Transition for GCP Auditors in Australia from ICH GCP E6(R2) to E6(R3) and the Implications for Sponsors

The International Council for Harmonisation’s (ICH) formally adopted the ICH Good Clinical Practice (GCP) E6(R3) guideline on January 6, 2025, marking the most significant evolution in clinical trial standards in nearly a decade. This comprehensive revision introduces notable changes to sponsor responsibilities while emphasising quality management, risk-based approaches, and enhanced oversight requirements. Understanding these changes is crucial for GCP auditors and sponsors in Australia to ensure compliance with the new standards as regulatory authorities worldwide begin implementation.

The European Medicines Agency (EMA) was among the first to adopt the E6(R3) Principles and Annex 1, setting an effective date of July 23, 2025. This swift adoption positions Europe as a leader in implementing the new standards, with other regions expected to follow similar timelines. For Australian sponsors and auditors, the transition represents both an opportunity and a challenge—requiring strategic preparation to adapt existing quality management systems, audit approaches, and compliance documentation.

This article explores the key changes between E6(R2) and E6(R3) from a GCP auditor’s perspective, focusing on the implications for Australian sponsors. By understanding these changes now, organisations can proactively prepare for the transition, avoiding compliance gaps and ensuring the continued integrity of their clinical trial programs.

Timeline

The European Medicines Agency has moved quickly in adopting E6(R3), announcing an effective date of July 23, 2025, for both the Principles and Annex 1. The EU Clinical Trials Regulation (CTR 536/2014) will be aligned with E6(R3) through revised risk-based monitoring guidelines and protocols for decentralised clinical trials (DCTs).

In contrast, Australia’s Therapeutic Goods Administration (TGA) has adopted a more measured approach:

The projected implementation timeline in Australia includes:

• Q3 2025: TGA publishes adopted E6(R3) Principles
• Q1 2026: Full implementation deadline for Annex 1
• 2027: Annex 2 adoption (conditional consultation feedback)

This pace allows Australian stakeholders more time to prepare but means Australian sponsors operating globally must be ready to comply with European timelines for trials conducted in the EU.

Key Structural Changes in ICH GCP E6(R3) in relation to ICH GCP E6(R2)

New Organisational Framework

ICH GCP E6(R3) introduces a significantly restructured framework designed to accommodate evolving clinical research methodologies:

ICH GCP E6(R2)

• Single comprehensive document
• 13 principles followed by detailed instructions
• 8 sections with limited flexibility for future innovations

E6(R3)

• Modular structure with Principles and Annexes
• 11 consolidated principles with supporting sub-principles
• Annex 1: Interventional trials guidance
• Annex 2: Non-traditional interventional trials (forthcoming)

This reorganisation allows for more agile updates to specific guideline components without revising the framework. The modular approach accommodates innovation while maintaining core principles for participant protection and data reliability.

Terminology Shifts

E6(R3) introduces key terminology changes that will impact how auditors evaluate compliance:

These changes reflect the evolution toward digital clinical trials while maintaining a focus on the fundamentals of quality and integrity.

Definition Changes Impacting GCP Auditor Approaches

Several definition changes in E6(R3) will require auditors to adapt their evaluation methods:

• Good Clinical Practice (GCP): The definition has expanded to explicitly include “planning, initiating, performing, recording, oversight, evaluation, analysis, and reporting” activities, reinforcing the full clinical trial lifecycle as part of compliance.
• Investigational Product: Now explicitly includes “drugs, medicines, medicinal products, vaccines, and biological products,” broadening the regulatory scope for auditors assessing investigational product management.
• Source Records: Now defined as “original documents or data (that include relevant metadata) or certified copies of the original documents or data, irrespective of the media used.” This reflects the increasing reliance on electronic records, digital metadata, and audit trails in modern trials.
• Data Integrity: Newly defined with criteria ensuring records are “attributable, legible, contemporaneous, original, accurate, complete, secure, and reliable.” This reinforces the necessity of validated electronic systems, audit trails, and risk-based data governance in audit practices.

For auditors, these changes necessitate a broader evaluation scope that considers the entire data lifecycle rather than focusing primarily on document completeness.

Principles-Based vs. Compliance-Based Auditing

ICH GCP E6(R3) shifts focus from strict compliance with detailed requirements to adherence to broader principles. For auditors, this means:

• Assessing whether the sponsor’s processes fulfill the intent of the principles
• Evaluating if alternative approaches are justified based on risk assessment
• Reviewing the overall quality management system rather than isolated procedures
• Considering the sponsor’s rationale for their chosen approaches

While this provides flexibility, it also requires auditors to exercise greater judgment in determining whether principles have been adequately implemented.

