Drug Development Documentation: Protocols, Raw Records, and Study Reports That Pass Inspection

Most development findings aren’t about bad science. They’re about paperwork.

When an inspector writes something up, the cause is usually mundane. A protocol element nobody filled in. An acceptance criterion so loose it can’t fail. A raw record written three days after the fact. A report whose numbers quietly disagree with the notebook underneath it.

This piece walks the three documents that actually carry a development program: the protocol, the raw records, and the study report. It also covers where small molecules and biologics need to split off, because one shared template for both guarantees gaps somewhere.

What are the key documents in drug development?

Three of them: the study protocol, the raw records, and the study report.

The protocol defines what you’ll do and how you’ll judge the result. The raw records capture what actually happened. The report interprets it and hands it off to the CTD. That’s the chain. Protocol sets the standard, records hold the data, report delivers the conclusion.

Everything below follows it in order.

Part 1: Writing the study protocol

What is a study protocol and why does it matter?

A protocol is the top-level design document for a study. It’s the single reference for how the study runs, how data gets judged, how deviations are handled, and how the report gets written. If it’s weak, the study is weak, however careful the bench work was.

Four things make one defensible: it’s complete, it’s executable, it’s decisive, and it’s traceable. Boilerplate kills all four.

What elements must a study protocol contain?

At minimum:

• Study objective
• Study basis (regulations, guidelines, pharmacopoeia, ICH)
• Test sample information
• Equipment and consumables
• Study design
• Operating procedure
• Test parameters and endpoints
• Study duration and time points
• Acceptance criteria
• Risk control
• Data recording requirements

The list is easy. Writing each one for this project, rather than copying last quarter’s, is the hard part.

The objective controls everything downstream. It has to separate exploratory work from confirmatory work. Exploratory studies are process scoping, method screening, condition optimization, so the objective can lean toward feasibility. Confirmatory studies are method validation, stability, comparability, quality bridging. Those need to name the validation target, the regulatory basis, and what the data will be used for in the submission.

The basis has to point at references that are current and that actually fit. Match it to the registration category too: new drug, modified new drug, generic, biosimilar. Expired references, mismatched references, and designs with no reference behind them are three findings inspectors write up again and again.

Sample information sounds administrative until it isn’t. Record batch number, production batch, manufacturing process, scale, storage conditions, retest or expiry date, plus reference product details for generic and biosimilar work.

Small molecules: go further on API purity, polymorph, particle size, baseline impurity levels, formulation composition, process parameters, and packaging material.

Biologics: drug substance structure, cell line origin, production passage, purification process, buffer system, internal sterility limits.

Do this properly up front and you avoid the worst outcome in development, which is generating perfectly valid data on the wrong sample.

Design and procedure need enough detail that someone else could repeat the study. Explicit parameters, gradients, replicate counts, environmental requirements.

Small-molecule stability work spells out stress, accelerated, and long-term conditions with temperature, humidity, light, and sampling points. Dissolution needs medium, volume, rotation speed, temperature, sample volume, and filtration. Impurity work needs detection wavelength, mobile phase, gradient program, and quantitation limit.

Biologics work needs incubation temperature and time, the assay system, replicate number, and sample handling. Bioactivity drifts and structures shift in ways a small molecule simply doesn’t, so the protocol has to say how you’ll control for it.

How should acceptance criteria be set?

This is where most protocols fall over.

Criteria are the rules for judging results, and they need to be scientifically sound, justified, tiered, and matched to what you intend to submit. Exploratory work can be loose. Confirmatory work needs something external to stand on: a pharmacopoeial limit, a guideline requirement, or head-to-head data against the reference.

For new drugs, criteria usually tighten as the program matures. Early on you might work to a preliminary release range. By submission, the internal specification and limits are locked.

For generics and biosimilars, build the criteria from comparison data, pharmacopoeial standards, and guideline requirements, matched against the reference or originator’s quality attributes.

