CRNO cheat sheet

ICH E6 (GCP) governs trial conduct; E6(R2) added risk-based quality management, and E6(R3) modernizes it around quality-by-design and proportionate oversight.

21 CFR Part 11 sets criteria for electronic records and signatures: validated systems, audit trails, access control, and signature components (name, date/time, meaning).

21 CFR Part 50 covers informed consent and IRB review of consent; Part 56 covers IRB organization and operations; Part 312 covers IND requirements; Part 812 covers IDE requirements.

Form FDA 1572 is the investigator's commitment to conduct the study per protocol and GCP; the investigator must be qualified by training and experience to take custody of the drug.

A significant risk device study requires an IDE; non-significant risk device studies are conducted under abbreviated requirements with IRB agreement on the NSR determination.

The Common Rule (45 CFR 46) exempts certain categories from IRB review; subpart B (pregnant women), C (prisoners), and D (children) add protections for vulnerable populations.

Serious breach of GCP or a pattern of noncompliance can lead to FDA disqualification of an investigator under 21 CFR 312.70, with notice and an opportunity for a hearing.

The Declaration of Helsinki is a statement of ethical principles from the World Medical Association; it is not a regulation but is often cited by regulators and IRBs.

Phase I assesses safety, tolerability, and pharmacokinetics; Phase II explores efficacy and dose-ranging; Phase III confirms efficacy for registration; Phase IV occurs after approval.

Randomization methods include simple, block (permuted blocks), and stratified; allocation concealment prevents foreknowledge of assignment and differs from blinding.

Superiority, non-inferiority, and equivalence designs require different hypotheses; a non-inferiority margin must be pre-specified and justified before unblinding.

Intention-to-treat analyzes all randomized participants as assigned; per-protocol analyzes only compliant participants; ITT generally preserves the benefit of randomization.

Sample size depends on effect size, variance, alpha, power, and dropout rate; a 20% dropout allowance requires inflating enrollment by dividing by 0.8.

Adaptive designs (group sequential, sample size re-estimation) require pre-specified rules and may need simulation to control type I error.

The protocol must include objectives and endpoints, eligibility criteria, investigational product handling, safety reporting, and a statistical analysis plan reference.

Protocol amendments require IRB approval before implementation except when needed to eliminate immediate hazard to participants.

Screening evaluates eligibility against inclusion and exclusion criteria; enrollment generally means signing consent, and randomization means assignment to a study arm.

Pre-screening (chart review, database query) may require IRB approval if it involves accessing identifiable protected health information.

Inclusion criteria define the target population; exclusion criteria remove participants whose safety or data quality would be compromised.

Screen failures must be documented with the reason; screen failure logs are commonly required by sponsors and reviewed during monitoring.

Recruitment materials (advertisements, flyers, social media posts) are subject to IRB review and must not promise benefit or coerce participation.

Payment for participation must be prorated and not so large as to constitute undue influence; payment for time and travel is generally acceptable.

Recruitment targets should account for screen failure rates and dropout; a 3:1 screen-to-enroll ratio means 300 screened for 100 enrolled.

Vulnerable populations (children, prisoners, cognitively impaired adults) require additional safeguards and, in the US, subpart-specific protections.

Consent must include purpose, procedures, risks, benefits, alternatives, confidentiality, compensation, contacts, and a statement that participation is voluntary.

Consent must be obtained before any study-related procedure, including screening tests performed solely for eligibility.

The consent form must be IRB-approved; using an unapproved version or failing to re-consent after a substantive amendment is a common finding.

Consent must be documented by a dated signature of the participant (or legally authorized representative) and the person obtaining consent.

Assent is required for children who can understand, alongside parental permission; the IRB determines whether assent is required.

An independent witness is required when a participant cannot read, or when consent is presented orally; the witness signs and dates the form.

Re-consent is required when new information could affect willingness to participate, such as a newly identified risk.

The IRB must review and approve the study before enrollment, and continuing review occurs at intervals appropriate to risk (at least annually under the Common Rule).

