This system map is part of the protocol deviation resolution guide, which covers what to inventory before a migration. Here the focus is structural: where each record lives, which identifier links it to the next, and who owns each piece.
The map: system, record, linking key, owner
Four systems typically hold the pieces of one deviation. The table is the evidence asset for this page; names are system types, not products.
| System | Record it holds | Linking key it carries | Usual owner |
|---|---|---|---|
| Trial management or data capture | Visit dates, participant schedule, site status | Study and site, participant study ID, visit identifier | Head of clinical operations |
| Quality system | Deviation entries, classifications, investigations, CAPAs | Deviation and CAPA numbers; study and site, usually | Quality director |
| Document file | Protocol, amendments with effective dates, IRB letters, site activation | Study, site and amendment number | Regulatory or clinical operations lead |
| Statistics files | Analysis population decisions, protocol deviation listings | Participant study ID; deviation number, sometimes | Head of biostatistics |
| Audit trail in each system | Who changed what, and when | Record ID plus timestamp | Each system's owner and validation team |
Read across a row to see what a system knows; read down the third column to see which keys are shared. A key that appears in only one row cannot join anything.
The five keys, and what each one proves
Study and site number. Groups deviations the way regulators read them. ICH E3 asks that important deviations in a clinical study report be summarized by site and category, so this key is usually present everywhere.
Participant study ID. Ties a deviation to the participant's visits. It is often typed into the quality system by hand, or left out, and it is an identifier to handle carefully.
Visit identifier and date. Proves the timing that defines the departure. Without it, "visit out of window" is a claim with no measurement.
Protocol version in force. Proves which rule applied. This is often the weakest key, because amendments live in the document file while deviations live in a log. Whether a departure counts as minor or important depends on what the protocol said on that date, so a missing version leaves the grading itself unverifiable.
Deviation and CAPA number. Proves the remedy answered a specific cause. A CAPA that does not carry the deviation number is an orphan.
One fully joined case (Illustrative)
Illustrative only; every value is invented, and the case is different from the late visit in the worked exception example. Amendment 2 of a fictional study lowers a screening lab threshold. Site 03 enrolls a participant under the new threshold two days before the site has activated amendment 2, so under the rules in force the participant was ineligible.
| Record | System | Keys it carries | Joined to |
|---|---|---|---|
| Amendment 2, new lab threshold and effective date | Document file | Study 207, amendment 2 | Site activation, by amendment number |
| Site 03 activation of amendment 2 | Document file | Study 207, site 03, amendment 2, date | Screening visit, by site and date only |
| Screening visit with the lab value | Data capture | Site 03, participant 03-118, visit SCR | Deviation, by participant and visit |
| Deviation DEV-311, eligibility, important | Quality system | Site 03, participant 03-118, DEV-311 | Sponsor decision, by deviation number |
| Sponsor letter allowing the participant to continue | Document file | Study 207, DEV-311 | CAPA, by deviation number |
| CAPA-58, enrollment check before activation | Quality system | CAPA-58, DEV-311 | Back to the deviation |
| Excluded from per-protocol set, kept for safety | Statistics files | Participant 03-118 | Deviation, by participant only |
Two joins rely on something weaker than a shared identifier. The screening visit meets the amendment only through dates, and the statistics decision cites the participant but not DEV-311. Both are typical, and both are what a reviewer will test first.
When the same key is written three ways
Many broken joins are not missing keys but keys typed differently. A reviewer reconciling systems usually meets variants like these, and each one is fixable only if someone knows the convention:
| Key | Form in one system | Form in another | What reconciles them |
|---|---|---|---|
| Participant study ID | 03-118 | 3118, or "Subj 118, site 3" | The site numbering convention in the data management plan |
| Visit identifier | SCR, W12 | "Screening", "Week 12 visit" | A visit schedule table mapping codes to names |
| Amendment | Amendment 2 | "Protocol v3.0", "Am2 dated March" | A version history listing amendment numbers against document versions |
| Deviation number | DEV-311 | "Dev 311" in an email subject | A consistent prefix, or a cross-reference list kept by quality |
| Study | 207 | The sponsor's own study code | A study register pairing internal and sponsor codes |
Ask whether these conventions are written down. A company with a data management plan, a visit schedule table and a study register can usually be joined by a script; one without them needs a person who remembers.
Where the joins break, and why audit trails matter
The common breaks are predictable: the participant ID typed differently in two systems, the protocol version never stored per deviation, a CAPA with no deviation number, statistics decisions that cite participants but not deviations. Each can be partly recovered if the dates survive.
Audit trails decide whether a reclassification, such as a deviation regraded after review, can be seen at all. FDA's Part 11 rule calls for secure, computer-generated, time-stamped audit trails in which changes do not obscure earlier entries, kept at least as long as the records themselves. A quality system that meets that standard shows both an original classification and any later correction, with who made each and when. Whether a given platform exports those trails in usable form varies by product, version and contract; the company should confirm it with its own vendors. Partners should not describe a platform's export features to a client as fact.
Questions for the systems owner
Ask at metadata level, and record only the answers:
- Which of the five keys does each system store as a field, rather than in free text?
- Is the protocol version stored per deviation, and since when?
- Do CAPAs carry the deviation number?
- Do statistics files cite deviation numbers?
- Are audit trails kept for classification changes, and for how many years?
- Which system is being replaced next, and on what documented date?
The workflow map template gives a blank layout for the answers, and the PLM migration guide shows the same join questions in engineering systems.
Who can act on the map, and does the company qualify?
The quality director can confirm the map. The CEO or COO decides whether to explore licensing, and counsel reads sponsor contracts, since trial records are often sponsor-controlled while the company's own procedures and internal audits may not be. The referral brief template carries the map's answers into the introduction. For a research company closing rather than migrating, see biotech wind-down; for comparable operational records in production, see manufacturing data monetization.
For SourceX, an introduced company needs 50+ full-time employees at peak (contractors excluded), a documented operating history, rights to license and an authorized contact. Companies in the U.S., Canada and the EU qualify, as do companies in the UK, Australia, New Zealand, India, Singapore, South Africa, Latin America, the UAE and Saudi Arabia when at least 90% of the data is in English. What stays unknown until SourceX reviews it: which record classes the company controls, the de-identification needed, SourceX's current data needs and any offer. SourceX licenses approved business data directly from companies for AI training and evaluation, and manages the agreement, rights review, data preparation, delivery and payout. Partners sign the Channel Partner Agreement before submitting, and the first valid introduction within the 90-day window is credited when the company submits a verified application.
Next step
Refer a company. Earn up to $100,000. Default reward: 25% of Actual Supplier Payout, capped at $100,000 cumulatively per referred company. Eligibility and payment conditions apply, and a signed Schedule A or addendum can differ. A lead, meeting or signature alone does not trigger payment.
If the map shows a client's deviations, amendments, CAPAs and analysis decisions still join by key across years of studies, register as a partner, check the company on who qualifies and read the program terms before the introduction.