Clinical study report authoring, explained.

A clinical study report tells regulators what one trial did and what it found

From last patient visit to a signed report, in five steps

1. The trial ends and the database locksVLT-302's database locks on October 2, 2026, with 642 participants' records frozen.
2. Biostatistics delivers the outputs412 files: 186 tables, 142 listings and 84 figures, all produced under the statistical analysis plan.
3. The medical writer writes the reportResults sections and patient narratives, with every number copied from an output and checked against it.
4. Reviewers comment and outputs changeStatistics, the medical monitor and the clinical team review. On October 6, four outputs are run again and eight quoted numbers move.
5. People sign, and the report goes to regulatorsEach owner approves their part, the responsible physician or investigator signs, and the report joins the application.

Step 3 and its loop with step 4 are the subject of this guide. The study, people and figures in this example are fictional.

The 1995 guideline, the thin text and two more CSR surprises

TLF, database lock, re-cut and patient narrative defined

Fourteen terms are defined in the one-page summary.

ICH E3 sections: what each part of a CSR holds and who writes it

In shortA CSR has sixteen sections. Medical writers draft the text in Sections 1 to 13 and 15. Section 14 holds the statistical tables and usually the narratives, and Section 16 holds the appendices. Most of the pages are outputs, and most of the writing effort goes into Sections 10 to 13, where every sentence rests on those outputs.

Hamilton's guide to CSR authoring, written for the European Medical Writers Association (EMWA), splits the report in two: a "text part" written by the medical writer, and appendices that are assembled.6 E3 itself says the report "should not be derived by simply joining a separate clinical and statistical report".2 The early sections, such as study design and statistical methods, are largely adapted from the protocol and the analysis plan and can be written before the final outputs arrive. The later sections wait for final outputs.

Why your company's clinical study report template differs from ICH E3's numbering

Sponsors build their own templates around E3, and E3 allows it. The guideline's own introduction, quoted in the Q&A, says "the specific sequence and grouping of topics may be changed if alternatives are more logical for a particular study".3 The Q&A warns that reading E3 "as a rigid template can result in presentation of redundant and suboptimal information".3 So one company's 11.4.3 may hold subgroups, where E3 discusses them under 11.4.2.8.

Two public efforts try to reduce the variety. CORE Reference, a free content guide developed from 2014 to 2016 by writers' associations, describes itself as "a content guidance tool and not a template". TransCelerate, a biopharmaceutical alliance, released a CSR template in November 2018.7

The rules for a clinical study report as of November 2026, from ICH E3 to E6(R3) Annex 2

In shortThe content rule is still ICH E3 from 1995. What moved recently sits around it. Good clinical practice (GCP), the international standard for running trials, was rewritten as E6(R3), and its Annex 2 takes effect in the EU on January 15, 2027. The US Food and Drug Administration (FDA) finalized its electronic records guidance in October 2024, and regulators have published their first positions on AI. Under all of them, people remain a report's authors.

Who signs the CSR signature page under ICH E3 and in the EU

When a report is signed electronically, Part 11 says the signature must show the signer's printed name, the date and time, and its meaning, "such as review, approval, responsibility, or authorship", and must be linked to its record so it cannot be copied to another.13 Part 11 does not itself say what happens when a signed record changes, so your procedure has to. The safe rule is that a changed section goes back to its signer.

How a number travels from the statistical analysis plan into a CSR sentence

In shortEach number in a report has a history: a rule in the analysis plan, a calculated value in a dataset, a program, a run, a cell in an output, and then a sentence typed by a person. Most of that chain is controlled and double-checked by programmers. The last step, from cell to sentence, usually leaves no link behind.

A recent scoping review, a preprint not yet peer reviewed, says a typical Phase III trial needs 200 to 500 TLFs, each validated by independent double programming, where a second programmer reproduces it separately, at 1.6 to 2.0 times the primary effort.1 Programmers usually produce those files with statistical software.6 Output files carry their history in footers: the source dataset, the program name, the run date and time.

The study documents a CSR writer needs open at once

Why CSR tables are hard for software to read

Output tables exist to be read by people. The standards body CDISC says analysis results such as tables and figures are usually not produced in a form computers can read, which is why it released its Analysis Results Standard, version 1.0, on April 19, 2024.20 Upstream, ICH adopted the M11 structured protocol at its November 2025 meeting.21 Both treat results and plans as data. Most reports written in 2026 still begin with hundreds of files laid out as pages.

