The Operating System for the Clinical Trial Lifecycle™

Aurelyn AI Life Sciences Academy · ICH/GCP Mastery

ICH/GCP Mastery for Modern Clinical Trials

A comprehensive, immersive training programme covering the latest ICH E6(R3) Principles, Annex 1, and Annex 2 — including the global frameworks that sponsors, CROs, sites, IRBs and regulators must navigate to run inspection-ready clinical trials in 2026 and beyond.

Why this programme?

The clinical trial landscape has been transformed since ICH E6(R2) was published in 2016. Decentralized elements, digital health technologies, electronic data sources, risk-based oversight, and real-world data have moved from the edge to the centre of how trials are designed and conducted. ICH E6(R3) reflects that transformation — and every sponsor, CRO, investigator, monitor, IRB member, data manager, and regulatory affairs professional involved in clinical trials needs to understand it.

This programme is built for non-technical learners as much as for experienced trial professionals. We assume no prior GCP certification, explain every acronym, and link every regulatory claim to its primary source. By the end you will be able to navigate ICH/GCP confidently — and explain it to your team.

Programme structure

How to navigate

Foundations of GCP

History, ethics, and the international architecture that made Good Clinical Practice possible.

Modern clinical research ethics did not arrive in a single document. It was built — painfully — over 50 years, in response to specific human tragedies. To understand why GCP is structured the way it is, you have to understand the events that forced each correction.

🪦 Nuremberg Code (1947)

After the Nuremberg Doctors' Trial — which prosecuted Nazi physicians who conducted lethal experiments on concentration camp prisoners without consent — the tribunal articulated ten principles for permissible human experimentation. The first sentence is the one that founded modern research ethics:

Everything in GCP today — informed consent forms, IRB review, capacity assessments, voluntariness language — flows downstream from this single sentence.

📖 Declaration of Helsinki (1964, last revised 2024)

The World Medical Association (WMA) translated Nuremberg into a practical, physician-facing standard. Helsinki introduced concepts that GCP later operationalised: independent ethics committee review, written research protocols, the distinction between therapeutic and non-therapeutic research, and the explicit duty to protect vulnerable populations. The 2024 revision (Helsinki version 9) emphasised post-trial access to interventions, data transparency, and the rights of communities, not just individuals.

⚠️ Tuskegee (1932–1972) and the trigger for Belmont

The U.S. Public Health Service "Tuskegee Study of Untreated Syphilis in the Negro Male" enrolled 600 Black men in Alabama in 1932. When penicillin became standard syphilis treatment in 1947, researchers continued to withhold it from participants — for 25 more years. The study only ended in 1972 after a journalist exposed it. In the aftermath, the U.S. Congress passed the National Research Act (1974), which created the National Commission for the Protection of Human Subjects, which produced the Belmont Report in 1979.

⚖️ The Belmont Report (1979) — three principles

Belmont distilled the ethical foundation into three principles that map onto every clinical trial activity:

By 1990, drug development had gone global, but the rules had not. The same molecule had to be tested separately to satisfy FDA, the European Commission, and Japan's Ministry of Health — duplicating trials, delaying access to medicines, and exposing more participants to risk than necessary. The International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use (ICH) was founded in 1990 to fix that.

The four ICH guideline categories

For clinical trials, the most important code is E6 — Good Clinical Practice — which is the focus of this entire programme.

▶ Hover or tap each card to reveal how each principle translates into practice

ICH E6 has been revised twice since it was first issued in 1996. Each revision was a response to how clinical trials had changed — and what the previous version did not anticipate.

Why E6(R3) was needed

E6(R2) was effectively a patch on a 20-year-old guideline. It bolted "addendum" sections onto a framework still rooted in paper-era assumptions. E6(R3) is a fundamental restructure — built around Quality by Design, proportionate risk-based oversight, and a media-neutral approach that accommodates whatever technology comes next. It does not assume paper. It does not assume in-person visits. It does assume that quality and participant protection are designed in from the start, not inspected in at the end.

GCP is shorthand for a quality and ethical standard that applies to every clinical trial activity. ICH defines it formally as:

GCP's two operational outcomes

Every requirement in ICH E6(R3), every clause in 21 CFR 312, every article in EU CTR 536/2014 — exists to serve one of these two outcomes. If you remember nothing else, remember those two outcomes. They are the test for every operational decision you will make in a trial.

📎 Resources for Module 1

ICH E6(R3) Principles + Annex 1

The 11 Principles, the structure of Annex 1, and how E6(R3) modernises sponsor and investigator responsibilities.

