FDA, MHRA, and Health Canada Signal a Growing Focus on Data Governance and Data Flows
What Trial Sponsors Should Know About Clinical Study Data Flow Maps Under ICH E6(R3)
At the start of June, during the 5th FDA-MHRA-Health Canada Symposium on Regulatory Perspectives in Good Clinical Practice, Bioequivalence & Good PV Practice, the FDA Lead for ICH E6(R3), described one approach to identifying vulnerabilities that could affect critical trial data:
“Map out the data flow and look at all of the technologies, the systems, and the people involved, and try to identify those vulnerabilities.”
She then added:
“That is something we do at the FDA. We always ask for data flow diagrams.”
For organizations navigating the implementation of ICH E6(R3), that statement should not be overlooked.
While regulators did not announce a requirement for Clinical Study Data Flow Maps, the symposium provided some of the clearest regulatory signals yet that understanding how data moves across the clinical trial ecosystem, and the risks associated with this movement, is becoming increasingly important.
Throughout the presentations from FDA, MHRA, and Health Canada, several common themes emerged:
- Data Governance
- Risk Proportionality
- Critical-to-Quality Factors (CtQs)
- Risk-Based Quality Management (RBQM)
- Data Integrity
- Increasingly complex data environments
- Oversight of systems, vendors, and processes
Taken together, these themes point toward a common conclusion:
Organizations cannot effectively govern, oversee, or assess risk within complex clinical trial ecosystems unless they first understand how data moves.
Clinical Study Data Flow Maps provide a practical way to create that understanding.
Regulatory Signal #1: Data Governance Has Become a Regulatory Priority
One of the clearest messages came from Health Canada.
As part of its implementation strategy for ICH E6(R3), Health Canada identified Risk Proportionality and Data Governance as primary focus areas for inspector training, stakeholder engagement, international collaboration, and guidance development.
The agency described a staged implementation approach that included:
- Inspector training focused on ICH E6(R3)
- Participation in international expert groups addressing Risk Proportionality and Data Governance
- Stakeholder outreach and readiness activities
- Updates to guidance documents and compliance initiatives
Health Canada further expanded its Compliance Readiness Inspection program during the ICH E6(R3) transition period to help organizations assess preparedness for these key concepts.
This focus is significant because effective data governance requires more than policies and procedures.
Organizations must understand:
- Where data originates
- How data moves between systems
- Where transformations occur
- Who is responsible for oversight
- How risks to data reliability are identified and managed
Without that visibility, governance becomes increasingly difficult.
As data ecosystems continue to expand, understanding data flows becomes a foundational component of effective oversight.
Regulatory Signal #2: Regulators Are Concerned About Increasingly Complex Data Flows
The MHRA reinforced a similar message.
Its presentation acknowledged that modern clinical trials are becoming increasingly digital and complex, involving multiple systems, teams, partners and data flows.
The agency further emphasized that compliance alone does not ensure quality.
Instead, organizations must create clarity within increasingly complex environments.
The MHRA also highlighted that complex systems with vast data flows require careful management to avoid inefficiency and ineffective oversight.
These observations reflect the reality facing sponsors today.
Sponsors may rely on dozens of systems, vendors, and data transfers across a single study, making it increasingly difficult to understand where critical data originates, how it moves, and who is responsible for oversight.
Clinical trial data rarely resides within a single platform. Instead, it moves across EDC systems, ePRO applications, laboratories, imaging vendors, safety databases, CTMS platforms, data warehouses, decentralized trial technologies, and increasingly sophisticated AI-enabled tools.
- Each transfer introduces dependencies
- Each dependency introduces risk
- Each risk requires oversight
This is precisely the challenge that Clinical Study Data Flow Maps help organizations address.
By visualizing how data moves across systems, vendors, and processes, sponsors gain a clearer understanding of responsibilities, dependencies, and potential vulnerabilities before they become compliance or quality issues.
Regulatory Signal #3: Data Flow Diagrams Are Being Discussed as Risk Assessment Tools
The most practical discussion may have occurred during the symposium question-and-answer session.
When discussing Critical-to-Quality Factors and vulnerabilities that may affect important study endpoints, the FDA representative described data flow mapping as a way to understand the technologies, systems, people, and risks associated with critical trial data.
This distinction matters.
The discussion was not about creating a diagram for documentation purposes.
Nor was it about satisfying a regulatory requirement.
Instead, the conversation focused on identifying risk.
That aligns closely with one of the primary objectives of Clinical Study Data Flow Maps.
