Source Data Verification in Clinical Trials: What Research Sites Still Verify Under Risk-Based Monitoring

If you have worked at a research site for more than a few years, you have watched a monitor sit for days comparing every field on a case report form against every chart, lab report, and diary. That model, called 100 percent source data verification, is no longer the expectation. Under the risk-based rules that now govern clinical trials, verification is focused on the data and processes that matter most to participant safety and to the reliability of the study result. The shift is often misunderstood as a relaxation of standards. It is not. It is a reallocation of monitoring attention, and it changes what your site is responsible for producing, protecting, and defending.

This article explains what source data verification is, how the field moved away from checking everything, and, most importantly, what still gets checked at your site.

The vocabulary, in plain language

Source data are the original facts recorded during a study, such as a blood pressure written in a clinic note, a lab value on a report, or a symptom a participant enters in a diary. Source documents, which the finalized ICH E6(R3) guideline now groups under the single term "source records," are the places those facts first live, including medical charts, lab printouts, ECG tracings, and device or wearable outputs.

A case report form (CRF), almost always an electronic CRF today, is the study-specific form where site staff record the data the sponsor needs. Electronic data capture (EDC) is the software system that hosts those forms. A clinical research associate (CRA), often called the monitor, is the sponsor or contract research organization (CRO) representative who oversees the site. A monitoring visit is when that person reviews site records and site processes.

Source data verification (SDV) is the narrow act of confirming that a value entered on the CRF matches the source record it came from. It answers one question: was this transcribed correctly? Source data review (SDR) is broader. It is a read of the source records for quality, completeness, protocol compliance, and safety signals. SDV checks whether the CRF matches the source. SDR checks whether the source itself is credible, complete, and clinically coherent.

How the field moved away from 100 percent SDV

For decades, the default was to send a CRA to the site and check every data point against every source document at regular intervals, regardless of how the trial was performing. The irony, as regulators later acknowledged, is that no rule ever required this. In a 2018 Federal Register notice, the FDA stated that its regulations do not specify how sponsors are to conduct monitoring and are compatible with a range of approaches. The frequent-visit, 100 percent model persisted largely because sponsors believed it was the preferred approach.

A coordinated set of regulatory and industry documents changed that expectation. TransCelerate BioPharma, a nonprofit industry consortium, released a Position Paper on Risk-Based Monitoring in 2013 that argued for shifting away from an excessive focus on SDV toward centralized, off-site, and adaptive on-site monitoring. The FDA issued its own risk-based monitoring guidance the same year, directing sponsors to identify critical data and processes and focus verification there, and finalized a companion questions-and-answers guidance in 2023 that reinforces the same principle. The European Medicines Agency (EMA) published its Reflection Paper on Risk-Based Quality Management in Clinical Trials, endorsing central statistical monitoring and a systematic, prioritized approach. Sites preparing for the newer guideline can find a plain-language readiness walkthrough useful before the next monitoring visit.

ICH E6(R2), adopted in 2016, wrote risk-based monitoring into Good Clinical Practice. Its addendum required sponsors to develop a systematic, prioritized, risk-based monitoring approach, permitted combinations of on-site and centralized monitoring, and required documentation of the monitoring strategy and its rationale. ICH E6(R3) is the current milestone. Its Principles and Annex 1 were adopted in January 2025, published as final FDA guidance in September 2025, and made effective by the EMA in July 2025. E6(R3) elevates risk-proportionate monitoring from an option to the expectation, adds a dedicated data governance section, and makes clear that traditional 100 percent SDV is no longer a default. The guideline explicitly permits verification "on the basis of using samples and supported by data analytics," and directs that sample sizes and record types adapt to prior monitoring results and other signals of data quality.

What still gets checked at or near 100 percent

This is the part that matters most for sites. Risk-based does not mean light-touch on the things that count. The anchor is criticality, meaning the data and processes whose error would meaningfully affect participant safety or the reliability of the result. Monitoring plans routinely designate the following as critical and subject to full or near-full verification:

• Informed consent documentation, including whether consent was obtained and dated before any study procedures
• Eligibility criteria, both inclusion and exclusion
• Primary and key secondary endpoints
• Serious adverse events (SAEs) and adverse events of special interest
• Investigational product accountability, dispensing, and dosing
• Randomization and, where applicable, maintenance of blinding
• Key safety data
• Protocol deviations that affect participant safety or the primary endpoint

Published site practice supports the same list. Sites operating fully risk-based programs have moved overall SDV rates into the 15 to 20 percent range while holding 100 percent SDV on consent, eligibility, adverse and serious adverse events, investigational product accountability, safety data, primary endpoints, and efficacy data. The list is durable across trials and phases, and preparing your source records with this list in mind is the single most useful thing a site can do. Sites can build on the same foundation with essential site compliance practices.

