eTMF
Electronic Trial Master File
An eTMF is the managed electronic home of the trial master file: the collection of essential records that, taken together, permit an independent party to reconstruct how a trial was conducted and to verify the quality of its data. ICH E6(R3) deliberately reframed E6(R2)'s fixed section-8 list of "essential documents" as "essential records" — defined by whether a record enables that verification, not by its presence on a checklist — with representative examples rather than an exhaustive inventory. The eTMF is where an organisation operationalises that definition: an index of what the trial should produce, workflows that file what it does produce, and metrics exposing the gap between the two.
What this page does not claim
A system class is not a product. SPEQ describes what a CTMS or a LIMS is; the vendor directory at /tools lists the products that implement one, and a GAMP category is a property of an implementation, not of a class.
What a eTMF actually is
An eTMF is the managed electronic home of the trial master file: the collection of essential records that, taken together, permit an independent party to reconstruct how a trial was conducted and to verify the quality of its data. ICH E6(R3) deliberately reframed E6(R2)'s fixed section-8 list of "essential documents" as "essential records" — defined by whether a record enables that verification, not by its presence on a checklist — with representative examples rather than an exhaustive inventory. The eTMF is where an organisation operationalises that definition: an index of what the trial should produce, workflows that file what it does produce, and metrics exposing the gap between the two.
The system's working structure is an index — most organisations base theirs on the industry TMF Reference Model — mapping zones and artifact types to the trial, country, and site levels. Against that structure the eTMF runs filing workflows: a document arrives, is classified, quality-checked for the right study, version, signature, and legibility, and is filed with metadata that makes it findable. Completeness is then measurable: expected versus filed, by site and by artifact type. That number is the difference between an eTMF and a shared drive full of PDFs — a shared drive cannot tell you what is missing.
The regulatory bar is contemporaneousness and inspection-readiness. Regulators expect the TMF to be maintained as the trial proceeds, not assembled in the weeks before an inspection — a reconstructed file is itself evidence that sponsor oversight was not operating. Because the eTMF is where signatures, approval dates, and audit trails are verified, 21 CFR Part 11 and ALCOA+ expectations apply directly: certified copies must be demonstrably complete and legible against the original, the audit trail must show who filed and who quality-checked, and access must reflect the blinding and confidentiality boundaries of the trial.
Ownership is split, and the split matters. The sponsor owns the sponsor TMF; the investigator maintains the investigator site file, and E6(R3) is explicit that records under the investigator's control must remain under the investigator's control — a sponsor eTMF does not absorb the ISF even when technology could. Deployments are configured commercial platforms — GAMP 5 Category 4 in practice — where the index configuration, QC workflows, and completeness reporting are the sponsor's to verify, and where the archive obligations run for years beyond the trial: retention, migration, and continued readability are part of the system's design, not an afterthought at closeout.
WHERE THE BOUNDARY ACTUALLY SITS
Not the operational tracking system. The eTMF files the evidence that a monitoring visit produced; the visit itself — scheduling, findings, follow-up — is managed in the CTMS.
CTMS owns it →Not the investigator site file. The ISF holds the records under the investigator's control — including those the sponsor must not hold, such as the full subject identification log — and it stays under the investigator's control.
Not the submission publishing system. Essential records may support a marketing application, but the dossier is compiled, published, and tracked in RIM.
RIM owns it →Not an archive of everything the trial ever generated. E6(R3) ties "essential" to verifiability of conduct and data quality, applied risk-proportionately — indiscriminate filing buries the record an inspector needs under a thousand that prove nothing.
WHAT IT HOLDS, AND WHAT CROSSES ITS BOUNDARY
CORE RECORDS
- Trial-level essential records — protocol and amendments, investigator's brochure versions, and their approvals
- Regulatory and ethics submissions, approvals, and correspondence, at trial and country level
- Site-level records — qualifications, training, delegation, and agreements — filed per site
- Finalised monitoring visit reports and follow-up correspondence
- Certified copies, with the certification evidence that makes them acceptable in place of originals
- Filing and quality-control audit trails — who filed, who checked, and when
- Completeness and timeliness metrics: expected versus filed, by site and artifact type
DATA FLOWS OUT
Final essential records — protocols, approvals, and report appendices — drawn into the clinical modules of a submission dossier
Completeness and filing-timeliness metrics that feed the sponsor's oversight of sites, CROs, and the trial itself
Systemic filing failures — a site or vendor whose records are chronically missing or late — escalated as quality events
HOW THIS CLASS IS USUALLY VALIDATED
- SPEQ synthesis: eTMF platforms are configured commercial software — GAMP 5 Second Edition (2022) Category 4 — where the index structure, filing and QC workflows, role-based access, and completeness reporting are the implementing organisation's configuration to verify. The category describes the implementation, not the product.
