The question, and the decision it supports, are written down before evidence is examined.
Engagements
Start with one study question.
The recommended way to begin an Audit Trail Review as a Service (ATRaaS) engagement is an evidence readiness assessment: small, bounded, and useful on its own. It shows what your evidence can support before you decide on anything wider; where feasibility is already clear, a pilot review can come first.
Perspective
An audit trail question can start with something specific: a correction that needs explaining, an audit observation, or activity that crosses the boundary between two study systems. Answering it depends on evidence held in several places and on knowledge of the protocol, the system configuration, and the instruments in use — and not every set of exports can support an answer. An engagement is therefore built around one question and its evidence rather than a fixed format, and its first stage establishes what that evidence can support.
The engagement path
Each stage ends in a decision.
After a first conversation, the recommended first step is an evidence readiness assessment; where feasibility is already clear, work can begin with a pilot review instead.
- 01
First conversation
A short conversation covers one study and one question and needs no participant-level data. It ends with an agreed next step: an evidence readiness assessment, a pilot review, a targeted investigation, a different question, or no engagement.
- 02
Evidence readiness assessment
Experts review the sources you list and representative exports — their structure, identity links, and timestamp meanings — against the applicable protocol version and the questions you need answered, and identify what is missing. It establishes feasibility; it is not a review of the study. The output is a confirmed source inventory, an account of which questions the evidence can and cannot support, and a recommended scope for the next stage. It ends in a decision: proceed, revise the scope, or stop with the readiness output, which is useful in its own right.
- 03
Pilot review
A bounded Expert-led review of one study, a small number of its systems, and one or two agreed questions, interpreted against the applicable protocol. Once both sides confirm that the evidence and study context are sufficient, Experts examine records, pursue the questions, and investigate explanations; missing or ambiguous evidence may require a revised scope or an inconclusive output. The pilot closes with its review report and a discussion with your team of conclusions, unresolved matters, and follow-up. Your team then decides whether to stop, refine, or extend.
- 04
Recurring review
Study onboarding comes first, building on the evidence readiness assessment or pilot review. Each cycle then covers defined systems, an evidence period, and review questions, and ends in a review report and a meeting with your team. Cadence follows the study’s risks, questions, and milestones; this is periodic review, not continuous monitoring. When sources, the protocol, or the questions change, the scope is agreed again before work continues.
Targeted investigation
A defined concern can be investigated on its own.
A targeted investigation examines one defined concern — prompted, for example, by an audit or inspection observation — about a participant, site, endpoint, process, or period. It begins with an evidence readiness assessment, scoped to that concern, to confirm what the evidence can support.
Named systems, exports, period, and population, with exclusions stated.
If the evidence points beyond the boundary, a wider inquiry is defined and agreed before it begins.
What has been established, what remains unresolved, and the next decision point. An inconclusive result can be the correct one.
Starting points
Eight questions shape the first conversation.
None needs a prepared answer. A promising first engagement has a concrete cross-system question, an owner who will act on the output, a credible path to authorized evidence, and a willingness to define boundaries. An illustrative question: do recorded changes to a critical item match the scope, actor, and timing of the related data change request?
- What prompted the question, and which decision or uncertainty does it need to support?
- Which sources and periods are reviewed today, by whom, and with what output?
- Which questions remain difficult to answer across systems?
- When a difficult case arises, who brings the study, technical, regulatory, system, and assessment knowledge together?
- Which systems hold the relevant evidence, and can representative exports, definitions, protocol versions, and change records be obtained?
- Who can explain identifiers, timestamp meanings, study configuration, and the instruments used?
- What approvals or access arrangements would sharing evidence require?
- Who would use the output, and what would make a first engagement worth continuing?
Inputs
You provide the evidence and the context to read it.
The items below are enough to begin once a confidential disclosure agreement (CDA) is in place; fuller evidence follows in the agreed format, through the agreed secure route. Anything that cannot be provided is recorded as a limitation, not filled in by assumption, and limited access to evidence is itself a reason to begin with an evidence readiness assessment.
