Quality Tolerance Limits (QTLs) & KRIs
Quality tolerance limits (QTLs) and key risk indicators (KRIs) are the risk-control instruments of risk-based quality management, and they are routinely confused with each other and misused. A QTL is a study-level threshold tied to a factor critical to the trial’s quality; a KRI is an operational, site- or country-level signal watched continuously. Getting the level wrong — setting a QTL at site level, or escalating every KRI as if it were a QTL breach — is a common and consequential error, and so is the assumption that a QTL breach is automatically a protocol deviation. This page separates the two and settles the deviation question; the wider discipline they belong to is the [RBM vs RBQM](/topics/rbm-vs-rbqm) explainer.
What an explainer is not
A topic explainer is SPEQ’s synthesis of what a practice involves, cited to the standards that govern it. It does not reproduce their text, and it does not determine which of them apply to your product or process.
[ POSITION IN THE FRAMEWORK ]
7 DIMENSIONS · 20 LINKSA quality tolerance limit is a study-level tripwire, not a site metric, and a QTL breach is not automatically a protocol deviation: in GCP, QTLs and KRIs sit at different altitudes and are constantly set at the wrong one.
06 · QUALITY MATURITY — QUALITY TOLERANCE LIMITS (QTLS) & KRIS, REACTIVE TO ADAPTIVE
There are dozens of 'QTLs', most set at site level; every KRI signal is escalated and a QTL breach is treated as a protocol deviation.
A handful of study-level QTLs and site KRIs are named, but the two are conflated in practice and QTLs are written into the protocol.
Few study-level QTLs sit above many operational KRIs; each is defined before enrolment with a prospective response, and QTL excursions reach the CSR.
KRIs resolve most risks locally; QTL breaches trigger sponsor evaluation and documented action, kept separate from protocol-deviation handling.
QTLs and KRIs compose as one calibrated system tied to critical-to-quality factors, catching systematic drift while local variation stays at the site.
SPEQ’s shared five-stage progression, labelled synthesis — not the FDA QMM rating scale. Where does your organization sit? Score your quality system →
07 · REGULATORY & EVIDENCE
GOVERNING STANDARDS · 3
Derived from the 3 standards SPEQ maps to this subject, across 2 regulatory bodies: ICH, FDA.
RECORDS & OBJECTIVE EVIDENCE
- Quality tolerance limits defined study-wide, few in number, before enrolment
- Key risk indicators defined at site/country level with expected ranges
- The RBQM or monitoring plan documenting both, prospectively
- QTL-excursion evaluations with the sponsor's action recorded
- QTL excursions and their handling reported in the clinical study report
COMMON INSPECTION FINDINGS
- QTLs set at site level (relabelled KRIs)
- Every KRI signal escalated as if it were a QTL breach
- A QTL breach treated as an automatic protocol deviation
- QTLs written into the protocol, blurring quality thresholds with commitments
- QTL excursions not evaluated or not reported in the CSR
What a QTL is — study-level, few, defined up front
A **quality tolerance limit** is a threshold set on a parameter tied to a factor critical to the quality of the trial — the level of departure from expected that, if crossed, may indicate a *systematic* problem affecting participant safety or the reliability of the results. Its defining properties are that it is **study-wide** (not site-specific), **few in number** (you set them for the handful of things that genuinely matter), **defined before enrolment** (in the RBQM or monitoring plan, not invented after a problem appears), and **reported in the clinical study report**, including any excursions and the actions taken. A QTL exists to catch a trial-level drift that individual site metrics would not reveal.
The most common structural error is setting a QTL at site level. That is a contradiction in terms: a threshold applied to one site is, by definition, an operational indicator — a KRI — not a quality tolerance limit, because a QTL is inherently about the study as a whole. A programme with dozens of "QTLs," most of them site-level, has not built quality tolerance limits; it has relabelled its KRIs.
