Risk-based quality management (RBQM) asks one question across the whole trial: what could go wrong that matters, and what is proportionate to do about it? This guide explains the method that ICH E6(R3) describes, from critical-to-quality factors to acceptable ranges, and shows how a small team can run it without a dedicated analytics platform.
Free sandbox · No credit card · 21 CFR Part 11 aligned
Identify critical to quality factors
Primary endpoint integrity, consent, dosing, safety reporting
Assess risks
Likelihood, impact, detectability per factor
Control proportionately
Design, training, edit checks, monitoring focus
Communicate and review
Metrics, issues, acceptable range excursions
Report
Quality management summarised in the report
RBQM in brief
The idea
For decades, trial quality was pursued by volume: monitor every site often, verify every data point against the source and check everything twice. It was expensive, and the evidence that it improved the things that matter was thin. A visit that confirms ten thousand low-value fields can still miss that consent was obtained late, that the dose was wrong at one site or that the primary endpoint is measured inconsistently.
Risk-based quality management turns this around. You define, at the protocol stage, what must go right for the trial to protect participants and produce a reliable answer. You then look for what could threaten each of those items, estimate how likely and how serious each threat is, and decide on controls that fit the size of the risk. A low-risk, easily corrected issue may get no special control. A high-risk issue gets design changes, training, system controls and targeted oversight.
This is the approach set out in the ICH Good Clinical Practice guideline. E6(R2) introduced a section on quality management, and E6(R3), adopted by ICH in January 2025, builds on it with an emphasis on proportionality and on quality by design. The risk-based quality management section is Section 3.10 in the text reported by secondary sources, though some cite numbering that differs by annex, so check the published guideline before quoting a section number. For what changed overall between versions, see the ICH E6(R3) guide for clinical trial teams and the Annex 2 guide.
Note that Capture does not claim formal E6(R3) compliance. This page explains the method so you can apply it with whatever system you use.
How to do it
Scaled down, the method fits on a few pages and a spreadsheet. Larger studies add analytics, but the logic is the same.
Read the protocol with one question: if this went wrong, would participants be harmed or the answer be unreliable? Typical CtQ factors are eligibility, informed consent, the primary endpoint measurement, investigational product dosing and accountability, blinding integrity and safety reporting. Aim for a short list. If everything is critical, nothing is.
For each factor, list realistic failure modes. For a primary endpoint measured by site staff, examples are inconsistent technique, missed assessment windows and unit errors. Draw on your own past studies and on your sites' experience, not only on templates.
Rate each risk on likelihood, impact and how easily it would be detected. A simple three-level scale is enough. The goal is a ranked list, not false precision. The clinical trial risk management plan template offers a structure for this.
Prefer controls that remove the risk at the source: simplify the protocol, remove non-essential data, make the form harder to fill in wrongly. Next come system controls (edit checks, required fields, calculated fields), then training and, last, extra checking. Monitoring can be centralised, remote or on site, and weighted toward the CtQ data.
Pick a handful of trial-level measures tied to CtQ factors, such as the proportion of participants with a major deviation in a critical procedure or the proportion with a missed primary endpoint assessment. Define the range you consider acceptable and what happens on an excursion: evaluate, document, act if needed.
Review the metrics on a set schedule, at least at each monitoring cycle and after major events. Record issues, their root cause and the action. Update the risk assessment when the protocol is amended or the data show something new.
Summarise the approach, the main issues, any excursions and the response in the study report. Regulators ask for this, and it gives the next study something to start from.
A worked example
Illustrative only. Your factors, scores and ranges come from your own protocol.
| CtQ factor | Risk | Control | Acceptable range (demo) |
|---|---|---|---|
| Informed consent | Procedure before signed consent | Consent captured and countersigned before screening forms unlock; coordinator training | 0 participants with procedures before consent |
| Eligibility | Ineligible participant randomized | Eligibility checklist with required fields; second reviewer before randomization | Under 2% of randomized participants |
| Primary endpoint | Missed or out-of-window assessment | Visit window flags; reminders; central review of timing | Under 5% of expected assessments |
| Dosing | Wrong dose or missed doses | Dose fields with range checks; accountability log | Under 3% of participants with a major dosing deviation |
| Safety reporting | Late SAE report | Same-day escalation process; timing review each cycle | Zero late expedited reports |
| Blinding | Unblinding by accident | Role-based access; blinded roles never see arm values | No unplanned unblinding events |
Demo data. Ranges are placeholders to show the format, not recommendations.