- The audit trail and certified-copy handling deserve scripted testing: an eTMF exists to be believed years later, so who-filed-what-when, the immutability of filed versions, and the fidelity of scanning and certification are the controls an inspection will probe directly.
- Access control is a blinding control, not just a security one — unblinded records, pharmacy files, and subject-identifying material must be provably invisible to blinded roles, and that segregation is verified, not asserted.
- Migration and long-term archive are part of the validated scope. A trial's retention obligation outlives the platform version it was filed in, so export completeness, metadata preservation, and continued readability need evidence, not intention.
SPEQ synthesis, not a rating. This is SPEQ’s reading of how this system class is commonly approached, offered to help you scope your own work. A GAMP category is a property of a specific implementation, not of a product class, and one deployment routinely spans several. It is not a classification service and does not replace your own documented risk assessment.
- Stage 1 · Reactive
The TMF is assembled retrospectively — documents live in email, shared drives, and site binders, and a filing campaign precedes every audit. Nobody can state completeness, and the reconstruction effort itself contradicts the contemporaneousness the record is supposed to prove.
- Stage 2 · Defined
A structured eTMF exists with a defined index, and filing responsibilities are assigned. Documents arrive in batches rather than as the work happens, quality control is inconsistent, and completeness is estimated from spot checks rather than measured continuously.
- Stage 3 · Controlled
Filing is contemporaneous and quality-controlled: expected-record lists are configured per trial, completeness and timeliness are measured by site and artifact type, and periodic reviews reconcile the eTMF against CTMS activity so gaps surface in weeks, not at closeout.
- Stage 4 · Predictive
TMF health is managed as a leading indicator — chronically late sites and vendors are visible and acted on, inspection-readiness reviews sample the file the way an inspector would, and risk-proportionate filing decisions are documented rather than defaulted.
- Stage 5 · Adaptive
The TMF is inspection-ready as a standing condition. Filing quality data feeds trial and vendor selection, the expected-record model adapts to each trial's design and risk, and closeout is an administrative confirmation because the file has been complete all along.
SPEQ’s shared five-stage progression, labelled synthesis. It is not the FDA QMM rating scale and not the scored maturity-assessment domains — assess your quality system for those.
WHAT AN INSPECTION PROBES, AND WHERE IT GOES WRONG
INSPECTION SIGNALS
- Whether the TMF was maintained contemporaneously — filing dates clustered just before the inspection are themselves a finding.
- Completeness against the expected-record list, and whether missing records were known, risk-assessed, and pursued or simply undiscovered.
- Whether the eTMF agrees with the CTMS and the site files — a completed visit with no report filed, or an amendment implemented before its approval was filed, reads as an oversight failure.
- Whether certified copies genuinely stand in for originals — complete, legible, and with certification evidence — where originals were destroyed.
- Whether blinded roles could access unblinded records, and whether audit trails demonstrate the QC that the SOP describes.
COMMON RISKS
- Batch filing at milestones, which converts the TMF from evidence of oversight into a reconstruction of it.
- An index configured once and never adapted, so decentralised elements, ePRO documentation, and vendor records have no home and end up unfiled.
- Quality control that checks classification but not content — the right artifact type, the wrong version or an unsigned copy.
- Duplicate systems of record: the CRO's eTMF and the sponsor's eTMF diverge, and transfer at closeout drops metadata and audit trails.
- Treating archive as storage rather than a validated activity, discovering at year eight that exports are incomplete or unreadable.
WHO WORKS IN IT, AND WHERE IT IS SHAPED
ROLES
- TMF manager / TMF operations specialist
- Clinical documentation associate
- Clinical Trial Manager
- Records and archive manager
- eTMF system administrator / business owner
- GCP quality and inspection-readiness lead
DELIVERY-LIFECYCLE PHASES
[ POSITION IN THE FRAMEWORK ]
6 OF 7 DIMENSIONS · 20 LINKSThe system of record for a trial's essential records — the filed evidence that lets the conduct of the trial and the integrity of its data be verified, maintained contemporaneously under ICH E6(R3), not reconstructed before inspection.
