Expert-led
QA4Tech Experts examine records, pursue their own questions, investigate, and decide. Technology and, case by case, targeted AI assist; neither reaches a conclusion.
Audit Trail Review as a Service
Meaningful review. Connected expertise.
Expert-led. Protocol-aware. Across systems. In Audit Trail Review as a Service (ATRaaS), QA4Tech Experts review a clinical study’s audit trails together and against its protocol, then investigate and decide what the evidence can establish, assisted by technology and AI.
Perspective
A clinical study is one connected sequence of activities, but its evidence is spread across systems. Randomization may be recorded in IRT, a questionnaire in eCOA, and a later correction in EDC, each with its own identifiers and timestamp meanings. A single audit trail shows what changed in one system; it cannot, on its own, explain the study. ATRaaS brings those records together: Experts connect the available evidence to the protocol and its critical data, and state what that evidence can and cannot establish.
The shift
A cross-system review asks a different question.
Within one system, the question is “What happened in this application?” Across a study, it becomes “What can the available evidence establish about this study activity?” Source-specific inspection still supplies the detail; ATRaaS seeks the answer across systems, against the protocol, with the limits of the evidence stated.
Service design
Six characteristics shape every review.
Protocol-aware
Review is informed by the applicable protocol version, amendments, and critical data, so a change is judged by what it means for the study.
Across systems
Audit trails from EDC, eCOA/ePRO, IRT/RTSM, CTMS, eTMF, safety, and laboratory systems, or any other system that keeps one, are reviewed together, subject to available evidence and access, to help reveal relationships that can be missed when each trail is reviewed separately.
The participant journey, as recorded
Experts follow each participant’s journey across systems as it was recorded. The reconstruction reflects the evidence received; it is not a guarantee of a complete journey.
Independent and vendor-agnostic
QA4Tech is independent of the sponsor, CROs, sites, and the vendors whose systems produce the records, so the people assessing the evidence are separate from those who generate or manage it. The method depends on no particular vendor or product.
Traceable, with coverage stated
Conclusions link to the source records they rest on, and each review states what evidence was reviewed and what could not be established.
Review focus
The review tests patterns against the study.
Each pattern is a question for Expert assessment, not a finding: a discrepancy may reflect a legitimate correction, a permitted pathway, different timestamp meanings, or missing evidence.
Retrospective entry
Records completed long after the activity they describe, especially near a visit or database lock. A late entry is not necessarily a late procedure; other systems’ records can help show which.
Modification without reason
Changes to critical data whose reason is absent or generic, or does not match what was altered. A change request is supporting evidence, not automatic justification.
Sequence anomalies
Events in an order the protocol does not expect, such as a questionnaire recorded before randomization in another system — not automatically a protocol deviation.
Identity and role
Shared accounts, activity outside a user’s role or study assignment, privileged access used for routine entry, and participants identified inconsistently between systems.
Timing patterns
Activity outside working patterns, implausibly fast entry, or bulk changes shortly before a study decision point. Timing alone does not establish misconduct.
Configuration and control change
Edit checks, ranges, or permissions altered mid-study, and whether each change was assessed before it took effect.
Deletion and disablement
Records removed, participants or visits disabled, and audit trail functions switched off or reconfigured, read against what other systems recorded.
Gaps
Periods, systems, or record types with no audit trail. A gap is a coverage question before it is a finding; an absent record does not prove the activity did not happen.
The method in brief
From an agreed question to a documented conclusion.
- 01
Agree the questions and scope
The study, sources, period, priorities, and report scope, and where a cross-system perspective could help.
- 02
Establish the study context
Experts examine the protocol versions and supporting documents, and identify critical data, milestones, and the actual system and assessment context.
- 03
Assess and prepare the evidence
Exports are checked, kept as received, and connected in one common, traceable representation, with gaps recorded rather than assumed away.
- 04
Review, investigate, and decide
Experts follow the recorded participant journey, assess signals from automated checks, pursue their own questions, and decide.
- 05
Report the work and its limits
The report separates observation from interpretation and states coverage, unresolved questions, and follow-up.
Participant timeline
Each participant’s recorded evidence, on one timeline.
QA4Tech has built an internal review system for this service. Each event on the timeline links to the source record it came from.
