TMF Reference Model: Filing the Evidence Behind Endpoint Decisions

In clinical drug and biologic investigations, primary and secondary endpoints determine product efficacy, safety profiles, and regulatory approval. Yet during regulatory Good Clinical Practice (GCP) inspections by agencies such as the U.S. FDA, the European Medicines Agency (EMA), and the UK Medicines and Healthcare products Regulatory Agency (MHRA), inspectors do not simply examine final statistical output tables. Instead, they examine the contemporaneous documentation that demonstrates how those numbers were generated, validated, and safeguarded against bias throughout the trial lifecycle.

Inspection of the trial file turns on reconstruction. In its introductory requirements, the EMA guideline on the content, management, and archiving of the clinical trial master file states that TMF documentation should be sufficient to adequately reconstruct the activities undertaken in conducting the trial, along with the decisions and justifications made concerning the trial. A following sentence in that same passage says the documents and records in the TMF should collectively permit confirmation of compliance with the protocol and GCP, and the integrity of the data collected, without additional explanation from the sponsor, CRO, or investigator/institution staff. Similarly, ICH E6(R3) Good Clinical Practice Appendix C says essential records should be collected and filed in a timely manner, retained so they remain complete, readable, readily available, and directly accessible, and, when appropriate, be identifiable and version-controlled, including authors, reviewers, and approvers where necessary.

Inspection practice still shows a gap between that expectation and the file teams can produce. A 2015 MHRA inspectorate blog describes record keeping and essential documents as the most frequent major finding for commercial sponsors. A vendor summary of the MHRA GCP Inspections Metrics Report for 1 April 2018 to 31 March 2019, issued on 12 February 2021, describes the same area as the most common finding category and estimates about 18% of sponsor-inspection findings. Treat that percentage as a secondary reading of a historical report. The report narrative documents critical record-keeping findings, including incomplete trial master files. Those sources also describe ancillary systems holding essential records the organization had not declared as part of the TMF, and decision correspondence that is missing or sparse. If the file cannot show which adjudication criteria were in force on the date a clinical event was assessed, the endpoint observation from that date cannot be reconstructed.

To organize the records generated across a clinical program, many biopharmaceutical sponsors and contract research organizations (CROs) use the Trial Master File Reference Model. Originally developed under the auspices of the Drug Information Association (DIA) and now formally stewarded by CDISC, the model establishes a standardized taxonomy and common metadata architecture for clinical trial records.

The current published and distributed standard is TMF Reference Model version 3.3.1, released as an operational workbook following prior widely adopted versions (v3.0, v3.1.0, v3.2.0, and v3.3). Version 4.0 remains in working-group development. A 2025 CDISC Europe Interchange presentation, offered as one speaker's view rather than finalized CDISC policy, said the model has carried a computer-system validation tab since version 3.0 and that incorporation of those records into version 4 was still under discussion.

Structurally, the Reference Model organizes records into a three-tiered hierarchy:

• 11 Functional Zones: High-level domains grouping related trial operations: Zone 01 Trial Management, Zone 02 Central Trial Documents, Zone 03 Regulatory, Zone 04 IRB/IEC and Other Approvals, Zone 05 Site Management, Zone 06 Investigational Product (IP) and Trial Supplies, Zone 07 Safety Reporting, Zone 08 Centralized and Local Testing, Zone 09 Third Parties, Zone 10 Data Management, and Zone 11 Statistics.

• Sections: Thematic divisions within each zone that cluster related operational processes (for example, Zone 11 contains sections for Study Design, Randomization, and Statistical Analysis).

• Artifacts: The core operational filing unit. Each artifact possesses a standardized name, a unique alphanumeric identifier, and a definition published in the CDISC TMF Controlled Terminology. Artifacts are classified as Core (if the record exists and applies to the trial, CDISC's standards page says it must be in the TMF) or Recommended (CDISC's standards page says the artifact does not have to be produced, but if it is created or collected it is recommended for the TMF).

Crucially, study teams must distinguish between an industry taxonomy and statutory regulations. The TMF Reference Model is a voluntary standard, not a binding regulation. Neither FDA regulations (such as 21 CFR Part 312 or 21 CFR Part 11) nor EU CTR Article 57 mandate adoption of the CDISC zone structure. Under ICH E6(R3) section C.3.1, the assessment of whether a record is essential, while important, is not required to be documented. A structured content list may be used to identify essential records prospectively.