Deviations are departures from the IRB-approved protocol; a protocol violation is a significant departure that may affect safety or data integrity.

Deviations must be documented, assessed for impact, and reported per sponsor and IRB requirements; serious deviations may require prompt reporting.

Source documents are the original records (hospital charts, lab reports, ECGs); source data must be attributable, legible, contemporaneous, original, and accurate (ALCOA).

Visit windows are defined in the protocol; a visit outside the window is a deviation that must be documented and evaluated.

Case report forms (CRFs) should be completed from source; when source is the CRF itself, the protocol must state that the CRF is the source document.

Concomitant medications and adverse events must be recorded at each visit and reconciled with the medical record.

Delegation of study tasks must be documented on a delegation log, and staff must be trained on the protocol before performing tasks.

Investigators must personally conduct or supervise the study and cannot delegate responsibility for the conduct of the trial to unqualified staff.

Investigational product accountability includes receipt, dispensing, return, and destruction records, reconciled at monitoring visits and at study close-out.

Storage must follow the protocol and label requirements; temperature logs document excursions and require sponsor assessment of impact.

Blinding must be maintained; unblinding should be documented with the reason and the individuals involved, and emergency unblinding codes must be available.

The investigator must not supply investigational product to any person not authorized under the protocol, and must not use it outside the study.

Dispensing records must link the participant identifier, kit or lot number, date, and dose; randomization codes link kit numbers to treatment assignment.

For devices, accountability includes serial numbers, inventory, and documentation of returned or explanted devices; the sponsor may require return of all devices.

Expired product must not be dispensed; expired or unused product must be segregated and dispositioned per sponsor instructions.

The investigator must maintain records of product disposition and make them available to the sponsor and regulators on request.

An adverse event (AE) is any untoward medical occurrence; a serious adverse event (SAE) results in death, is life-threatening, requires hospitalization, causes disability, or is a congenital anomaly.

A suspected unexpected serious adverse reaction (SUSAR) must be reported to regulators and IRBs within protocol and regulatory timelines (e.g., 7 or 15 calendar days).

Severity (mild, moderate, severe) is distinct from seriousness; a severe headache is not necessarily an SAE.

Causality assessment (related, possibly related, unrelated) determines reportability and labeling; the sponsor makes the final determination for SUSARs.

SAEs must be reported to the sponsor immediately (typically within 24 hours) and followed until resolution or stabilization.

Expectedness is judged against the investigator brochure or package insert; an event not listed is unexpected.

Pregnancy is often reported as an AE and followed to outcome; the protocol should specify the handling of pregnancies and lactation.

Safety monitoring may include a Data Safety Monitoring Board (DSMB) or Data Monitoring Committee (DMC) for trials with significant risk.

ALCOA-C principles: attributable, legible, contemporaneous, original, accurate, complete; corrections must preserve the original entry, with date, initials, and reason.

Corrections must use a single line through the error, initials, date, and explanation; do not obliterate or use correction fluid.

Electronic source systems must be validated, have audit trails, and restrict access to authorized users per 21 CFR Part 11.

Query resolution must be documented; the data management plan should describe query generation, escalation, and closure.

Record retention: FDA regulations require records be retained for 2 years after the marketing application is approved or the investigation is discontinued (21 CFR 312.62).

Source documents must support the CRF entries; discrepancies between source and CRF are findings and must be corrected.

Data entry should be timely and reviewed; critical data fields should be verified against source during monitoring.

Records must be available for inspection by FDA and the sponsor; destruction before the retention period is a compliance failure.

Monitoring verifies that the rights and well-being of participants are protected, data are accurate and complete, and the study is conducted per protocol, GCP, and regulations.

Source data verification (SDV) compares CRF entries to source; 100% SDV is not required under risk-based monitoring, which targets critical data and processes.

A monitoring report documents findings, actions, and follow-up; significant findings may require a for-cause audit or corrective action plan.

