Rethinking clinical trial risk management to improve quality and productivity
Yuxiao Wang, Vibhore Gupta, Vishal Kabra, and Sharma Ramanathan coauthored article.
Your organization has invested millions of dollars in risk-based quality management (RBQM) technology. It has set up teams and processes and rolled out rounds of training.
Yet quality issues persist, as protocol amendments continue to pile up and most data points are still reviewed as they always have been. Study teams complain that risk assessment is a check-box exercise, and that signals from central monitoring tools have too many false positives.
If this sounds all too familiar, you are not alone. Many industry surveys show adopting RBQM remains a challenge. A 2024 study revealed that RBQM components are used in only 57% of clinical trials on average, and that teams in site management/site monitoring, clinical development and clinical operations/study management are among the functions with the least trust in RBQM.
Similarly, our industry analysis suggests that while 78% of sponsors have adopted some form of RBQM, only 12% report achieving their anticipated efficiency gains and quality improvements. RBQM has promised more efficient monitoring, enhanced quality and risk-proportionate resource allocation. But that promise remains unrealized. And it's why we're introducing a new approach: integrated quality risk management (IQRM).
IQRM addresses RBQM's barriers by connecting risk assessment with downstream monitoring and quality activities. Organizations report IQRM has improved data quality, reduced protocol amendments by about 25% and delivered 30%–40% reductions in monitoring costs, as we explore in this article.
7 structural barriers holding back risk-based quality management
So why is it that despite clear regulatory expectations and widespread industry discourse, RBQM remains inconsistently and incompletely adopted at many pharmaceutical sponsors? Our ZS RBQM maturity benchmarking assessment suggests it’s due to barriers that are largely structural and rooted in multiple aspects of the organizational operating model.
These seven barriers collectively explain why RBQM has struggled to take hold as a scalable, end-to-end capability.
Many organizations still operate within a culture that values exhaustive verification over critical thinking. They say their culture is to triple check everything and leave no stone unturned. This, of course, rewards exhaustive verification rather than critical thinking.
If leadership values and encourages firefighting, a mindset will develop that deters teams from raising and addressing risks proactively. And if there is little reward or recognition for upfront risk assessment and planning, staff will be reluctant to adopt risk-based approaches.
Another cultural challenge is balancing speed and quality. Senior leaders often say good clinical practice (GCP) quality is to never be sacrificed. However, we regularly hear from teams that say that speed to first-subject-first-visit (FSFV) is rewarded more than last-subject-last-visit (LSLV).
At many pharma sponsors, governance structures typically escalate issues after they occur, instead of guiding systematic, risk-based decision-making. Teams describe reactive or issue-based quality governance rather than proactive or risk-based. They see governance bodies as “a place to go when things are bad” rather than a mechanism for forward-looking oversight.
A lack of metrics-driven oversight, poor integration with processes and vendor risks all weaken governance. They also limit leadership’s ability to objectively monitor quality signals and identify root causes across programs.
RBQM functions are sometimes buried several layers down in the organization, limiting their ability to influence the decision-making of study teams. The risk manager role—often a “lower title” than others on a study team—is viewed as an outsider, instead of an integral part of the study team.
On top of this, responsibilities and accountabilities across “GCP quality” roles are frequently ambiguous. Many companies have overlapping roles in RBQM, compliance, central monitoring and quality assurance. This lack of clarity makes functional handoffs inefficient and hinders the collaboration needed to foster RBQM practices.
A protocol risk assessment should be conducted during trial design. But sometimes, the initial risk assessment doesn’t happen until after protocol finalization, and sponsors miss the window to embed quality-by-design principles into trial protocols.
Even when they’re actually conducted, risk assessments are frequently performed in silos. Identified risks and mitigations aren’t meaningfully integrated into downstream study execution processes such as site monitoring and data review.
Standard operating procedures (SOPs) sometimes fail to reference the outputs of a risk assessment. For example, the SOPs for data management and monitoring should reference critical-to-quality and risk assessments. They need to focus on what matters most, rather than noncritical data. Because of this lack of integration, study teams are often unable to observe the impact of risk assessment on subsequent trial operations.
Effective RBQM requires teams to think critically and make collaborative, quality-focused decisions—but these skills take intentional mentorship and hands-on experience to build. Study teams also consistently report that better education and training are needed for many RBQM concepts and their practical applications (especially around tailoring to each specific protocol).
We sometimes see a risk manager job description written as a facilitator role, even though strong leadership skills are needed to drive a study team toward an optimized and well-mitigated risk management plan. Similarly, central monitors at some companies also only play a reactive role to signals and lack the end-to-end picture to drive meaningful action.
Many sponsors operate in a highly fragmented systems landscape with datasets that are incompletely harmonized. Most RBQM solutions focus only on risk assessments and surveillance and are disconnected from downstream review and monitoring application. This limits the ability to pull through risk-based strategies.
For companies that use commercial off-the-shelf products, the pay-per-study license model often leads to too few studies using RBQM technology. These companies are then unable to perform portfolio-level roll-ups or detect systematic risks across studies.