Three ways people get this wrong. Criteria so wide nothing can fail. Criteria tightened with no justification. Criteria that shift between documents with no record of the change.

One more thing worth doing while you’re here: define what counts as abnormal before you generate a single data point. Pre-set your OOS and OOT triggers. Then when an odd number shows up in month four, the handling path already exists instead of being invented under pressure.

Part 2: Protocol amendments and deviations

What’s the difference between an amendment and a deviation?

An amendment is planned. You change the design, a parameter, a criterion, or a step before the work continues, or while the study is paused. A deviation is unplanned. Something went sideways during execution and the study didn’t follow the approved protocol.

Amendments get approved first, then executed. Deviations get recorded, investigated, evaluated, and closed.

Regulators treat them differently, which is why blurring them is expensive. The industry habit of running the study first and filing the change later is how a manageable issue becomes a data integrity finding.

How are protocol amendments classified?

Type	What it covers	How it’s handled
Major	Core design changes, revised acceptance criteria, different analytical method, substantially different study duration	Resubmit for approval. Existing data may need to be voided and the study restarted
General	Small adjustments to supporting parameters, like-for-like consumable substitutions, slight shifts in sampling time	Written justification, approved by project lead and QA before execution
Minor	Detail changes that don’t touch the core result	Simplified approval, but the change record is still kept in full

Concrete examples help. Changing the mobile phase or detection wavelength in a small-molecule impurity study is major: you’re re-running method validation. Tweaking incubation time or buffer composition in a biologics assay is general, but you still write down why.

How should deviations be handled?

Real time. That’s the whole rule. Record it, investigate it, evaluate it, close it.

Backfilling records, hiding deviations, and deleting inconvenient data are the three moves that turn a technical problem into a credibility problem. The underlying study might have been fine. Once you hide something, nobody will believe that.

A deviation record captures when it happened, what deviated, how far the impact reaches, and what you did about it immediately. Then you investigate and classify the cause:

• Human: non-standard technique, sampling error, preparation error, testing mistake
• Equipment: lapsed calibration, precision drift, bad system parameters
• Material: degraded reagents, contaminated consumables, improper sample storage
• Environment: temperature or humidity out of limits, inadequate classification, general drift
• Product: process variation, natural degradation, or structural change in a biologic

Then judge it. Doesn’t affect the core result? Close it as an acceptable deviation with a full record. Invalidates the data? Void it and repeat. Data that can’t be defended doesn’t go in the report, and it definitely doesn’t go in the submission.

How should protocol versions be controlled?

New version number, new revision date, a note on what changed, and the old version formally retired.

Mixing versions mid-study produces data nobody can explain. Keep the original protocol, the change justifications, the approvals, and the deviation log together so the whole thing can be rebuilt on request.

Part 3: Raw records

What makes a raw record compliant?

Raw records are the source data, and they’re the first thing an inspection team asks for. Under ALCOA+ they need to be attributable, legible, contemporaneous, original, and accurate, plus complete, consistent, enduring, and available.

In plain terms: write down everything as it happens, tell the truth, and leave a trail someone else can follow backwards.

Why is real-time recording non-negotiable?

Because late entries, batch transcription, estimated values, and edits are the shortest path to a data integrity finding.

Record at the moment the operation finishes. Operation done, data entered, closed the same day. No cross-day entries, no Monday morning catch-up.

A record documents what happened, not what you hoped would happen. Failed runs and ugly numbers get written down too. Selective recording is falsification even when the bench work was flawless.

How should corrections be made?

Never overwrite, scrape, cover, or delete.

On paper, one line through the original value so it stays readable, plus your name, the date, and the reason.

In a system, the audit trail does the work: before and after values, timestamp, operator, reason. Disabling the audit trail or wiping original logs defeats the point of having the system.

Fixing a typo is fine, with a stated reason. Smoothing over a result that came out wrong is not a correction. That’s a deviation investigation.

What does real traceability require?

