• Trial coordinators tracking patient visits, protocol deviations, and site milestones in spreadsheets with no central visibility for the sponsor -- database locks delayed because the status of every site is a phone call?

  • Regulatory inspection findings on data integrity because source data verification records were in email threads with no audit trail?

Clinical Trial Management Software Development

Trial coordinators tracking patient visits, protocol deviations, and site milestones in spreadsheets have no central visibility -- and the sponsor is always a phone call behind the actual status. Database locks get delayed because no one has a real-time view of where every site stands.

We build custom clinical trial management software for pharma companies, biotech firms, and CROs. Trial setup, site management, patient enrolment tracking, deviation management, and regulatory documentation in one system -- with an audit trail that holds up under inspection.

  • Trial setup -- protocol, arms, visits, and eligibility criteria

  • Site and investigator management with performance dashboards

  • Patient enrolment, visit scheduling, and deviation tracking

  • Audit trail and regulatory document management (ICH E6)

A clinical trial management system (CTMS) is purpose-built software for tracking the operational and regulatory aspects of clinical trials -- site activation, patient enrolment, visit compliance, protocol deviations, and regulatory document collection. RaftLabs builds custom CTMS platforms for pharma companies, biotech firms, and CROs that need trial operations management and audit-ready documentation built to ICH E6 and 21 CFR Part 11 requirements.

Vodafone
Aldi
Nike
Microsoft
Heineken
Cisco
Calorgas
Energia Rewards
GE
Bank of America
T-Mobile
Valero
Techstars
East Ventures
Products shipped
100+
Industries served
24+
Cost delivery
Fixed
Week delivery cycles
12-14

Why trial operations break down without a dedicated CTMS

Clinical trials generate a large volume of operational data across sites, coordinators, and timelines. Protocol version changes affect eligibility criteria and visit schedules. Investigator staff turns over. Sites activate and close at different times. Patients miss visits, deviate from protocol, and withdraw consent. Each of these events needs to be documented, reviewed, and tracked -- not managed through email threads and site-level spreadsheets.

The inspection risk is the most direct consequence. Regulatory agencies expect to see a controlled record of every site activation decision, every deviation, and every change to the trial master file. When that record exists in email folders and shared drives with no version control or access log, the finding is data integrity -- one of the costliest inspection outcomes in terms of delay and remediation cost.

A custom CTMS gives the sponsor a single view of operational status across all sites without coordinator phone calls. It gives each site a structured workflow for the tasks they are responsible for. And it produces the audit trail that inspection readiness requires -- not as an export, but as a live record of every action taken in the system.

What we build

Protocol and study setup

Trial configuration covering study arms, visit schedules, inclusion and exclusion criteria, and randomisation schemes aligned to ICH E6(R3) Good Clinical Practice requirements. Protocol amendment management updates visit schedules and eligibility criteria across all active sites when a protocol version is approved -- so coordinators at every site are working from the current criteria, not a version they retrieved from an email attachment three months ago.

CDISC CDASH data standards are applied to the data collection structure where applicable, ensuring that fields captured in the CTMS align with the standard data collection framework used by EDC systems and expected in FDA and EMA regulatory submissions. IVRS and IWRS integration handles randomisation assignment for blinded trials -- the CTMS records the randomisation event without exposing treatment allocation, maintaining blind integrity at the operational level.

Investigational product management covers dosing schedule, storage requirements, and dispensing record structure. Each dispensing event is recorded against the patient visit so the IP accountability record required under GCP is maintained without a separate paper log. Study calendar view shows visit windows, required assessments per visit, and allowed deviation ranges so coordinators can identify in advance whether an upcoming visit is at risk of a protocol deviation before it occurs. Protocol version history makes the criteria and schedule active at any point in the trial retrievable in seconds during an inspection -- not recoverable from a shared drive folder with seven versions of the protocol document.

Site management

Site qualification and initiation tracking from feasibility through IRB or IEC approval, regulatory submission, and site activation. The site initiation visit (SIV) workflow captures the visit date, the investigator staff trained, the materials reviewed, and the activation decision -- with the monitoring report generated and approved in the system rather than filed as a Word document in a shared drive. Site initiation visit automation also triggers the delegation of authority log setup for the investigator team at each newly activated site.

Investigator and study staff records include role assignments, ICH E6-required training records, and delegation of authority entries. The delegation log captures who is authorised to perform each protocol procedure at each site, with dates effective and superseded -- the record an inspector expects to see demonstrating that every procedure was performed by appropriately authorised and trained staff.

Regulatory document collection covers IRB or IEC approval letters, FDA Form 1572, financial disclosure forms, investigator CVs, and laboratory normal ranges -- with expiry tracking and renewal reminders so the sponsor's TMF coordinator does not discover an expired IRB approval during a routine monitoring visit. Site performance dashboard shows enrolment count against target, visit compliance rate, open query count, deviation frequency, and monitoring visit schedule by site. Sites falling below enrolment targets or above expected deviation rates surface automatically in the sponsor's performance view rather than requiring a manual review of each site's status report.

