Audit Trails for Recruitment: What Monitors Expect to See

Sites keep meticulous trails for study data and then run recruitment through personal cell phones and untracked inboxes. That gap is getting noticed — by monitors, IRBs, and occasionally by regulators.

What "auditable recruitment" means

For any given participant, the site should be able to reconstruct:

• Where they came from — the source, and which IRB-approved material they saw.
• Every contact — calls, texts, emails, and voicemails, timestamped and attributed to a staff member.
• Consent for the outreach itself — permission to contact, channel preferences, and any opt-outs, with dates.
• What they were told — approved scripts and templates in use at the time, retrievable by version.
• The pre-screening record — questions asked, answers given, and the eligibility determination.

If a participant later says "I never agreed to be texted," or an IRB asks which ad version a cohort saw, the answer should be a lookup, not an archaeology project.

Common findings and their fixes

Personal-device messaging. PHI on unmanaged phones, invisible to audit. Fix: route all participant messaging through logged, site-controlled systems — and make the policy explicit.

Undocumented verbal exchanges. The screening call happened; nothing was recorded about it. Fix: structured call logging with required fields, not optional notes.

Unversioned materials. The flyer was updated twice; nobody can say which version ran in March. Fix: version numbers on every material, retirement dates logged.

Orphaned opt-outs. The patient opted out in the texting tool but remained on the call list. Fix: one system of record for contact permissions, honored everywhere.

The upside

The same infrastructure that satisfies an auditor — complete histories, logged consent, template discipline — is what makes recruitment operationally good. Compliance and performance, for once, point in the same direction.