Audits are independent, systematic examinations by the sponsor or a qualified auditor; inspections are conducted by regulatory authorities such as FDA.

Quality management includes quality-by-design, risk assessment, key risk indicators, and centralized monitoring to detect issues early.

A CAPA plan identifies root cause, corrective action, preventive action, responsible person, and effectiveness check; it must be documented and tracked.

Common inspection findings include inadequate consent documentation, unreported SAEs, source-CRF discrepancies, and insufficient delegation or training records.

Form FDA 483 lists inspectional observations; the investigator responds in writing, and failure to correct can lead to disqualification or warning letters.

The FDA may conduct inspections of clinical sites, IRBs, sponsors, and laboratories; the investigator must permit access to records and facilities.

Institutional Review Boards may approve, require modifications, or disapprove research; they must have at least five members with varied backgrounds.

The IRB must review at a convened meeting unless the research qualifies for expedited review or exemption.

An IND is required for studies of unapproved drugs or for studies of approved drugs with a changed route, dose, or population that increases risk.

The sponsor-investigator holds both sponsor and investigator responsibilities, including IND submission and safety reporting to FDA.

Good Clinical Practice requires a quality management system proportionate to the risks of the trial, including risk assessment and mitigation.

Financial disclosure (21 CFR 54) requires investigators to disclose interests that could affect the study, such as equity or consulting arrangements.

The clinical trial must be registered on ClinicalTrials.gov for applicable trials, and results may need to be submitted per FDAAA 801.

A control arm may be placebo, active, historical, or no treatment; placebo use must be justified when an effective treatment exists.

Blinding may be single (participant), double (participant and investigator), or triple (adds data analysts or monitors); open-label studies have no blinding.

Primary endpoint selection determines the study's power and must be pre-specified; secondary endpoints support but do not replace the primary.

Stratification factors (e.g., site, disease severity) must be pre-specified and matched by the randomization system.

Interim analyses require pre-specified stopping rules for efficacy or futility to control alpha spending.

The protocol should define the analysis population, handling of missing data, and the statistical methods for the primary endpoint.

A run-in period can identify tolerators or screen out noncompliant participants but may reduce generalizability.

Crossover designs require washout periods and must consider carryover effects; parallel designs avoid this issue.

Informed consent must be obtained before any screening procedure that is performed solely for research purposes.

The screening log typically captures participant identifier, date of consent, eligibility determination, and reason for screen failure.

Enrollment targets should reflect the expected screen failure rate; a 25% screen failure rate requires screening about 133 participants to enroll 100.

Recruitment from a treating physician's practice raises undue influence concerns; the consent discussion should be handled by someone not directly involved in the patient's care when possible.

Advertising must be reviewed by the IRB and must not state or imply that the drug or device is safe or effective for the purpose under investigation.

Remote or decentralized recruitment and consent require validated platforms, identity verification, and documentation equivalent to in-person consent.

Underrepresentation of racial and ethnic groups and older adults is a documented recruitment problem; sponsors may require diversity action plans.

Pre-screening using existing records may require a partial waiver of authorization under HIPAA; the IRB must approve the waiver.

Consent is an ongoing process, not just a signature; participants must be informed of new findings throughout the study.

The consent form must state that the participant may withdraw at any time without penalty or loss of benefits.

The IRB must approve the consent form and any changes; the currently approved version must be used.

A legally authorized representative may consent for an adult who lacks capacity, per applicable law and IRB policy.

Emergency research may proceed with an exception from informed consent only if the strict criteria of 21 CFR 50.24 are met, including community consultation.

HIPAA authorization or a waiver is required when protected health information is used or disclosed for research.

The consent document must not include exculpatory language through which the participant waives legal rights or appears to release the investigator from liability.

Consent forms should be written in language understandable to the participant; non-English speakers require a translated form and an interpreter.

The investigator must maintain adequate records of each participant's study participation, including dates of visits and procedures performed.

The delegation log must list all study staff, their roles, and start and end dates; staff must not perform tasks before being delegated.