- A concrete study question and the decision the output will support
- A list of the relevant sources and a representative sample, synthetic or appropriately de-identified where that is enough to establish feasibility
- Export field definitions, event types, identity keys, timestamp meanings, and time-zone conventions
- The extraction method, the period covered, and any known export limitations, missing events, or historical changes
- Protocol and amendment versions, system configuration, and the assessment or instrument versions in use
- Examples of data change requests, reasons for change, and related approvals
- Named contacts: an export owner, protocol and instrument contacts, someone to coordinate questions about the source data, and a follow-up owner
Report contents
The review report shows where the evidence stops.
Each review ends in one report, whose scope is agreed before work begins. A useful report may contain findings, inconclusive cases, or a substantiated account of the coverage reviewed without findings. Your team receives the report; direct access to QA4Tech’s internal review system is not assumed.
Scope and coverage
What was reviewed and how — the sources, periods, event types, and methods covered — with exclusions and evidence gaps stated.
Findings
Each with an evidence-linked case record: the source records, study context, the Expert’s reasoning, and decision history, with observation kept separate from interpretation.
Legitimate explanations and unresolved questions
What the evidence explained, and what it could not settle, with case records where relevant and the limitation that prevented a conclusion.
Recommended follow-up
Questions or actions for the named owners in your organization, with escalation where appropriate.
Method basis
The evidence baseline and the mapping, study-context, and review-method versions used, so another reviewer can follow how each conclusion was reached.
Responsibilities
Your organization keeps its decisions.
The engagement documents confirm the final division; this is where the discussion starts.
QA4Tech
- Performs the review within the engagement’s scope: Experts examine records, pursue questions, investigate, and decide, assisted by technology and AI
- Establishes the study context with your team, with agreed specialist input where a question requires it
- Preserves the evidence received and keeps each conclusion traceable to it
- Raises important concerns promptly through the agreed escalation route
- States coverage and limitations, and reports unresolved matters as unresolved
Your organization
- Provides the evidence through the agreed route, with the necessary authorizations, and the context needed to interpret it
- Coordinates source questions and makes the right contacts available
- Keeps the study responsibilities agreed between the sponsor and its partners; sponsor oversight stays with the sponsor
- Decides on follow-up actions and owns them
Boundaries
Every engagement states its limits.
ATRaaS is study-level audit trail review. It is not clinical data review, monitoring, data management, or an independent GCP audit, and it does not assume the investigator’s clinical responsibilities or the sponsor’s safety responsibilities. Clinical, safety, and instrument questions that need specialist judgment go to the appropriate specialist through the agreed escalation route.
A review does not certify a study or guarantee findings. A result without findings does not show that a study has no issues; its value depends on the coverage and the work performed. Nor does the review establish that an export is complete or unaltered.
Scope changes are agreed before further work. A new source or schema, a changed export structure, a protocol amendment, a broader evidence period, or new review questions each prompt a scope review. Meanwhile, concerns already identified are still raised through the escalation route, and nothing unresolved is dropped or presented as closed.
Data handling
Arrangements are agreed before any evidence moves.
A CDA is in place before any data is received. The format of the audit-trail exports, a secure delivery route such as SFTP, and the delivery frequency are then agreed.
Authorized access, permitted data and AI use, evidence location, retention, and exit arrangements are agreed in the engagement documents.
The first conversation needs no participant-level data. Please do not include patient data, regulated records, passwords, or sensitive client information in your initial email; an appropriate secure communication channel can be agreed where needed.
Start a conversation
Bring one study and one difficult question.
Tell us about the study, the systems involved, the review already performed, the expertise it drew on, and the question that remains hard to answer. A short conversation can establish whether an evidence readiness assessment, a pilot review, or a targeted investigation is the right next step, or whether none is.