Patient enrolment and tracking

Screening log with screen fail reason capture and eligibility criteria verification against the current protocol version. Every screen failure is recorded with the specific exclusion criterion that applied so screen failure analysis by criterion is available without manual tabulation. Informed consent tracking records the consent version, the date consent was obtained, and the staff member who obtained it -- the record ICH E6 requires to demonstrate that consent was properly administered before any study procedures began.

Patient-reported outcome (ePRO) integration supports electronic collection of patient diaries, symptom questionnaires, and quality-of-life instruments via BYOD (the patient's own smartphone) or site-provided devices. ePRO completion rates and overdue diary alerts are visible in the patient tracking view alongside visit compliance so coordinators have a complete picture of data completeness for each patient.

Enrolment status by site and study-wide shows current count against target with projection to trial completion based on current enrolment rate. Visit scheduling calculates allowed visit windows from the protocol calendar -- the system tells the coordinator the permitted date range for each upcoming visit given the previous visit date, rather than requiring manual window calculation. Visit compliance tracking flags overdue visits and identifies lost-to-follow-up patients based on missed contact attempts and visit non-attendance. Withdrawal and early termination recording captures the reason in a structured classification -- adverse event, withdrawal of consent, investigator decision, or protocol deviation -- for inclusion in safety reports and the statistical analysis dataset.

Protocol deviation management

Deviation capture linked to the patient record, the specific protocol section violated, and the visit where the deviation occurred. Each deviation record includes the description of what occurred, the date identified, the date of the event, and whether the deviation affected patient safety or data integrity -- the fields regulators look at first during an inspection. SAE (Serious Adverse Event) expedited reporting workflow is integrated into the deviation module: events meeting the SAE criteria trigger a dedicated reporting workflow with 15-day and 7-day reporting timeline tracking to FDA, EMA, or both, depending on the trial's regulatory jurisdiction. The system flags overdue SAE reports before the submission deadline passes.

Deviation classification by severity -- minor, major, or important protocol deviation -- follows the classification scheme defined in the study's deviation management plan. The classification requires review and sign-off from the assigned medical monitor or sponsor representative before the deviation is finalised, with the sign-off recorded in the audit trail under 21 CFR 11.10(e) requirements. CAPA (Corrective and Preventive Action) assignment tracks the action owner, the planned resolution date, and the effectiveness review outcome.

Deviation trend reporting by site, investigator, category, and protocol section surfaces patterns before they become inspection findings. A site with three consent-related deviations in 60 days is a pattern the sponsor needs to address through re-training -- the trend dashboard identifies this before the monthly monitoring report would have flagged it. Sponsor and CRO review workflows track approval status and response documentation for each deviation, with the full review history stored against the deviation record.

Data management integration

Integration with EDC systems -- Medidata Rave, Veeva Vault EDC, and OpenClinica -- so visit data entered in the EDC is reflected in the CTMS without dual entry. The integration eliminates the discrepancy risk that occurs when enrolment counts in the CTMS and the EDC diverge because one system was updated and the other was not. eCRF validation rules (range checks, cross-field logic) defined in the EDC are respected at the integration boundary -- the CTMS does not import data that fails EDC validation and surfaces rejected records for coordinator review.

CDISC SDTM and ADaM submission datasets are referenced as the target data structure for regulatory submission to FDA and EMA eSub systems. The CTMS operational data is structured to align with CDISC CDASH collection standards at the point of capture, reducing the transformation work required when producing SDTM datasets from the collected data. Data reconciliation alerts fire when the EDC enrolment record and CTMS patient record are inconsistent -- for example, when a patient is marked enrolled in the EDC but remains in screening status in the CTMS.

Database lock workflow tracking covers query resolution status per site, data freeze confirmation, and lock status -- replacing the email chain that typically manages the lock process. Each site's readiness for database lock is visible in a single status view so the data management team does not need to contact each site coordinator individually to confirm query closure. Open queries from the EDC appear in the coordinator's operational dashboard alongside upcoming visit schedules so coordinators see both operational and data tasks in one workspace rather than switching between the CTMS and the EDC query management view.

Regulatory documentation

Trial master file (TMF) index aligned to the ICH E6(R3) essential document requirements and the industry-standard TMF Reference Model. The TMF structure in the CTMS maps every document type to its required location in the TMF index so completeness can be measured objectively against a defined standard rather than against someone's recollection of what should be there. Document version control with upload, review, and approval workflow ensures that only the current approved version of each document is presented to an inspector while previous versions remain accessible with their approval history.

21 CFR Part 11 electronic records and signatures compliance is built into the document management layer. Electronic signatures for documents requiring sponsor or investigator sign-off are implemented with the authentication and non-repudiation controls required under 21 CFR 11.100 -- a signer must authenticate with their credentials before the signature is applied, and the signature record captures the signer's name, date, and the meaning of the signature (approved, reviewed, certified). The audit trail required under 21 CFR 11.10(e) captures every system action -- document upload, approval, deviation entry, enrolment change, and user access event -- with user identification, timestamp, and the previous value where a record was changed.