A well-developed Clinical Study Data Flow Map allows sponsors to:
- Identify system dependencies
- Understand vendor interactions
- Evaluate oversight responsibilities
- Visualize data transformations
- Prioritize risk mitigation efforts
- Assess vulnerabilities and risk
In other words, data flow diagrams can support the very activities regulators are increasingly emphasizing under ICH E6(R3).
Data Integrity Risks Often Exist Between Systems
Another important message emerged throughout the symposium discussions.
Regulators repeatedly emphasized that sponsors must understand how critical data is collected, transferred, reviewed, and maintained throughout the trial lifecycle.
It was repeatedly noted that sponsors are expected to identify Critical-to-Quality Factors during trial design, perform structured risk assessments, implement proportionate controls, and document how risks are identified and mitigated.
Importantly, regulators also emphasized the need to trace data back to its original source and assess integrity risks that can arise at each point of transfer.
This is a critical consideration for modern clinical trials.
Every data transfer introduces opportunity for risk.
Clinical Study Data Flow Maps help trial sponsors identify where data is transferred, transformed, reviewed, and reconciled before those vulnerabilities become quality issues.
Data may be transferred between sites, laboratories, imaging vendors, ePRO platforms, safety systems, statistical environments, and sponsor databases. Each transfer creates an opportunity for misunderstanding, delay, transformation errors, access issues, or oversight gaps.
Clinical Study Data Flow Maps help organizations visualize those transfer points and evaluate where integrity risks may exist before issues occur.
Rather than focusing solely on where data resides, they help sponsors understand:
- Where data originates
- How data is transferred between systems
- Where transformations occur
- Which vendors and functions are involved
- Where integrity risks may emerge
- What controls mitigate those risks
As trial ecosystems become increasingly complex, the ability to visualize and assess these transfer points becomes an important component of both data governance and risk management.
Clinical Study Data Flow Maps Support Risk-Proportionate Oversight
A recurring theme throughout the symposium was the importance of focusing oversight on what matters most.
FDA, MHRA, and Health Canada repeatedly referenced concepts related to Quality by Design, Risk-Based Quality Management, and Critical-to-Quality Factors.
These approaches share a common principle:
Not all risks are equal.
ICH E6(R3) reinforces that sponsors should focus oversight activities on processes and data critical to participant safety and trial reliability, rather than treating all activities with the same level of scrutiny.
Organizations should focus resources on the activities, systems, processes, and data that have the greatest potential impact on participant safety and data reliability.
However, risk-proportionate oversight becomes difficult when sponsors lack visibility into how critical data moves throughout the study.
Clinical Study Data Flow Maps help bridge that gap.
Clinical Study Data Flow Maps provide visibility into critical data, dependencies, and risk, helping sponsors apply risk-proportionate oversight in increasingly complex trial environments.
Most importantly, they help organizations connect operational activities to the broader objectives of participant protection and data reliability.
Why This Matters Under ICH E6(R3)
The implementation of ICH E6(R3) is accelerating a shift that has been underway for several years.
Clinical trials are becoming more decentralized.
Technology ecosystems are becoming more interconnected.
Data sources are becoming more diverse.
Oversight models are becoming increasingly risk-based.
In this environment, organizations must be able to explain not only what data they collect, but also:
- Where the data originates
- How it moves
- Who oversees it
- What controls are applied
- How risks are assessed and managed
Clinical Study Data Flow Maps provide a practical way to answer those questions.
They transform complex data ecosystems into something that can be understood, governed, monitored, and explained.
The Regulatory Message Is Becoming Clear
Neither FDA, MHRA, nor Health Canada announced a requirement for Clinical Study Data Flow Maps.
However, regulators repeatedly emphasized Data Governance, Risk Proportionality, Critical-to-Quality Factors, complex data environments, and understanding vulnerabilities across systems and service providers.
The FDA discussion added an especially important practical dimension by directly connecting data flow diagrams to risk identification activities.
Taken together, these messages point toward a common conclusion.
As clinical trials become more connected, more digital, and more complex, sponsors are increasingly expected to understand how critical data moves throughout the trial ecosystem.
Whether regulators ultimately require Clinical Study Data Flow Maps is almost beside the point.
The message emerging from FDA, MHRA, and Health Canada is that sponsors must be able to identify vulnerabilities, understand dependencies, and apply risk-proportionate oversight to critical trial data.
Organizations cannot effectively oversee data they do not understand.
