Over the past year, European Medicines Agency (EMA) inspection trends have become more than a regulatory barometer; they are effectively a design signal for how modern clinical trials should be built.
The 2024 EMA GCP inspection report highlighted recurring issues in vendor oversight, access to site e-systems, data traceability, and fragmented sponsor oversight. At the same time, the finalized ICH E6(R3) guideline has clarified that these are not isolated operational gaps; they are symptoms of a deeper problem: quality that was not designed into the trial from the start.
This convergence brings two disciplines together in a decisive way:
Quality by Design (QbD) as the philosophy, and Risk-Based Quality Management (RBQM) as the operating model that makes it inspectable.
Historically, many organizations treated inspections as episodic events, something to prepare for at the end of a study. That mindset is no longer viable.
Inspectors are now looking backward from outcomes to decisions:
How were risks defined at protocol design?
How did those risks shape monitoring?
How did data criticality influence controls?
How were deviations assessed and escalated?
In other words, regulators are not just evaluating documentation; they are evaluating how you designed your quality system.
This is where QbD becomes central.
Across recent CHMP-requested inspections, the most frequent findings clustered around five themes:
Contracts and vendor oversight
Weak GCP clauses, unclear responsibilities, and limited ongoing oversight of providers.
Direct access to site systems
Overreliance on PDFs, screenshots, or ad-hoc exports rather than planned, robust access.
Computerized systems
Inconsistent qualification, poorly defined source data, and weak audit trails.
Data handling and traceability
Generic Data Management Plans (DMPs) that did not reflect what was truly critical to quality.
Sponsor oversight
Monitoring, audits, and deviations operate in parallel rather than as a single integrated system.
Taken together, these findings do not point to isolated failures; they point to a lack of coherent quality architecture.
ICH E6(R3) reframes quality from being reactive to being prospective and intentional.
Three changes are especially significant:
1) Quality must be designed, not inspected in
Critical to Quality (CtQ) factors are expected to be identified early, directly shaping monitoring strategy, data controls, and oversight priorities.
2) Systems must be fit for purpose
Validation depth should reflect data criticality rather than uniform, one-size-fits-all approaches.
3) Oversight must be adaptive
Risk management should evolve with the study rather than remain static from protocol to close-out.
This is classic QbD thinking applied to clinical research, but it requires an operational engine to make it real.
That engine is RBQM.
Many organizations still rely on tools that:
Generate risk indicators without decision logic
Provide dashboards without governance pathways
Surface signals without clarifying ownership
Track deviations without linking them to oversight changes
These approaches may improve visibility, but they rarely create defensible oversight.
Under ICH E6(R3), visibility alone is insufficient. Inspectors want to see how decisions were made, why they changed, and what followed.
That is a design problem, not a reporting problem.
Estimate Your Cost Savings
Get a quick, directional view of how risk-based quality management can reduce monitoring effort, rework, and delay-related costs in your next study.
Estimate Your Cost Savings
Get a quick, directional view of how risk-based quality management can reduce monitoring effort, rework, and delay-related costs in your next study.
When implemented as an operating model rather than a monitoring add-on, RBQM connects three layers seamlessly:
Design (QbD) — CtQs, risks, and controls defined at protocol stage.
Execution (operations) — monitoring, data management, and deviations aligned to those CtQs.
Governance (oversight) — clear ownership, escalation pathways, and evidence trails.
In this configuration, RBQM is no longer a toolset; it is the organizing principle of trial quality.
Organizations that are aligned with both EMA trends and ICH E6(R3) typically demonstrate:
A living risk register tied to protocol intent
A Data Management Plan driven by CtQs, not templates
Planned access to site e-systems from study start
Proportionate system qualification based on data criticality
A unified oversight model linking monitoring, deviations, audits, and CAPA
Clear documentation of why decisions were made, not just what was done
In short, inspection readiness is a by-product of good design, not last-minute remediation.
For sponsors and CROs in 2026, the direction is increasingly consistent: QbD shapes the design intent, ICH E6(R3) defines the expectations, and EMA inspections test how well that intent was executed in practice. In this context, RBQM functions as the operating model that connects design, data, and decisions into a coherent system; strengthening compliance, efficiency, and defensibility across both individual studies and entire portfolios.
If you’re considering how EMA findings and ICH E6(R3) expectations affect your approach to QbD and RBQM, our Growth team can discuss practical next steps for your studies and governance model.
Featured Insights
Start Your Roll-Out
Quick Answers
Explore short interviews and podcast episodes with industry experts discussing RBQM, Clinical Operations, Data Science, and the future of clinical trials.
New episodes added regularly
