OPRA: Risk-Based Monitoring Software for UK CROs
OPRA is the risk-based monitoring software we build at TRI in Cambridge. Contract research organizations and sponsors use it to assess risk, monitor trials centrally and keep a record of their oversight decisions across every study they run. The platform has three modules: OPRA-RAM for risk assessment and management, OPRA-CM for centralized monitoring and OPRA-SM for subject-level monitoring.
We have worked only on Risk-Based Quality Management (RBQM) since TRI started in 2013. The platform is cloud-based, fully validated and 21 CFR Part 11 compliant, and every risk review leaves a time-stamped audit trail.
That matters more in the UK now than it did a year ago. Since 28 April 2026, the amended UK clinical trials regulations and UK ICH E6(R3) GCP have expected oversight to match the risk of each trial. CROs need to be able to show how they decided where their monitoring effort went.
What is risk-based monitoring software?
Risk-based monitoring software helps clinical teams spend monitoring effort where participant safety and data reliability are most at risk, rather than checking every data point at every site. It is one part of RBQM, which runs from study design through to close-out.
Most platforms cover the same ground. Before the study starts, the team identifies the critical-to-quality factors and the risks to them. They then set key risk indicators (KRIs) and quality tolerance limits (QTLs) or acceptable ranges, with a planned response for each. Once data comes in, centralized monitoring looks across sites and subjects for anything unusual. Signals become actions with an owner, and the system records what was reviewed, what was decided and why.
What UK clinical quality teams need from it
For a CRO, the requirements are fairly practical. Quality leads need a consistent way of assessing and monitoring risk across their studies, while keeping each sponsor’s data separate. Monitoring should come down where risk is low, with less source data verification and fewer site visits. Decisions have to be traceable enough to hold up in an MHRA GCP inspection or a sponsor audit. Set-up can’t delay first patient in. CRAs, data managers and central monitors also have to find the system easy to use, or they will drift back to spreadsheets.
Why UK CROs are rethinking risk-based monitoring in 2026
On 28 April 2026 the Medicines for Human Use Regulations came into force across England, Wales, Scotland and Northern Ireland, together with a UK implementation of ICH E6(R3) Good Clinical Practice. The MHRA and HRA developed the framework, and it is the biggest change to UK trial regulation in 20 years.
For CROs, three parts of it stand out. The regulations now state that monitoring and governance should reflect the level of risk a trial poses. ICH E6(R3) moves GCP away from prescriptive procedure towards a risk-proportionate, quality-by-design approach. E6(R3) also widens quality tolerance limits into “acceptable ranges”, which gives teams more options for controlling risk.
So, a UK CRO now must show sponsors and inspectors that its monitoring is proportionate and properly documented. That is hard to do across a portfolio when the evidence sits in spreadsheets and separate dashboards. Inspections during 2026 and 2027 should show how consistently the new approach is being applied.
Few organizations are starting from scratch. More than 85% of clinical trials now use an RBQM framework, compared with 53% in 2018. Teams faced with too much data and too many dashboards often slip back into traditional monitoring, and that is the problem we set out to fix with OPRA.
What is OPRA?
OPRA stands for Operational Platform for Review, Reporting and Analysis. TRI was founded in Cambridge in 2013. We started the company to make RBQM accessible for trials of any size.
| Module | Role in RBQM |
|---|---|
| OPRA RAM | Risk assessment and management: identify, score, and control risks to critical-to-quality factors. |
| OPRA CM | Centralized monitoring: connect clinical and operational data and surface evolving risk signals. |
| OPRA SM | Subject-level monitoring through patient profiling: bring each participant's data into one view, so reviewers can spot safety concerns, protocol deviations, and data inconsistencies that site-level analysis can miss. |
How OPRA supports risk-based monitoring at UK CROs
CRO clinical operations and quality leaders use OPRA to plan, run and document risk-based monitoring across studies for many different sponsors.
Risk assessment at study start
OPRA-RAM gives every study the same risk assessment method. Quality teams apply it to each sponsor’s protocol, then tailor KRIs and acceptable ranges to that trial’s critical-to-quality factors.