Six dimensions:

• Personnel: operator, reviewer, approver
• Equipment: name, model, ID, calibration status, calibration expiry
• Materials: sample batch, reagent lots, consumables, reference standard source and lot, expiry
• Method: protocol version and SOP number
• Environment: temperature, humidity, and classification for sterile work
• Measurement: the linked chromatogram, raw data file, and instrument log

Every number should be traceable back to the full context of the study. Not most numbers. Every one.

Which electronic data and chromatograms have to be retained?

Pretty much all of it. Most development data comes off instruments now, so chromatograms, raw files, and system logs are the raw record. Keeping only the final result is a common and expensive mistake.

Small molecules: HPLC, GC, dissolution, particle size, and water determination all need the original chromatogram, integration parameters, sequence file, and instrument log. Impurity chromatograms keep baseline, peak shape, retention time, and integration untrimmed. Dissolution keeps the full curve and the raw readings at each time point. Assay and related substances keep every injection: blanks, standards, samples. Filing away only the passing chromatograms is data selection, and inspectors check for exactly that.

Biologics: higher bar. Electrophoresis, characterization chromatograms, bioactivity, immunology, microbiology, and sterility logs all stay in original form. Characterization, aggregates, charge heterogeneity, and glycosylation keep the raw output and analysis parameters rather than a tidied figure. Potency needs the full dilution series, the fitted curve, and raw readings so the activity can be recalculated by someone else. Sterility, endotoxin, and microbial limits need culture records, raw colony counts, and environmental monitoring.

File by project, batch, and study type with clear numbering so paper and electronic versions map one to one.

Attachments count too: reagent prep logs, standard weighing records, sample handling records, calibration certificates, environmental monitoring, photos, instrument screenshots. A complete notebook with missing attachments is still a broken trail.

How do requirements differ between chemical drugs and biologics?

Small molecules are physicochemical. They repeat well, the data is stable, and impurities behave in recognizable patterns. Records lean on physical and chemical parameters, impurity movement, degradation trends, and control of process and degradation impurities. Drug substance: synthesis parameters, intermediate purity, impurity changes, residual solvents, polymorph, particle size. Drug product: composition, process parameters, dissolution consistency, related substances, container closure compatibility, and every stability time point, with close attention to when degradation impurities first show up and how fast they climb.

Biologics are about activity, structure, and immunological behavior. More variable, more sensitive to environment and technique, harder to record well. Drug substance: cell culture parameters, purification parameters, protein concentration, purity, aggregates, charge heterogeneity, glycosylation, and process residuals like host cell protein and host cell DNA. Drug product: bioactivity, immunological potency, sterility, endotoxin, uniformity, stability decay, and what temperature, freeze-thaw, and storage time do to activity.

Here’s the trap specific to biologics: replicate variability is normal in a bioassay. Record it. Do not quietly average the numbers to make the study look tighter than it was. Everyone in the field knows bioassays move. Pretending yours don’t just makes people wonder what else got adjusted.

Comparability and biosimilarity work needs batch details, comparison conditions, and the originator or reference data, with full head-to-head raw data retained. Generic consistency work needs dissolution curves in each medium, impurity comparisons, and batch-to-batch variation.

Part 4: Writing the study report

What is a study report for?

It’s the final technical summary and the bridge between your raw data and the CTD. It’s what an assessor reads to decide whether the product is controlled, safe, and effective.

Five tests: the data is true, the logic holds, everything is closed out, the conclusion is compliant, and it fits the submission.

How should study data be summarized?

Systematically, not by dumping spreadsheets into an appendix.

State the objective, basis, and protocol content. Describe how the study actually ran. Then classify, analyze, and compare the valid data so the result and any trend are visible. Use tables, figures, and trend charts with consistent precision, units, and significant figures. Inconsistent rounding and missing units look sloppy because they are.

Small-molecule reports lean on the impurity profile, assay stability, dissolution consistency, and physicochemical variation. Stability reports tabulate related substances, largest single impurity, total impurities, assay, dissolution, water, and hardness at each time point, and describe the degradation pattern. Consistency reports put your impurity profile, dissolution curves, and physicochemical data next to the reference and quantify the gap. Validation reports walk accuracy, precision, specificity, linearity, range, robustness, and stability, then say whether the method is fit for purpose.