Protocol deviations should be classified as major or minor and reported to the sponsor and IRB per their policies.

The site should have a documented process for scheduling visits, confirming attendance, and following up on missed visits.

Out-of-window visits and missed assessments must be recorded with the reason and assessed for impact on the analysis.

Vital signs, ECGs, and laboratory results should be reviewed by the investigator or a qualified clinician and clinically significant findings documented.

Investigators must report unanticipated problems involving risks to participants or others to the IRB promptly.

The site must maintain a regulatory binder with protocol, approvals, correspondence, training records, and delegation logs.

The investigator brochure summarizes the investigational product's pharmacology, toxicology, and clinical experience; it must be current.

The sponsor must ensure that the investigational product is manufactured and stored per GMP and labeled with the required caution statement.

The investigator must not make changes to the investigational product or its packaging without sponsor authorization and IRB approval.

Randomization and kit assignment must follow the protocol; dispensing errors must be documented and reported as deviations.

Temperature excursions require an assessment of product stability and a sponsor decision on whether product may still be used.

Device accountability must include the device's unique identifier where applicable and documentation of any malfunction.

The investigator must report device deficiencies that could have led to an SAE to the sponsor and IRB per the protocol and regulations.

At study close, remaining product must be returned or destroyed per sponsor instructions, with documentation retained.

AEs must be recorded from the time of consent through the end of the study, and sometimes beyond, per protocol.

Each AE record should include onset and resolution dates, severity, seriousness, relationship to study product, action taken, and outcome.

Serious adverse events must be reported to the sponsor within the timeframe specified by the protocol, often 24 hours of site awareness.

The sponsor must report SUSARs to FDA and all participating investigators in an IND safety report, generally within 15 calendar days, or 7 days for fatal or life-threatening events.

The IRB must receive reports of unanticipated problems, including SUSARs, per its written procedures.

AEs must be followed until resolution, return to baseline, or stabilization, and the follow-up documented.

Relationship assessment should consider temporal association, plausibility, dechallenge and rechallenge, and alternative causes.

Safety data must be reconciled with the clinical database before database lock and reporting.

The data management plan describes data capture, validation rules, query management, coding, and database lock procedures.

Edit checks should be pre-specified and tested; critical fields require validation before database lock.

The audit trail must capture who made a change, when, and what was changed; it must not be disabled or modified.

Source documents may be paper or electronic; electronic source must meet Part 11 requirements for validation and audit trails.

Records must be legible and in ink; corrections must not obscure the original entry.

The investigator must retain records for the required period and notify the sponsor before destroying them.

Data transfers to the sponsor must be secure and traceable; the site should retain a copy of transmitted data.

The database lock should occur only after all queries are resolved and the data are reconciled with safety and external data.

Risk-based monitoring focuses on critical data and processes and may combine on-site and centralized monitoring.

Monitoring visits typically include an opening meeting, source review, IP accountability, informed consent review, and a closing meeting.

The monitor must verify that the investigator has sufficient qualifications, staff, and facilities to conduct the study.

Findings should be documented in a monitoring report and tracked to resolution; unresolved findings may trigger escalation.

Audits should be independent of the study team; auditors should have access to all records and facilities.

Inspection readiness includes an organized regulatory binder, available source documents, and staff prepared to explain their roles.

A root cause analysis should distinguish systemic issues from isolated errors; CAPA effectiveness must be verified.

Quality tolerance limits and key risk indicators can trigger early action before data integrity is compromised.

The Belmont Report principles are respect for persons, beneficence, and justice; they underpin informed consent, risk-benefit assessment, and subject selection.

GCP requires that the IRB be independent of the investigator and sponsor, with members who collectively have the qualifications to review the research.

The sponsor must select qualified investigators and ensure they are trained on the protocol and GCP before the study begins.

The investigator must provide the sponsor with a current curriculum vitae and documentation of qualifications.

The sponsor must maintain a trial master file; the investigator must maintain the trial-related documents at the site.