E6(R3) is intentionally modular. It separates the durable, technology-agnostic ethical and quality foundations from the operational details, which can be updated more easily as trial methodologies evolve.

What "media-neutral" means

E6(R2) and earlier versions implicitly assumed paper records, in-person visits, and CRA-driven on-site monitoring. E6(R3) is deliberately written so that none of those assumptions are required. A trial can be 100% paper, 100% electronic, or any mix — the principles are the same. The same rule applies to monitoring: it can be on-site, off-site, centralised, remote, or risk-based hybrid. The standard is the outcome, not the method.

The Principles section of E6(R3) is short on purpose. It contains 11 statements that are intended to remain stable as trial methodology evolves. Every requirement in Annex 1 and Annex 2 traces back to one or more of these principles. Memorise these — they are the foundation of every operational decision.

Principle 8 is the most operationally significant change in E6(R3). It is the bridge from ICH E8(R1) (general considerations for clinical studies) and ICH Q9(R1) (quality risk management) into the conduct of clinical trials.

Quality by Design means that quality is built into the trial during planning — through the protocol, the case report form, the operational model, the technology choices — not bolted on later through monitoring or auditing. The mechanism that operationalises QbD is the identification and management of Critical-to-Quality factors.

Annex 1 is where E6(R3) gets specific. It is organised around the actors and artifacts of an interventional clinical trial. If you have worked with E6(R2), the section headings will feel familiar — but the content has been substantially modernised.

Where E6(R3) Annex 1 differs most from E6(R2)

Proportionality is the operational logic that ties the principles to the annexes. It says: the level of effort, control, and documentation should be proportionate to the risk to participants and the reliability of the results. Used well, it reduces busywork and concentrates attention where it matters. Used poorly, it becomes a justification for cutting corners.

Three rules for applying proportionality defensibly

1. Document the rationale. "We did 30% targeted SDV on this domain because the risk assessment ranked it medium and central monitoring covered the rest" — that's defensible. "We did 30% SDV because that's what the previous study did" — is not.
2. Apply at the data-point level, not the trial level. A trial does not have one risk; it has a risk profile across many activities. The risk of the consent process is different from the risk of the dose dispensing log.
3. Review and re-rank as data accrues. Risk assessment is not a one-time document at study start. Signals — protocol deviations, monitoring findings, safety reports — should trigger re-assessment and possibly re-ranking of CtQ factors.

📎 Resources for Module 2

ICH E6(R3) Annex 2 — Modern Trial Designs

Decentralized elements, pragmatic clinical trials, and real-world data — newly adopted 3 June 2026.

The simplest way to think about Annex 2 is: it explains how GCP principles apply when the trial design moves outside the traditional single-site, in-person, sponsor-provided-IP model. The trial is still an interventional trial — it is still bound by E6(R3) Principles and Annex 1. Annex 2 supplies the additional considerations that arise when modern elements are added.

A "decentralized trial" is not a single design — it's a continuum. A trial can have one decentralized element (e.g., home delivery of IP) or be fully decentralized (no physical trial site at all). Most trials in 2026 sit somewhere in between, often called hybrid trials.

How to implement a decentralized element — step by step

Pragmatic trials answer the question "does this intervention work in routine clinical practice?" rather than the more controlled "can this intervention work under ideal conditions?" They use broad eligibility, usual-care comparators, routinely captured outcomes, and minimal study-specific procedures.

A particularly important pragmatic design is the registry-based RCT, where randomisation is layered on top of an existing disease registry, and the registry's routine data collection serves as the trial's data capture. This dramatically reduces operational cost and accelerates enrolment — but requires careful fit-for-purpose evaluation of the registry.

Real-world data (RWD) is data relating to patient health status or healthcare delivery routinely collected from sources other than traditional clinical trials. When RWD is generated into evidence used in regulatory decisions, it becomes real-world evidence (RWE). Annex 2 sets expectations for using RWD in interventional trials — the key concept is fit-for-purpose.

How Annex 2 sharpened the draft

The most substantive changes from the public-consultation draft to the final Annex 2 (adopted 3 June 2026) relate to real-world data. The final text places greater emphasis on documenting the rationale for selecting a specific RWD source, on data-quality controls applied to that source, and on the chain of evidence that supports its fit-for-purpose use. Documentation is no longer optional.

📎 Resources for Module 3

Roles & Responsibilities

Sponsor, CRO, investigator, site staff, IRB/IEC, DSMB, monitor, auditor, and participant — who does what, when, and why.

