Study and protocol knowledge
The applicable protocol version and amendments, critical data and processes, milestones, and permitted pathways — what makes a recorded change a question about the study, not the software.
Connected expertise
Experts bring the relevant disciplines to the evidence.
An audit trail shows that something happened. Audit Trail Review as a Service (ATRaaS) asks whether it matters to the study, bringing study, technical, regulatory, system, and assessment knowledge into one Expert-led review.
Perspective
Study teams bring study knowledge. IT brings technical understanding. QA brings a quality and regulatory perspective. ATRaaS is built around how those perspectives are connected inside the review itself, where a specific change in a specific system has to be explained in study terms. For each engagement, QA4Tech Experts establish the knowledge the review needs, agree specialist input where a conclusion calls for it, and then review, investigate, and decide, assisted by technology and AI.
Record and activity
A record and a study activity describe one event differently.
The recorded action is a question of the system: what it captured, how it is configured for this study, and what its timestamps mean. Its study significance is a question of the protocol, the assessment, and related events in other systems. A review has to answer both before it reaches a conclusion.
Seven disciplines
Each discipline answers part of what the evidence means.
In ATRaaS, Experts bring them to the same evidence, in the same review, around the questions agreed for the study.
Technology and audit-trail interpretation
What a source actually records: event types, coded values, system-generated entries, and the difference between activity time, data-entry time, submission, server receipt, and audit-record creation.
Regulatory and data-integrity knowledge
The expectations the review is anchored to — risk-based, trial-specific review focused on critical data — and what makes a record trustworthy: who acted, when, what changed, and why.
Study-specific system knowledge
How this study’s instance of each system is configured — forms, roles, timestamps, and correction workflow — and how that configuration shapes what its audit trail records.
Assessment and instrument context
Which instrument and version were used, what the item measures, when it was administered, and how the study uses the result.
Interpretation across systems
Reading together the records from EDC, eCOA/ePRO, IRT/RTSM, and any other system in scope, subject to available evidence and access, to establish whether they describe one study activity — with identity and timing reconciled explicitly and uncertain links kept visible.
Evidence-based investigation
Testing alternative explanations and pursuing questions no automated check has raised. A finding rests on investigated evidence and a documented Expert assessment; an inconclusive result can be the right outcome.
Discipline map
Where each discipline typically sits.
The comparison shows which team typically holds each discipline as a core strength, and where it depends on skills and remit. It is a discussion aid for mapping your own review, not a judgment about any team.
| Study team | IT team | QA team | ATRaaS | |
|---|---|---|---|---|
| Study and protocol knowledge | Typical core strength | Depends on skills and remit | Depends on skills and remit | Within the scope the service is designed to bring |
| Technology and audit-trail interpretation | Depends on skills and remit | Typical core strength | Depends on skills and remit | Within the scope the service is designed to bring |
| Regulatory and data-integrity knowledge | Depends on skills and remit | Depends on skills and remit | Typical core strength | Within the scope the service is designed to bring |
| Study-specific system knowledge | Depends on skills and remit | Depends on skills and remit | Depends on skills and remit | Within the scope the service is designed to bring |
| Assessment and instrument context | Depends on skills and remit | Depends on skills and remit | Depends on skills and remit | Within the scope the service is designed to bring |
| Interpretation across systems | Depends on skills and remit | Depends on skills and remit | Depends on skills and remit | Within the scope the service is designed to bring |
| Evidence-based investigation | Depends on skills and remit | Depends on skills and remit | Typical core strength | Within the scope the service is designed to bring |
- Full: a typical core strength for a team; for ATRaaS, the scope the service is designed to bring
- Partial: depends on skills and remit
ATRaaS marks show the combined scope the service is designed to bring to each engagement, not universal mastery or a measured comparison. This is an illustrative comparison: actual team capabilities vary, and an internal multidisciplinary team can combine the same disciplines. Study, system, and instrument knowledge is established during onboarding, with specialist input where needed.
System and assessment knowledge
System knowledge is not assessment knowledge.
Knowing that a source is eCOA does not establish how its forms, permissions, timestamps, or correction workflow are configured. Two studies can run the same product and version and still be configured differently.
Assessment knowledge is a separate discipline. A screening assessment and a later endpoint assessment can raise different review questions even when their audit-trail entries look alike. Recognizing a questionnaire’s name says as little about its use in this study as recognizing a product’s name says about its configuration.