ICH E6(R3) section C.2.12 says certain essential records may relate to the investigational product, facilities, or systems used across trials and may be retained outside the trial-specific repository. The examples given there include the investigator's brochure, master service agreements, standard operating procedures, and validation records. Section C.2.4 still calls for a record of where essential records, including source records, are located, in a storage system that supports identification, version history, search, and retrieval. An organization that misplaces an essential endpoint document cannot defend itself by demonstrating that its electronic TMF folder structure perfectly mirrors the CDISC taxonomy. The compliance test is always retrieval, completeness, and contemporaneous reconstruction.

When an inspector audits an endpoint, they verify the alignment between protocol commitments, data collection tools, statistical derivation code, and independent decision bodies. The table below maps every essential endpoint artifact defined in CDISC TMF Controlled Terminology to its designated zone, primary operational owner, lifecycle timing, and inspectable purpose.

Filing these records requires active collaboration between biostatistics, clinical data management, clinical operations, and quality assurance. As detailed in our analysis of locking statistical analysis plans before unblinding, the statistical analysis plan and the other Zone 11 records that define the endpoint analysis should be finalized and filed before unblinded access. As discussed in our guide to validating computerized systems that capture trial endpoints, Zone 10 should hold the study-specific evidence that the configured capture system was fit for purpose before production use. FDA's October 2024 electronic-records questions-and-answers guidance and the EMA guideline on computerised systems and electronic data in clinical trials both address that expectation.

To understand how the cross-zone filing architecture operates in practice, consider the following hypothetical clinical trial scenario. A sponsor is conducting a global Phase 3 double-blind clinical trial evaluating a novel targeted biologic for active systemic lupus erythematosus. At 40% enrollment, emerging clinical evidence and evolving regulatory guidance prompt the trial steering committee to modify the primary efficacy endpoint from a single organ composite score to an expanded multivariable response index. Concurrently, secondary symptom reporting is migrated from clinic-administered paper forms to an electronic patient-reported outcome (ePRO) smartphone application, and the Independent Adjudication Committee (IAC) severity grading rubric is tightened.

Uploading Protocol Amendment 2.0 into Zone 02 leaves the dependent records behind. File a synchronized cross-zone change set. The zone.section.artifact numbers below follow the public v3.2.0 artifact index. CDISC lists v3.3.1 as the current standards-page release and issued it as a minor definition correction. Confirm the identifiers in the workbook version named in the TMF plan before an eTMF is configured. The change set updates every dependent artifact:

The synchronization of these cross-zone activities is visualized in the operational flow diagram below. Notice that execution branches simultaneously across statistics, clinical data systems, and oversight operations, but converges at a formal eTMF Quality Control Gate prior to deploying the amendment to active trial sites:

flowchart TD
  subgraph G1["Phase 1: Decision & Governance"]
    A["Steering Committee / Clinical Lead: Endorses Endpoint Modification"] --> B["Zone 01: Meeting Material & Documented Decision Minutes"]
    B --> C["Zone 02: Protocol Amendment Tracked Changes & Rationale"]
  end

  subgraph G2["Phase 2: Authorization & Release Gates"]
    C --> D["Zone 03: Regulatory Submissions & Health Authority Approvals"]
    C --> E["Zone 04: Institutional Review Board / Ethics Committee Approvals"]
  end

  subgraph G3["Phase 3: Synchronized Cross-Zone Execution"]
    D & E --> F["Zone 11 (Statistics): Re-Issued SAP, Sample Size & Evaluability Criteria"]
    D & E --> G["Zone 10 (Data Management): eCOA Requirements, UAT Logs, Edit Checks & Change Control"]
    D & E --> H["Zone 01 (Trial Management): Revised Adjudication Charter & Re-Trained Rater Logs"]
    D & E --> I["Zone 08 & 09 (Testing & Vendors): Amended SOWs, Lab Normal Ranges & Assay Validation"]
  end

  subgraph G4["Phase 4: Inspection-Ready eTMF Filing"]
    F & G & H & I --> J["Unified eTMF Quality Control Gate: Timeliness, Indexing, Audit Trails & Version-in-Force Verification"]
  end

EMA guideline section 3.5.2 says superseded versions of final documents are necessary to reconstruct the trial and should be retained in the TMF. Keep Protocol v1.0, SAP v1.0, the initial adjudication charter, and the original eCRF specifications retrievable. For an endpoint assessment collected in month 6, the file should produce the protocol version, database logic, and adjudication charter in force on that date. The guideline's examples of superseded final documents include the protocol, the investigator's brochure, and the eCRF. MHRA inspection reports have treated an incomplete trial master file as a critical record-keeping finding.

