A computing device generates an audit trail for monitoring clinical data. In particular, the computing device receives clinical data comprising patient data and investigator site data. The computing device accepts and rejects respective portions of the clinical data by applying a risk-based monitoring policy comprising one or more policy rules to the clinical data. The computing device generates an audit trail for the clinical data. The audit trail comprises the clinical data and corresponding audit data. The audit data comprises identification of the accepted and rejected portions of the clinical data, identification of one or more of the policy rules of the risk-based monitoring policy used in the accepting and rejecting of the respective portions of the clinical data, and one or more timestamps corresponding to each of the accepting and rejecting of the respective portions.