Risk-Based Approach to Auditing

Aligning Audit Strategies with E6(R3) Risk Management Principles

E6(R3) Principle 7 states: “Clinical trial processes, measures and approaches should be implemented in a way that is proportionate to the risks to participants and the importance of the data collected, and that avoids unnecessary burden on participants and investigators.”

For auditors, this requires:

• Evaluating whether sponsors have implemented risk-based quality management systems
• Assessing if risk mitigation strategies are proportionate to identified risks
• Reviewing documentation of risk assessment and monitoring activities
• Confirming that risks are continuously evaluated throughout the trial lifecycle

Auditors should now evaluate compliance with specific requirements and whether the sponsor’s approach is appropriately risk-based and proportionate.

Focus on Critical to Quality Factors

E6(R3) introduces a more structured approach to identifying critical quality factors (CtQF). Auditors should assess whether sponsors have:

• Identified CtQFs during protocol development
• Documented the rationale for their classification of critical processes
• Implemented appropriate risk controls for these critical factors
• Established reasonable parameters (acceptable ranges) for critical processes
• Documented and justified any deviations from acceptable ranges

The auditor’s role shifts from checking a standard list of requirements to assessing whether the sponsor has appropriately applied risk-based principles to their specific trial.

Proportionate Approach to Findings Classification

Audit findings classification should now reflect the risk-based approach of E6(R3), emphasising a proportionate response to quality issues. Suggested classification:

• Critical findings: Issues with significant impact on participant safety or data reliability.
• Major findings: Issues with potential impact on critical-to-quality factors.
• Minor findings: Issues that have a low likelihood of affecting participant safety or data integrity but should be addressed to prevent escalation.

The proportionality principle requires auditors to consider the context, severity, and potential impact of findings when classifying them, rather than applying a rigid compliance-based approach.

This aligns more closely with E6(R3)’s emphasis on quality by design and risk-proportionate approaches

Documentation of Risk-Based Decisions

GCP Auditors should expect to see documented evidence of:

• Risk identification processes
• Risk evaluation methodology
• Risk control measures
• Risk communication to relevant stakeholders
• Periodic risk reviews
• Actions taken when acceptable ranges are exceeded

This documentation should demonstrate that the sponsor’s decisions were based on proper risk assessment rather than arbitrary choices.

Critical Sponsor Responsibility Changes

Enhanced Quality Management Requirements

ICH GCP E6(R3) significantly expands quality management expectations beyond what was outlined in ICH GCP E6(R2):

Auditors should evaluate whether sponsors have:

• Implemented a comprehensive quality management system
• Documented their quality management approach in the clinical trial report
• Developed a framework for continuously monitoring quality
• Established mechanisms for reporting quality issues

Data Governance and Integrity Expectations

ICH GCP E6(R3) introduces a dedicated section (Section 4) on data governance, requiring sponsors to:

• Implement comprehensive data lifecycle controls
• Ensure audit trails and metadata integrity
• Validate computerised systems using a risk-based approach
• Maintain data security throughout the trial
• Document data transfer, migration, and archiving processes
• Auditors should assess whether sponsors have:
• Properly defined critical data elements
• Implemented appropriate data quality controls
• Established data integrity verification procedures
• Maintained appropriate audit trails
• Validated computerised systems proportionate to risk

Delegation and Oversight of Service Providers

ICH GCP E6(R3) clarifies sponsor responsibilities regarding service providers:

• Sponsors retain ultimate responsibility regardless of delegation
• Service provider agreements must clearly define roles and responsibilities
• Sponsors must maintain appropriate oversight of all delegated activities
• Service providers must implement appropriate quality management

Auditors should assess whether sponsors have:

• Documented the qualification and selection of service providers
• Clearly defined roles and responsibilities in written agreements
• Implemented appropriate oversight mechanisms
• Maintained evidence of ongoing supervision of delegated activities

Technology and Innovation Considerations for GCP Auditors

Auditing Decentralised Clinical Trials

E6(R3) explicitly recognises decentralised clinical trials (DCTs), requiring auditors to evaluate:

• Risk assessment specific to remote trial activities
• Participant identification and consent verification procedures
• Data integrity controls for remote data collection
• Investigator oversight of remote participants

Auditors should verify that sponsors have:

• Documented the rationale for decentralised elements
• Implemented appropriate risk controls for remote activities
• Maintained investigator oversight despite geographical separation
• Ensured data integrity from remote sources