What is now sampled or reviewed centrally

For lower-risk information, verification is sampled rather than exhaustive, and much oversight moves to centralized monitoring, which E6(R3) defines as an evaluation of accumulated data performed in a timely manner by the sponsor’s qualified and trained personnel. Data that are typically sampled or reviewed centrally include non-critical descriptive fields, lower-risk secondary endpoints, routine visit data, and concomitant medications unless they are safety-critical or tied to eligibility.

Centralized monitoring reads the whole trial’s data continuously to detect what a single-site verifier cannot see. It looks for missing data, inconsistent data, data outliers, unexpected lack of variability, and trends across sites. When central review flags a site or a specific data field, that is where on-site effort is directed through what is called a triggered or targeted visit. For a deeper look at how central monitoring is built, the systems side is worth understanding.

The tools that now aim monitoring at your site

Two metrics increasingly drive when a monitor pays your site attention. Key risk indicators (KRIs) are metrics that compare site-level performance, such as query resolution time, adverse event reporting rates, or overdue data entry, and flag sites that may need support. Quality tolerance limits (QTLs) are predefined thresholds set at the whole-trial level for a small number of critical parameters. A breach triggers a trial-level investigation. For sites, the practical takeaway is that oversight is now dynamic. Clean, timely data can mean fewer visits. Data signals can trigger a deeper look.

These dynamics also elevate the importance of the systems a site uses to capture, track, and report study activity. A well-run clinical trial management system is often the difference between a site whose indicators stay quiet and a site whose data prompts a monitor to look closer.

What sites need to do differently under risk-based monitoring

The first step is to understand the monitoring plan and the risk assessment for each study. Ask your sponsor or CRO which data points and processes are designated critical, what the SDV strategy is, and how remote and centralized monitoring will be used. This is a reasonable, professional question, and the answer shapes site workflow.

The second step is to protect source quality above all. Because less of your data will be verified field by field, the quality of your source records carries more weight. E6(R3) makes the investigator responsible for the integrity of data at the site and requires that source records be attributable, legible, contemporaneous, original, accurate, and complete, the standard commonly called ALCOA-C, with traceable changes that do not obscure the original entry. The guideline also asks the investigator to define what counts as a source record, and where it lives, before the trial starts, and to avoid unnecessary transcription steps.

The third step is to prepare for remote and centralized queries. Expect questions that arrive between visits, driven by data analytics rather than a calendar. Fast, well-documented responses keep a site’s key risk indicators favorable. Support triggered visits without treating them as accusations. A triggered visit means a signal warranted a closer look, not that the site failed. Sites that build these habits into daily work also perform better on the wider audit cycle, which is where continuous inspection readiness pays off.

Common misconceptions worth correcting

The most damaging misconception is that less SDV means less rigor. It does not. Risk-based monitoring is smarter monitoring, not less monitoring, and a high-risk site or data point may receive more scrutiny than it would have under uniform 100 percent verification. A second misconception is that critical data are checked less thoroughly now. In reality, consent, eligibility, endpoints, safety events, and investigational product accountability are exactly what still get full verification. A third is that fewer routine visits mean the sponsor has stepped back. Centralized monitoring often means the sponsor is watching your data more continuously than before, just remotely. Finally, some sites assume a fixed SDV percentage is what "risk-based" means. E6(R3) expects the sample to adapt to results, so a static percentage is really just a smaller census.

Practical implications for coordinators, principal investigators, and staff

Document as work happens, not before a visit. Contemporaneous, complete source records are the primary protection, because they are what centralized review and any triggered SDV will rely on. Keep the delegation log, training records, and source-definition documentation current, since E6(R3) reinforces investigator oversight and role-appropriate training. Communicate proactively with the monitoring team about which data are critical and about any process gaps the site spots first. Self-identified issues handled well are far less costly than signals a central monitor finds first. Treat query turnaround and data-entry timeliness as visible performance metrics, because under key-risk-indicator oversight, they are.

Adoption across the industry remains uneven. While most trials now include at least one risk-based component, 100 percent SDR and SDV are still used on a meaningful share of studies. Sites should expect a mix, and asking where a given study falls is now part of professional site operations.

Where DecenTrialz fits

DecenTrialz is a United States-based clinical trial recruitment and pre-screening platform that uses AI-assisted matching and registered nurse-led pre-screening to connect potential participants with research sites. The platform delivers qualified referrals into the site’s workflow with structured, auditable data that supports clean source records from the first touchpoint. Final eligibility determination, informed consent, study walk-through, and enrollment are always owned by the research site and study team, never by DecenTrialz. For sites operating under a risk-based monitoring model, the value is upstream: fewer low-quality referrals, cleaner pre-screening data feeding into the source record, and less noise for centralized monitoring to sift through.

The bottom line

The shift from 100 percent SDV to risk-based monitoring is not a relaxation of standards. It is a reallocation of attention toward what protects participants and preserves the integrity of the result. For sites, the practical takeaway is durable. The data that has always mattered most, including consent, eligibility, endpoints, safety, and investigational product accountability, still gets checked closely. The quality of the source records supporting that data matters more than ever.