Risk-based quality management in clinical trials should guide operational decisions: what requires closer oversight, what can be managed proportionately, what should trigger escalation, and where monitoring resources should be focused.

For medical device Clinical Operations teams, ISO 14155:2020 provides the device-specific Good Clinical Practice framework for clinical investigations, while ISO 14971:2019 provides the framework for medical device risk management. EU Medical Device Regulation (MDR) Article 72 links monitoring to the characteristics of the investigation, and MDCG 2024-3 further defines expectations for the Clinical Investigation Plan (CIP) and monitoring plan.

MDCG 2024-3 strongly recommends adherence to ISO 14155:2020 and states that the CIP should include a statement of compliance with relevant international standards. Where a sponsor chooses not to follow ISO 14155:2020, the guidance indicates that the alternative approach should provide an equal or higher level of protection for subjects.

ICH E6(R3) provides a complementary framework for risk management around factors that are critical to quality. ICH E6(R3) does not formally apply to medical device investigations, but its risk-management structure provides a practical reference that aligns with the risk-based approach expected in device clinical investigations.

The practical question is not whether to use risk-based quality management (RBQM). It is how to apply it consistently across study design, monitoring, data review, site oversight, and escalation.

ICH E6(R3) Section 3.10.1.1 states that sponsors should identify risks that may have a meaningful impact on critical-to-quality factors before trial initiation and throughout trial conduct.
For ClinOps, the first step is to identify the factors that are critical to participant protection and the reliability of trial results.
Depending on the medical device investigation, these may include:

• Primary and key secondary endpoint data
• Safety reporting and device deficiency processes
• Informed consent
• Critical eligibility criteria
• Device accountability and traceability
• Protocol-defined procedures affecting critical endpoints
• Imaging or core laboratory data
• Follow-up required for the primary analysis

Not every protocol deviation, missing field, or site issue has the same quality significance.

ClinOps action

Conduct a cross-functional critical-to-quality review before study activation. Include Clinical Operations, Regulatory Affairs, Data Management, Biostatistics, Safety, Medical Affairs, and other relevant functions.

Consider adding a “critical-to-quality factor affected” field to the study risk register. Each high-priority risk should have a clear link to a critical factor.

ICH E6(R3) Section 3.10.1.2 states that sponsors should evaluate identified risks and existing controls by considering likelihood, detectability, and impact on participant protection and the reliability of trial results. Section 3.10.1.3 then addresses proportionate risk control.

Frequency alone does not determine risk significance.

Consider two sites with different signals. Site A repeatedly enters non-critical data outside the expected timeframe. Site B fails once to perform a protocol-required assessment that contributes directly to a primary safety endpoint.

The first issue occurs more often, but the second may carry greater quality significance because of its potential impact on participant protection or the reliability of trial results.

A practical risk assessment can distinguish:

ClinOps action

For each important risk, document:
risk → control → signal → response

This makes the risk register useful during study conduct, not only during planning or audit preparation.
Electronic data capture (EDC) and clinical trial management systems (CTMS) can support this process by making relevant clinical and operational information available for review.

Medical device investigations may involve several distinct sources of risk.

The risk profile can include the investigational device, the way it is used, and procedures introduced specifically by the clinical investigation. Depending on the study, operator experience, procedural variability, device handling, imaging quality, device deficiencies, and follow-up may all be relevant.
These risks should not be treated as one undifferentiated category.

A practical structure is:

1. Device-related risks, informed by device risk-management information and the clinical context. ISO 14971:2019 provides the framework for identifying hazards, estimating and evaluating associated risks, implementing risk controls, and monitoring their effectiveness throughout the device lifecycle.
2. Procedure-related risks, particularly where the investigation introduces procedures or assessments beyond normal clinical practice.
3. Operational risks, including consent, eligibility, endpoint collection, follow-up, reporting, site performance, data processes, and service providers.

Consider an interventional device investigation that requires both a specialized implantation procedure and protocol-defined imaging assessments.

A device-related safety concern, inconsistent procedural execution, and missing imaging assessments are all relevant risks. However, they arise from different sources and may require different controls, expertise, data, and escalation pathways.

ClinOps action

Add two fields to the study risk assessment:

Risk source: device, procedure, participant, site, data, vendor/system, or study process.

Accountable function: Clinical Operations, Medical, Regulatory Affairs, Safety, Data Management, Biostatistics, or another designated owner.

For EU medical device investigations, MDR Article 72(2) links monitoring directly to the characteristics of the investigation.

Sponsors must ensure adequate monitoring to verify that the rights, safety and well-being of subjects are protected, the reported data are reliable and robust, and the conduct of the clinical investigation complies with the MDR.

The extent and nature of monitoring should be based on an assessment of the investigation’s objectives, methodology, and the degree to which the intervention deviates from normal clinical practice.

