eCOA UAT: from baselined test plan to inspection-ready report
A sponsor deploying an eCOA solution across a multi-country Phase III study needs to verify that the configured system does what the protocol and specifications say — and to be able to show an inspector how they know.
Service line
Clinical Trial Services — eCOA UAT & Verification
Scenario
Global Phase III, eCOA with 4 instruments, 6 languages, BYOD and provisioned devices
Who we act for
The sponsor. Delegate the work, not the accountability
Deliverables
UAT strategy, baselined test plan, executed scripts with evidence, defect log, UAT report with traceability matrix
The challenge
eCOA vendors validate their platform. Sponsors are still accountable for verifying that their configured study — instruments, schedules, branching logic, translations, alerts, device settings — is fit for purpose. ICH E6(R3) and the C-Path eCOA Consortium guidance are explicit that UAT is sponsor verification, not a repeat of vendor validation, and that accountability stays with the sponsor even when execution is delegated.
In practice, sponsor teams are stretched: the UAT window is short, the configuration keeps moving, screenshots end up in shared drives with no link back to requirements, and the final report is written from memory. That is the gap this engagement closes.
Our approach
- Scope and requirements. We derive verification requirements from the protocol, the schedule of assessments, the COA specifications and the vendor's configuration documents. Each requirement gets an ID, a source reference and a risk rating — the backbone of the traceability matrix.
- UAT strategy and test plan. Risk-based coverage in line with GAMP 5 (2nd edition) and FDA's Computer Software Assurance thinking: critical-to-quality functions (scoring, visit windows, alerts, data transfer) get deeper scripted testing; low-risk screens get exploratory checks. The plan is versioned, reviewed and baselined with sponsor approval before execution starts.
- Configuration freeze check. Execution runs against a baselined test configuration. If the vendor changes the build mid-way, the affected requirements are flagged as stale and re-executed — nothing is silently carried over.
- Execution with evidence. Scripts are executed per language and device class. Every step captures screenshot evidence tagged to its requirement ID, tester, timestamp and environment. Evidence is classified explicitly (confirmed from source, derived, missing) and that classification never changes automatically.
- Defect lifecycle. Defects are logged with severity, reproduction steps and linked evidence, then tracked through vendor fix, re-test and closure. Open defects at report time are listed with a documented risk acceptance from the sponsor.
- UAT report. The report references the approved test plan as a separate, frozen artefact. It contains the study context summary, environment and build identifiers, execution results by requirement, the defect summary, deviations, and a full requirement-to-evidence traceability matrix. Completion status is set by the reviewer, never auto-declared. Electronic signatures close it out.
Standards and practices we hold the work to
- ICH E6(R3) — sponsor oversight of computerised systems; UAT as sponsor verification.
- 21 CFR Part 11 and EU Annex 11 — audit trails, electronic records and signatures, controlled documents.
- GAMP 5 (2nd ed.) and FDA CSA — risk-based, critical-thinking approach to assurance instead of blanket scripted testing.
- ALCOA+ — evidence that is attributable, legible, contemporaneous, original, accurate, complete, consistent, enduring and available.
- C-Path eCOA Consortium and ISPOR ePRO good practice — instrument migration, equivalence and usability considerations feed the test scope.
- Language discipline. "Verification" not "validation"; "sponsor approval" not "client approval"; "baselined" not "frozen" — because the words end up in inspection files.
What the sponsor is left with
A single, coherent evidence package: an approved plan, executed scripts, classified evidence, a closed defect log and a signed report — every line of which traces back to a requirement and forward to a screenshot. If an inspector asks "how do you know the eCOA does what the protocol says?", the answer is one document away.
How Pragma Clinical fits
We run this workflow in our own eCOA UAT & Usability module inside Pragma Clinical: test plan versioning and baseline approval, stale-configuration guards, evidence classification, defect lifecycle and report generation. Clients can use the platform or receive the deliverables as documents — the method is the same either way.
Need sponsor-side eCOA verification you can evidence?
We can run the full UAT cycle or strengthen the one you have — plan, execution, evidence and report.