The hypothetical change set can still fail inspection. The five patterns below apply documented inspector concerns — undeclared ancillary systems, missing decision records, and versions that cannot be retrieved — to this endpoint example. The counts in the illustration are hypothetical.

1. The Ancillary Vendor Repository Trap: The specialized eCOA technology vendor executed rigorous User Acceptance Testing (UAT), regression test scripts, and device configuration validation. However, these electronic records were retained entirely inside the vendor's proprietary quality portal. Because the sponsor never formally migrated the completed validation documentation into Zone 10 or referenced the vendor repository in an approved Master TMF Locator, inspectors treat the data as unverified shadow records. Under 21 CFR Part 11 and computerized systems guidance, the sponsor still has to be able to show that the system used to capture the endpoint was validated and that those records are inside the declared TMF scope or named in the locator.

2. The Undated Charter and Missing Effective Date: In this illustration, 45 suspected clinical events are adjudicated between month 7 and month 11. The sponsor filed Charter v1.0 and Charter v2.0 in Zone 01, but Charter v2.0 lacked documented member signature dates, and the eTMF contained no record showing the precise calendar date on which the committee switched to the revised severity criteria. The sponsor could not prove whether events adjudicated in month 9 were evaluated under the original or revised standard.

3. Missing Evidentiary 'Why' in Decision Records: The clinical development team and biostatisticians debated the endpoint threshold adjustment across dozens of email exchanges. When finalizing the amendment, the team uploaded the protocol and SAP but filed no correspondence, meeting minutes, or filenotes explaining why the specific threshold cutoff was chosen. That file would fail the reconstruction test in the EMA guideline, which expects the justifications and rationale for trial decisions to be available in the record.

4. Inadvertent Overwriting of the Pre-Amendment SAP: When Biostatistics uploaded SAP Revision 2.0 into the eTMF system, an automated document management setting replaced the original SAP file rather than establishing a distinct version-stacked record. When inspectors requested the pre-specified analysis plan that governed the first interim safety analysis, the original locked document could not be produced.

5. Inability to Export Human-Readable Audit Trails: Under FDA's October 2024 guidance on Electronic Systems, Electronic Records, and Electronic Signatures in Clinical Investigations, FDA inspectors may request all records and data needed to reconstruct an investigation, including associated metadata and audit trails, in human-readable form. When asked to prove who uploaded, approved, and authorized the mid-study database change control, the sponsor's electronic system could only generate raw XML logs that site personnel could not interpret.

A persistent misconception in trial operations is that TMF filing is an archival task reserved for study close-out. Under Regulation (EU) No 536/2014 Article 57, the clinical trial master file shall at all times contain the essential documents relating to that clinical trial. This statutory obligation is echoed in ICH E6(R3) section C.2.5, which mandates that essential records must be collected and filed in a timely manner, with core foundational records in place prior to study start.

EMA guideline section 3.5.4 reads Article 57's requirement that the file contain essential documents at all times as a reason to add documentation during the trial, and it says filing timelines should be defined in procedural documents or the TMF plan. Leaving the endpoint change set unfiled until an inspection is announced leaves that period without the records Article 57 expects to be present. One TMF plan might use the clocks below. They are choices written into that plan, and another trial can justify different clocks:

• Regulatory Clearances & Ethics Approvals (Zones 03 & 04): Filed within 5 business days of receipt from competent authorities or review boards.

• Protocol Amendments & Signed SAPs (Zones 02 & 11): Filed within 10 business days of final executive authorization, and strictly prior to first patient enrollment under the amendment or prior to unblinding.

• Database Change Control & System UAT Logs (Zone 10): Filed prior to migrating changes into the production clinical environment.

• Adjudication Minutes & Decision Sheets (Zone 01): Filed within 15 business days of committee meeting completion.

EMA guideline section 4.2 lists the TMF-level quality checks to apply to endpoint records. The checks below use that list. The right-hand column is an example of how a TMF plan can make each check operational.

Not all endpoint evidence neatly fits into a pre-defined artifact slot. When study teams encounter irregular events, regulatory questions, or cross-functional discrepancies, they must apply clear governance rules to maintain an interpretable record trail.

