit windows into the electronic schedule with automatic reminders.
  • Detect: Log each deviation within a set period and review the trend at each monitoring meeting.
Likelihood 3 x impact 3 before; 2 x 2 after Owner: Study coordinator Target: Within 60 days Early warning: Visits completed outside the agreed window, or more than two open data queries on one participant.
H04

Investigational product storage, accountability and dispensing errors

Safety Before 15 After 8

Study drug is stored outside its required conditions, dispensed to the wrong participant, or not reconciled against stock records, which can cause unsafe dosing or invalid study results.

Who or what is affected: Participants, pharmacy staff and investigators

Causes

Manual logs, staff turnover and supplies delivered outside normal hours.

Consequences

Unsafe exposure, loss of product, invalid study data and regulatory findings.

Existing controls

  • Storage temperatures are logged twice daily with an audible alarm.
  • Dispensing is recorded on a participant specific log that the pharmacist signs.

Control gaps

Alarm response times are not tested, and out of hours deliveries are not checked against the log.

Additional controls

  • Prevent: Use a two person check at dispensing for every new supply batch.
  • Detect: Reconcile stock counts against dispensing logs each week and investigate any gap.
Likelihood 3 x impact 5 before; 2 x 4 after Owner: Pharmacist responsible for study medicines Target: Within 30 days Early warning: A temperature excursion without a documented response within the agreed time.
H05

Privacy breach and loss of participant records

Technology and data Before 12 After 6

Participant identifiers, medical notes or trial data are sent to the wrong person, left on unlocked screens or stored on unapproved devices, which breaches confidentiality and exposes people to harm.

Who or what is affected: Participants, families, staff and sponsor data teams

Causes

Email copying, shared printers, portable storage and busy handovers.

Consequences

Harm to participant privacy, regulatory reports, loss of trust and withdrawal from the study.

Existing controls

  • Paper records are kept in a locked room, and electronic access needs a named login.
  • Staff complete confidentiality training before accessing participant data.

Control gaps

Access logs are not reviewed, and portable device use is not tracked.

Additional controls

  • Prevent: Use coded participant identifiers in all data transfers and block personal email for study data.
  • Respond: Follow a written breach procedure with the data protection contact and inform participants as required.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Data protection lead for the site Target: Within 45 days Early warning: Access to participant records from an account that does not appear on the delegation log.
H06

Regulatory submission and inspection readiness failures

Legal and compliance Before 12 After 6

Approvals, amendments, annual reports or safety notices are submitted late, incomplete or with the wrong document version, and the site cannot show its files when inspected.

Who or what is affected: Sponsor, regulators, ethics committee and study staff

Causes

Changing rules by jurisdiction, many documents to track and end of study pressure.

Consequences

Suspension of recruitment, inspection findings, delayed results and loss of approval.

Existing controls

  • A regulatory tracker lists the main submission dates.
  • The trial master file is reviewed by the regulatory lead every quarter.

Control gaps

Mock inspections are not scheduled, and the tracker is not linked to the filing system.

Additional controls

  • Prevent: Use a submission checklist with a second reviewer before any filing leaves the site.
  • Detect: Run a mock inspection of the trial master file twice a year and record the gaps found.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Regulatory affairs lead Target: Within 60 days Early warning: A submission due within 14 days that has no named preparer or reviewer.
H07

Staffing gaps, unclear handovers and competence lapses

People Before 9 After 4

Staff leave, cover is thin, or a new team member has not completed training, so tasks are missed, duties overlap or a handover leaves a participant without a clear plan.

Who or what is affected: Participants, research team and investigators

Causes

Small team, short notice absence and reliance on informal handover notes.

Consequences

Missed visits, unsafe care gaps, repeated work and loss of staff confidence.

Existing controls

  • A delegation log lists who may perform each task.
  • Training records are checked before a new person starts any study task.

Control gaps

Backup cover is not tested, and training refreshers are not tracked against the delegation log.

Additional controls

  • Prevent: Keep a named backup for every critical task and confirm cover before leave is approved.
  • Respond: Hold a structured handover meeting with a written summary for any participant whose care changes hands.
Likelihood 3 x impact 3 before; 2 x 2 after Owner: Principal investigator Target: Within 45 days Early warning: A critical task with no named backup, or a training record older than the agreed refresher period.
H08

Sample handling, equipment failure and infection exposure

Safety Before 8 After 4

Biological samples are mishandled, equipment such as centrifuges or freezers fails, or sharps and specimens expose staff and participants to infection or spills during collection.

Who or what is affected: Research nurses, laboratory staff, cleaners and participants

Causes

Ageing equipment, rushed collections and gaps in infection control training.

Consequences

Needlestick or exposure injury, lost samples, invalid results and the need to repeat procedures.

Existing controls

  • Sample collection follows a written procedure with personal protective equipment.
  • Equipment is serviced according to the manufacturer instructions and each service is recorded.

Control gaps

Backup freezer capacity is not verified, and exposure incidents are not reviewed for patterns.

Additional controls

  • Prevent: Train staff on safe sharps use and provide a sealed disposal route at every collection point.
  • Recover: Keep a tested plan for moving samples to a backup freezer if equipment fails.
Likelihood 2 x impact 4 before; 1 x 4 after Owner: Laboratory manager Target: Within 30 days Early warning: An exposure or spill incident, or a freezer alarm not acknowledged within the agreed time.