- One lane per source system, or all events in a single combined lane.
- A dashed connector marks a relationship that was derived rather than stated by the source.
Review report
One review report traces each conclusion to its evidence.
The report’s scope is agreed before work begins, and each conclusion in it can be traced to the evidence it rests on. A pilot review ends with its report and a discussion with your team about whether to stop, refine, or extend.
- Scope and coverage: what was reviewed, how, and what was excluded or missing
- Findings, each with an evidence-linked case record and the Expert’s reasoning
- Legitimate explanations and unresolved questions, with the limitations that apply
- Recommended follow-up for your agreed owners
- Method basis: the evidence baseline and the mapping and method versions used
Engagement formats
Engagements expand only where the evidence supports it.
A short conversation comes first. The recommended next step is an evidence readiness assessment: small, bounded, and useful on its own. Where feasibility is already clear, work can begin with a pilot review instead; a targeted investigation begins with a readiness assessment scoped to its concern.
Establish whether the available exports and study context can support your questions, and define a feasible scope.
Where feasibility is already clear: one study, a small number of its systems, and one or two agreed questions.
Follows an evidence readiness assessment or pilot review: a scope and cadence set around study risks and milestones, revisited when the study or its sources change.
A defined concern, with an agreed evidence boundary and a route for widening the inquiry.
Regulatory anchors
Anchored to published regulatory expectations.
For clinical trials, EMA and ICH describe audit trail review as a planned, risk-based, trial-specific activity focused on critical data; for other regulated systems, the GxP guidance that applies to them sets the expectations. Which references matter depends on the system, the regulated activity, and the jurisdiction. The service is designed around them; none of them endorses it, requires review to be outsourced, or sets an interval for it. References checked 24 September 2026.
- EMA guideline on computerised systems and electronic data in clinical trials (EMA/INS/GCP/112288/2023), section 6.2.2
- Procedures for risk-based, trial-specific audit trail review, with data review generally documented, focused on critical data, and proactive and ongoing unless justified. Manual review and technology-assisted review of larger datasets should both be considered.
- EMA guideline, sections 4.1 and 4.5: ALCOA++ principles
- Data that are attributable, legible, contemporaneous, original, accurate, complete, consistent, enduring, available when needed, and traceable, with the audit trail named as part of what makes data contemporaneous, complete, and traceable.
- ICH E6(R3) Good Clinical Practice, sections 4.2.2, 4.2.3, and 3.16.1(b)
- Audit trails and logs that are interpretable and can support review, and review of trial-specific data, audit trails, and other relevant metadata as a planned, risk-based activity, adapted to the trial, adjusted with experience, and focused on data of higher criticality.
- ICH E6(R3), sections 3.6.4–3.6.9
- Activities transferred to a service provider are documented in an agreement, while the sponsor keeps ultimate responsibility for the reliability of trial data and oversees the transferred work, which is why each engagement documents its scope and who is responsible for what.
- FDA guidance, Electronic Systems, Electronic Records, and Electronic Signatures in Clinical Investigations: Questions and Answers (October 2024), Q12
- Periodic audit trail review that may help sponsors ensure data quality, authenticity, and integrity, with the decision to review based on a risk assessment of the clinical investigation, and audit trails retained in a searchable, sortable format.
- 21 CFR Part 11, section 11.10(e)
- Secure, computer-generated, time-stamped audit trails that record operator entries and actions creating, modifying, or deleting electronic records, without obscuring earlier information. It governs the records a review relies on rather than requiring a review itself.
- EU GMP Annex 11, Computerised Systems (2011), clause 9
- For computerised systems used in GMP-regulated activities: audit trails of GMP-relevant changes and deletions, based on risk assessment and with reasons documented, available in a generally intelligible form, and regularly reviewed.
- MHRA ‘GXP’ Data Integrity Guidance and Definitions (March 2018), section 6.13
- Documented audit trail review as part of routine data review where a risk assessment determines it, by listing relevant data or by exception reporting, carried out by reviewers with sufficient knowledge and system access. UK guidance across GxP.
- PIC/S PI 041-1, Good Practices for Data Management and Integrity in Regulated GMP/GDP Environments (2021), section 9.6
- For GMP and GDP environments: risk-based audit trail review concentrating on changes to data and anomalous activity, with trails for critical data reviewed alongside the related records.
