CCRA common mistakes
CCRA · Understand the traps and how to avoid them.
Answering source-document questions from memory of how sites usually work rather than applying the ALCOA+ criteria to the specific scenario described, so a record that is contemporaneous but lacks an attributable signature is judged acceptable.
Candidates who have monitored real sites rely on habitual impressions of 'good documentation' and skip a systematic check of each ALCOA+ element against the facts in the item stem.
What to do instead
Before choosing, run a fixed checklist on the scenario: attributable, legible, contemporaneous, original, accurate, complete, consistent, enduring, available. Name which element the scenario violates, then pick the option that addresses that element rather than the option that sounds most like general good practice.
Confusing the roles of sponsor, monitor, investigator, and IRB/IEC when asked who is responsible for an action, for example selecting the monitor as the party responsible for obtaining informed consent or for making the final source-data correction.
The exam tests delegation and oversight boundaries, but candidates conflate 'who notices a problem' with 'who is accountable for fixing it', and everyday site experience blurs these lines.
What to do instead
Build a one-page responsibility matrix from ICH E6: consent obtained by investigator or delegated qualified staff, corrections made by the person who made the original entry with a dated, signed, explained change, sponsor responsible for oversight and quality management, IRB/IEC for initial and continuing review. Drill each item by asking 'who signs, who decides, who verifies'.
Treating a protocol deviation as automatically a serious breach, or conversely dismissing an eligibility deviation as minor because the subject did well, and then choosing the wrong escalation pathway.
Candidates reason from outcome (no harm occurred) instead of from the definitional criteria: effect on safety, rights, or data reliability, and whether it meets the serious-breach definition for reporting timelines.
What to do instead
Classify by criteria, not consequence: does it affect subject safety or rights, or the reliability of the data? Does it meet the serious breach definition (likely to affect safety, rights, or data reliability significantly)? Then map to the correct action: document, assess, notify sponsor within the protocol/ICH timeframe, sponsor notifies authorities within the required window. Practice sorting a list of deviations into minor, major, and serious breach using only those criteria.
Selecting 'contact the IRB immediately' or 'stop the study' as the default answer for every problem, instead of first following the internal escalation sequence from site staff to investigator to monitor to sponsor.
Candidates memorize that IRBs and regulators exist and over-apply them, missing that most items test the routine chain of communication and documentation before external notification.
What to do instead
Learn the standard escalation ladder and when each rung is triggered: site staff document and inform the investigator, the investigator informs the monitor/sponsor, the sponsor assesses and decides on regulatory and IRB notification. Choose external notification only when the scenario meets a reporting trigger such as an unanticipated problem involving risk to subjects or a serious breach.
Misreading the timeline arithmetic in reporting questions, such as applying a 24-hour clock to a 15-calendar-day safety report or counting from the wrong start event (awareness versus occurrence).
Items deliberately include dates and 'first became aware' language, and candidates compute from the event date or from the monitoring visit date rather than the regulatory start point.
What to do instead
For every timeline item, write the start event explicitly (date of awareness, date of receipt, date of occurrence) and the required interval in the correct unit (hours, calendar days, working days) before calculating. Memorize the common intervals you are expected to know and confirm which one the stem names rather than assuming.
Accepting a consent form deficiency because the signature and date are present, without checking that the correct current-approved version was used, that the subject dated it personally, and that the process preceded any study procedure.
Candidates scan for the visible signature and stop, treating consent as a paperwork check rather than a process check with version control and sequencing requirements.
What to do instead
Check consent in a fixed order: correct IRB-approved version in use at the time, all required elements and signatures present, subject (or legally authorized representative) personally dated it, consent obtained before any screening procedure, and re-consent documented when the form was revised. When reviewing a scenario, identify which of these five links is broken.
Conflating adverse events, serious adverse events, and suspected unexpected serious adverse reactions, and therefore choosing the wrong reporting category or timeline for a case described in the stem.
The three terms overlap, and candidates apply seriousness criteria inconsistently, for example labeling a hospitalization for a pre-planned procedure as an SAE or missing that expectedness is judged against the reference safety information.
What to do instead
Apply a two-step test: first, does it meet a seriousness criterion (death, life-threatening, inpatient hospitalization or prolongation, persistent or significant disability, congenital anomaly, or important medical event)? Second, is it unexpected against the current reference safety information and reasonably possibly related? Only then is it a suspected unexpected serious adverse reaction with the associated expedited timeline. Practice on borderline cases such as elective hospitalization and pre-existing conditions that worsen.
Answering monitoring-visit questions by listing everything a monitor could do, rather than identifying the action that addresses the specific finding described, such as choosing 'retrain the site' when the finding is a systematic source-to-case-report-form discrepancy requiring a documented corrective action plan.
Candidates default to general monitoring activities and do not distinguish between detection, correction, and prevention, which is what corrective and preventive action items test.
What to do instead
For each finding, separate the immediate correction (fix the record, re-consent, repeat the assessment) from the root-cause analysis and the preventive action (revised procedure, retraining, additional oversight). Select the option that matches the level the question asks about, and reject options that only restate the finding or only promise more monitoring.
Ignoring the essential-documents lifecycle, for example treating the investigator brochure, protocol signature page, or delegation log as a one-time collection item rather than a document that must be current, version-controlled, and reconciled with actual site practice.
Candidates memorize the list of essential documents but not the requirement that they be complete, current, and consistent with each other at the time of the visit.
What to do instead
For essential-document items, check three things: is it present, is it the current approved version, and does it agree with other documents and with practice (delegation log matches signatures and training records, protocol version matches the consent form version, approvals predate subject enrollment). Answer by naming which of these three fails.
Choosing the most authoritative-sounding or most punitive option in communication scenarios, such as recommending termination or a formal audit when the situation calls for a documented discussion with the investigator and a follow-up letter.
Candidates equate seriousness with escalation and underestimate proportionate, documented communication as the expected professional response.
What to do instead
Rank options by proportionality: direct discussion and documentation first, written follow-up and corrective action plan next, escalation to sponsor quality or regulatory functions only when the issue is serious, repeated, or unaddressed. Prefer the option that preserves the site relationship while creating a written record, and eliminate any option that skips documentation.