Checking a CSR number: rounding, populations and a 74.6% PASI improvement

In shortA number in a report is right only if it has the right value, rounding, population, row and column, and still matches the latest output. A proofreader can sometimes spot the first two. The worked case shows how one rounding rule for one participant moves eight numbers.

How one participant moves eight numbers in the VLT-302 report

In the fictional VLT-302 trial, a participant counts as a PASI 75 responder when their score improves by at least 75% from baseline. The percentage improvement is (baseline score − Week 16 score) ÷ baseline score × 100. Participant 302-0915-0137 improved by 74.6%. The first program rounded that to 75 before testing it, so the flag said responder. The analysis plan, Section 9.2, says to test the unrounded value, so the correct flag is non-responder.

Placebo is unchanged: 11 ÷ 214 = 5.14%, printed as 5.1. The table prints the treatment difference as 57.3, and its footnote says this is a stratum-adjusted Mantel-Haenszel difference, a method that compares the arms within groups of similar participants (strata) and then combines the results. So a reader cannot rebuild it reliably from the printed rates, which is why a writer quotes the cell. One person sits in several analyses at once, so the fix travels:

Fictional example. Multiple imputation estimates missing results statistically, the per-protocol set counts participants who followed the protocol closely enough, and biologic-naive participants have never had a biologic drug. Testing a threshold after rounding is a known kind of programming error; we found no public figure for how often it happens.

Five ways a CSR number goes wrong, and which check finds each

A QC specialist writing in EMWA's journal describes the two halves of the job: checking "against source data" and checking "for consistency", and warns that proofreading software "will not identify issues with analytical statements or incorrect data".22 A published account of the routine runs in order: format first, then numbers in the tables, in-text tables and text, then conclusions and the synopsis against the report.23

Population and column errors are the dangerous pair. The number is typed correctly and answers a different question. A check that asks only "does this value appear somewhere in the table?" passes both.

Patient narratives in a CSR: what ICH E3 12.3.2 asks for each participant

In shortE3 asks for a brief narrative of each death, each other serious adverse event and other significant events of special clinical interest. A report can need a thousand or more. Each draws on many listings, so the risk is a wrong date or a missing fact, and the rule is to ask the site, the hospital or clinic that treated the participant, when something is missing.

A narrative is one participant's story around one event, written so a reviewer does not have to piece it together from listings. E3 says narratives can sit in the text or in section 14.3.3, "depending on their number", and that events clearly unrelated to the test drug "may be omitted or described very briefly".2

Medical writers at one large contract research organization (CRO), a company hired to run trial work, report that the number in one report "can be as high as 1000 or more", depending on the phase of the trial.24

Eleven facts every serious-event narrative should carry under E3

The left column follows E3 section 12.3.2, grouped; the right column is common practice, and your listing numbers will differ.2

How narrative writing moved from copy and paste to templates

Writers at the same CRO recall that they "used to spend a huge amount of time simply copying and pasting data from multiple sources", and that every hand-entered value then needed a full check. Their next step was templates populated by programmers from the clinical data, which brought consistency, and the template and its output still need a QC check. They see AI as the next step, with manual review still required.24

What a re-cut does to a drafted CSR, and why finding the damage takes days

In shortOutputs get run again after lock when independent checks or reviewers find something. Each re-run can change numbers already quoted, sometimes in signed sections. By hand, the safe response is to go back through every section that quotes the output.

Outputs change after delivery for ordinary reasons. Independent programming finds a problem in how a value was calculated. A reviewer's question exposes a footnote or population that needs correcting. A data query closes late. EMA's inspectors list among CSR findings "Insufficient data cleaning resulting in data changes detected only after primary analysis".25

What a CSR team does by hand when a table is run again

1. Someone tells the writer, usually by email, which outputs changed and why.
2. The writer compares old and new files to find the cells that moved.
3. The writer searches the report for every place those outputs are quoted, including in-text tables, the synopsis and the conclusions.
4. Number QC runs again on those sections, because nobody can prove the rest was not touched.
5. Signers are told, and anyone who approved a changed section reviews and signs again.

The hidden cost is uncertainty. If the VLT-302 team could prove that 17 of the 25 numbers still match, nobody would need to read them again. Without that proof, careful teams re-check them all. Hamilton's survey found a range of 3 to 120 working days from first draft to final, and she suggests the number of review cycles may explain it.6 A re-run during review can add to those cycles.

How clinical study reports go wrong: inspection findings, warning letters and reviewers' complaints

In shortRegulators see report quality directly. Reviewers say poor documents slow them down, EMA's inspectors write findings against CSRs and the data management behind them, and FDA has cited a report that stated planned doses in place of the doses actually given. We found no public study that measures how often a CSR carries a wrong number.