In the free sandbox you can add edit checks, set SDV per field and test how your risk controls behave in the forms. No credit card and no time limit.
Monitoring is one control
Many teams meet RBQM first as risk-based monitoring (RBM), and the two terms are often mixed. RBM is the part concerned with oversight of sites and data: where to look, how often and how deeply. RBQM is the umbrella covering design, training, systems, monitoring and response. If you want a definition of the monitoring piece alone, see the glossary entry for risk-based monitoring; for tooling that supports targeted source data verification, see risk-based monitoring and SDV software.
The practical effect is that monitoring effort follows the risk assessment. Critical data points can be verified at 100 percent, while low-risk fields are sampled or checked centrally. Sites that show unusual patterns, such as a different distribution of values or a high query rate, can be prioritized for contact or a visit. A monitoring visit report then records findings against the CtQ factors rather than against a generic checklist.
Remote and central review do not replace on-site visits entirely. They change what an on-site visit is for: less time on routine verification, more on training, process, investigational product handling and the things that can only be checked in person.
Controls in the system
The cheapest control is the one that stops an error at entry. A platform where the study team builds the forms can put risk controls into the casebook as the risk assessment changes, without waiting for a vendor change order.
Open queries
14
Out-of-window visits
6.2%
Late SAE reports
0
Review first
Common failure modes
Writing the plan and never reading it again. A risk register that is signed at start-up and never updated is paper compliance. Schedule the review and tie it to protocol amendments.
Too many critical factors. A list of thirty CtQ items cannot be monitored. Merge them and keep only what would change a participant's safety or the interpretation of the primary result.
Treating acceptable ranges as pass/fail. A range is a trigger for evaluation. The response may be to investigate, retrain or accept the excursion with a reason. What matters is that the decision is documented.
Ignoring deviations as a data source. Patterns in protocol deviations are among the best signals of a process that does not fit the real world. Review them by type and by site.
Adding checks instead of removing complexity. A leaner protocol and fewer data points are the strongest risk controls. If a field is not needed for the endpoint or for safety, drop it.
Readiness check
Short list, signed by the sponsor and clinical lead.
Ranked by likelihood, impact and detectability.
Design, system, training and monitoring controls named.
Who reviews, how often, what an excursion triggers.
Per-field SDV, central review and visit triggers set.
Linked to monitoring cycles and protocol amendments.
Kept current, referenced in the report.
Risk-based quality management (RBQM) is a systematic way of focusing quality effort on the aspects of a trial that matter most to participants' rights, safety and the reliability of results. It covers identifying critical-to-quality factors, assessing risks, applying proportionate controls, reviewing results and reporting the approach.
Risk-based monitoring is the part of RBQM that concerns oversight of sites and data. RBQM is broader: it starts at protocol design and includes training, system controls, monitoring, issue management and reporting.
They are the elements of a trial that are essential to protecting participants and to producing reliable results, for example informed consent, eligibility, primary endpoint measurement, investigational product dosing and safety reporting. They are specific to each protocol.
Quality tolerance limits (QTLs) were introduced in ICH E6(R2) as pre-defined levels for trial-level parameters that, if crossed, signal a possible systemic issue. Secondary sources report that E6(R3) frames them as acceptable ranges. Check the guideline text for the wording that applies to you.
ICH adopted E6(R3) in January 2025, and sources report an EU effective date of 23 July 2025. Whether it is binding depends on the region and local law, and sources found did not show a binding US compliance date. Check your regulator's current position.
The principle applies to every trial, but the documentation can be proportionate. A single-site study may need a one-page CtQ list, a short risk register and a review date. Larger or higher-risk trials need more.
Capture does not make a formal E6(R3) compliance claim. It provides features that support a risk-based approach: edit checks, per-field SDV, a field-level audit trail, role-based access and a draft-to-approved form lifecycle, with 21 CFR Part 11-aligned controls.
Not to start. A CtQ list, a risk register and a regular review can run in documents and spreadsheets. Software helps when you need to track metrics across many sites. Your data capture system should at least let you apply targeted controls and export data by site.
Keep exploring
ICH E6(R3) guide
What changed from R2.
ICH E6(R3) Annex 2
Decentralised, pragmatic and RWD designs.
Risk-based monitoring
The monitoring piece defined.
Risk-based monitoring and SDV software
Verify what matters.
Risk management plan template
A document to start from.
Monitoring visit report template
Record findings against CtQ factors.
Protocol deviation tracking
A key early-warning signal.
Good clinical practice
The framework behind it.
Free sandbox with every feature. No credit card, and you pay only when you go live with real participants.