MDCG 2024-3 further states that the monitoring plan should address the general monitoring approach, independent monitoring, access to source data, and the planned extent of source data verification.

The practical implication is that the monitoring plan should reflect the logic of the risk assessment.

The desired traceability is:

risk → control → monitoring activity → signal → action

ClinOps action

For each major monitoring activity, ask:
Which identified risk does this activity control or detect?
What finding would cause us to change the intensity or type of monitoring?

RBQM should also inform database design.
If missing endpoint assessments, inconsistent procedural data, delayed reporting, or recurrent data-quality issues are identified as important risks, the EDC specification should consider how they will be detected during study conduct.
Clinical Operations and Data Management should therefore align early on:

• Which data are critical?
• How quickly does the team need visibility?
• Which inconsistencies can be detected through validation?
• Which signals require cross-site review?
• Who reviews the resulting information?

Within Meditrial’s Medigen Suite, Catchtrial EDC+ can support this clinical data environment.

ClinOps action

Add one RBQM question to the EDC specification review:
“Does our data collection and review strategy provide the information needed to detect the critical risks we identified?”

ICH E6(R3) Section 3.10.1.3 states that, where relevant, sponsors should establish predefined acceptable ranges, such as trial-level quality tolerance limits, to support control of risks to critical-to-quality factors.

When an acceptable range is exceeded, the sponsor should evaluate whether a possible systemic issue exists and whether action is needed.
For ClinOps, this means defining in advance when a signal requires investigation or action.

Relevant signals may include:

• Missing critical endpoint data
• Important protocol deviations
• Informed consent issues
• Eligibility violations
• Loss to follow-up
• Safety-reporting timeliness
• Device deficiencies
• Repeated site-specific data-quality issues

Not every metric requires a formal quality tolerance limit. A predefined range or trigger should be linked to a risk that could meaningfully affect a critical-to-quality factor.

ClinOps action

Where appropriate, define:

metric → acceptable range or trigger → owner → required response

Within Meditrial’s Medigen Suite, Maptrial CTMS+ can support the operational trial-management environment, while Catchtrial EDC+ supports the clinical data environment.

The principle is to connect the source of the signal with the workflow used to investigate and manage it.

FDA’s risk-based monitoring guidance supports focusing monitoring on aspects of study conduct and reporting that matter most to participant safety and data quality, and it applies to medical device investigations. Centralized monitoring can form part of this risk-based approach.

Centralized review can help identify patterns across participants, sites, and the investigation as a whole.

Examples include:

• Missing endpoint assessments at one site
• Repeated deviations involving the same procedure
• Differences in data completeness between sites
• Unexpected safety-reporting patterns
• Increasing loss to follow-up

Centralized monitoring does not replace on-site monitoring. It can help determine where more targeted investigation is warranted.

Consider a multi-country device investigation where centralized data review identifies a growing pattern of missing protocol-required endpoint assessments at one site. The signal may justify targeted site review rather than a study-wide change in monitoring.

If the same pattern starts to appear across several sites, however, the team may need to assess whether the issue is systemic and whether the monitoring strategy, training, or other risk controls should be revised.

ClinOps action

When a signal is detected, assess:

1. Does it affect a critical-to-quality factor?
2. Has a predefined trigger been reached?
3. Is the issue isolated or study-wide?
4. Is targeted site review required?
5. Should monitoring intensity change?
6. Does the risk assessment need to be updated?

EDC, CTMS, and clinical oversight should therefore operate as connected components of the same process.

Technology does not determine whether a signal is clinically meaningful. It makes the relevant information available so the study team can assess the signal consistently and determine the appropriate response.

Risk management does not end when the risk assessment and monitoring plan are approved.
ICH E6(R3) Section 3.10.1.5 calls for periodic review of risk control measures to determine whether the implemented quality management activities remain effective and relevant, taking emerging knowledge and experience into account.
A risk assessment completed before first patient in and rarely reviewed afterward is not functioning as an operational RBQM tool.
Potential reassessment triggers include:

• Early enrollment experience
• Protocol amendments
• New safety or device information
• Repeated important deviations
• Quality tolerance limit excursions
• Addition of countries or new site types
• Significant vendor or system changes
• Changes in recruitment or follow-up patterns

ClinOps action

Add one standing question to study governance:

“Has anything changed that alters our assessment of the study’s critical risks or the controls applied to them?”

If yes, determine whether the risk assessment, monitoring strategy, training, system configuration, or other controls need to change.

ISO 14155:2020, MDR Article 72, MDCG 2024-3, FDA risk-based monitoring guidance, and the risk-management principles described in ICH E6(R3) all support a proportionate approach to clinical investigation quality and oversight.

