An audit report is the written evaluation of the results of an audit by the sponsor’s auditor. It documents the observations and findings of an independent review of trial-related activities, documents or systems. Its purpose is to traceably evaluate whether processes are suitable to support compliance with the protocol, GCP and the applicable regulatory requirements.
Function, content and follow-up measures
An audit is independent of routine monitoring. It systematically investigates whether the reviewed processes and controls are effective and compliant. The audit report records the result of this evaluation. According to ICH E6(R3), observations and findings of the auditors must be documented; the sponsor’s requirements must also cover the form and content of the report. The report is thus a result document, not merely a visit note or a list of open points.
The specific structure depends on the documented procedures of the audit program and the subject of the audit. A robust report states the scope and period of the audit, the documents and activities reviewed, the facts established and their relation to the relevant requirements. It separates traceable facts from the assessment. Classifications such as “critical”, “major” or “minor” can be used, but are not specified by ICH as uniform categories; the quality system of the respective sponsor is decisive.
An audit report creates the basis for investigating root causes and planning appropriate corrective and preventive actions, CAPA for short. The report itself, however, is not the CAPA plan. After the finding, responsibilities, timelines, evidence of implementation and the verification of effectiveness must be managed separately. A rapidly closed action is not automatically effective if the root cause persists or comparable processes continue to be deficient.
The addressees receive only the information they need for their role. For audited personnel, objective communication of relevant findings and expected actions is important. The independence of the audit must not be lost in the process: auditors do not evaluate their own operational decisions. An audit report also does not replace monitoring. Monitoring accompanies the conduct and continuously checks data or processes, for example; an audit independently evaluates the quality and control system or defined parts thereof.
Differentiation from audit plan and inspection report
The audit plan is a forward-looking planning document. Based on risks and priorities, it determines what, when and how to audit. ICH E6(R3) requires documented procedures on the audit subject, method, frequency, and form and content of audit reports. The plan guides the audit; the audit report records the results after the audit. Therefore, both documents must not be confused in content or in their approval logic.
An inspection report, on the other hand, is generated during an official inspection. The inspection is an official review by the competent authority and differs in mandate, sovereign authority and reporting line from the sponsor audit. To maintain the independence of the audit function, authorities should not routinely request audit reports. ICH E6(R3) provides for access on a case-by-case basis when there is evidence of serious GCP non-compliance or when required by legal proceedings. Where legally required, an audit certificate can provide evidence that an audit has taken place instead.
Confidentiality and traceability
The special treatment of the audit report protects the independence and value of the audit function. Confidentiality does not mean that findings remain without consequence or that relevant safety and quality problems may be hidden. Necessary escalations, CAPAs and notifications must be made according to applicable procedures. Rather, confidentiality limits the routine provision of the complete internal assessment document and the circle of persons with access.
At the same time, the essential documents and source data underlying the conduct of the trial must be available for monitoring, audit and inspection. An audit report is not to be equated with these audit-related original documents. During an inspection, the organization may therefore not generally refer to confidentiality to deny access to required trial documents. The separation between audited evidence, audit report and inspection report preserves both transparency and the function of the quality system.
Relevance for clinical trials
A precise audit report makes risks and weaknesses of the quality system traceable and enables appropriate prioritization of measures. It is particularly valuable when it clearly delineates the reviewed scope, links observations with evidence and explains the significance of a finding without exaggeration. It is not an instrument to hand over operational responsibility to quality assurance, but an independent impulse for its effective steering.
Full-service CROs such as Mediconomics support through prepared quality processes, audit readiness, document control and the coordinated follow-up of CAPAs. They can organizationally accompany audit programs and involve relevant teams from clinical operations, data management, pharmacovigilance and project management without removing the required independence of the auditors from the audited activities.
Frequently Asked Questions (FAQ)
Is an audit report an audit plan?
No. The audit plan prospectively describes the selection, scope and approach of planned audits. The audit report documents the assessment, observations and findings after the audit is completed.
Must an audit report be submitted during every inspection?
No. ICH E6(R3) states that authorities should not routinely request audit reports. Access can occur on a case-by-case basis if there is evidence of serious GCP non-compliance or in legal proceedings.
Does an audit report replace the processing of CAPAs?
No. The report documents the audit findings. Root cause analysis, actions, timelines and the verification of effectiveness are managed in a separate, controlled CAPA process.
Regulatory references
- ICH E6(R3) Good Clinical Practice — independent audits, documentation of findings and handling of audit reports.
- Regulation (EU) No 536/2014 on clinical trials — inspections and compliant conduct of clinical trials.
- EudraLex Volume 10 — guidelines and application documents for clinical trials in the European Union.