A GCP inspection is a regulatory or competent-authority-commissioned review of whether a clinical trial is planned, conducted, monitored, documented and reported in accordance with the principles of Good Clinical Practice (GCP). The focus is on patient safety, data integrity and the traceability of all trial-relevant processes. Inspections can involve the sponsor, CRO, investigational site, laboratory, data management service provider or archiving service provider.
GCP inspections are not an “audit” within internal quality management but a regulatory oversight measure. Results can range from minor observations to critical findings that can affect the usability of data, the continuation of a trial, or authorisation decisions.
Triggers and types of GCP inspections
Inspections can take place routinely, on a risk basis, or for cause, for example in the event of suspected serious deviations, data anomalies or complaints. They are also often part of authorisation procedures (e.g. to verify pivotal trials or specific investigational sites). In the EU, inspections are coordinated by national authorities depending on jurisdiction (e.g. BfArM, PEI); internationally, FDA inspections are among the relevant ones.
A distinction is made, among others, between inspections at the sponsor (system- and trial-specific), inspections at investigational sites (site inspections) and inspections at outsourced service providers. Remote elements are also common, e.g. document reviews via secure data rooms, supplemented by on-site visits for source documents and infrastructure.
Areas of review: what authorities typically assess
Authorities assess whether the trial complies with the approved protocol and applicable requirements. Typical areas of review include: informed consent, protection of particularly vulnerable persons, delineation of roles and responsibilities between sponsor, CRO and investigational site, qualification of personnel, data flow and data management, handling of protocol deviations, medicinal product safety (e.g. SAE/SUSAR processes), and the completeness of essential documents in the Trial Master File.
At the investigational site, the focus is usually on documentation in the Investigator Site File, the completeness and plausibility of the source data, investigational medicinal product logistics, and the implementation of monitoring. For central systems, the validation of computerised systems and the integrity of the audit trail may additionally be reviewed. In sponsor/CRO inspections, vendor management, evidence of oversight and the control of changes (change control) also come into focus.
Process: preparation, conduct, follow-up
Before the inspection, the parties concerned usually receive notification with scope, schedule and requested documents. In preparation, a structured document package, the appointment of an inspection team, a clear communication line and a realistic “mock inspection” are helpful. It is important that statements are consistent and that documents can be quickly located.
Conduct usually comprises an opening meeting, interviews, document and data reviews, where applicable a walk-through (e.g. storage of investigational medicinal products), and a closing meeting with preliminary observations. Follow-up often involves an inspection report or a follow-up letter with findings, for which CAPA measures and deadlines are expected.
Role of sponsor and CRO
Since many tasks are outsourced, governance is decisive: the sponsor remains responsible, while the CRO is generally responsible for the operational implementation of central processes. An inspection therefore examines whether oversight is documented, whether vendor management functions, and whether responsibilities in contracts, SOPs and delegated tasks are consistently reflected.
For CROs, it is particularly relevant that monitoring reports, query management, training records and process documentation are consistent. Common weaknesses include inadequate documentation of decisions, incomplete follow-up of deviations, or gaps in archiving. A robust “evidence trail” makes it easier to answer detailed questions, particularly when several systems (EDC, eTMF, safety database) are involved.
Typical findings, prevention and references
Common findings include deficiencies in consent documentation, delayed safety reports, missing evidence of qualification/training, inadequate source data verification, and inconsistencies between the eCRF and source documents. Also critical are missing version control of documents, incomplete delegation logs and unclear responsibilities for outsourced activities.
Preventive measures include clear SOPs, risk-based quality planning, an up-to-date Trial Master File, and regular internal audits and quality controls. In the event of deviations, root cause analyses and CAPA measures should be documented and followed up promptly so that they can be demonstrated as effective during an inspection. For inspection readiness, it has also proven effective to design processes to be “inspection-ready”: clear responsibilities, consistent document control, timely filing in the eTMF, and a traceable audit trail across all relevant systems.
Particularly in complex trial landscapes with many service providers, it should be traceable how oversight is practically implemented, for example through documented quality metrics, risk reviews, escalation pathways and decisions on deviations. The training of new team members, the versioning of SOPs and the control of system access are also regularly used in inspections as indicators of a functioning quality management system.
- ICH E6(R3) Guideline for Good Clinical Practice (GCP)
- EU Clinical Trials Regulation (EU) No 536/2014 (CTR)
- EMA / national authorities: GCP inspection programmes and corresponding guidance
FAQ
Can a GCP inspection also take place during an ongoing trial?
Yes. Inspections are not limited to completed trials and can also take place during recruitment, the follow-up phase or data cleaning, particularly for high-risk trials or in the event of conspicuous signals.
What is the difference between an audit and a GCP inspection?
An audit is an internal or commissioned quality review within the framework of quality management; a GCP inspection is a regulatory oversight measure with potentially direct regulatory consequences.
How should findings be translated into CAPA?
What matters is a robust root cause analysis, concrete corrective and preventive actions with responsibilities and deadlines, and evidence of effectiveness. CAPA should demonstrably show how recurrence is prevented.