A mature RBQM model connects regulatory strategy, critical-to-quality factors, risk assessment, database design, monitoring, site management, and study governance. For medical device sponsors, Regulatory Affairs establishes the regulatory and evidence context. Clinical Trial Management translates study priorities into site strategy, monitoring, oversight, and escalation. Data Management supports the collection and review of critical clinical information.

Trial-level risk management also forms part of the manufacturer’s broader quality framework. Under MDR Article 10(9), manufacturers are required to maintain a quality management system that encompasses risk management, clinical evaluation, post-market surveillance, and other lifecycle processes. Connecting RBQM with established quality processes, such as document control, CAPA, and device risk-management records, can strengthen traceability between clinical investigation activities and the broader product lifecycle. This alignment supports consistent decision-making, facilitates oversight, and helps ensure that insights generated during the clinical investigation can feed into the manufacturer’s wider quality and risk-management processes.

Technology provides the infrastructure through which clinical and operational signals can be identified, reviewed, and connected with the appropriate follow-up actions.

Meditrial supports medical device sponsors across Regulatory Affairs and Clinical Trial Management, with the Medigen Suite, including Catchtrial EDC+ and Maptrial CTMS+, providing a complementary digital layer for clinical data and trial management.

Use these questions to test whether the RBQM process is influencing study decisions:

1. Can we name the study’s critical-to-quality factors without opening the risk register?
2. Can every high-priority risk be traced to a meaningful control?
3. Does our monitoring plan reflect the risks we identified?
4. Have we distinguished device, procedure, data, and operational risks?
5. Do critical signals have predefined owners and escalation pathways?
6. Can centralized findings trigger targeted site-level action?
7. Do we know when the risk assessment must be reconsidered?
8. Can we explain why monitoring intensity differs across activities or sites?

Clear answers indicate that the study is moving beyond simply having an RBQM process toward using risk to guide operational decisions.

Meditrial’s Regulatory Affairs and Clinical Trial Management capabilities can support sponsors in connecting regulatory requirements, evidence strategy, study planning, and clinical execution, complemented by Medigen Suite technologies for clinical data and trial management. Visit Regulatory Affairs or Clinical Trial Management, or contact the Meditrial team to discuss your clinical development program.

What should an RBQM risk assessment contain?
An RBQM risk assessment should identify critical-to-quality factors, risks that could materially affect them, existing controls, likelihood, detectability, potential impact, and necessary mitigation. For operational use, sponsors can also link each important risk to a signal, responsible owner, and escalation pathway.

How should RBQM affect a clinical trial monitoring plan?
The monitoring plan should reflect the risks and specific characteristics of the investigation. For EU medical device investigations, MDR Article 72 links these factors to the extent and nature of monitoring, while MDCG 2024-3 provides further guidance on the monitoring plan within the CIP.

What is the difference between RBQM and risk-based monitoring?
Risk-based quality management is the broader framework for identifying, evaluating, controlling, communicating, and reviewing risks to trial quality. Risk-based monitoring is one mechanism for controlling or detecting those risks during study conduct.

What is different about RBQM for medical device trials?
Medical device investigations may need to consider risks related to the device, clinical procedures, investigator or operator experience, critical data, sites, and study operations. ISO 14155:2020 provides the device-specific GCP framework, while ISO 14971:2019 addresses risk management for the medical device itself.

Does RBQM require quality tolerance limits?
ICH E6(R3) describes predefined acceptable ranges, such as trial-level quality tolerance limits, where relevant. This does not mean every operational metric requires a formal limit. ICH E6(R3) is not the governing GCP standard for medical device investigations, but its risk-management structure is a useful reference.

How often should a clinical trial risk assessment be reviewed?
There is no single review frequency appropriate to every investigation. Risk review should respond to emerging knowledge and experience during study conduct, including important deviations, new safety or device information, protocol changes, and relevant operational trends.

This article provides general information and does not constitute regulatory, clinical, or legal advice. Requirements and appropriate risk-based quality management approaches should be confirmed for the specific medical device, clinical investigation, study design, applicable regulatory framework, and markets concerned.

• ISO 14155:2020 — Clinical investigation of medical devices for human subjects — Good clinical practice.
• ISO 14971:2019 — Medical devices — Application of risk management to medical devices.
• ICH E6(R3) Good Clinical Practice Guideline
• European Commission — MDCG 2024-3 Guidance on the Clinical Investigation Plan
• Regulation (EU) 2017/745 on medical devices (MDR)
• FDA — A Risk-Based Approach to Monitoring of Clinical Investigations: Questions and Answers (2023)
• Regulation (EU) 2017/745, Annex XV — Clinical investigations.
• TransCelerate BioPharma — Risk-Based Monitoring Toolbox (Risk Assessment and Categorization Tool).

One Partner. Integrated Solutions. Faster Pathways. Better Outcomes.