Rating method and evaluation

Each risk is rated on two five-point scales. Likelihood runs from Rare to Almost certain, and impact runs from Insignificant to Catastrophic. Multiplying the two gives a score from 1 to 25, which falls into one of four bands: Low from 1 to 4, Medium from 5 to 9, High from 10 to 16 and Critical from 17 to 25. The score is a guide for ordering work, not a measurement. Inherent risk is the score before any controls. Residual risk is the score after the existing controls and the additional controls are in place. Impact to participants is judged first, so a risk to participant safety is never rated down only because it has not yet happened. Anything Critical or High needs senior attention and a dated plan, anything Medium needs routine controls with a named owner, and anything Low is accepted and watched. Staff who do the work should challenge the ratings, and any rating is reviewed whenever a monitoring indicator reaches its escalation threshold.

Likelihood, impact and rating bands

Likelihood

  • 5 Almost certain: Expected to happen in most circumstances.
  • 4 Likely: Will probably happen in many circumstances.
  • 3 Possible: Could happen at some time.
  • 2 Unlikely: Not expected, but it could happen.
  • 1 Rare: Only in exceptional circumstances.

Impact

  • 1 Insignificant: No lasting effect. Handled within routine work.
  • 2 Minor: Small effect that is quickly corrected.
  • 3 Moderate: Noticeable effect that needs managed effort to correct.
  • 4 Major: Serious effect on people, delivery or reputation.
  • 5 Catastrophic: Severe or lasting effect that threatens the whole activity.

Bands (likelihood x impact)

  • Low (1 to 4): Accept and monitor.
  • Medium (5 to 9): Manage with routine controls.
  • High (10 to 16): Senior attention and a treatment plan.
  • Critical (17 to 25): Act first. Do not proceed until reduced.

Monitoring, escalation and review

Review this assessment every 6 months, and sooner when an indicator below reaches its threshold.

Early-warning indicators and escalation thresholds
Indicator to watchEscalate when
Safety listing entries older than the agreed reporting window without a documented assessment.Escalate to the principal investigator at once, and to the sponsor safety contact if any entry remains open after the reporting window.
Consent forms carrying a version number that is not the current approved version.Escalate to the regulatory affairs lead on the same day, and re-consent affected participants before any further study procedure.
Temperature excursions without a documented response within the agreed time.Escalate to the pharmacist immediately, and quarantine the affected supply until the principal investigator approves its use.
Access to participant records from an account that does not appear on the delegation log.Escalate to the data protection lead within one working day, and suspend the account until its access is confirmed.
Submissions due within 14 days that have no named preparer or reviewer.Escalate to the principal investigator at once, and to the sponsor regulatory contact if the filing is still unassigned after 3 days.

Contingency arrangements

If a serious event occurs, such as a serious adverse event, a confirmed privacy breach or a failed storage unit, the principal investigator pauses dosing for the affected participants and informs the sponsor and ethics committee as the protocol requires. The pharmacist quarantines affected supplies and records every step. The IT manager isolates affected accounts and restores data from the latest tested backup. Participants receive clear, early information about their care and their data.

Prioritized action plan

  1. Record a weekly safety listing review with a documented assessment for each entry, owner principal investigator, within 30 days.
  2. Check the current consent version before every consent discussion and remove paper copies of superseded sheets, owner regulatory affairs lead, within 30 days.
  3. Add a two person check at dispensing and test the alarm response for storage units, owner pharmacist, within 30 days.
  4. Enable coded identifiers for all data transfers and review access logs, owner data protection lead, within 45 days.
  5. Name a backup for every critical study task and test the backup freezer plan, owner laboratory manager, within 30 days.

Conclusion

Reliable research depends on a few steady habits: structured safety checks, current consent versions, two person checks for medicines, coded data, tested backups and a calendar for every submission. The highest scores sit with missed adverse events and storage errors, and each has actions that bring the residual score down. Treat the register as a living record, review it on the stated cycle, and seek qualified clinical, pharmacy and regulatory advice for any real study decision.

Assumptions and limitations

Assumptions

  • The study is conducted under a recognized ethical review and sponsor oversight arrangement that is not described in detail here.
  • Staff hold appropriate professional registrations, and training records are kept for each person on the delegation log.
  • Jurisdiction and regulatory authority are not specified, so legal duties are described in general terms only.
  • Systems are commercial, managed by the site IT team, and backed up on a regular schedule.

Limitations

  • The scores are examples for learning and do not describe any real study, site or sponsor.
  • Clinical, pharmacy and regulatory rules differ by country and change over time, so specialist review is needed.
  • This is educational content and does not replace a formal site-specific assessment or advice from licensed clinicians, pharmacists or regulatory specialists.

Related frameworks to study

  • Good Clinical Practice principles
  • Risk-based quality management approach
  • Hierarchy of controls
  • Three lines model of risk ownership
  • Informed consent principles

Healthcare Risk Assessment

China, India, United States, Indonesia, Pakistan, Nigeria, Brazil, Bangladesh, Russia, Japan, Mexico, Philippines, Vietnam, Egypt, Turkey, Germany, United Kingdom, France, Italy, Canada, South Korea, Australia, Spain.

For Learning Reference Only: This assessment demonstrates how risk assessment principles are applied in a practical setting, providing a useful reference for learning and understanding. Actual assessments may be adapted to suit specific site conditions and circumstances.

Keep learning

Study the subject behind this assessment.

Clinical Research and Regulatory Affairs course Read the best practices for this course

More Healthcare risk assessments

Hourly Active: 45,552 Learners