The sponsor is the individual, company, institution, or organisation taking responsibility for the initiation, management, or financing of a clinical trial. The sponsor can delegate tasks to a CRO or other vendor — but cannot delegate accountability.

▶ Select each role to explore key responsibilities under ICH E6(R3)

The principal investigator (PI) is the individual responsible for the conduct of the clinical trial at the trial site. If a trial is conducted by a team, the PI is the responsible leader. The PI's responsibilities cannot be delegated as a whole — though specific tasks can be delegated to qualified site staff and documented in the delegation log.

The delegation log — the document inspectors always ask for

The delegation log is the contemporaneous record of which trial-related tasks each named site staff member is authorised to perform. Inspectors review this document at virtually every inspection. Common findings: (1) staff performing tasks not delegated to them; (2) delegations starting before staff completed required training; (3) signatures missing; (4) date ranges incorrect; (5) the same task delegated to staff who don't have the corresponding qualifications.

Institutional Review Board (IRB) / Independent Ethics Committee (IEC)

The IRB (U.S. terminology) or IEC (European terminology) is an independent body composed of medical professionals and non-medical members. Its purpose is to ensure protection of the rights, safety, and well-being of trial participants — and to provide public assurance of that protection by reviewing and approving (or providing favourable opinion on) the trial protocol, the suitability of investigators, facilities, and the methods and material used in obtaining and documenting informed consent.

Data Safety Monitoring Board (DSMB) / Data Monitoring Committee (DMC)

A DSMB is an independent group of experts (typically clinicians, statisticians, sometimes ethicists or bioethicists) appointed by the sponsor to monitor the accumulating safety and, often, efficacy data during a trial. The DSMB is separate from the IRB/IEC: where the IRB protects rights, the DSMB protects safety and scientific integrity as data accrues.

DSMBs are not required for every trial. They are commonly used for: large outcome trials, oncology trials, paediatric trials, trials in vulnerable populations, trials with mortality endpoints, trials with adaptive designs, and trials where stopping rules are pre-specified.

The trial participant is not a passive subject of the trial. They are an autonomous person who has agreed, after being adequately informed, to participate. ICH E6(R3) and applicable regulations (21 CFR 50, EU CTR 536/2014 Annex I §60–69, etc.) define their rights.

The essential elements of informed consent

Under 21 CFR 50.25 and ICH E6(R3), informed consent must include explanations of: the trial nature and purpose; expected duration; procedures (identifying those that are experimental); reasonably foreseeable risks; reasonably expected benefits; alternatives; confidentiality; compensation in case of injury; whom to contact for trial-related questions and for participant rights; that participation is voluntary; that the participant may withdraw at any time without penalty; the approximate number of participants; and clinically significant new findings that may develop during the trial.

📎 Resources for Module 4

Global Regulatory Landscape

FDA, EMA, MHRA, Health Canada, PMDA, NMPA, TGA, HSA, MFDS — what each requires, where they align, and where they diverge.

ICH E6(R3) — Global adoption timeline

Clinical trials of drugs and biologics in the U.S. operate under an Investigational New Drug (IND) application authorised by FDA's Center for Drug Evaluation and Research (CDER) or Center for Biologics Evaluation and Research (CBER). The applicable regulations are codified in Title 21 of the Code of Federal Regulations.

The IND process — three timing milestones

The IND submission triggers a 30-day FDA review clock. If FDA does not place the IND on clinical hold within 30 days, the sponsor may begin clinical investigations. The sponsor must also: register the trial on ClinicalTrials.gov within 21 days of enrolling the first participant (for applicable trials under FDAAA 801); submit IND amendments for protocol changes; submit annual reports (within 60 days of the anniversary of IND becoming effective); submit safety reports per 21 CFR 312.32 (IND safety reporting).

Since 31 January 2022, all new EU clinical trials must be authorised under Regulation (EU) No. 536/2014 (the Clinical Trials Regulation, or CTR), which replaced the old Clinical Trials Directive 2001/20/EC. The CTR introduced a single-portal submission via the Clinical Trials Information System (CTIS). By 31 January 2025, all ongoing EU trials had to be transitioned to the new regulation.

The CTR provides for transparency by default: trial information and results summaries are published in CTIS, subject to defined deferral rules. Each Member State retains authority over Part II (ethics, national requirements, language). Investigational product manufacturing is governed by Annex 13 / EU GMP Annex 13 for IMPs.

