Know what is missing before the inspector asks.

1An inspection-ready file is maintained, not assembled.

At any point in a trial, the TMF should answer four questions: what evidence should exist, what has arrived, whether it is the right evidence, and who owns each gap. Seal makes those questions part of trial operations rather than a reconciliation exercise at closeout, so the file stays a current account of how the sponsor, investigators, CROs, laboratories, committees and vendors conducted the study.

That requires context as well as final documents: what triggered the record, which study level it covers, which version was effective, who reviewed it, which expectation it satisfies and what it replaced. The useful measure is whether the trial can be reconstructed and every exception explained.

1.1Why teams choose Seal for the trial master file

A standalone eTMF is a well-organised repository: documents are uploaded, classified and counted, and the gaps are found by comparing folders with spreadsheets, often at closeout. Seal generates the expected file from the trial’s own events, and the systems and partners that hold essential records are reconciled against it. A completeness figure can therefore be traced to the missing or rejected records behind it, and an inspector can be given the live record rather than an export.

2Compile the file from the trial.

The CDISC TMF Standard Model provides the common taxonomy of zones, sections and artifacts. Seal records the model version the study adopted, any approved extensions and the mapping rules. A model update is assessed rather than applied like a folder rename, and earlier evidence keeps the classification under which it was accepted.

The study TMF plan applies that model to one protocol: its parties, countries, sites, committees, vendors, owners, QC strategy and timeliness targets. Applicability is decided at the right level. An artifact can be required for one country but not another, or only when a particular vendor or procedure is used. Each exclusion, substitution or waiver carries a rationale and approval, so it stays visible in the denominator. The plan also records where essential records live when they remain authoritative in CTMS, EDC, IRT, safety or vendor systems.¹

A record can only be missing once the system knows it should exist, so expectations come from events that actually occur:

• A country is added: regulatory and ethics expectations appear with local owners and due dates.
• A site is activated: approvals, qualifications, delegation, training and initiation evidence become expected.
• A monitoring visit closes: the report and follow-up letter are expected against that visit.
• An amendment becomes effective: affected countries, sites, consent forms and training are traced to the new version.

Expected, overdue, awaiting QC, rejected, filed, substituted, waived and not applicable remain distinct states, and each change records who made it and on what evidence. One artifact can satisfy several expectations when its scope genuinely covers them, without uncontrolled copies.

3Give every artifact a chain of custody.

Documents arrive from sites, CROs, e-signature tools, CTMS, EDC, safety systems, laboratories, email, scans and migrations. Each intake keeps the source, channel, original file, checksum, received time and signature state. Likely duplicates are identified but not silently deleted, because apparently identical files can differ in provenance, certification or study scope. A spreadsheet, audit trail or query history does not become equivalent evidence by being rendered to PDF; Seal records the owning system and reconciles what the TMF needs.

Seal can propose a classification from the document and its operational context. The proposal keeps its confidence and the reason for the match, and low-confidence, conflicting or high-risk classifications go to a reviewer. Automation does not overwrite an approved classification without a controlled change.

Quality control asks whether the artifact is complete, legible, correctly signed, the right version and filed in the right place. It is separate from author review, approval, execution and filing: a document can be approved but filed against the wrong country, or correctly classified but unsigned. A rejection keeps its finding, the correction and the comparison with the resubmitted version; it does not vanish when the corrected file arrives.

Swipe to see the full diagram →

Drafts, executed versions, translations, certified copies, redactions and replacements are relationships within one artifact family, not file-name conventions. A country-specific consent can replace an earlier country version without erasing the master template or a site’s previously effective copy.

Underneath, the system itself has to be controlled. Audit trails remain attributable, time-stamped and retained with the record, and distinguish automated actions from human decisions.² Electronic signatures stay linked to the exact record version they signed.³ Neither an administrator nor an integration can rewrite that history silently.

4Turn completeness into work.

A percentage means little without its denominator and exceptions. Seal calculates completeness from applicable expectations, accounting for due dates, QC outcome, execution requirements, supersession, substitutions and waivers, and rolls it up by study, zone, country, site, vendor or owner. A user can move from “Country GB is 91% complete” to the missing and rejected expectations that produced 91%.