Electronic Consent Processes

E6(R3) formally recognises electronic consent, requiring auditors to assess:

• Validation of electronic consent platforms
• Documentation of participant identity verification
• Procedures for ensuring participant understanding
• Storage and access controls for electronic consent records
• Procedures for consent updates and re-consenting

Auditors should review:

• System validation documentation
• Identity verification procedures
• Audit trails for consent processes
• Documentation of participant comprehension

Data Integrity in Digital Systems

With E6(R3)’s expanded focus on data integrity, auditors must evaluate:

• Implementation of ALCOA+ principles across all systems
• Validation of data collection tools and electronic systems
• Audit trail functionality and completeness
• Access controls and user management

Data backup and recovery procedures

Auditors should verify that sponsors:

• Have validated all critical electronic systems
• Maintain complete audit trails for all critical data
• Have implemented appropriate data access controls
• Can demonstrate data integrity throughout the data lifecycle

Remote Monitoring Capabilities

E6(R3) explicitly supports remote monitoring approaches, requiring auditors to assess:

• Risk assessment for remote vs. on-site monitoring
• Remote access controls for source documentation
• Data verification procedures for remotely monitored data

Documentation of remote monitoring activities

Auditors should evaluate whether:

• The monitoring approach is appropriate for the trial’s risk profile
• Remote monitoring activities are properly documented
• Data integrity is maintained during remote review
• Privacy and confidentiality are protected during remote access

Computer System Validation

E6(R3) requires a risk-based approach to computer system validation:

• Validation scope proportionate to system criticality
• Documentation of validation activities
• Change control procedures
• Ongoing system maintenance and monitoring

Auditors should assess whether:

• The validation approach is proportionate to system risks
• Validation documentation is complete and accessible
• Change control processes are followed
• System performance is monitored throughout the trial

Implications for Australian Sponsors

Preparation Strategies for E6(R3) Implementation

Australian sponsors should develop a structured approach to E6(R3) implementation:

• Gap Analysis: Compare current processes against E6(R3) requirements
• Prioritisation: Focus on high-risk areas and critical changes
• Implementation Plan: Develop a timeline aligned with regulatory deadlines
• Resource Allocation: Ensure adequate resources for transition activities
• Communication Strategy: Inform all stakeholders of upcoming changes

This phased approach allows sponsors to address the most critical changes while developing a comprehensive implementation plan.

Audit Readiness Assessment

To prepare for audits under E6(R3), sponsors should:

• Conduct internal mock audits using E6(R3) criteria
• Review quality management documentation against new requirements
• Assess data governance processes for compliance with Section 4
• Evaluate risk management activities for alignment with E6(R3) principles
• Review service provider oversight mechanisms

This proactive assessment helps identify compliance gaps before external audits occur.

Updating SOPs and Quality Management Systems

E6(R3) will require updates to several key procedural documents:

Sponsors should prioritise these updates based on the criticality of each process and its impact on participant safety and data integrity.

Training Requirements for Study Teams

ICH GCP E6(R3) implementation will require comprehensive training:

• Principles Training: Ensure all staff understand the core principles of E6(R3)
• Risk-Based Approach Training: Develop competency in risk assessment and management
• Role-Specific Training: Provide detailed training on role-specific requirements
• Service Provider Training: Ensure service providers understand their responsibilities
• Documentation Training: Train staff on enhanced documentation requirements

Training should be documented and evaluated for effectiveness to demonstrate compliance with E6(R3) requirements.

Conclusion

The transition from ICH GCP E6(R2) to E6(R3) represents change in clinical trial conduct and oversight. For Australian GCP auditors and sponsors, this transition requires careful preparation and a shift in mindset from pure compliance checking to risk-based quality management.

Key considerations for a successful transition include:

• Understanding the structural and philosophical changes in E6(R3)
• Adopting a risk-based approach to quality management
• Enhancing data governance and integrity processes
• Embracing technological innovation within a controlled framework
• Strengthening service provider oversight
• Developing comprehensive training programs

By proactively addressing these areas, Australian sponsors can ensure compliance with ICH GCP E6(R3) and realise the benefits of more efficient, participant-centric, and high-quality clinical trials. While the transition presents challenges, it also offers an opportunity to modernise clinical trial practices and ultimately improve the development of new medical treatments.

Australian global sponsors should prepare for the earlier European implementation deadline while continuing to monitor TGA guidance for local implementation requirements. This dual approach will ensure compliance across all operational regions while maintaining the flexibility to adapt to Australia-specific requirements as they are finalised.