Regulatory authorities may require the sponsor to submit annual reports and safety updates for an active IND.

The clinical study report follows ICH E3 structure and is the basis for regulatory submission.

Deviation from GCP may result in rejection of the data by the regulatory authority, regardless of the study's scientific merit.

The protocol synopsis should summarize objectives, design, population, endpoints, and statistical methods for quick review.

Eligibility criteria should be operationally definable and verifiable from source documents; vague criteria lead to deviations.

The schedule of assessments should align with the visit windows and the data collection plan.

The protocol must state the maximum number of participants and the expected duration of the study.

The protocol should describe the handling of participants who discontinue treatment but consent to follow-up.

The protocol must specify the method of assigning participants to treatment groups and the blinding procedure.

The protocol should define the procedures for monitoring and the frequency of monitoring visits.

Amendments that change risk require IRB review before implementation, except to eliminate immediate hazard.

The investigator must not enroll participants before IRB approval and execution of the clinical trial agreement.

The screening process should verify identity and eligibility, including review of prior and concomitant medications.

The site should document the date of informed consent and the date eligibility was confirmed.

Randomization must occur only after eligibility is confirmed and consent is documented.

Screen failure data should be captured in a log and, where required, in the CRF.

Recruitment strategies should be documented and approved; changes to advertising require IRB review.

Retention strategies include reminder calls, flexible scheduling, and reimbursement of travel; these should be described in the protocol or site plan.

The site should track enrollment against targets and communicate shortfalls to the sponsor early.

The consent form must include a statement that the study involves research and an explanation of the purposes of the research.

The consent form must describe foreseeable risks or discomforts and any benefits that may reasonably be expected.

The consent form must disclose appropriate alternative procedures or courses of treatment.

The consent form must describe how confidentiality will be maintained and the extent to which records may be inspected.

The consent form must state whom to contact for questions about the research and about research-related injury.

The consent form must state the circumstances under which participation may be terminated without the participant's consent.

The consent form must disclose any additional costs to the participant.

The consent form must state that the participant will be informed of significant new findings developed during the course of the research.

The investigator must ensure that the study is conducted according to the signed investigator statement and the protocol.

The investigator must personally conduct or supervise the study and ensure that all staff are informed of their duties.

The investigator must ensure that the study staff are adequately trained and that training is documented.

The investigator must maintain a list of appropriately qualified persons to whom significant trial-related duties have been delegated.

The investigator must ensure that the study is conducted in accordance with the protocol and any amendments.

The investigator must ensure that the study is conducted in accordance with GCP and applicable regulations.

The investigator must ensure that the study is conducted in accordance with the IRB-approved protocol.

The investigator must ensure that the study is conducted in accordance with the sponsor's written procedures.

The investigator must ensure that the investigational product is used only in accordance with the approved protocol.

The investigator must ensure that the investigational product is stored in a secure location with controlled access.

The investigator must ensure that the investigational product is stored under the conditions specified by the sponsor.

The investigator must ensure that the investigational product is dispensed only to participants enrolled in the study.

The investigator must ensure that the investigational product is dispensed only by authorized staff.

The investigator must ensure that the investigational product is accounted for at all times.

The investigator must ensure that the investigational product is returned or destroyed per sponsor instructions.

The investigator must ensure that the investigational product is not used after the expiration date.

The investigator must report all serious adverse events to the sponsor immediately, except those that the protocol identifies as not requiring immediate reporting.

The investigator must report serious adverse events to the IRB per its policies.

The investigator must report unanticipated problems involving risks to participants or others to the IRB.

The investigator must report deviations from the protocol to the sponsor and IRB per their policies.

The investigator must report information that could affect the safety of participants or the conduct of the study.

The investigator must report the discontinuation of the study to the IRB.

The investigator must report the completion of the study to the IRB.

The investigator must report any changes in the study to the IRB before implementation, except to eliminate immediate hazard.

The investigator must maintain adequate and accurate records to enable the conduct of the study to be fully documented and the study to be reconstructed.