The same survey, run by a working group of the American Medical Writers Association, found that 77% agreed poor quality will delay approval of applications that are ultimately approved, and 53% said they send back or reject over 10% of applications with questions arising from poor documents. The authors add that poor quality has the potential "to bias reviewers against subsequent submission documents".26

The CSR findings EMA's GCP inspectors listed for 2024

• "Deficient quality control of the CSR".25
• "Incomplete or inaccurate reporting of protocol deviations and key data in the CSR".25
• "Insufficient data cleaning resulting in data changes detected only after primary analysis".25

When a CSR states what was planned in place of what happened

In a warning letter dated November 27, 2024, FDA found that a sponsor's CSR "reported dose levels for subjects as stated in the protocol", although mislabeled drug meant sites gave 80% of the protocol-required dose between March and June 2021. FDA cited 21 CFR 314.50(d)(5)(iv) on the description and analysis of controlled clinical studies.

Separately, the letter says that after electronic data were deleted, FDA "cannot verify the accuracy, consistency, and completeness of study data" collected on critical electronic outcome assessments.27 That is a serious case with serious causes, well beyond a typing slip. It shows what regulators hold a report to: what happened, traceable to its records.

When a CSR becomes public: the EU database, EMA Policy 0070 and Health Canada

In shortA report written for reviewers may later be read by anyone. For a trial meant to support a marketing authorization, the EU's approval to sell a medicine, the EU requires the CSR in its database within 30 days after authorization is granted, the procedure is completed or the application is withdrawn. EMA publishes clinical data for new active substances, and Health Canada releases study reports too. So a CSR's narratives and numbers have to be fit for public eyes after anonymization.

The practical lesson for authoring is to write with redaction in mind. Short, factual narratives with participant numbers and study days are easier to anonymize than ones full of dates and locations. Every value that appears in both the registry entry and the report is a value someone has to keep the same, and a re-cut can reach both.

How long a CSR takes after database lock, and what a day of delay is worth

In shortThe one public stage-by-stage benchmark we found adds up to about 74 working days from lock to a final report for a moderately complex Phase 3 study. A third of that passes before the writer has final tables, and the first draft takes under a quarter. The range is huge, so your own last six reports will predict your next one better than any average.

Hamilton collected these figures from 75 to 78 professionals at eight EMWA workshops, and her conclusion is plain: "There are no industry standard durations for analysis and reporting tasks".6 Review took 2.6 cycles on average, with a range of 1 to 5.

Before any of this, a survey of 257 companies by the Tufts Center for the Study of Drug Development put the wait from last patient's last visit to lock at 36.3 days.31 A 2026 webinar page says the gap from lock to TLFs "commonly takes four to six weeks",32 which matches the survey's 24.5 working days.

What the 2026 lean authoring review says about speed

Medical writing leaders from eight large sponsors list enhanced efficiency and cost-effectiveness in preparing documents, and more efficient regulatory reviews, among the benefits of lean authoring.8 The abstract gives no timing figures, and the review rests on its authors' own experience. Use your own history as the baseline, and test a leaner template against it.

What a day of CSR delay costs, if the report holds up the filing

Those dollar figures apply only when the report is what holds a filing back. FDA's integrated summaries of effectiveness and safety, filed under 21 CFR 314.50(d)(5)(v) and (vi), combine data from several studies,35 so in practice a late report on a trial meant to support approval, called a registrational report, can hold up the summaries that depend on it. A Phase 1 report that no filing is waiting on carries none of that value.

How many clinical study reports the industry writes

We found no public count of CSRs written each year, and no public figure for what the writing costs. Market research estimates for all medical writing in 2025 disagree: Mordor Intelligence says $3.94 billion and Reports and Data says $5.43 billion, using their own definitions and no published dataset.37,38 At the far end, FDA's drug center approved 55, 50 and 46 novel drugs in 2023, 2024 and 2025, each resting on clinical study reports.39,40,41

AI-drafted clinical study reports: what FDA, EMA and the EU AI Act say in 2026

In shortWe found no rule that forbids an AI-drafted first draft. FDA's draft guidance leaves drafting out of its scope only where it does not affect the reliability of results. EMA expects close human supervision of generated text in a neighboring area. The sponsor stays responsible, people stay authors and signers, and any tool has to be validated for its use.

