Good Clinical Practice (GCP) audits sit at an uncomfortable intersection: they are simultaneously the least visible and most consequential quality activity in a clinical trial’s lifecycle. A sponsor’s internal audit program rarely makes headlines, but its absence — or its shallowness — tends to surface unmistakably the moment a regulatory inspector walks in. Between 2017 and 2023, the FDA completed 2,836 review-based routine GCP inspections in support of Center for Drug Evaluation and Research (CDER) marketing applications alone, with 81.2% resulting in a final No Action Indicated (NAI) classification, 18.5% Voluntary Action Indicated (VAI), and 0.3% Official Action Indicated (OAI).
Encouragingly, the proportion of inspected establishments that were issued a Form FDA 483 fell steadily over that period — from 23.5% in 2017 to 10.4% in 2023 [1]. That downward trend tracks with an industry that is auditing itself more rigorously before regulators arrive, rather than treating inspection readiness as a fire drill. This piece sets out what a GCP audit actually examines, where audits and inspections most often surface trouble, and a practical, checklist-driven approach to preparation — updated for the ICH E6(R3) guideline that came into effect through 2025 and 2026.
Audit vs. Inspection: A Distinction Worth Keeping Straight
The terms get used loosely, but the mechanics differ. A GCP audit is a systematic, independent review conducted by or on behalf of the sponsor — typically by a dedicated quality assurance (QA) function or a specialist CRO partner — to verify that trial-related activities and documentation comply with the protocol, applicable standard operating procedures (SOPs), GCP, and regulatory requirements. It is a sponsor-controlled, proactive exercise. A regulatory inspection, by contrast, is conducted by a competent authority — the FDA’s Bioresearch Monitoring (BIMO) program, the EMA and its member-state inspectorates, MHRA, PMDA, Health Canada, or others — and its findings carry direct regulatory consequences for a marketing application or an ongoing trial.
Monitoring is a third, related but distinct activity: it is the ongoing, trial-level oversight of site conduct and data, usually performed continuously rather than as a periodic systems check. Audits sample across monitoring, site, vendor, and TMF performance to test whether the oversight system itself is working — which is precisely what an inspector will also be testing, just with more at stake.
The Regulatory Backbone Behind GCP Audits
ICH E6(R2) has functioned as the baseline international standard for GCP since 2016, and most current SOPs, audit checklists, and CRO quality systems are still built on its structure. That baseline has now been substantially updated. The ICH adopted the revised guideline, ICH E6(R3), in January 2025; the EU’s overarching principles and Annex 1 came into effect on 23 July 2025 following CHMP adoption, and the FDA issued its final Level 1 guidance implementing E6(R3) on 9 September 2025.
A second component, Annex 2 — covering pragmatic and decentralized trial designs and the use of real-world data — reached ICH Step 4 in June 2026 and CHMP adoption later that month, with an EU effective date of 15 January 2027 [2]. For sponsors and CROs running multi-region trials, that staggered timeline means audit programs need to accommodate two overlapping GCP frameworks for some time yet.
The E6(R3) revision does not replace the core GCP principles so much as re-weight how compliance is demonstrated. It formalizes a proportionate, risk-based approach to quality management — often shorthanded as “Critical-to-Quality” (CtQ) factors — and puts new emphasis on documented rationale: sponsors are expected to keep clear records of the decisions, risk assessments, and reasoning behind their oversight approach, not just evidence that oversight happened. Training requirements now explicitly extend to personnel at CROs, sites, and other service providers, not solely sponsor staff. Auditors should expect these expectations to appear in inspection checklists well before every annex is finalized, on a region-by-region basis.
Cross-agency collaboration also shapes what “audit-ready” means in practice. FDA and EMA have jointly conducted GCP inspections since 2009, and the two agencies’ inspection programs continue to feed a shared body of findings through mechanisms such as the GCP Inspectors Working Group (GCP IWG). Sponsors preparing for a single-agency inspection are, in effect, preparing against a broader, harmonized set of expectations.
