26.3 Source Access, Certified Copies and Context
Key Takeaways
Appropriate originals or certified copies can support source verification.
Live EHR access is not an absolute requirement in every trial setting.
Fit-for-purpose system assessment considers the trial’s data importance and relevant controls.
Source Access, Certified Copies and Context
The following matrix summarizes the practical operational expectations, common site-level monitoring deficiencies, and critical CRA red flags across all nine ALCOA+ elements:
| ALCOA+ Element | Practical Site Expectation | Common Monitoring Deficiency | CRA Red Flag / Inspection Hazard |
|---|---|---|---|
| Attributable | Every entry, signature, and date is executed personally by authorized staff listed on the DOA log. | Study coordinator signs the Principal Investigator's name on physical lab reviews or regulatory forms. | Identical handwriting across entries attributed to different investigators; shared computer logins. |
| Legible | Clear handwriting; corrections executed via a single strike-through, dated, initialed, with reason. | Use of correction fluid ("white-out"), correction tape, or heavy black ink obliterating original values. | Overwritten numerical values (e.g., turning a '3' into an '8' to satisfy an inclusion lab threshold). |
| Contemporaneous | Clinical data recorded at the physical moment the assessment, vital sign, or exam occurs. | Writing clinical progress notes days or weeks after the subject visit from memory or brief scratch sheets. | Retrospective entries without "Late Entry" notation; identical timestamps across multiple concurrent tests. |
| Original | First recording medium preserved; certified copies created when digitization or copying is required. | Data entered onto sticky notes or informal scrap paper, transcribed into official binders, then discarded. | Informal scrap notes found clipped inside charts; uncertified, cropped photocopies missing margins. |
| Accurate | Factual, precise data without transcription errors; mathematically and medically plausible. | Transcribing systolic/diastolic blood pressure numbers inversely or misplacing decimal points in lab data. | Perfect, identical physiological values across months of visits (e.g., pulse exactly 72 bpm at every visit). |
| Complete | Every protocol-required evaluation documented; blank fields explained with explicit rationale. | Unanswered questionnaire sections; missed pharmacokinetic blood draws left completely blank in charts. | Incomplete diagnostic reports; omitted pages from multi-page informed consent documentation. |
| Consistent | Data concordance across all parallel medical records, nursing logs, pharmacy, and central lab files. | Physician note records "no adverse events," while concurrent nursing triage chart notes severe rash. | Adverse event onset dates that contradict concomitant medication start dates or emergency room visits. |
| Enduring | Records stored on durable, archival-grade physical media or certified, backed-up digital storage. | Fading thermal paper ECG tracings left in binders without protective measures or certified copies. | Completely blank or illegible thermal slips where critical baseline ECG intervals have vanished. |
| Available | Records organized and readily retrievable during on-site and remote monitoring visits and audits. | Subject binders locked in off-site archive facility requiring two weeks notice for CRA retrieval. | Missing charts during a regulatory audit; deactivated EMR vendor accounts preventing source review. |
Electronic source records and appropriate access
Identify source records, methods of capture and locations before trial start, updating them when needed. Source can include an EHR, laboratory system, direct eCRF entry, participant diary or a certified copy. Direct capture does not require creating an unnecessary duplicate paper chart. The investigator and sponsor should agree how records remain accessible and how data are verified.
A binder of selective, uncertified EHR printouts may omit relevant context, later corrections or missing events. Determine whether the material is original, a certified copy or an uncontrolled convenience copy. Secure direct EHR access can support review, but ICH does not require a monitor to access every site's live EHR in all circumstances. Suitable certified copies or another justified access method can be appropriate. Escalate inadequate access rather than using another person's credentials.
For electronic access verify individual authorisation, appropriate permissions, participant scope, confidentiality and the institution's process. Access rights should permit the agreed review while protecting other patients' information. Remote review adds questions about privacy, downloads, screenshots, location and retention of copies. Participant consent does not remove all privacy duties.
Clinical-practice systems need a documented fit-for-purpose assessment in the trial context. Do not claim ONC certification proves trial-system validation or that every EHR must be newly validated like a bespoke EDC platform. Consider importance of the data, security, user management, audit trails, backups and known limitations, with proportionate mitigation. The sponsor and investigator retain their respective responsibilities even when an IT vendor hosts the system.
CRA Best Practices for Source Record Auditing
When conducting on-site or remote monitoring, high-performing CRAs utilize proven auditing heuristics:
- Triangular Verification: Use relevant corroborating records when needed to assess reliability. Cross-reference the physician's narrative note against: (a) nursing bedside flowsheet entries, (b) pharmacy dispensing records, and (c) central/local laboratory timestamps.
Look for Uniformity Anomalies: In paper source records, unusual uniformity across records can warrant review, but does not by itself prove fabrication rather than recorded contemporaneously. 3. Audit the Margins and Dates: Inspect every diagnostic printout (ECGs, spirometry, Holter tapes) for automated header/footer timestamps. Compare the instrument's internal machine clock against the handwritten visit date recorded on the CRF. 4.
Escalate Unexplained Discrepancies: If a source document shows signs of intentional alteration, erasure, or fabricated signatures, the CRA must immediately log the finding, preserve the evidentiary trail, and escalate the event to the Clinical Trial Manager (CTM) and sponsor Quality Assurance (QA) following corporate standard operating procedures.
Official sources
Checked October 18, 2026: ICH E6(R3), Principles and Annex 1, ICH E9(R1).
A site cannot provide live EHR access but offers suitable complete certified records under an agreed process. What applies?
Use the PI password instead.
Any uncertified excerpt automatically proves completeness.
Evaluate whether the authorised arrangement provides adequate verification, context and confidentiality.
ICH always requires a live login regardless of circumstances.
Sections you finish are checked off in the contents.