The investigator must retain records for the period required by the sponsor and applicable regulations.

The investigator must make records available to the sponsor, the IRB, and regulatory authorities on request.

The investigator must maintain records of the disposition of the investigational product.

The investigator must maintain records of the randomization and the treatment assignment.

The investigator must maintain records of the medical history and concomitant medications.

The investigator must maintain records of the informed consent of each participant.

The investigator must maintain records of the delegation of study tasks.

The sponsor must ensure that the study is monitored adequately to ensure the rights and well-being of participants and the integrity of the data.

The sponsor must select monitors with the appropriate qualifications and training.

The sponsor must ensure that the monitor has access to the source documents and the study facilities.

The monitor must verify that the investigator has the qualifications and resources to conduct the study.

The monitor must verify that the study is conducted according to the protocol and GCP.

The monitor must verify that the data are accurate and complete.

The monitor must document the findings of the monitoring visit in a report.

The sponsor must ensure that the monitor follows up on the findings of the monitoring visit.

The sponsor must ensure that the study is conducted in accordance with GCP and applicable regulations.

The sponsor must ensure that the study is conducted in accordance with the protocol.

The sponsor must ensure that the study is conducted in accordance with the IRB-approved protocol.

The sponsor must ensure that the study is conducted in accordance with the sponsor's written procedures.

The sponsor must ensure that the study is conducted in accordance with the applicable laws and regulations.

The sponsor must ensure that the study is conducted in accordance with the applicable guidelines.

The sponsor must ensure that the study is conducted in accordance with the applicable ethical principles.

The sponsor must ensure that the study is conducted in accordance with the applicable standards.

The protocol must include the name and address of the sponsor and the investigator.

The protocol must include the name and address of the IRB.

The protocol must include the name and address of the laboratory.

The protocol must include the name and address of the institution.

The protocol must include the name and address of the study site.

The protocol must include the name and address of the study staff.

The protocol must include the name and address of the study monitor.

The protocol must include the name and address of the study statistician.

The investigator must ensure that the recruitment of participants is conducted in accordance with the protocol and IRB-approved materials.

The investigator must ensure that the recruitment of participants is conducted in accordance with the applicable regulations.

The investigator must ensure that the recruitment of participants is conducted in accordance with the applicable ethical principles.

The investigator must ensure that the recruitment of participants is conducted in accordance with the applicable standards.

The investigator must ensure that the recruitment of participants is conducted in accordance with the applicable guidelines.

The investigator must ensure that the recruitment of participants is conducted in accordance with the applicable laws.

The investigator must ensure that the recruitment of participants is conducted in accordance with the applicable policies.

The investigator must ensure that the recruitment of participants is conducted in accordance with the applicable procedures.

The investigator must ensure that the informed consent is obtained in accordance with the protocol and IRB-approved form.

The investigator must ensure that the informed consent is obtained in accordance with the applicable regulations.

The investigator must ensure that the informed consent is obtained in accordance with the applicable ethical principles.

The investigator must ensure that the informed consent is obtained in accordance with the applicable standards.

The investigator must ensure that the informed consent is obtained in accordance with the applicable guidelines.

The investigator must ensure that the informed consent is obtained in accordance with the applicable laws.

The investigator must ensure that the informed consent is obtained in accordance with the applicable policies.

The investigator must ensure that the informed consent is obtained in accordance with the applicable procedures.

The investigator must ensure that the study is conducted in accordance with the protocol and the applicable regulations.

The investigator must ensure that the study is conducted in accordance with the applicable ethical principles.

The investigator must ensure that the study is conducted in accordance with the applicable standards.

The investigator must ensure that the study is conducted in accordance with the applicable guidelines.

The investigator must ensure that the study is conducted in accordance with the applicable laws.

The investigator must ensure that the study is conducted in accordance with the applicable policies.

The investigator must ensure that the study is conducted in accordance with the applicable procedures.

The investigator must ensure that the study is conducted in accordance with the applicable requirements.