Post-Brexit, the UK operates independently of CTIS. The framework remains the Medicines for Human Use (Clinical Trials) Regulations 2004 (SI 2004/1031, as amended), with new clinical trials legislation that came into force in 2024–2025 introducing major reforms. UK CTAs go through a Combined Review — a single application to both MHRA and a Research Ethics Committee (REC), with a statutory clock of ~30 days for MHRA assessment alongside REC opinion.

Under the Windsor Framework, since 1 January 2025 Northern Ireland is regulated by MHRA for clinical trial purposes (aligning with Great Britain rather than the EU). The new UK CT legislation also introduces a statutory transparency mandate — sponsors will have a legal duty to register trials and report results, supported by HRA's Make-it-Public framework.

A modern phase III programme is rarely run in a single region. ICH E17 (General Principles for Planning and Design of Multi-Regional Clinical Trials) sets the framework for designing trials intended to support simultaneous global development and submission. The practical implications are substantial.

📎 Resources for Module 5

Quality, Risk & Data Governance

Risk-based quality management, ALCOA+ data integrity, 21 CFR Part 11, EU Annex 11, and computer system validation.

RBQM is the operational discipline that delivers E6(R3) Principle 8 in practice. It is a continuous loop: identify what matters, assess the risk, design proportionate controls, monitor signals, respond when signals emerge, document throughout.

Key Risk Indicators (KRIs) — what they look like

A KRI is a quantitative or qualitative metric that, when it crosses a threshold, signals that a CtQ factor may be compromised. Examples:

• Eligibility KRI: rate of eligibility deviations per site >5% — triggers targeted SDV on that site
• Safety KRI: SAE reporting timeline non-compliance — triggers site retraining
• Data quality KRI: query rate per CRF page above study mean >2 standard deviations — triggers data review
• Enrolment KRI: screen failure rate <5% (unusually low) — may signal eligibility leniency
• Visit compliance KRI: >15% missed visit windows — protocol training needed

ALCOA is an acronym originally articulated by FDA's CDER in 2010 and now adopted globally as the framework for data integrity in regulated activities. ALCOA+ adds four further attributes. In E6(R3) Annex 1 (Data Governance section), ALCOA+ is explicit.

▶ Hover or tap each ALCOA+ element to see what it means in practice

Two regulations govern computerised systems holding regulated records: 21 CFR Part 11 in the U.S. and EU GMP Annex 11 (with cross-applicability to GCP via the broader EU regulatory framework). The two regulations are not identical, but they cover overlapping ground.

21 CFR Part 11 — the core requirements

• Validation — systems must be validated to ensure accuracy, reliability, consistent intended performance
• Audit trails — secure, computer-generated, time-stamped audit trails to independently record date and time of operator entries and changes
• Access controls — limiting system access to authorised individuals
• Operational checks — to enforce permitted sequencing of steps and events
• Authority checks — to ensure only authorised individuals can use the system, electronically sign, access operations, alter records, or perform operations
• Device checks — to determine validity of source of data input or operational instruction
• Records retention — accurate and complete copies of records suitable for inspection, review, and copying
• Electronic signatures — uniqueness, identity verification, components (ID + password or biometrics)

EU Annex 11 — additional emphasis

• Risk management — based on a justified and documented risk assessment of the computerised system
• Personnel — close cooperation between process owners, system owners, qualified persons, IT
• Suppliers and service providers — formal agreements; supplier capability assessed
• Validation — lifecycle approach; URS to retirement; change control
• Business continuity — provisions to ensure continued support of critical processes
• Periodic evaluation — periodic review of operational performance, deviations, incidents, upgrades

Computer system validation is the documented process of assuring that a computerised system does what it is intended to do, consistently, and as required. The de facto industry standard for CSV in life sciences is GAMP 5 (Good Automated Manufacturing Practice, 5th edition, 2008; Second Edition issued 2022) — issued by ISPE.

The validation effort and documentation depth should match the category and the risk to participants and data reliability — a Category 4 EDC capturing primary endpoint data needs more documentation than a Category 4 e-mail tool used for non-essential trial communications.

📎 Resources for Module 6

Safety Reporting & Pharmacovigilance

Adverse event taxonomy, ICH E2A–E2F, SUSAR reporting, DSUR, and ICSR transmission via E2B(R3).

Safety language is precise on purpose. Misclassifying an event can result in delayed reporting, late warnings to participants, and regulatory findings. The definitions below come from ICH E2A and have been preserved through E6(R3).

A SUSAR is the safety event the regulators most want to know about quickly. Reporting timelines are short — measured in days, sometimes hours — and counted from the moment the sponsor became aware of the event meeting the definition.