What published tests of AI CSR drafting show so far

The evidence is early and narrow. About 90% is a strong result for one narrow kind of report, but a quality score is an average over a document, and a CSR can fail on one number from the wrong population. The authors of that study are current or former employees of the one drug company where the method was developed, and we read the abstract only.48

Checkers need testing too, and the preprint's figure shows how rarely anyone has measured them. A sound test of a drafting tool plants known errors in a copy of a completed study and counts what the checks catch.

Decisions that stay with the medical writer and the statistician

• Which results matter, and how the report describes them. "Small" or "moderate" is a judgment, and so is "consistent across subgroups".
• Whether a sentence is a fair reading of the table it quotes.
• Any interpretation at all: Hamilton says presentation of results must be factual, with interpretation kept to the discussion.6
• Who is accountable. E3 names authors and signers, and Part 11 ties a signature to one person.2,13
• When unblinded data, which show who received which treatment, may be seen. No person or system should read unblinded outputs before lock.

How CSR teams work today: medical writer, statistician, medical monitor and the hand-offs

In shortA lead medical writer sits at the center of five or six people, moving text between them while statisticians own the numbers and physicians own the medical judgment. Sponsors write in house, outsource to a CRO or freelancers, or add software. Most of the calendar goes to waiting, checking and reconciling comments.

Medical writer to clinical lead: who touches a CSR

Six hand-offs between database lock and a signed CSR

Where the writing weeks go on a CSR done by hand

In-house writers, outsourced CSRs or CSR software

The VLT-302 report: 412 outputs read, 8 stale numbers found and one signature withdrawn

In shortThis is the example from the top of the page, inside the product. Five AI agents, each a program with one job, read the outputs and draft the sections. Dr. Maya Chen, the lead medical writer, opens a number at its cell. When biostatistics re-cuts four outputs, one click finds the eight numbers that moved. She updates five sentences, and Omar Haddad's signature on the subgroup section is withdrawn until he signs it again.

1

Database lock: 412 outputs become 9,840 addressable cells

The database locks on Friday, October 2, at 6:31 p.m., and biostatistics delivers 186 tables, 142 listings and 84 figures. The output reader reads them in 49 minutes and indexes 9,840 cells, each with its row, column, population and program run.

The Outputs screen is the record of every delivery. Each output shows which sections quote it and how many of its numbers they use. The screen's own line says it plainly: these are the only place a number in the report may come from.

2

Click 62.4% and Table 14.2.1.1 opens at its cell

By Tuesday morning the results writer has drafted the results sections and the narrative writer has drafted 53 narratives. Maya opens Section 11.4.1. The draft is set like a report page, with the tables it quotes beside it.

She clicks 62.4%. The table opens at the row PASI 75 responders and the column Veltrimab 150 mg (N=428), and a dashed line joins the number to the cell: 267 (62.4). The footer names the dataset, the program and the run.

3

Biostatistics re-cuts four outputs, and one click checks the text

At 10:44 a.m. a banner appears. Dana Okafor's independent programming QC found the PASI 75 flag was set on a rounded improvement, and four outputs were re-run at 10:31 a.m.

Maya clicks "Check the text", and the number verifier works through it on screen: read the re-cut outputs, compare cell by cell with delivery 1, find every sentence that quotes a changed cell, re-check the other numbers, flag for the writer. Eight of 38 cells changed, all in the Veltrimab column.

4

Eight numbers flagged, old and new side by side

Every sentence that quotes a changed cell turns amber, with the old value struck and the new one beside it. In the table, the changed cells show the same. 62.4% becomes 62.1%, 57.3 becomes 57.0, and the confidence interval moves from 51.9, 62.6 to 51.7, 62.3.

Nothing changes until a person accepts. Approval and export stay held while anything is flagged. The re-cut also reaches Section 13, and Section 11.4.3, which Omar signed at 9:40 that morning.

5

One update, and each section goes back to its signer

Maya clicks "Update 5 sentences". Before anything changes, the dialog lists every replacement by section and says what happens to each: 11.4.1 goes from In review to To review, 11.4.3 from Approved to To review, and Section 13 stays To review.

She confirms. The change becomes version 0.3, every number matches its cell again, and Section 11.4.3 reads "signature withdrawn by the re-cut". The report drops from 5 of 11 sections approved to 4 until Omar signs again. Nobody signs anything on anyone's behalf.

The solution's design targets are 5 days from database lock to a first full draft, 100% of numbers linked to their table cell, and about 2 minutes to find every sentence a re-cut changed. They are targets, to be measured in the live solution and on your own reports. The sample dashboard shows 4 days for this study against the fictional team's 68 days by hand.

