thebench.bio #1 Ecosystem for the Bio-Tech Industry
All Clinical Data Management questions

Question 19 of 20 Advanced Troubleshooting

An audit trail review shows site users changing data after investigator sign-off. What do you do?

Short answer

Find out what changed, who changed it, when and why, and whether the changes touch critical data. Changes after sign-off are allowed if justified and source supported, but they break the investigator's endorsement, so the affected data need re-review and re-signature, and a pattern of unexplained changes is escalated as a possible integrity issue.

Why

EMA's computerised systems guideline treats the investigator's signature as confirmation that data are attributable, legible, original, accurate, complete and contemporaneous, and it expects risk-based, ongoing audit trail review focused on critical data. Review is meant to catch exactly this: changes at unexpected times, data entered long after the visit, or one user editing values across many participants. A change after sign-off is not wrong in itself.

A late laboratory result or a query answer can legitimately change a signed form. The questions are whether each change has a reason, matches source and was re-endorsed by the investigator. Start by quantifying: how many changes, which forms, which users, which time window.

Then sample against source. A coordinator correcting dates to match the source after a query is ordinary. Repeated changes to primary endpoint scores without queries or reasons, made at night before a database cut, are not.

Ask the monitor to verify against source on site, involve quality assurance, and in the EU consider whether the facts reach the serious breach threshold.

How to work it through

  1. Extract the audit trail for all changes after signature, with user, time, old value, new value and reason.
  2. Group the changes by form, user and time to find patterns.
  3. Classify each group by whether it affects safety, eligibility or endpoint data.
  4. Sample changed values against source records through the monitor.
  5. Require re-review and re-signature for legitimately changed data.
  6. Escalate unexplained or patterned changes to quality assurance and assess regulatory reporting.

An example

A monthly review finds 340 changes after signature at one site in a quarter. 290 follow query answers and match source on a 30 record sample. The remaining 50 are changes to a pain score primary endpoint by one coordinator account, all between 22:00 and 23:30 in the two days before a data cut, with reason 'updated'.

Source on site shows the original scores were correct. The sponsor restores the original values through the site, suspends the account, notifies quality assurance and assesses a serious breach notification within 7 days of confirming it.

Where the answer stops holding

Audit trails differ between systems, and some show only the last change or omit reasons, which limits what review can find. Not every unusual time is suspicious, since sites in other time zones or night shifts enter data late. Review effort must be risk-based, so low-risk fields may never be examined.

A strong answer covers

  • Quantify changes by form, user and time
  • Legitimate changes need reasons, source and re-signature
  • Focus on critical data
  • Source verification through the monitor
  • Escalate patterns and assess serious breach reporting

Common mistakes

  • Assuming every change after sign-off is misconduct.
  • Ignoring the need for the investigator to re-endorse changed data.
  • Reviewing audit trails only at the end of the study.