The 10 Most Powerful Study KRIs in RBQM and GCP Issues They Can Prevent

Section 1 — Introduction

Risk-based quality management (RBQM) aims to detect the right signals early enough to prevent an issue from occurring. To make a meaningful difference to a trial, RBQM requires a combination of the right signals and the ability to interpret those signals correctly.

The first challenge — knowing what to monitor — is relatively predictable. The quality and compliance issues that surface across clinical trials tend to follow recurring patterns.

Protocol nonadherence has been the most common FDA and European Medicines Agency (EMA) inspection finding, accounting for ~30% of findings. Issues related to serious adverse event (SAE) reporting and data quality follow.

For RBQM, that consistency provides a useful starting point. When risks are known and recurring, sponsors can tailor the central monitoring metrics, or key risk indicators (KRIs), to detect signals associated with four good clinical practice (GCP) challenge areas: noncompliance, safety, data quality and integrity, and oversight.

However, selecting the right KRI is only one part of the risk-detection equation. How sponsors configure an indicator, and how they interpret it, determine whether it provides a meaningful signal.

A KRI defined without appropriate normalization and design considerations, or reviewed in isolation, can tell a misleading story.

Section 2 — The Four GCP Areas: What to Monitor and How to Interpret the Signals

2a. Compliance

Noncompliance is the most cited finding category in FDA inspections and one of the two areas (alongside trial management) in which FDA and EMA findings agree ~90% of the time.

The three KRIs that can help identify signals of noncompliance are:

1. Important protocol deviation (IPD) rate
2. Nonimportant protocol deviation (PD) rate
3. Rate of missing procedures

The rates themselves, however, do not tell the whole story. A rising IPD rate concentrated around a specific category, such as informed consent or SAE reporting, may point to a systematic issue and signal something more serious: major noncompliance, ineffective corrective and preventive action, or a potential serious breach.

Recurring nonimportant PDs can also warrant attention. Conversely, an unusually low rate of nonimportant PDs may indicate incorrect categorization or deviations that go undetected or unlogged.

2b. Safety

SAE reporting is the second most cited finding by health authorities, and one of the highest-priority areas under GCP. Two important signals to monitor are:

1. Adverse event (AE) rate
2. SAE rate

Together, these KRIs can detect not only under- or overreporting but also potential safety or noncompliance issues. For example, inconsistencies between toxicity and seriousness assessments, increases in event severity, or atypical patterns within a system organ class may surface issues related to principal investigator (PI) oversight or unexpected safety concerns.

2c. Data Quality and Integrity

The reliability and integrity of critical data are the foundation for robust statistical analysis and submission. Incomplete or incorrect data threaten both the quality of the clinical trial and its operational execution. In this case, two important signals to monitor are:

1. Data entry delays
2. Open query rate

Data are the backbone of clinical trials. Significantly delayed data availability is not simply a matter of data arriving later; it can signal that sponsors cannot effectively oversee the trial.

An open query rate can signal data quality problems as well as less crucial programming errors and may become particularly crucial toward trial closeout.

2d. Oversight

Sponsor accountability for patient protection, scientific data validity, and compliance is a key regulatory requirement described in multiple GCP regulations and guidelines, including the International Council for Harmonisation E6(R3) guideline. A significant portion of Bioresearch Monitoring inspections mention oversight.

Scientific data validity and potential fraud also fall within the oversight area. Because oversight requires sponsors to identify when study conduct or data patterns warrant closer attention, useful signals to monitor include:

• Screen failure rate
• Premature discontinuation rate
• Data reliability score

These KRIs can reflect very different root causes depending on the patterns behind them. Premature discontinuation, depending on the reason, may reveal safety concerns, changes in the competitive landscape, the availability of a good alternative, or misconduct.

The data reliability score, when well designed, can reveal potential issues with data validity related to compliance, technical issues, or even fraud.

Section 3 — Reading KRIs in Combination

A single KRI is a symptom, not a full story. To realize value in RBQM, sponsors should read KRIs together because value comes from both triangulation and meaningful root cause analysis.

The following examples illustrate practical approaches to reviewing KRIs.

