What documentation does FDA expect to see for an RBM program during an inspection?

Bioresearch monitoring inspectors look for a documented risk assessment identifying critical data and processes, defined Key Risk Indicators and Quality Tolerance Limits used to trigger action, written monitoring procedures describing how centralized and on-site monitoring interact, and evidence that triggered actions (such as an on-site visit prompted by a KRI breach) were actually followed through. A program that exists only as a policy statement without operational evidence of KRIs being tracked and acted on is a common inspection finding.

How did ICH E6(R2) and E6(R3) change expectations for monitoring approach?

The 2016 E6(R2) addendum first established risk-based monitoring as the expected default rather than an optional alternative to 100 percent SDV, and the 2023 to 2025 E6(R3) revision reinforces and further formalizes this expectation within its broader risk-based quality management framework. Sponsors still running blanket 100 percent SDV programs without a documented risk rationale are increasingly out of step with both the ICH guideline and FDA's monitoring guidance.

What is the difference between Risk-Based Monitoring and Risk-Based Quality Management?

Risk-Based Monitoring refers specifically to how monitoring resources (site visits, source data review, centralized statistical checks) are allocated based on risk. Risk-Based Quality Management (RBQM) is the broader practice that extends the same risk-based logic to all quality oversight activities across the trial, including protocol design, vendor oversight, and data management, not monitoring alone. RBM is essentially the monitoring-specific application within the larger RBQM framework.

Back to Clinical Trials & Evidence

Clinical & TrialsQuality System Clinical EvidenceRBM

Risk-Based Monitoring

Monitoring strategy that targets oversight resources to the highest-risk sites, processes, and data based on a documented risk assessment, replacing 100% source data verification.

Reviewed by Christian Espinosa, Founder, Blue Goat CyberLast reviewed June 20, 2026

Definition

Risk-Based Monitoring (RBM) is a clinical trial oversight approach that uses a documented risk assessment to direct monitoring resources to the trial elements (sites, processes, data points) most critical to subject safety and data integrity. Rather than performing 100% source data verification (SDV) at every site, sponsors combine centralized statistical monitoring (off-site analytics on EDC data), targeted on-site monitoring focused on critical data and processes, and remote source data review where feasible. The broader practice, Risk-Based Quality Management (RBQM), extends this approach to all quality oversight activities.

What the regulation says

ICH E6(R2) §5.18.3 and E6(R3) §3.10 establish RBM expectations. FDA's 'Oversight of Clinical Investigations - A Risk-Based Approach to Monitoring' guidance (2013, refreshed 2023) is the primary U.S. reference.

What this means in practice

RBM became the default expectation under ICH E6(R2) addendum (2016) and is reinforced in E6(R3) (2023). For device IDE studies, sponsors implementing RBM must produce a documented risk assessment, defined Key Risk Indicators (KRIs) and Quality Tolerance Limits (QTLs), trigger-based monitoring procedures, and centralized monitoring analytics. FDA bioresearch monitoring inspections increasingly evaluate RBM implementation depth.

Examples

Instead of verifying every single data point at all sites, a sponsor implemented RBM, focusing on-site monitoring visits on sites with higher patient enrollment and a history of data discrepancies.
Centralized monitoring tools identified an unusual pattern in adverse event reporting at several study sites, prompting a targeted remote source data review and follow-up with those specific sites.
A study protocol identified patient consent and primary efficacy endpoints as critical data; thus, the monitoring plan allocated more frequent and in-depth review resources to these aspects across all participating centers.

Common pitfalls

•Declaring RBM without a documented risk assessment, the assessment is the foundation; without it, RBM is just reduced SDV.
•Setting KRIs/QTLs without thresholds for action, KRIs that no one acts on add cost without benefit.
•Cutting on-site visits to zero, RBM redistributes monitoring, it doesn't eliminate it.

Frequently asked questions

No, RBM does not eliminate on-site monitoring, it targets it. Sponsors combine centralized statistical monitoring of EDC data with targeted on-site visits focused on the sites, processes, and critical data points identified as highest risk in the documented risk assessment, rather than performing 100 percent source data verification everywhere. High-risk sites or those showing anomalous Key Risk Indicators may still receive frequent, intensive on-site visits under an RBM program.

Grouped by theme

Editor's picks

· Hand-selected related concepts

Standards

ISO 14155

Good clinical practice for clinical investigations of medical devices.

Clinical & Trials

Data Safety Monitoring Board(DSMB)

Independent committee that periodically reviews accumulating safety and (sometimes) efficacy data during a trial.

Clinical & Trials

Decentralized Clinical Trial(DCT)

A trial that uses telehealth, home-based assessments, wearables, and direct-to-patient logistics to reduce or eliminate site visits.

Clinical & Trials

Electronic Data Capture(EDC)

Software systems used to collect, manage, and report clinical trial data electronically, replacing paper case report forms.

Clinical Trials & Evidence

· From this learning path

Clinical & Trials

Adaptive Trial Design

Trial design that pre-specifies opportunities to modify aspects (sample size, arms, endpoints) based on interim data.

Adjacent lesson

Clinical & Trials

Clinical Evaluation Report(CER)

Documented assessment of clinical data demonstrating EU MDR conformity for a device.

Adjacent lesson

Clinical & Trials

Adverse Event(AE)

Any untoward medical occurrence in a subject, whether or not related to the device.

Clinical & Trials

Feasibility Study

Small clinical study evaluating initial safety, usability, and design parameters of an investigational device.

Cited by

Where this term appears across MedTech Terms.

Learning paths (1)

Clinical Trials & EvidenceLesson 16 of 18

Ecosystems (2)

Latest in MedTech

Sources

3 sources

Every citation below opens the original document. Each is graded against our source-tier hierarchy so you can see what rests on binding law versus commentary.

Tier 2Regulator guidance and consensus· 2Tier 3Peer-reviewed and registry evidence· 1

Link health: 3 verified· last checked 2026-06-20

FDA·1ICH·1NIH·1

Inline markers like [1] jump to the matching reference above.

My progress

All terms0 / 513

Clinical & Trials0 / 52

Saved on this device, and to your account when signed in. View studied terms

Full glossary

Browse all terms A to Z, each with a short definition.

On this term

Category: Clinical & Trials
Acronym: RBM
Sources: 3
Updated: 6/20/2026

Compare with another term

Learn in 60 seconds

Monitoring strategy that targets oversight resources to the highest-risk sites, processes, and data based on a documented risk assessment, replacing 100% source data verification.

·RBM became the default expectation under ICH E6(R2) addendum (2016) and is reinforced in E6(R3) (2023).
·FDA bioresearch monitoring inspections increasingly evaluate RBM implementation depth.
·The broader practice, Risk-Based Quality Management (RBQM), extends this approach to all quality oversight activities.

Remember this

Watch out: Declaring RBM without a documented risk assessment, the assessment is the foundation; without it, RBM is just reduced SDV.

Related terms

You may also need

Auto-suggested from Clinical & Trials and shared keywords.

All Clinical & Trials terms

From the Blue Goat network

Related resources and services on this topic.

MedTech Launchpad
MedTech funding rounds, accelerators, and launch resources.