Centralized monitoring
OPRA-CM uses data visualization and statistical modelling to flag sites and subjects whose data look unusual. Central monitors can spot a problem early and send CRAs to the sites that need a visit.
Actions with owners
Each risk signal can be turned into an action with an owner and an outcome. Inspectors want to see that chain: a risk was found, someone acted on it, and the effect was checked.
Audit trails for sponsors and the MHRA
OPRA keeps a time-based audit trail of every risk review and decision. When we first built it, regulators kept finding little evidence that organizations knew whether their actions had worked or had followed their own quality management plans.
One method across the portfolio
OPRA is cloud-based, so new studies can be added without local infrastructure. Using the same method on every study means staff are trained once and sponsors get reports in a consistent format. Over time that should mean fewer unnecessary site visits, earlier detection of data problems and less time spent moving between systems.
How to choose risk-based monitoring software as a UK CRO
If you are comparing risk-based monitoring systems, put the same questions to every vendor, us included.
It is also worth asking each vendor to run a demo on an anonymized past study from your own portfolio. You will see how quickly the platform picks up issues you already know about, and how much work it takes to set up.
| Criterion | Question | Why It Matters for a UK CRO |
|---|---|---|
| End-to-end RBQM | Does one platform cover risk assessment, KRIs/QTLs, centralized monitoring, and actions? | Fewer hand-offs and one audit trail |
| ICH E6(R3) alignment | How does it support critical-to-quality factors and acceptable ranges? | Required under UK GCP since 28 April 2026 |
| Validation and compliance | Is it validated, with 21 CFR Part 11 controls and audit trails? | Needed for MHRA inspection and US-sponsor work |
| Multi-study, multi-sponsor use | Can we standardize methods while separating sponsor data? | CROs run concurrent portfolios |
| Data integration | Which EDC, CTMS, and other sources connect, and how fast? | Determines set-up time per study |
| Usability | Can CRAs and central monitors act without specialist statisticians? | Drives real adoption |
| Data residency and security | Where is data hosted and how is it protected under UK GDPR? | Sponsor and legal due diligence |
| Vendor support | Are implementation and RBQM consultants available in UK hours? | Faster start-up and issue resolution |
Getting started with OPRA
We usually suggest starting with a pilot on a few studies, then rolling the method out once you have results.
- Record your current numbers on two or three active studies, including visit frequency, SDV rates, query volumes and cost per site.
- Pick pilot studies with enough sites and data to show signal detection. Studies from different sponsors make for a better test.
- Set up the risk assessment in OPRA-RAM, defining critical-to-quality factors, KRIs and acceptable ranges for each pilot.
- Connect EDC and operational data to OPRA-CM, then agree how often you will review and when issues get escalated.
- After one or two review cycles, compare the results with your starting numbers, such as issues found, visits avoided and time to action.
- Write the pilot method into your SOPs, templates and training, and use it on new studies by default.
To see how OPRA would work on your studies, book a demo with our RBQM team.
Frequently asked questions
Which risk-based monitoring software do UK clinical quality teams use?
Teams that run risk-based monitoring across several trials usually move from spreadsheets to a dedicated RBQM platform. OPRA, built by TRI in Cambridge, is one of them. It covers risk assessment, centralized monitoring and the documentation of oversight decisions across multiple clinical trials.
Which risk-based monitoring software is best for CROs in the United Kingdom?
It depends on how many studies you run, your sponsor mix and which systems you need to connect. OPRA suits UK CROs that want a validated, UK-developed platform covering the whole RBQM process.
What is the difference between RBM and RBQM?
Risk-based monitoring (RBM) is about directing monitoring activity according to risk. Risk-Based Quality Management (RBQM) is the wider framework. It also includes risk assessment, quality by design, risk control and continuous improvement.
Does OPRA support ICH E6(R3)?
Yes. In OPRA, teams identify critical-to-quality factors, set acceptable ranges, monitor centrally in proportion to risk and record their risk decisions, which is what ICH E6(R3) expects. UK ICH E6(R3) GCP has applied since 28 April 2026.
Is OPRA validated and compliant?
Yes. OPRA is cloud-based, fully validated and 21 CFR Part 11 compliant. Every risk review and decision is recorded in a time-based audit trail.