ICH E6(R3) - Good Clinical Practice
ICH E6 Sponsor + Quality Risk Mgmt

ICH E6(R3) - Good Clinical Practice ICH-E6-Sponsor-QualityRiskMgmt-Monitoring-CRO-Vendor: ICH E6 Section 5 - Sponsor + Quality Management System + Risk-Based Monitoring + CRO + Vendor Oversight

Section 5 establishes sponsor responsibilities and quality management. Sponsor must implement a Quality Management System (QMS) per R3 covering: risk identification + assessment + mitigation + acceptance + monitoring + review; critical-to-quality factor identification (data quality + subject safety + scientific validity); proportional + risk-based approach to: monitoring + data management + safety reporting + audit; documented Quality Tolerance Limits (QTLs) per critical-to-quality factor. Risk-based monitoring (RBM): R3 modernised from R2 - centralised + remote + on-site monitoring blend; targeted SDV (critical data only); statistical monitoring of data trends; risk-based site selection; trigger-based escalation. Contract Research Organisation (CRO) oversight: sponsor retains responsibility + accountable; written agreement + scope + transfer of obligations register; CRO qualification + audit + ongoing oversight. Vendor management: investigational product manufacturer + clinical supplies + laboratories + imaging + electronic data capture (EDC) + IWRS/IXRS + central lab + ePRO + wearables; SLA + KPI + qualification + audit + change control + business continuity. Multi-region trial: regulatory submission per region + IND + CTA + protocol amendment per local requirements + global protocol with local addenda. Sponsor data + safety monitoring committee (DSMC) + Data Monitoring Committee (DMC) for adaptive + high-risk trials. Coordinates with ICH Q9 Quality Risk Management + ICH Q10 Pharmaceutical Quality System + FDA Risk-Based Monitoring Guidance + EMA Risk Proportionate Approaches + TransCelerate. ICH E6 + Sponsor + QMS + RBM + CRO + Vendor applies.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 97 controls across 43 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

EU Clinical Trials Regulation (CTR 536/2014) · 6 controls

  • CTR-Art.36_37 Start and end of trial notifications (Articles 36-37)
  • CTR-Art.38 Temporary halt or early termination for subject safety (Article 38)
  • CTR-Art.52 Reporting of serious breaches (Article 52)
  • CTR-Art.61_62_63 Manufacturing and import of IMPs and the qualified person (Articles 61-63)
  • CTR-Art.66_67_68_69 Labelling of investigational medicinal products (Articles 66-69)
  • CTR-Art.71_72_73_74 Sponsor, co-sponsorship, principal investigator and legal representative (Articles 71-74)

Austria Data Protection Act (Datenschutzgesetz, DSG, amended 2018) · 3 controls

  • AT-DSG-10 Section 29 - Liability and right to compensation / civil jurisdiction
  • AT-DSG-12 Section 62 - Administrative penalties
  • AT-DSG-7 Section 18 - Establishment of the Data Protection Authority

FDA 21 CFR Part 11 · 3 controls

  • Part11.30 Controls for open systems (21 CFR §11.30)
  • Part11.AuditTrail Audit trail requirements - secure computer-generated time-stamped (21 CFR §11.10(e))
  • Part11.RecordRetention Record protection + retention + readiness for inspection (21 CFR §11.10(b) + (c))

ISO/IEC 27011:2024 · 3 controls

  • 27011-5.2 Information Security Roles in Telecoms
  • 27011-6.3 Awareness and Training
  • 27011-8.6 Data protection and backup

Australia NHMRC National Statement on Ethical Conduct in Human Research · 2 controls

Azerbaijan Law on Personal Data (2010) · 2 controls

  • AZ-DPA-15 Article 17 - Dispute resolution
  • AZ-DPA-6 Article 6 - State regulation in personal data protection

Bahrain PDPL · 2 controls

Barbados Data Protection Act 2019 · 2 controls

  • BB-DPA-1 Section 1 - Short Title
  • BB-DPA-4 Section 4 - Principles Relating to Processing

FDA Quality Management System Regulation (QMSR) · 2 controls

  • QMSR-820.10 Requirements for a Quality Management System - ISO 13485:2016 Sections 4-8 incorporation (§820.10)
  • QMSR-ISO13485-Sec8 Measurement, analysis and improvement (ISO 13485:2016 Section 8)

Family Educational Rights and Privacy Act (FERPA) · 2 controls

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL) · 2 controls

  • UAE-PDPL-Art.10 Data Protection Officer (DPO) (UAE PDPL Article 10)
  • UAE-PDPL-Art.18_19_20_21 Security measures, controller/processor relationship, DPIA (UAE PDPL Articles 18-21)

IATF 16949:2016 - Quality Management System for Automotive Production · 2 controls

  • IATF16949-Clause10-Improvement-Nonconformity-CorrectiveAction-Problem-ErrorProof IATF 16949 Clause 10 - Improvement + Nonconformity + Corrective Action + Problem Solving + Error Proofing + Continual Improvement
  • IATF16949-Clause4-Context-Scope-CustomerSpecific-ProductSafety IATF 16949 Clause 4 - Context of Organization + QMS Scope + Customer Specific Requirements + Product Safety

ISO/IEC 27400:2022 · 2 controls

  • 27400-7.1 Network Security for IoT
  • 27400-7.4 Data retention and deletion

Iceland Data Protection and Processing of Personal Data Act (Act No. 90/2018) · 2 controls