• Low IPD/PD rate + high rate of missing procedures → may indicate deviations going undetected rather than a genuinely compliant site, a lack-of-oversight signal masquerading as good compliance.
• Low nonimportant PD rate + low/no IPD rate → may look like a good site profile but actually indicate a lack of oversight.
• High rate of missing procedures + low AE rate + low SAE rate + high data entry delays → may indicate neither a safety signal nor a compliance signal but one shared root cause (data incompleteness) manifesting across multiple KRIs at once.
• Low SAE rate + high AE rate → may look like a consistent safety profile but actually indicate an incorrect categorization or detection of AEs by the PI.
• High SAE rate + low rate of discontinuation → may indicate a genuine safety concern: sites are not withdrawing patients who experience SAEs when the protocol requires it.
• High SAE rate + high rate of discontinuation + high rate of missing procedures + high disease activity index → may look highly concerning but actually indicate consistent site oversight and compliance, with patients’ underlying conditions accounting for the pattern.
• High rate of open queries + data entry delays → may point to broader problems with data completeness and correctness, or simply a programming issue. As the study approaches database lock, this combination becomes a high priority.
• Low screen failure + high premature discontinuation rate → may point to enrollment of ineligible patients.
• High screen failure + no issues with other KRIs → may point to a protocol feasibility issue rather than a site-level problem, particularly if the appropriate patient population is difficult to enroll overall or in a particular area.
• No issues across other KRIs + data reliability score outside the range → may provide the evidence needed to move a borderline signal from “watch” to “must investigate.” The central questions are whether the data are valid and whether the site is compliant.

Sponsors should read KRIs together to reveal the broader picture. Sometimes several KRIs reflect the same root cause.

Section 4 — Key Factors for Defining and Analyzing KRIs

Even when sponsors have selected the right KRI and read it alongside other KRIs, several contextual factors can still change what that KRI represents. Accounting for those factors is therefore an important part of both defining a KRI and interpreting the signal it produces.

Six factors are particularly important:

1. Consistency with other KRIs
2. Data delays
3. Trial milestones
4. Trends
5. Normalization factors
6. Conditional logic

Consistency with other KRIs

• Impact on the KRI: A KRI read in isolation can be actively misleading; this is the mechanism behind every Section 3 combination example.
• What good looks like: Sponsors review KRIs as clusters or signatures per site, not independently, and investigate discrepancies between correlated KRIs before trusting either.
• Why this matters: This approach helps minimize both false positives and false negatives, two common errors in RBQM statistical algorithms.

Data delays

• Impact on the KRI: Any KRI built on recently entered data (AE rate, open query rate, IPD rate) can look artificially favorable when entry is lagging. The KRI is not wrong; it is incomplete.

Trial milestones

• Impact on the KRI: The same raw value can mean different things at different points in a trial. High screen failure may be expected early in enrollment and remain unchanged during treatment or follow-up. Similarly, an increase in open query rate during high-intensity visits may reflect immediate workload rather than risk, although the same increase closer to database lock may warrant greater attention.
• What good looks like: Thresholds, the set of KRIs reviewed, and analysis may change depending on the trial stage rather than remaining static across the whole study. Sponsors may also add KRIs to or exclude KRIs from the review strategy depending on the milestone.

Trends

• Impact on the KRI: A single snapshot can hide a worsening trajectory or overstate one bad period at an otherwise improving site.
• What good looks like: Sponsors review KRIs as rolling trend lines over a defined look-back window. A temporary spike, even one that falls outside the threshold, may not indicate increased risk.

Normalization factors

• Impact on the KRI: Raw counts are not comparable across sites with different enrollment, study duration, or visit volumes. A larger or longer-running site naturally accumulates more raw events.
• What good looks like: Sponsors express KRIs as rates using a meaningful denominator (per patient, per visit, per patient-week, per data point), with size-adjusted control limits. The normalization approach varies depending on the nature of the KRI (see examples in the table below).

Conditional logic

• Impact on the KRI: Normalization on its own is not always enoughto reduce the biases built into the KRI algorithms. Conditional logic can further improve accuracy by defining which data should be included in a KRI calculation. For example, calculating AE rate only for enrolled patients can reduce skew in studies with high screen failure rates. Similarly, calculating open query rate based only on queries open for more than 5 days can distinguish persistent issues from short-term query volume.
• What good looks like: Sponsors define and document the logic and configure it accordingly in their RBQM tool of choice.

Table 1 below shows how trial milestones, normalization, and conditional logic can be applied to each of the 10 KRIs — and why those choices matter from a GCP perspective.

Section 5 — Conclusion

Across noncompliance, safety, data quality and integrity, and oversight, the same KRI can point to very different issues depending on how it is configured and what other signals accompany it.

Having a KRI is therefore not enough. The value of a risk monitoring strategy comes from intentional configuration and composition — choosing indicators that reflect the risk strategy, are “fit for purpose,” and complement and cross-check each other.

Effective KRI monitoring is not about cleaner metrics. Instead, it is about catching the right problem at the right time, allocating resources to the highest-risk area, and avoiding pursuit of signals that are not present.

About the Author

Vera Pomerantseva, Director of Product Management, RBQM, at eClinical Solutions.