Where Audits and Inspections Actually Find Trouble
Preparation is most effective when it targets where deficiencies actually cluster, not where an audit program assumes they will. A comparative analysis of 49 concurrent FDA and EMA inspections found that for FDA, the most common findings were Protocol Compliance issues at clinical investigator sites and Trial Management issues at sponsors and CROs; for EMA, Documentation deficiencies — including Trial Master File (TMF) gaps — were the leading finding category at both site and sponsor/CRO level.
Concordance between the two agencies was high: roughly 90% agreement on Protocol Compliance and Trial Management findings, and about 70% agreement on Documentation findings [3]. More recent data reinforces the same pattern. An analysis of the 2025 GCP IWG report found that inspections concentrated in the EU/EEA (34%), Asia (28%), and North America (18%), with investigator sites accounting for 69% of inspections and sponsors 25%; General, Trial Management, and Investigational Site findings were the top three categories, with recurring gaps in documented delegation of duties to service providers and in direct-access provisions for source records [4]. At the site level, failure to follow the investigational plan or protocol remains the most-cited category across FDA clinical-investigator inspections, followed closely by inadequate source documentation and informed consent deficiencies [5].
| Deficiency category | Most common at FDA inspections | Most common at EMA inspections |
| Protocol compliance | Leading finding — clinical investigator (CI) sites | High concordance with FDA (~90%) but secondary to documentation |
| Trial management | Leading finding — sponsor/CRO inspections | High concordance with FDA (~90%) |
| Documentation / TMF | Present, ~70% concordance with EMA | Leading finding — both CI and sponsor/CRO inspections |
| Source documentation & informed consent | Second and third most cited at CI sites | Consistently among leading critical/major findings |
A Practical GCP Audit Preparation Checklist
The checklist below is organized by the domains in which FDA and EMA data show findings are concentrated. It is written as a pre-audit self-verification tool — the questions a sponsor’s QA function, or an outsourced audit partner, should be able to answer with documented evidence before scheduling either an internal audit or anticipating a regulatory inspection.
| Domain | Verify before the audit | Evidence to have on hand |
| Trial Master File | The TMF structure follows the TMF Reference Model; essential documents are complete, dated, and version-controlled; and the TMF is reconciled against the trial timeline, not just a filing checklist. | TMF completeness/health-check reports; open-item log with owners and target dates. |
| Protocol compliance | Protocol deviations are logged, categorized by severity, and supported by evidence of root cause analysis and CAPA — not just recording. | Deviation log with trending; CAPA tracker; amendment history. |
| Informed consent & source documentation | Current IRB/EC-approved consent versions are in use at every site; source data is attributable, legible, contemporaneous, original, and accurate (ALCOA); source-to-CRF traceability spot-checked. | Site-level consent version tracker; source data verification (SDV) sample results. |
| Trial management & oversight | Sponsor oversight of delegated tasks is documented with a clear rationale, not assumed; risk assessments that drive monitoring frequency are current and align with the CtQ approach under E6(R3). | Risk assessment and monitoring plan; oversight meeting minutes; escalation records. |
| Vendor & delegation contracts | Written agreements specify exactly which duties are delegated to each CRO/vendor and confirm the sponsor retains ultimate legal responsibility; direct-access-to-source clauses are present. | Signed task-delegation logs; vendor qualification and oversight files. |
| Computerized systems & data integrity | Electronic systems are validated per applicable guidance; audit trails are complete and reviewed; access controls and e-signature workflows are current. | System validation summary; audit-trail review logs; access-control records. |
| Training & GCP currency | Training records cover sponsor, CRO, site, and service provider personnel — not sponsor staff alone — and reflect the current ICH E6(R3) content. | Training matrix with completion dates and course versions. |
What ICH E6(R3) Changes About Audit Readiness Going Into 2027
Three shifts under E6(R3) are worth building directly into 2026 audit programs rather than treating as a future compliance project:
- Proportionality has to be documented, not just applied. Auditors and inspectors alike will look for a written record of why a given level of monitoring, data verification, or oversight was chosen for a given trial element — the CtQ rationale itself becomes an auditable artifact.
- Training obligations extend across the outsourcing chain. Sponsors are expected to ensure GCP, protocol, and role-specific training for personnel at CROs, sites, and service providers, which shifts training records from a nice-to-have vendor-file item to a core audit checkpoint.
