Clinical trial risk assessment template and risk management plan

Every trial has more things that could go wrong than any team can check equally. A risk management plan makes the choice explicit: it lists what could threaten participant protection or the reliability of the results, ranks those risks, and says what the study will do about each. Without it, monitoring effort tends to follow habit, for example checking every field at every visit, rather than risk.

Revised GCP guidance encourages this proportionate approach. Capture does not claim compliance with any particular version of the guideline on this page; the point is that the planning practice is useful whichever version your sponsor and regulator apply. Our ICH E6(R3) guide for clinical trial teams explains the principles, and risk-based monitoring covers how plans become monitoring practice.

The plan is also useful outside inspections. It gives a new site, a new monitor or a new statistician a short list of what the study team has decided matters most.

A plan that is written once and filed is a document, not a process. Set a review cadence, for example at first participant in, at a defined enrolment milestone, after each interim safety review and after every protocol amendment, and record what changed and why. Where a risk has materialised, note what happened, what you did and whether the control needs to change.

Link the plan to the monitoring plan so that the two do not drift apart. If a risk is rated high, the monitoring plan should say what is checked, by whom and how often. If monitoring finds a recurring issue that is not in the plan, add it. For a template of the data side, see the data management plan template.

Take a trial whose primary endpoint is measured at week 12 within a window. The risk is that visits drift outside the window at sites with scheduling pressure. Likelihood is medium, impact is high because late measurements may be excluded from the primary analysis, and detectability is good if someone is watching. The control is a visit window in the schedule that flags late assessments, plus a monthly look at the dashboard. The owner is the study manager.

Now take eligibility. If a criterion depends on a laboratory value, the risk is that an ineligible participant is enrolled on an outdated result. The control can be built into the form: an eligibility screening eCRF with the criteria as required fields, a range check on the value, and source data verification set on that field only. That is a proportionate use of monitoring effort: heavy where the plan says it matters, light elsewhere.

Third, consider consent. The risk is that a participant undergoes a study procedure before signing, or signs an out-of-date version. A control can be procedural, a check at site activation, and system-based, since the signed consent record carries a timestamp and each signature is linked to the exact document content at signing time. The plan simply records that both controls exist and who reviews them. These examples are illustrations of structure, not a list of risks your study will have; build your own from the protocol.

Keep the register short enough to use. Fifteen to twenty well-described risks that the team actually reviews are worth more than a hundred rows nobody opens. Where several risks share a control, say so, and where a risk cannot be controlled by design, state how it will be detected.