Where SUSARs go — destinations by region

ICH E2F defines the Development Safety Update Report (DSUR). It is the annual safety check-in to regulators during the development of a product, replacing the previous annual safety report (US) and annual safety report (EU) with a globally harmonised format. The DSUR is due to each authority that has authorised the trial within 60 days of the data lock point (DLP), which is usually the international birth date (IBD) anniversary of the first IND authorisation.

A Data Safety Monitoring Board (DSMB) — also called a Data Monitoring Committee (DMC) — is an independent group of experts (typically clinicians, biostatisticians, and ethicists) chartered by the sponsor to review accumulating safety and efficacy data during a trial. The DSMB is the only entity in the trial with access to unblinded safety data while the trial is ongoing, and it can recommend modifications, pausing, or termination of the trial.

📎 Resources for Module 7

TMF & Inspection Readiness

The Trial Master File, DIA TMF Reference Model v3.3, eTMF, and how to prepare for a regulatory inspection.

The Trial Master File (TMF) is the collection of essential records that, taken together, demonstrate the conduct of a clinical trial and the integrity of its data. It exists to allow the sponsor, the regulator, and an inspector to reconstruct what happened in the trial — who did what, when, and why — without relying on personal recollection.

Sponsor TMF vs. Investigator Site File (ISF)

The TMF Reference Model is a community standard maintained by the DIA (Drug Information Association) TMF Reference Model Working Group. It is the de facto standard for organising sponsor TMFs across the industry, and is referenced in ICH E6(R3) Annex 1. Version 3.3 (current as of 2026) organises the TMF into a three-level hierarchy.

Inspection readiness is not a project; it is an operating state. A trial that is inspection-ready is one where, at any random moment, the TMF reflects current state, the rationale for every decision is documented, and the responsible person could explain what happened and where it lives. The opposite — the "inspection sprint" — is a red flag in itself.

Five practices of inspection-ready trials

The FDA publishes BIMO (Bioresearch Monitoring) inspection metrics annually. The most cited findings across sponsor and investigator inspections cluster into a small number of recurring problem areas.

CDISC — the Clinical Data Interchange Standards Consortium — is an independent, global, non-profit organisation that develops and maintains data standards for clinical and non-clinical research. Its standards are mandated by FDA and Japan PMDA for electronic submissions, and are widely adopted by sponsors globally. Understanding CDISC is inseparable from understanding the modern eTMF, because CDISC-compliant data is itself a class of essential trial documentation.

The CDISC Standards Stack — click each layer to explore

Data flows from collection (CDASH) → tabulation (SDTM) → analysis (ADaM) → regulatory submission (Define-XML). Each standard serves a distinct purpose in the data lifecycle.

CDISC in the eTMF: where standards meet documentation

CDISC data standards and the TMF are complementary, not separate systems. Many CDISC-related documents are themselves TMF artifacts. The table below maps key CDISC deliverables to their DIA TMF Reference Model locations:

📎 Resources for Module 8

Final Assessment

Demonstrate mastery across all 8 modules. Pass with 80% (16 of 20 correct) to unlock your certificate.

Resource Library

Every regulatory citation in this programme links back to its authoritative source. Bookmark this page.

ICH guidelines

FDA

EMA · MHRA · Health Canada

APAC regulators

Ethics & global frameworks

Aurelyn Tools

CDISC / standards

Glossary

Every acronym and term used in this programme, defined.

Certificate of Completion

Personalise your name, then download or print your certificate.

🎉

Congratulations! You have demonstrated mastery of ICH/GCP for modern clinical trials. Type your name into the certificate below — the field is editable. Then use the buttons to print (or "Save as PDF") and download.

⚜

Aurelyn AI Life Sciences Academy

Certificate of Completion

ICH/GCP Mastery for Modern Clinical Trials

This certifies that

has successfully completed the eight-module programme covering ICH E6(R3) Principles, Annex 1, and Annex 2, the global regulatory landscape across the US, EU, UK, Japan, China, Canada, Australia, Singapore and Korea, risk-based quality management, ALCOA+ data integrity, safety reporting under ICH E2A–E2F, and inspection-ready TMF practice.

Programme

ICH/GCP Mastery

Modules · Hours

8 · ~6 hrs

Assessment Score

—/20

Date Issued

—

Sheilah Johnson

Founder · Aurelyn AI Clinical

Certificate ID: —

🖨️ Print / Save as PDF 📥 Download (HTML)