RBQM falls short without integration
RBQM struggles not because the framework is flawed, but because the organizational ecosystem surrounding it isn’t configured to support the risk-based quality as a core operating discipline. Cultural resistance, reactive governance, procedural processes, skill gaps, organizational misalignment, vendor disconnects and fragmented systems can contribute to RBQM’s limited adoption and impact.
IQRM: The next evolution of risk-based quality management
IQRM elevates traditional RBQM into a more integrated approach. Here are three key pillars of IQRM:
- Risk assessment becomes truly integrated with downstream functional monitoring and quality management activities.
- All monitoring and data review activities—including site monitoring, central monitoring, data monitoring, medical monitoring and safety monitoring—become integrated with each other.
- Study level risks become more integrated with systemic risks at higher levels, such as the process level, vendor level, region/country level and asset/program level.
Although the integrated quality risk management plan is a decade-old concept and term, IQRM is a new framework that extends its spirit to every aspect of how clinical trials are delivered—from design, planning, execution and reporting. IQRM represents the broadest and most mature application of risk-based approaches in clinical trial quality.
Building upon the foundation established by ICH E8 R1 and ICH E6 R3, IQRM unifies quality-by-design, protocol risk assessment, data monitoring, site monitoring, central monitoring and other functional activities into a single, coherent framework. All of these functions share a common understanding of critical-to-quality factors, associated risks and risk controls.
The business case is compelling: Organizations that have achieved even partial IQRM integration reported to ZS:
- 30%-40% reductions in monitoring costs
- 25% fewer protocol amendments
- Measurably improved data quality
More importantly, IQRM delivers on the promise risk-proportionate approaches by focusing resources where risks are highest and streamlining oversight where risks are well controlled.
For senior directors, VPs and other leaders responsible for RBQM strategy, IQRM represents both an opportunity and an imperative. Regulatory expectations continue to evolve, with authorities increasingly expecting sponsors to demonstrate systematic, integrated quality approaches. Meanwhile, competitive pressures demand greater trial efficiency without compromising quality. Organizations that implement IQRM will have a significant operational advantage in an increasingly complex clinical development landscape.
The four pillars of IQRM transformation in clinical trials risk management
Leveraging IQRM requires embracing four key pillars. Rather than viewing these as sequential steps, we recommend thinking of them as interconnected capabilities that sponsors must develop in concert.
Pillar 1: A risk-proportionate framework
Although one can argue a risk-proportionate framework is already a core component of traditional RBQM, not all sponsors have truly embraced a risk-based approach. This is often because they start risk assessments too late, leaving little time for it to influence protocol design or functional monitoring plans. Instead, sponsors should:
- Start risk assessments early, during study design and planning, to fully reap the benefits of quality-by-design.
- Base risk control actions on critical-to-quality factors, and ensure they’re proportional to assessed risks.
- Focus trial execution and quality management on identified priorities, adapting as real-time signals emerge.
- Adopt strategies such as adaptive site monitoring, targeted source data verification/source data review, risk-based data review and cleaning.
What pillar 1 looks like in practice: Sponsors with mature risk assessment practices often evaluate each risk based on impact, probability and detectability using a standardized scale (such as 1, 4, 7, 10), before calculating a risk priority number (RPN) by multiplying these scores.
They then establish thresholds to determine whether a risk can be accepted or if it requires proportionate mitigation based on its RPN. For instance, in one trial, if the RPN for a risk of failure in cold storage management is calculated at 160, the team may determine that reviewing temperature logs during site monitoring visits are sufficient controls.
In another study, however, if the risk of improper storage leading to unusable investigational product is significantly higher—say, an RPN of 700—the mitigation strategy may escalate to deploying RFID temperature sensors on all kits to ensure continuous monitoring.
Pillar 2: Unified monitoring and risk management
As reflected in ICH E6(R3) section 3.11.4, monitoring is not limited to traditional clinical research associate activities. Every function that participates in the quality management of a trial is engaging in monitoring. Therefore, instead of having five or six separate monitoring plans and siloed reviews by each function, IQRM aims to unify all “monitoring” functions into a single, harmonized monitoring and risk management plan. This looks like:
- One unified monitoring strategy that aligns roles and responsibilities across clinical, operations, biostats, data and safety functions.
- A single integrated plan that minimizes redundant reviews while amplifying synergies across roles.
- A shared platform with metrics, signals, issues and actions visible across all monitoring functions.
- An adaptive monitoring and risk management strategy that evolves as new risks, realized risks or significant quality events emerge.
What pillar 2 looks like in practice: In many clinical development organizations, a data manager may review adverse event or serious adverse event data for discrepancies, missing fields and quality checks. Meanwhile, safety and medical monitors may review the same data for medical plausibility, timelines and clinical context. Clinical research associates will look at it for source data verification, and key risk indicator flags could also lead to central monitors examining it.