- The framework will remain a two-track system for a while. With Annex 2 not taking EU effect until 15 January 2027, audit checklists covering decentralized elements, pragmatic designs, and real-world data sources need to satisfy both the current baseline and the incoming annex, particularly for trials that will still be active when it lands.
None of this replaces the fundamentals. Protocol compliance, source documentation, informed consent, and TMF completeness remain — by a wide margin — where both FDA and EMA findings concentrate. E6(R3) changes how sponsors are expected to justify and evidence their oversight decisions around those fundamentals, not the fundamentals themselves.
Where Specialist Oversight Fits
The global clinical trial support services market — encompassing the monitoring, quality, and operational functions that audits ultimately test — is projected to grow from roughly USD 28.1 billion in 2025 to USD 42.0 billion by 2031 [6], a trajectory that reflects sponsors’ increasing reliance on outsourced partners for exactly the oversight functions inspectors scrutinize most. That makes the choice of CRO partner and the rigor of its quality system inseparable from a sponsor’s audit readiness. A CRO whose SOPs are already mapped to ICH E6(R3), whose TMF practices follow the TMF Reference Model, and whose delegation contracts are audit-tested in advance shortens the distance between an internal audit finding and a closed CAPA — and, ultimately, between a routine inspection and a clean one.
Frequently Asked Questions
How often should a sponsor conduct GCP audits during an active trial?
There is no single mandated frequency — ICH E6(R3) calls for a proportionate, risk-based approach. In practice, most sponsors schedule at least one system-level audit (of the TMF, vendor oversight, and data management) early in a trial, plus periodic site and vendor audits keyed to enrolment milestones, risk indicators, or protocol amendments, rather than a fixed calendar.
What is the difference between a critical, major, and minor audit finding?
Severity classifications vary slightly by framework, but broadly: critical findings indicate a direct risk to participant safety, data integrity, or regulatory compliance and typically require immediate corrective action; major findings reflect a significant deviation from GCP or the protocol that could affect trial conduct or data reliability; minor findings are isolated, low-impact deviations that still warrant correction and trending.
Does a sponsor audit replace the need to prepare for a regulatory inspection?
No. A well-run audit program reduces the likelihood and severity of inspection findings by catching and correcting issues in advance, but it does not substitute for inspection-specific readiness activities such as mock inspections, inspection response planning, and designated spokesperson training.
How does the TMF Reference Model relate to GCP audit findings?
Because Documentation and TMF completeness are consistently among the top deficiency categories — the leading category at EMA inspections specifically — structuring the TMF around the TMF Reference Model gives auditors and inspectors a predictable, navigable filing structure and makes gaps easier to identify and close before they become findings.
Who should conduct a GCP audit — an internal QA team or an external partner?
Either can be appropriate, and many sponsors use both. Internal QA teams bring institutional context; independent external auditors bring a perspective closer to what a regulatory inspector will apply and are especially valuable for sponsors without a large in-house quality function or for auditing a CRO partner’s own performance.
About AICROS
The Association of International CROs (AICROS) is a global alliance of specialist, small- to midsize contract research organizations headquartered in Bremen, Germany. AICROS member CROs deliver specialist-led service with multinational reach across six core service lines: biostatistics, clinical operations, data management, medical writing, pharmacovigilance, and regulatory affairs — giving sponsors access to focused expertise without sacrificing the coordinated, multi-region delivery larger CROs offer.
To discuss GCP audit readiness, quality system design, or clinical operations support for an upcoming trial, contact the AICROS team at info@aicros.org.
References
[2] ICH E6 Good Clinical Practice — Scientific Guideline, European Medicines Agency
[3] Descriptive Analysis of GCP Inspection Findings from FDA and EMA — NCBI/PMC
[4] New Insight into Risk Mitigation in 2025: An Analysis of the GCP IWG Report — Florence Healthcare
[5] Common GCP Violations & How to Avoid Them — CASRAI
[6] Clinical Trials Support Services Market Size & Share — Mordor Intelligence
Additional guidance referenced: E6(R3) Good Clinical Practice — FDA Guidance for Industry