EU Annex 11 requirements for computerised systems are addressed through system access controls, audit trail completeness, and the change control record. Inspection readiness checklist identifies missing or expiring TMF documents before an audit -- not as a one-time check but as a continuously maintained completeness score by TMF section and site. TMF health reporting shows overall completeness percentage, documents missing by category, and documents expiring within 30 days so the TMF coordinator has an ongoing operational view rather than a pre-inspection scramble.

Frequently asked questions

A CTMS is operational software for managing the conduct of a clinical trial -- not the scientific data captured in patient visits, which is handled by an EDC (Electronic Data Capture) system with eCRF forms and validation rules, but the operational record: which sites are active, how many patients are enrolled at each site, whether visits are happening on schedule within the allowed windows defined in the protocol calendar, what deviations have occurred and how they have been classified and resolved, and whether the regulatory documents at each site are current and not expired.

It is the tool that gives the sponsor real-time visibility into trial operations without relying on individual site coordinator reports or monitoring visit reports that arrive two weeks after the visit. A well-designed CTMS surfaces site performance data -- enrolment rate, visit compliance, deviation frequency, query rate -- continuously rather than at the point of a monitoring visit or a safety review.

It also produces the audit trail and TMF documentation that inspection readiness requires. Under ICH E6(R3) GCP requirements, every operational decision and document change must be traceable to the person who made it and the time it was made. Under 21 CFR Part 11, electronic records and signatures used in FDA-regulated trials must meet specific requirements for record integrity, audit trail completeness, and signature authentication. A CTMS designed to these standards produces the inspection-ready record as a by-product of normal operations rather than requiring a separate documentation effort before each audit.

EDC systems capture clinical data from patient visits -- the structured data entered against the protocol data collection requirements. The CTMS captures operational data -- enrolment status, visit compliance, deviations, and site management records. Integration between the two systems means the CTMS shows visit completion status based on EDC data entry, and query counts from the EDC appear in the site performance view without dual entry. We integrate with Medidata Rave, Veeva Vault EDC, and OpenClinica through their APIs. For EDC systems without a standard API, we integrate through file-based exchange. Integration scope and approach is confirmed during discovery.

The primary standards for clinical trial management systems are ICH E6(R3) Good Clinical Practice for trial conduct and documentation requirements, 21 CFR Part 11 for electronic records and signatures in FDA-regulated trials, and EU Annex 11 for computerised systems in EMA-regulated trials. ICH E6(R3) was updated in 2023 and introduced a risk-based approach to quality management -- the CTMS design reflects the essential document requirements and audit trail expectations in the revised guideline, not only the original 1996 version.

21 CFR Part 11 defines how electronic signatures must be implemented and what system access controls, audit trail scope, and record protection mechanisms are required for FDA-regulated trials. The key requirements include a complete audit trail under 21 CFR 11.10(e) that captures every change to any record with user identification and timestamp, electronic signature implementation that meets 11.100 authentication requirements, and access controls that limit system access to authorised users with defined roles.

CDISC CDASH standards inform the data collection field structure used at the eCRF level in the integrated EDC. CDISC SDTM and ADaM dataset structures are the submission format expected by FDA and EMA eSub -- the CTMS data model is designed to align with these standards at the collection point rather than requiring significant transformation work before submission.

We design the system to meet these requirements from the start -- not retrofitted after the fact. Your validation team performs the formal computer system validation (CSV) process covering IQ/OQ/PQ protocols. We support that process with system design documentation, configuration specifications, and test execution support.

A CTMS covering trial setup, site management, patient enrolment and visit tracking, deviation management, and regulatory document management for a single active trial programme typically takes 16 to 20 weeks from requirements sign-off to go-live. EDC integration adds four to six weeks depending on the EDC system and integration complexity. Multi-programme platforms covering several trials concurrently, or systems requiring formal IQ/OQ/PQ validation documentation, take longer. We scope the timeline and milestone plan at the start of the engagement so your clinical operations and validation teams can plan around it.

What clients say

What our clients say

Three-year average engagement. Founders and operators describing the work in their own words. No marketing varnish.

Charles E.
Charles E.
USA
Entrepreneur at Aggie Technologies

All of the sprints were completed on schedule and on budget. We highly recommend RaftLabs!

01 / 02

Related services

  • Business Process Automation -- Automate regulatory submission workflows, CAPA tracking, deviation management, and batch record generation
  • AI Agent Development -- AI agents for adverse event signal detection, clinical data review, and regulatory document classification
  • Custom Software Development -- Custom LIMS, eTMF, clinical trial management, and regulatory compliance platforms

Talk to us about your clinical trial management project.

Tell us your trial programme, the systems you are currently using, and where the operational gaps are. We will scope a CTMS built around how your trials run.