That’s a lot of reviews. And it often leads to sites being overrun with multiple queries on the same piece of data.
IQRM offers a better path forward. A unified monitoring plan can harmonize and define which roles look at what data, for what objective and under what condition. We recommend pursuing a shared platform that can show who triggered what query, on what data field, and how the site responded.
Pillar 3: Quality risk management from a portfolio lens
When companies are running dozens or even hundreds of trials simultaneously, study-level RBQM processes can quickly become inefficient. Instead, mid-to-large pharma sponsors are forced to manage quality and risks at a higher level, as opposed to just study by study.
This involves setting up processes and analytical capabilities to understand risks not only across assets, programs, regions and countries, but also across SOPs, computerized systems and service providers, as described in ICH E6(R3). Having these types of cross-study insights will enable sponsors to make systemic changes that improve GCP quality across the portfolio of trials simultaneously. Here are the benefits:
- Trending risks, risk patterns, issues and metrics roll up from studies and sites to the portfolio level (disease areas, therapy areas, countries, regions, sites, vendors and processes).
- Study teams save time by leveraging risks identified at the higher-level domains within a consolidated and curated risk library.
- Process and vendor leads can see how their respective risks were selected and evaluated by teams across portfolios.
- Standard metrics and escalation pathways are set up to filter data to key indicators and narratives that support enterprise GCP governance.
What pillar 3 looks like in practice: For a company with a suboptimal informed consent form (ICF) process, its 50 or so study teams may end up spending time and effort figuring out 50 ways to mitigate ICF risks. But if an informed consent process owner identifies and addresses this process-level risk centrally, all studies will benefit from the quality improvement. And the study team will spend less time on their own risk assessment sessions because they can breeze through ICF-related risks. Imagine the efficiency gains if all process owners did risk assessment at the process level.
On the flip side, suppose a vendor lead is able to see that 60% of the studies in the portfolio are concerned about lab data, and metrics like “showing high rates of missing lab values” or “discrepancies between local and central lab units” are flashing across many studies. In this case, the lead can take action to address this vendor quality issue at the enterprise level.
Pillar 4: Unlocking institutional knowledge for insights
Many pharmaceutical sponsors frequently encounter challenges due to excessive dependence on undocumented organizational knowledge and individual experience. Institutional knowledge of “what worked and what didn’t work” often heavily relies on word-of-mouth assessments during activities, such as study design, operational planning and risk assessment.
As a result, the ability to systematically learn and improve from past studies remains limited, especially in larger organizations. Establishing the right process, tools and culture to better capture this institutional knowledge is necessary to truly enable continuous improvement. Organizations should aim to:
- Build a structured knowledge layer for risks, control actions, metrics and issues.
- Develop comprehensive end-to-end traceability from risks to mitigations, through issues and outcomes—all to enable the ability to retrospectively evaluate decision-making.
- Establish ontology or taxonomy with standardized metadata for quality and risk data, and library curation with the necessary localized context.
- Create feedback loops that embed performance insights, cross-study trends and patterns, and organizational intelligence into systematic improvements.
- Use AI and agentic techniques—such as risk librarian capabilities and cross-study pattern detection—to separate meaningful signals from noise across complex data, maximizing the value of historical knowledge.
What pillar 4 looks like in practice: Rather than relying on emails, reports and undocumented experience, organizations can centralize quality and risk knowledge in a structured, searchable format to better answer key questions.These could include:
- Did we miss any critical risks based on quality issues and events?
- What percentage of risks documented were realized?
- Were the risks scored appropriately in terms of impact, probability and detectability?
- Did our key risk indicators have too many false positives?
- Were the risk control actions effective?
- Do we see any trends and patterns that necessitate an SOP update?
Through these types of reflections, companies can turn episodic learnings into institutional memories that drive quality-by-design at both the study and enterprise level.
IQRM: A new path for risk-based quality management in clinical trials
Pharma R&D is at an inflection point. Regulatory expectations for risk-based approaches are solidifying. Trial complexity continues to increase. Greater efficiencies are needed to scale the portfolio and deliver therapies to market faster.
For sponsors seeking to modernize their operating model, IQRM represents the path forward. By grounding decisions in risk and CtQ factors, unifying monitoring, elevating oversight to the portfolio level and better institutionalizing knowledge, sponsors can establish a harmonized, intelligent and adaptive approach to achieve the next frontier of clinical trial excellence.
When implementing IQRM, sponsors must adopt a multi-pronged approach to address all seven common barriers at the same time—particularly the often overlooked barriers of culture, governance and organizational design. These can impede sustainable, lasting change.
Pharma R&D leaders can follow four simple steps to start their IQRM journey:
- Conduct an honest assessment of the current state to pinpoint gaps across the full integration chain, from risk through mitigation, ownership, monitoring, quality signals and issue realization.
- Identify the changes required to address these integration gaps.
- Devise a holistic roadmap that accounts for the seven common barriers.
- Articulate the value proposition, obtain senior leadership endorsement and consistently communicate to the broader organization.
