How to build a clinical trial management system
The parts of a clinical trial system, from site setup and visits to eConsent and safety reporting, the GCP and Part 11 rules behind them, and an order to build it in.
What a clinical trial management system does
A clinical trial management system (CTMS) runs the operations of a trial: sites, staff, participants, visits, milestones, payments to sites and the documents that prove it was done right. Around it sit recruitment, eConsent and safety reporting.
Everything it holds may be inspected. Records must show who did what and when, signatures must meet the rules for electronic signatures, and the trial master file must be complete.
The modules you need
Most teams need all of these in the end. The phased plan below sets the order.
Study and site setup
Protocol, arms, visit schedule, sites, staff and their training records.
Recruitment and screening
Candidates screened against eligibility criteria, with reasons recorded for each decision.
eConsent
Consent with versioned documents, signatures and re-consent when the protocol or information changes.
Visits and milestones
Planned and actual visits, deviations and study milestones tracked per site.
Monitoring
Monitoring visits, findings and follow-up actions.
Safety reporting
Adverse events captured and routed with the regulator's reporting clocks shown.
Trial master file
Essential documents filed to a standard structure, with completeness checks.
Site payments
Payments to sites based on completed visits and milestones.
How the parts fit together
- 01
Audit trail in the data model
Every change to a regulated record keeps old value, new value, user, time and reason.
- 02
Electronic signatures
Signing steps that re-authenticate, record the meaning and bind to the record version.
- 03
Protocol as configuration
Visit schedules, eligibility and forms defined per study, so a new study is setup, not code.
- 04
Document management
Versioned documents with review and approval workflows.
- 05
Validation pipeline
Requirements, tests and evidence produced with every release.
Data model sketch
- 01
Study, arm and visit schedule
The protocol structure and its versions.
- 02
Site and staff
Sites, investigators, staff roles and training.
- 03
Participant
Pseudonymised participant, consent history and status.
- 04
Visit and deviation
Each visit done or missed, and each protocol deviation.
- 05
Adverse event
Event details, seriousness, causality and reporting status.
- 06
Document
Trial master file documents with version, status and signatures.
Systems it has to talk to
- 01
Electronic data capture
Visit and participant status shared with the EDC system.
- 02
Safety database
Serious adverse events sent for case processing and regulator reporting.
- 03
Regulator and ethics portals
Submissions and notifications where the portal allows it.
- 04
Identity and signatures
Identity checks for staff and participants, and signature services where needed.
Rules to design for
Which rules apply depends on your market and product.
- 01
Good clinical practice
ICH GCP and national trial laws, such as the EU Clinical Trials Regulation, set how trials are run and recorded.
- 02
Electronic records and signatures
21 CFR Part 11 for FDA-regulated trials and EU Annex 11 principles for computerised systems.
- 03
Safety reporting
Regulators set deadlines for reporting serious and unexpected adverse events.
- 04
Participant data
Trial data is health data under the GDPR and similar laws, and is pseudonymised.
From prototype to production
Build in this order so something real is in users' hands early.
- 01
Clickable prototype
Site, visit and document screens, tried by study coordinators and monitors.
- 02
First study live
Study setup, visits, deviations, audit trail and signatures, with validation evidence.
- 03
Consent and safety
eConsent and adverse event capture with reporting clocks.
- 04
Scale
More studies and sites, the trial master file, site payments and reporting.
What drives the cost
These decide most of the budget. For a number based on your own scope, use the cost tool. OceanLab bills $30-50/hr or per milestone.
- 01
Validation
Validation evidence for each release is part of the build, not extra paperwork.
- 02
Countries and regulators
Each country adds rules, languages and submissions.
- 03
eConsent
Versioned consent, signatures and re-consent across languages.
- 04
Integrations
EDC, safety database and portal integrations.
- 05
Number of studies
How much study setup must be self-service.
Product builds that match this guide
Kopiec - Clinical Trial Management System for Sites, Visits and Milestones
Designed and built a clickable clinical trial management system for a Warsaw contract research organisation running phase II and III trials in seven countries: a portfolio dashboard with CTIS notification deadlines, study timelines planned against actual, an 11-step site activation tracker and monitoring visit reports signed with a stated meaning.
Tomoshibi - Trial Recruitment and eConsent Platform for a Japanese SMO
Designed and built a clickable recruitment and eConsent platform for a Japanese site management organisation: a pre-screen leads pipeline with contact SLAs, a consent status view against the current IRB-approved version, and a participant consent record with every signature, quiz result and question a monitor needs to see.
Umlindi - Pharmacovigilance Safety Database with Regulator Clocks
Designed and built a clickable safety database for a South African generic medicines company: one intake inbox for calls, emails, web forms, rep and partner reports, case processing with MedDRA coding and WHO-UMC causality, medical review sign-off, and a submission clock that counts every SAHPRA and partner deadline from Day 0.
Two ways to work with OceanLab
Project build
We design and build the system as one project. It starts with a clickable prototype your team tries before any production code is written. Pay per milestone (outcome-based) or hourly at $30-50/hr, depending on role and seniority.
Embedded engineers
Our engineers join your team on a flexible monthly retainer. Part-time is fine and it runs month to month, with hours that overlap the US, UK and Europe, the Middle East, and Australia and Asia. Outcome-based or $30-50/hr.
Questions
Can a CTMS be validated if you build it?
Yes. We produce validation evidence with each release, and your quality team validates the system for its intended use. The controls Part 11 and GCP need are built into the data model.
Do we need eConsent from the start?
Not always. Many sponsors start with paper consent tracked in the system, then add eConsent once the core operations are live.
Should safety reporting live in the CTMS?
Capture can, but case processing usually lives in a safety database. We connect the two so serious events move without retyping.