The CDISC TMF Reference Model includes the general artifact Filenote across every functional zone. A filenote serves as an authoritative explanatory memorandum to clarify isolated discrepancies, explain non-standard documentation practices, or reconcile apparent data anomalies. Defensible uses of a filenote include documenting the rationale for an isolated departure from an analytical procedure, explaining a temporary communication outage that delayed an eCOA data transfer, or recording the resolution of a sample identification query at a central laboratory.

However, clinical quality teams must vigorously prevent 'filenote fatigue'. A filenote should never be utilized to retrospectively justify unapproved protocol deviations, circumvent a formal protocol amendment, or substitute for comprehensive Corrective and Preventive Action (CAPA) documentation. As noted in eCOA change control frameworks, when a measurement methodology changes, a formal protocol amendment and system change control must be executed; a filenote cannot validate an unapproved assessment.

EMA guideline section 3.5.3 says the sponsor should retain relevant correspondence necessary for the reconstruction of key trial conduct activities and decisions, specifically including communications with independent data monitoring committees, ethics committees, and regulatory authorities. In the CDISC Reference Model, these records are captured under Meeting Material and Relevant Communications.

When endpoint criteria are adjusted, the TMF must preserve the formal meeting minutes of the steering committee, email communications with regulatory liaisons confirming submission requirements, and advisory letters issued by Data Monitoring Committees (DMCs). Preserving these records provides inspectors with the historical context and clinical rationale behind statistical decisions, fulfilling the mandate to reconstruct decisions without oral testimony.

A common misconception is that every record connected to a clinical trial must physically reside inside the electronic TMF software. Under ICH E6(R3) Appendix C (sections C.2.4 and C.3.2), health authorities acknowledge that certain enterprise-level records are more effectively maintained in specialized corporate repositories. These include:

• Enterprise Standard Operating Procedures (SOPs): Retained in the corporate document management system, complete with historical versioning and training records.

• Global System Validation Master Files: Retained in corporate IT quality management systems for off-the-shelf software platforms (EDC, eCOA, CTMS, IRT).

• Master Service Agreements (MSAs): Maintained in corporate legal repositories, while trial-specific Statements of Work (SOWs) and work orders reside in Zone 09.

The non-negotiable regulatory requirement is the maintenance of an approved, version-controlled Master TMF Document Locator. ICH E6(R3) C.2.4 says the sponsor and investigator should maintain a record of where essential records, including source records, are located. A practical locator names the system of record, the repository, the custodian, and how an inspector obtains access. When an inspector asks to review the validation package for an eCOA system, presenting the locator and retrieving the package from that repository is how the sponsor meets the C.2.4 record-of-location expectation.

Prior to executing the formal database lock and unblinding the study, biostatisticians, data managers, and clinical operations leaders must perform a synchronized quality review of the endpoint record trail. Once the database is locked and unblinded, retrospective additions to Zone 11 and Zone 10 face intense regulatory skepticism.

The following five-point quality control checklist provides a structured gate that teams should execute prior to breaking the trial blind:

1. Temporal Version-in-Force Verification: For every subject assessment visit, verify that the active protocol version, eCRF field definitions, eCOA software build, and central laboratory reference ranges in force on that visit date match the approved TMF records. Ensure all superseded versions remain archived and fully retrievable.

2. Cross-Zone Change Set Reconciliation: Audit every protocol amendment executed during the trial against its downstream dependencies. Confirm that corresponding updates were completed, signed, and filed across Zone 11 (SAP and sample size revisions), Zone 10 (edit check testing and database change controls), Zone 01 (charter revisions and rater calibration), and Zones 03/04 (regulatory and ethics clearances).

3. Blinded vs. Unblinded Separation Audit: Verify that Zone 11 master randomization lists, randomization code generation programs, and unblinded interim analysis reports are stored in restricted-access partitions. Confirm that no blinded study team member, investigator, or monitor accessed unblinded partitions prior to formal unblinding.

4. Third-Party and Ancillary Repository Sweep: Audit external vendor repositories (eCOA providers, central imaging laboratories, biomarker core facilities). Confirm that all final data transfer specifications, UAT completion sign-offs, calibration certificates, and assay validation reports have been transferred into the sponsor eTMF or recorded in the approved TMF Document Locator.

5. Audit Trail and Human-Readable Export Verification: In accordance with FDA's October 2024 guidance on electronic clinical records, execute test exports of electronic signatures, user role assignment histories, and database lock approvals. Ensure all audit trails can be exported into clear, human-readable formats with standardized date/time metadata.