These are examples, not a complete list. The frameworks and criteria that apply to a particular engagement are identified and agreed as part of defining its scope.
White paper
Read the reasoning behind the service.
“From system records to study understanding” explains why the study is the relevant unit of audit trail review and how an Expert-led method keeps evidence traceable, with three synthetic review scenarios. It is written for clinical operations, data management, quality, and sponsor oversight teams.
Questions
Questions worth settling before a review begins.
Our CRO or system vendor already reviews audit trails. Where would ATRaaS fit?
Alongside that review. An engagement starts by understanding the review the sponsor, CRO, and other providers already perform, then defines what ATRaaS adds: a cross-system, protocol-aware perspective, a targeted investigation, or additional review capacity. It is not clinical data review, monitoring, or a GCP audit.
Could our internal team do this?
Yes. Study, IT, and QA teams can bring the same disciplines together internally. ATRaaS offers them as one Expert-led managed service, with the study, system, and assessment knowledge established for each engagement. An evidence readiness assessment shows what your evidence can support, and a pilot review then lets you see, on that evidence, whether the service adds value.
Which systems can be included?
Typically EDC, eCOA/ePRO, IRT/RTSM, CTMS, eTMF, safety, and laboratory systems, but the review is not limited to them: audit trails and relevant event logs from any system that keeps an audit trail can be included, subject to available evidence and access. No vendor integration is assumed; each export’s structure and meaning are assessed for the engagement.
Is ATRaaS only for clinical trials?
Clinical trials are its primary focus, which is why the review is described here in study terms. It can also cover any regulated system that keeps an audit trail, such as laboratory, manufacturing, quality, or other GxP systems. There, the documented process and procedures play the role the protocol plays in a trial: they set the expectations the records are reviewed against.
What if our exports are incomplete or hard to interpret?
Exports can be incomplete, filtered, or truncated without saying so. The evidence readiness assessment examines what was exported, how, and with what known limitations; some questions stay answerable with a stated limitation, others need more evidence or a revised scope. A check that cannot be evaluated is reported as not evaluable, never as passed.
Does AI make decisions in the review?
No. Experts review, investigate, and decide. Deterministic checks raise signals that an Expert must assess before anything becomes a finding, and Experts also examine evidence nothing flagged. AI is used case by case, for bounded tasks where it helps — for example, comparing recorded changes with data change requests. Its output stays linked to the evidence it used and is assessed by an Expert, and permitted AI use is agreed for each engagement.
Is ATRaaS software, and would we need access to QA4Tech’s system?
No to both. ATRaaS is a managed review service, not software. The review system is internal to QA4Tech and supports the Experts; your team receives the review report. Once a confidential disclosure agreement (CDA) is in place, evidence is provided as agreed exports and documents over a secure route, and no direct connection to your systems is assumed.
What happens if the review finds nothing?
A useful review can end without findings. It still gives a substantiated account of which questions could be answered, what the evidence supports, and what could not be established. A no-findings result is not proof of a clean study, and the review does not certify one.
How do we start?
With a short conversation about one study, the review already performed, and a question that remains difficult to answer. It needs no participant-level data, so please do not email patient data or regulated records. A CDA is in place before any data is received; the export format, a secure delivery route such as SFTP, and the delivery frequency are then agreed. The recommended first piece of work is an evidence readiness assessment.
The service in depth
Each part of the service is covered in more depth.
01
How it works
The five-step method in depth: study context, preserved evidence, signals and findings, how technology and AI assist Experts, and a synthetic example.
02
Expertise
The seven disciplines a review draws on, how QA4Tech Experts establish each study’s knowledge, specialist input, independence, and accountability.
03
Engagements
How engagements begin and progress, including targeted investigation: what each stage produces, what you provide, and what the review report contains.
04
Review system
QA4Tech’s internal system for its Experts: participant timelines, checks that show their basis, findings with history, and evidence lineage.
05
White paper
From system records to study understanding: why the study is the relevant unit of audit trail review, and how an Expert-led method is built.
Start a conversation
Tell us what your study team needs to understand.
A short conversation can establish what evidence would allow an Expert to reach a defensible conclusion, and whether an evidence readiness assessment, the usual first step, or a pilot review is the right place to begin.