What a KRI is — operational, many, continuous
A **key risk indicator** is an operational metric monitored continuously at the site or country level as a *leading* signal that something may be going wrong — screen-failure rates, query rates, overdue data entry, adverse-event reporting lag, protocol-deviation frequency. KRIs are numerous, they are watched in near-real-time through centralised monitoring, and a KRI crossing its expected range triggers *operational* follow-up: a query to the site, a targeted monitoring visit, a root-cause look at one location.
The mirror-image error to the site-level QTL is escalating every KRI signal as though it were a QTL breach. Most KRI signals are ordinary operational variation to be managed at the site; a QTL breach is a study-level event that demands sponsor evaluation and CSR reporting. Treating them the same either floods the study-level process with site noise or, worse, buries a genuine trial-level signal in a stream of routine KRI alerts. KRIs feed the operational layer; QTLs feed the trial-level quality judgement.
Is a QTL breach a protocol deviation? No.
This is the question that trips up even experienced teams, and the answer is clear: **crossing a QTL is not, in itself, a protocol deviation.** A QTL is a quality-management threshold the *sponsor sets for itself* to watch its own trial — it is not a requirement the protocol imposes on investigators. When a QTL is breached, the sponsor is obliged to evaluate why, consider whether corrective action is needed, and report the excursion and its handling in the clinical study report. That obligation is real, but it is a quality-management duty, not a deviation.
The relationship actually runs the other way. A QTL breach may *surface* deviations — the individual events aggregated into the breached metric might each be protocol deviations — but the breach and the deviations are different things. One important operational caveat: if QTLs are written *into the protocol* as commitments, they arguably become protocol requirements, and then crossing one could be a deviation. That is a strong practical argument for defining QTLs in the RBQM or monitoring plan rather than in the protocol itself, keeping the quality-management threshold cleanly separate from the protocol commitments.
Why the levels have to stay straight
The reason this precision matters is that QTLs and KRIs drive different responses at different altitudes of the organisation. KRIs are the operational nervous system — many signals, handled locally, keeping sites on track day to day. QTLs are the small set of study-level tripwires that tell the sponsor the trial as a whole may be compromised, and they carry a documentation and reporting weight KRIs do not. Collapse the two and you either over-escalate operational noise or under-detect the systematic problem the QTL existed to catch.
Set correctly, they compose cleanly: KRIs watch the many operational risks at the site level and resolve most of them there; a small number of QTLs sit above them watching the critical-to-quality factors at the study level; and the RBQM plan documents both, prospectively, so that when a threshold is crossed the response — operational for a KRI, sponsor-level evaluation and CSR reporting for a QTL — is already defined rather than improvised.
FREQUENTLY ASKED
What is the difference between a QTL and a KRI?
A quality tolerance limit (QTL) is a study-level threshold tied to a factor critical to trial quality — few in number, defined before enrolment in the RBQM/monitoring plan, and reported in the clinical study report; a breach signals a possible systematic problem. A key risk indicator (KRI) is an operational, site- or country-level metric monitored continuously as a leading signal; a KRI crossing triggers operational follow-up. QTLs are study-wide; KRIs are local.
Can a QTL be set at the site level?
No — that is a contradiction in terms. A QTL is inherently a study-wide threshold about the trial as a whole; a threshold applied to a single site is by definition an operational indicator, i.e. a KRI. A programme with many site-level "QTLs" has relabelled its KRIs rather than defining true quality tolerance limits.
Is crossing a QTL automatically a protocol deviation?
No. A QTL is a quality-management threshold the sponsor sets for itself, not a requirement the protocol imposes on investigators. Crossing it obliges the sponsor to evaluate, consider corrective action, and report the excursion in the clinical study report — but the breach is not itself a deviation. It may surface deviations among the aggregated events. Caveat: if QTLs are written into the protocol as commitments, a breach could become a deviation, which is why they are better placed in the RBQM/monitoring plan.
Should every KRI signal be escalated?
No. Most KRI signals are ordinary operational variation handled at the site level; escalating each as if it were a study-level QTL breach floods the quality process with noise and can bury a genuine trial-level signal. KRIs feed operational follow-up; QTLs feed the sponsor’s study-level quality judgement.