A file exists, the dataset is complete, the spreadsheet can be opened. The approval email is still in the inbox.
At first glance, everything appears to be there.
But in a regulated environment, having the record is not the same as being able to defend it.
A defensible record carries more than content. It preserves the context that explains where the information came from, how it changed, who was responsible for it and whether the process around it remained controlled.
The difference between availability and control
This distinction is increasingly important as clinical data moves across systems, partners and formats.
The EMA Guideline on computerised systems and electronic data in clinical trials treats data integrity as a lifecycle issue. It explicitly links electronic source data and metadata, including audit trails, to the ALCOA++ principles: attributable, legible, contemporaneous, original, accurate, complete, consistent, enduring and available. In other words, the record has to remain understandable and traceable in context – not merely retrievable.
That makes “we still have the file” a very low bar.
A final spreadsheet may contain the right numbers, but its history may sit elsewhere. An approval may exist, but not be clearly linked to the version that was reviewed. A CRO may provide a final deliverable, while important metadata, source context or transfer history remains with the provider.
What makes a record defensible?
Four elements matter particularly in practice.
Controlled status. The effective version must be identifiable without comparing multiple folders, attachments or local copies.
Traceable history. Relevant changes should remain visible over time, including who made them and when. The original information should not disappear behind later edits.
Accountable ownership. Roles, access rights and responsibilities need to be clear. This includes knowing who owns the system or record internally, even where operational work is outsourced.
Preserved context. A record should not lose meaning when it moves between a CRO, a clinical system, a shared workspace and the sponsor archive. The supporting metadata, approvals and relationships to other records need to travel with it.
ICH E6(R3) reinforces the same direction at GCP level. It calls for documented, risk-based processes that protect data integrity throughout the lifecycle, including relevant metadata, interpretable audit trails and traceable transfers between computerised systems. The two are complementary: ICH E6(R3) sets the broader GCP framework, while the EMA guideline gives more operational detail for electronic data and systems.
This is also why sponsor oversight matters. Outsourcing an activity does not remove the need for the sponsor to understand how critical data and documents are created, maintained, transferred and retained.
Why this becomes harder as the company grows
The challenge is rarely one problematic file.
It is the accumulation of studies, vendors, interfaces, user roles, approvals and handovers. Manual workarounds that feel manageable early on can become difficult to govern once the same information exists in several places or passes repeatedly between organisations.
At that point, defensibility depends less on individual knowledge and more on the operating model around the data.
A mature setup therefore connects document control, data standards, system ownership, validation, sponsor oversight and inspection readiness. These are also areas covered by Novyra’s 8-Question Quick Assessment, which looks across eTMF/document management, CDISC adoption, inspection readiness, oversight, named system owners, system validation, digital strategy and partnership readiness.
The broader point is important: a defensible record is not created by one good system alone. It results from clear governance across the full data lifecycle.
A practical check for this week
Choose one critical record your team relies on today and follow its path from creation to its current state.
Do not only check whether you can retrieve the final version. Look at whether its provenance, changes, approvals, ownership and supporting context remain visible across every handover.
If that history is fragmented, the problem may not be missing data.
It may be missing control.
Because in clinical development, data is only as useful as your ability to demonstrate that it can be trusted.
How well controlled is your current compliance foundation?
Take our free 8-Question Quick Assessment for an initial view of your operational and compliance maturity across quality, oversight, data, systems and governance.