Biologics reports lean on activity, characterization, uniformity, and stability behavior. New biologics: purity, heterogeneity, potency, process residuals, sterility, endotoxin across drug substance and product, plus batch consistency and process stability. Biosimilars: multi-batch, multi-attribute head-to-head data across structure, activity, physicochemical properties, stability, and batch analysis. Comparability: critical quality attributes before and after a change or site transfer.

Only valid data goes in, and if you excluded data you say why. Every number traces to a raw record and a chromatogram.

How should OOS and OOT results be handled?

OOS means the value exceeded a limit: internal, pharmacopoeial, or comparative. OOT means it passed but drifted away from the normal pattern, or from historical and comparative data.

OOT gets ignored constantly, precisely because it passed. That’s what makes it useful. A value that’s comfortable on its own and wrong relative to trend is often the earliest signal you’ll get.

Six steps: identify, report, investigate, evaluate, correct, summarize. Disclose all of it in the report.

Root cause work goes layer by layer against the raw records, instrument logs, environmental records, and material logs. “Experimental error” is not a root cause. “Analyst error” without naming which step and why is barely better.

Then assess impact. Controllable cause like operator technique or a failing instrument? Invalidate the data, repeat the study, put a corrective action in. Real product behavior like degradation or genuine process variation? Disclose it, and deal with it through process, storage, or specification changes. Investigation records, corrective actions, and verification data go in as attachments.

How do you check consistency across protocol, records, and report?

Consistency across the three is the floor. Five things have to line up: design, procedure, results, acceptance criteria, and conclusion logic.

Procedure first. Does the report’s account of what happened match the approved protocol, amendments and deviations included?

Then data. Check every summarized value against the raw records and instrument output. Transcription errors, rounding drift, and selective data points all live here.

Then criteria and conclusion. The report uses the criteria from the final protocol version. Not an earlier one that was easier to meet, and not a later one you wish you’d set. The conclusion follows the data.

Then check that the phase report, the development summary, and the CTD module agree with each other.

What makes a conclusion defensible?

No absolutes, no vagueness, no inflation. The conclusion sits on the data in front of you, and it includes a risk assessment covering controllability, process stability, and method suitability.

Small-molecule conclusions address process stability, impurity safety, specification soundness, and product consistency. Impurity reports say the profile is understood, known and unknown impurities are controlled, and the limits meet safety requirements. Stability reports state shelf life, storage conditions, and the variation pattern. Consistency reports say whether the product matches the reference and can substitute for it.

Biologics conclusions address molecular uniformity, activity stability, process reproducibility, and similarity: critical quality attributes stable, batch variation controlled, similarity to the originator met.

Add a risk section covering minor deviations, data fluctuation, and process variation, with risk level, controls, and next steps. A report that only ever reports success reads as incomplete, because no study is that clean.

Three review levels before signature: study lead checks the data is real, technical lead checks the science, QA checks completeness and compliance.

A checklist you can actually use

Before the study starts:

• Objective says whether this is exploratory or confirmatory
• References are current and match the registration category
• Sample information supports full batch traceability
• The design is repeatable by someone who wasn’t there
• Acceptance criteria are justified, with OOS and OOT triggers pre-set

During the study:

• Data entered the same day; corrections fully traceable
• Deviations logged when they happen, not during report writing
• Chromatograms and raw files retained untrimmed
• Amendments approved before the affected work continues

Before signature:

• Every number traces to a raw record
• All OOS and OOT results disclosed with closed investigations
• Report matches the final protocol version
• Risk section present
• Three review levels done

There’s one idea underneath all of this. Regulators aren’t really testing whether your product worked. They’re testing whether a stranger could reconstruct what you did from your documents alone, without asking you a single question.

Write like that stranger is reading.