06 · QUALITY MATURITY — ETMF, REACTIVE TO ADAPTIVE
The TMF is assembled retrospectively — documents live in email, shared drives, and site binders, and a filing campaign precedes every audit. Nobody can state completeness, and the reconstruction effort itself contradicts the contemporaneousness the record is supposed to prove.
A structured eTMF exists with a defined index, and filing responsibilities are assigned. Documents arrive in batches rather than as the work happens, quality control is inconsistent, and completeness is estimated from spot checks rather than measured continuously.
Filing is contemporaneous and quality-controlled: expected-record lists are configured per trial, completeness and timeliness are measured by site and artifact type, and periodic reviews reconcile the eTMF against CTMS activity so gaps surface in weeks, not at closeout.
TMF health is managed as a leading indicator — chronically late sites and vendors are visible and acted on, inspection-readiness reviews sample the file the way an inspector would, and risk-proportionate filing decisions are documented rather than defaulted.
The TMF is inspection-ready as a standing condition. Filing quality data feeds trial and vendor selection, the expected-record model adapts to each trial's design and risk, and closeout is an administrative confirmation because the file has been complete all along.
SPEQ’s shared five-stage progression, labelled synthesis — not the FDA QMM rating scale. Where does your organization sit? Score your quality system →
07 · REGULATORY & EVIDENCE
GOVERNING STANDARDS · 7
Derived from the 7 standards SPEQ maps to this subject, across 5 regulatory bodies: FDA, ISPE, ICH, EMA, MHRA.
RECORDS & OBJECTIVE EVIDENCE
- Trial-level essential records — protocol and amendments, investigator's brochure versions, and their approvals
- Regulatory and ethics submissions, approvals, and correspondence, at trial and country level
- Site-level qualification, training, delegation, and agreement records, filed per site
- Certified copies, with the certification evidence that makes them acceptable in place of originals
- Completeness and timeliness metrics: expected versus filed, by site and artifact type
COMMON INSPECTION FINDINGS
- Filing dates clustered just before the inspection, contradicting contemporaneous maintenance
- Missing records that were undiscovered rather than known, risk-assessed, and pursued
- The eTMF disagreeing with the CTMS or site files — a completed visit with no report filed
- Certified copies that are incomplete or illegible where the originals were destroyed
- Blinded roles able to access unblinded records the segregation should have hidden
Choosing, validating, and living with eTMF
FREQUENTLY ASKED
What is the difference between a TMF and an eTMF?
The TMF is the obligation; the eTMF is a way of meeting it. The trial master file is the collection of essential records that lets the conduct of the trial and the quality of its data be verified — it exists whether it lives in binders, a shared drive, or a purpose-built system. An eTMF is the managed electronic system: a configured index, filing and quality-control workflows, audit trails, and completeness metrics. The regulatory expectations attach to the TMF itself; the eTMF is what makes those expectations continuously demonstrable rather than reconstructable.
What does "contemporaneous" filing actually require?
That the record is filed as the trial produces it, within timelines the sponsor defines and can defend — not that every document is filed the day it is signed. The test regulators apply is whether the TMF could have supported oversight at any point during the trial: a file that only became complete in the month before an inspection could not have, and the filing-date pattern in the audit trail shows exactly that. Most organisations set artifact-level filing windows, measure timeliness against them, and treat chronic lateness as a quality signal, not an administrative one.
Who owns the TMF when a CRO runs the trial?
The sponsor, always — delegation transfers activity, never accountability. A CRO may operate the eTMF and do the filing, but ICH E6(R3) keeps the sponsor responsible for oversight, and regulators expect the sponsor to have ongoing access and demonstrable supervision of TMF health during the trial, not a handover of boxes at the end. Separately, the investigator site file remains under the investigator's control throughout; it is part of the trial's records but it is not the sponsor's to hold, and some of its contents must never reach the sponsor.
Can paper originals be destroyed once scanned into the eTMF?
Often, but only on the strength of a certified-copy process — not the scan alone. A certified copy is one verified to have the same information, including data that describes the context, content, and structure, as the original. That requires a defined process: controlled scanning, a completeness and legibility check, certification evidence in the record, and a retention decision made under the applicable national rules, since some jurisdictions and some record types still expect originals. Where any doubt exists, the conservative reading is to retain the original — destruction is irreversible and the record's obligations run for years.