Fourteen more CSR screens, from the signed subgroup section to your sign-off rules

In shortOne re-cut is the story. These screens show the rest: the signed section the re-cut reached, the number check, the safety section and its listing row, the narratives and their sources, a query to a site, the outputs, the dashboard and the settings. The sample uses its own house template, so its 11.4.3 holds subgroups, where ICH E3 discusses them under 11.4.2.8.

Select any screen to open it larger. The study, people, participants, sites' data and figures are fictional sample data.

Five CSR agents read, draft and check, while a biostatistician, monitor, writer and clinical lead sign

In shortEach agent has one job and limits it does not cross. They draft, check and propose, and they never approve or sign. Sections go to named people by type, so every draft meets a second pair of eyes. A changed section returns to its signer, and every version, delivery and step is kept.

Output reader to template checker: the five report agents

Who signs which section of the sample report

Each approval is an electronic signature with its meaning, recorded with name, date and time. The agents that draft never sign, and sections go to named approvers by type, so a second person reviews every draft (four-eyes review). These controls support your compliance with 21 CFR Part 11 and EU expectations for computerized systems; your organization validates the system for its intended use. Botminds is SOC 2 Type II audited, and manages information security to ISO 27001.

The writer, statistician and monitor in the VLT-302 screens

From locked TLFs and your CSR template to drafted sections, narratives and a number-to-cell trace

In shortThe solution reads the outputs biostatistics already produces, writes into your own template, and leaves behind drafted sections, cited narratives and a trace from each number to its cell, with every re-cut on record. The finished report goes out to Word. Your statistical and document systems stay where they are.

Systems a CSR authoring rollout connects to

The design includes roles and separation of duties, maker-checker sign-off, a complete audit trail you can export, connections to the systems above, and scale across studies and CROs.

What hand-copied numbers and late CSRs cost your medical writing team

In shortStart from your own reports. We found no published figure for what a CSR costs or how often one carries a wrong number, so the numbers that matter are in your timesheets and delivery logs. A few published figures frame them: how long the stages run, what reviewers say about quality, and what a day means when a report holds up a filing.

Pulling a baseline from your last six clinical study reports

The CSR costs that no timesheet shows

What CSR automation returns once you count hours, re-cuts and supervision

In shortPut in your own numbers. The calculator values two things you can measure: hours per report and hours per re-cut. A day off a filing can dwarf both, so it appears on its own line and stays out of the total. Every default is an assumption to replace, except the published average for a day of sales.

Number copying, re-cuts and review: where CSR hours come back

Work out your CSR return from reports a year, hours per report and re-cuts

At these defaults, a team writing eight full reports a year roughly breaks even on hours alone, so the case depends on what you do with the time and on reports with a filing behind them. A team writing a dozen short Phase 1 reports on lean templates may save too few hours per report, and should work that out before buying anything.

How ready your medical writing team is for CSR automation: outputs, templates, signers and validation

In shortPick the answer closest to your team today. Eight questions score 0 to 2, and the last is for reflection. The meter adds up your score as you go, and each question says why it matters and what a strong answer sounds like.

A low score usually means settling your CSR template first

What to ask CSR software or a medical writing vendor about numbers, re-cuts and signatures

In shortAsk every vendor the same questions, us included. The answers show how the draft is built: what it reads, whether a number can exist without a source, what happens when an output changes, whose template applies, and how you would measure it on your own study.

Which clinical study reports to automate first

Replay a completed CSR before you buy: a six-step test with planted errors

In shortPull your baseline, replay a completed study with errors you planted, then run one live report in parallel and decide with three numbers. None of these steps commits you to a vendor, and the same test measures your current process.

1. Time your last six reports, by stage and by role. Count re-cuts and late corrections.
2. Choose a completed study where outputs were re-run after lock, and freeze every delivery as it left biostatistics.
3. Plant known errors in a copy: wrong populations, swapped columns, stale values, a deleted listing row, a missing narrative fact. Keep clean copies too.
4. Replay it delivery by delivery. The signed report is useful for comparison, but the cell is the answer key. You may also find places where the signed report was wrong.
5. Run one live report in parallel, with your people signing everything.
6. Decide with three numbers: catch rate by error type, false alarms on clean copies, and hours to a signed section.

Catch rate, false alarms and writer hours for each planted error

Clinical study report questions answered: ICH E3, timelines, signatures, narratives and AI

In shortCommon questions from writers, statisticians and buyers, each answered on its own.