Take a synthetic example: a questionnaire response changed after submission. System knowledge explains the recorded action and its timestamps; assessment knowledge, what the item measures at that study stage; study knowledge, whether the protocol permits the pathway. Experts weigh those connections — treating a recorded reason or change request as supporting evidence, not automatic justification — before deciding whether the evidence supports a legitimate correction, a concern for follow-up, or an inconclusive assessment. In the review report, the case record keeps the source records, the protocol and assessment context, the alternatives considered, and the rationale together, so each part of the reasoning can be checked.
Onboarding
Onboarding establishes the knowledge this study needs.
Relevant Expert experience is the starting point. Onboarding combines it with your protocol, system configuration, source definitions, and assessment documentation, so the review starts from how this study actually runs.
- The protocol version and amendments, and the data and processes the study treats as critical
- Milestones, visit windows, and permitted pathways that give recorded events their meaning
- How each system in scope is configured for this study
- What each field, code, and timestamp means, including time zones and participant identity keys
- The instruments and versions in use, and when they are administered
- How changes are requested and approved, for example through data change requests
- Where specialist input is needed, and the agreed routes for questions and urgent escalation
- What the available exports can and cannot show, before any conclusion is drawn
Specialist input and escalation
Clinical and safety judgment stays where it belongs.
Some questions reach beyond audit-trail interpretation. Where a conclusion needs medical, safety, or instrument-specific judgment, the specialist input and the route for obtaining it are agreed as part of the engagement, before a case needs them.
ATRaaS does not assume the investigator’s clinical decision-making or the sponsor’s safety responsibilities. Important concerns are raised promptly through the agreed route, and a matter that cannot be resolved within scope is reported as unresolved.
Scope follows the expertise that can be demonstrated for the study and the evidence that can be accessed, not an assumption that every speciality or instrument is covered. Where either falls short, some questions can still be answered with the limitation stated; others need further evidence, specialist input, or a revised scope.
Your existing review
A defined addition to the review you already perform.
Each engagement begins by understanding the review already performed by the sponsor, any CRO, and other providers. ATRaaS then contributes within an agreed, complementary scope.
A cross-system perspective
Questions that span more than one study system, examined together against the protocol and the study’s critical data.
Targeted investigation
A defined concern — a participant, site, endpoint, process, or period — examined within an agreed evidence boundary.
Additional review capacity
Expert review alongside your team’s work, with the reasoning documented so it can be followed, challenged, and acted on.
Independence
Independence supports judgment, not proof of completeness.
QA4Tech is independent of the sponsor, CROs, sites, and the vendors whose systems produce the records; that is where the service’s independence comes from. The method is vendor-agnostic, and the arrangements that support independence are agreed at the start of each engagement.
What independence provides
- Separation between the people assessing the evidence and the parties that generate or manage it
- A review organized around the study, not around any one vendor’s product or export format
- Expert assessments whose substance is not set by the contractual relationship
- Agreed routes for who receives conclusions, how disagreement is recorded, and when a matter is escalated
Its boundaries
- No proof that an export is complete or unaltered — provenance, extraction scope, and limitations are stated instead
- No requirement to use an outside provider — the guidance the work is anchored to does not require one
- No judgment that the review already in place is inadequate
- No change in responsibility — the sponsor and its partners keep theirs, including oversight of service providers
- No certification of the study, and no assurance that it has no issues
Accountability
QA4Tech Experts are accountable for the conclusions.
Experts examine the evidence, pursue their own questions, investigate, and decide. Technology assists their analysis, and AI is used case by case for bounded tasks, as agreed for each engagement. An Expert assesses its output; AI does not reach conclusions.
QA4Tech was founded by George Evgrafov, MBA, CISA, a quality and technology assurance leader with more than 25 years of experience in information technology and more than a decade in pharmaceutical and regulated-industry quality. George has been a Certified Information Systems Auditor since 2014.
Where appropriate, QA4Tech can work with selected freelance consultants and subject matter experts. Their involvement is managed through defined responsibilities, confidentiality requirements, quality expectations, and clear oversight.
Start a conversation
Your hardest case is a good place to begin.
In a short first conversation, describe the case in one of your studies that is hardest to interpret and the knowledge already applied to it. That is enough to start mapping the disciplines, evidence, and specialist input a review would need, and which engagement fits: an evidence readiness assessment, a pilot review, or a targeted investigation.