Italy Personal Data Protection Code (Legislative Decree No. 196/2003, amended 2018) · 2 controls

  • ItalyCodice-Garante-Enforcement-AdministrativeSanctions-Criminal-Art166-167-170-20MEUR-Coord-EDPB Italy Codice Garante Authority + Article 140-bis + Article 144 Complaints + Article 166 Administrative Sanctions up to EUR 20M/4% + Article 167 Criminal Offences + Article 170 Failure to Comply with Garante Orders + EDPB Coordination
  • ItalyCodice-ePrivacy-Cookies-ElectronicCommunications-Telemarketing-PublicOpposition-TrafficDataRetention-Art121-122-130-132 Italy Codice ePrivacy - Article 121 Electronic Communications + Article 122 Cookies and Tracking + Article 130 Unsolicited Direct Marketing + Article 132 Traffic Data Retention + Italian Public Opposition Register (Registro delle Opposizioni)

NATO AQAP 2110 - Quality Assurance Requirements for Design, Development, and Production · 2 controls

  • AQAP2110-7 Production, Special Processes, Inspection, Testing, and Records
  • AQAP2110-8 Internal Audit, Management Review, Corrective Action, CofC, and Continual Improvement

Pakistan Personal Data Protection Bill 2023 · 2 controls

  • PAKPDPB-6 Cross-Border Transfer and Data Localization
  • PAKPDPB-7 NCPDP, Registration, Records, Processor Contracts, DPO

Privacy Act 1988 (Australia) · 2 controls

  • AUPRV-1 APP 1 Open and Transparent Management + Privacy Management Framework
  • AUPRV-6 Sensitive Information, PIA, Privacy by Design, Children

SWIFT CSCF · 2 controls

  • SWIFTCSCF-1 Restrict Internet Access and Protect Critical Systems (Objective 1)
  • SWIFTCSCF-3 Physically Secure the Environment (Objective 3)

Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023) · 2 controls

Vermont Data Privacy and Online Surveillance Act · 2 controls

  • VERMONTAICDA-3 Bias Testing, Discrimination Prevention, Transparency
  • VERMONTAICDA-4 Vermont AG Enforcement and Cure

AS9100D - Aerospace Quality Management System · 1 control

  • AS9100D-10.2 Nonconformity and Corrective Action

ASD Strategies to Mitigate Cyber Security Incidents · 1 control

  • ASD37-27 Outbound data loss prevention (Very Good)

AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association) · 1 control

  • AWWA-3.4 Encryption and Data Protection

Aged Care Quality Standards 2019 (repealed edition) · 1 control

  • ACQS-8-3 Continuous Improvement

Albania Law No. 124/2024 on Personal Data Protection · 1 control

  • AL-DPA-14 Direct Marketing

CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0 · 1 control

  • CPG-3.C Strong and Agile Encryption

DAMA-DMBOK2 - Data Management Body of Knowledge (2nd Edition) · 1 control

  • DIQ-2 Data Quality Management

FTC GLBA Safeguards Rule (16 CFR Part 314) · 1 control

  • FTC-Safeguards-9-Elements 9 Safeguard Elements - Access, Inventory, Encryption, Secure-Dev, MFA, Disposal, Change-Mgmt, Monitoring, Pen-Test (16 CFR 314.4(c))

Florida Digital Bill of Rights (FDBR) · 1 control

  • FDBR-ControllerObligations-DPA-Notice Controller + Processor Obligations + Data Protection Assessments (Fla. Stat. 501.707, 501.708, 501.71, 501.711)

GLOBALG.A.P. Integrated Farm Assurance (IFA) Standard v6 · 1 control

  • GGAP-IFA-AllFarmBase-Mgmt-Workers-Env-Trace GLOBALG.A.P. IFA v6 All Farm Base (AF): Management, Workers, Environment, Traceability and Food Safety

German Supply Chain Due Diligence Act (LkSG) · 1 control

Hungary Act CXII of 2011 on Informational Self-Determination and Freedom of Information (Info Act) · 1 control

ISO/IEC 27014:2020 · 1 control

  • 27014-5.6 Continuous improvement

India DPDP Act · 1 control

Law No. 172-13 on the Protection of Personal Data · 1 control

  • DOM172-Supervisory-Authority-Cooperation-Sanctions-Penalties-Articles-77-79-Awareness-Training-Retention-DPO-Designation Dominican Republic Law 172-13 Supervisory Authority + Sanctions + Articles 77-79 + DPO + Awareness

Law on Personal Data Protection (Official Gazette No. 42/2020) · 1 control

NIST Special Publication 800-34 Revision 1, Contingency Planning Guide for Federal Information Systems · 1 control

  • NISTSP34-5 Plan Testing, Training, and Exercises (TTE)

Russia Federal Law on Personal Data (152-FZ) · 1 control

  • RUSPD-4 Special Categories, Biometric Data

SQF Code Edition 9 - Safe Quality Food · 1 control

  • 2.5.2 Verification Activities

UK Defence Standard 05-138 - Cyber Security for Defence Suppliers · 1 control

  • D.1 Incident Response Planning

US Consumer Product Safety Act (CPSC) Manufacturer and Importer Duties · 1 control

  • CPSC-CS.3 Data Protection for Safety Systems

Vietnam Law on Cybersecurity (No. 116/2025/QH15) · 1 control

  • VIETNAMCYBER-4 Incident Reporting and Cooperation

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Query this from an agent

The graph holds this control, the 97 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll ICH E6(R3) - Good Clinical Practice controls