Timeliness is measured over the interval that matters. Event, availability, receipt, QC, rejection, resubmission and filing timestamps show whether a delay arose in creation, transmission, review or correction, rather than calculating every metric from one upload time. Approved pauses carry dates, reasons and authority, so they do not silently improve a metric.

QC findings, wrong study levels, missing signatures, late documents and repeated replacements become records that can be trended by artifact, site, vendor, source system or reviewer. Recurring issues link to actions, CAPAs, training or vendor oversight, so the party and mechanism producing weak evidence can be found while the trial is still running.

5Reconcile partners and systems to the plan.

Delegating TMF work does not delegate sponsor accountability. The plan records each partner’s deliverables, transfer schedule, formats, quality checks and resubmission targets, and every submission, rejection and acceptance remains attributable. Oversight reviews work from inspectable populations (expected versus delivered artifacts, ageing gaps, first-pass QC, unresolved reconciliations) and record the data cutoff, decisions and follow-up. A sponsor can show what it knew, when, what it challenged and whether the response worked.

Correspondence is filed because it is essential, not because it is email. A committee decision, protocol interpretation or vendor commitment can become essential evidence without a signed form, and Seal records why it matters and which later artifact completed the story.

The complete TMF is often not one application. CTMS owns sites, milestones and visits; EDC owns subject data and database lock; safety, IRT, laboratories and quality systems keep their own records. Seal maintains the inventory of those sources, with their owner, access, audit-trail availability and retention basis, and compares each operational population with its expected TMF evidence. Each comparison keeps its cutoff, matching rule, discrepancies and decisions, and a later reconciliation does not overwrite an earlier one. Where a source system will be retired, the plan shows how its data, metadata and audit trails remain searchable and interpretable.

6Give inspectors direct access to the live record.

EMA guidance expects the TMF to be current, readily available and directly accessible, and MHRA inspection guidance notes that inspectors may require direct access to each system that holds part of it. An inspection should not begin with an export project.

Teams can rehearse before notice: locate an artifact, compare two versions, show its source and audit trail, and prove which version was effective at a site on a date. Seal provides a read-only inspection role against the live record, with search, browsing by TMF structure, metadata and provenance, without entering operational workflows or relying on a super-user.

The inspection workspace records its authority, scope, inspector identities and access expiry, and timestamps every request, view, export and response. The sponsor knows exactly what was exposed, and the inspection history remains part of the governed record. The same access model applies throughout the trial: create, review, approve, file, view and export are separate permissions, scoped by role, study, country, site and blinding, and each grant has an approver and an expiry.

7Close the study once, and keep the proof.

Closeout evaluates the final expected population across sponsor, sites, CROs and vendors: missing and rejected evidence, open QC findings, incomplete signatures, late transfers and unreconciled sources. Exceptions that cannot be resolved receive an impact assessment, owner and approval. The final decision references the actual exception population rather than asserting “100%” by administrative closure.

Every transfer, whether a CRO contract ends or ownership changes, keeps its inventory, checksums, validation results and acceptance, and the receiving party proves it can retrieve and interpret the content before the sender’s access is removed. The EU Clinical Trials Regulation, for example, sets a minimum period for archiving the trial master file.⁴ The archive applies the approved retention basis for each jurisdiction and record type, and is accepted only when a restore test shows the trial can still be reconstructed after the live systems and original teams are gone.

8Start with one site and the hardest exceptions.

Choose one protocol, one country and one site, with the connected sponsor, CRO, laboratory and vendor responsibilities. Approve the plan, generate activation expectations and ingest representative records from a portal, email, e-signature, CTMS, EDC and one vendor transfer. Run them through amendment, monitoring and database lock, hold an inspection drill with read-only access, then archive and prove an independent restore.

Include a wrong-country filing, a missing signature, a translated replacement, a late vendor transfer, a duplicate artifact, an approved substitution and expired inspector access. Success means the system shows what was expected, what satisfied it, what failed, what changed and who decided, without reconstructing the answer in a spreadsheet.