FDA Audit Checklist for Clinical Trials

Standard Operating Procedure: FDA Audit Readiness & Inspection Checklist for Clinical Trials

1. Document Control Block

---

2. Executive Summary & Purpose

This Standard Operating Procedure (SOP) defines the institutional requirements, audit mechanisms, and verification protocols necessary to ensure 100% compliance with United States Food and Drug Administration (FDA) regulations (21 CFR Parts 11, 50, 56, 312, and 812) during clinical trials. The purpose of this document is to establish a repeatable, high-precision framework for clinical operations, data management, and site investigators to achieve continuous inspection readiness, mitigate compliance risk, and maintain data integrity.

---

3. Scope & Prerequisites

Scope

This procedure applies to all Phase I–IV clinical trials sponsored, co-sponsored, or managed by Template Registry, including all internal clinical data systems, electronic Trial Master Files (eTMF), Contract Research Organizations (CROs), and clinical investigative sites.

Prerequisites & Required Tools

• Software Systems: Part 11 compliant Electronic Trial Master File (eTMF), Clinical Trial Management System (CTMS), Electronic Data Capture (EDC), and Interactive Response Technology (IRT).
• Hardware/Access: Secure, role-based multi-factor authentication (MFA) credentials for regulatory document repositories.
• Reference Frameworks: ICH GCP E6(R2/R3), 21 CFR Part 11, 21 CFR Part 50, 21 CFR Part 56, 21 CFR Part 312.

---

4. Roles & Responsibilities

---

5. Step-by-Step Procedure

Phase I: Pre-Inspection Readiness & eTMF Audit

• 1.1 Verify that the electronic Trial Master File (eTMF) is complete, indexed, and reconciled against the DIA Reference Model within 5 business days of document generation.
• 1.2 Audit all essential documents for wet-ink or validated digital signatures, clear audit trails, and correct version control.
• 1.3 Confirm that all Protocol Amendments and corresponding IRB/IEC approvals are filed alongside historical versions with explicit effective dates.
• 1.4 Execute a systemic review of the Delegation of Authority (DoA) log to ensure all site staff training records (CVs, GCP certificates, protocol training logs) are current and match actual trial execution tasks.

Phase II: Informed Consent Process & Subject Safety Verification

• 2.1 Cross-reference EDC subject enrollment lists against signed and dated Informed Consent Forms (ICFs) to confirm 100% consent capture prior to any study-related procedures.
• 2.2 Verify that subjects were consented using the most current, IRB-approved version of the ICF, particularly following protocol amendments.
• 2.3 Audit documentation of the consent discussion (e.g., medical record notes confirming time, date, and absence of coercion).
• 2.4 Review Serious Adverse Event (SAE) reporting timelines: confirm all SAEs were reported to the Sponsor within 24 hours and to the IRB/FDA within regulatory windows (7/15 calendar days).

Phase III: Investigational Product (IP) Accountability & Chain of Custody

• 3.1 Reconcile IP shipping manifests, temperature excursion logs, site receipt records, dispensing logs, and final destruction/return certificates.
• 3.2 Verify that storage temperatures for IP and biological samples have been continuously monitored with calibrated data loggers, with zero unaddressed excursions.
• 3.3 Inspect pharmacy/investigational site physical security to ensure restricted access to controlled substances and investigational drugs.

Phase IV: Data Integrity, EDC, and Computerized Systems Validation (CSV)

• 4.1 Ensure all Data Query resolution timelines are within operational thresholds (< 5 business days from query generation).
• 4.2 Confirm that manual data changes in the EDC maintain immutable audit trails showing the old value, new value, timestamp, user ID, and reason for change (21 CFR Part 11 compliance).
• 4.3 Verify that all computerized systems utilized for data capture, randomization, and analysis possess valid Validation Packages (IQ/OQ/PQ) and periodic review logs.

Phase V: Mock Inspection & Auditor Logistics

• 5.1 Conduct an unannounced mock FDA inspection utilizing an independent QA auditor to simulate front-room/back-room dynamics.
• 5.2 Designate and train the Inspection Host, Lead Scribe, Runner, and Subject Matter Experts (SMEs) for the audit front/back rooms.
• 5.3 Prepare the physical/virtual audit war room, ensuring access to high-speed secure scanners, dedicated projectors, and segregated document review stations.

---

6. Quality Assurance & Pro-Tips

Best Practices (Pro-Tips)

• The "Golden Rule" of Audits: If it isn't documented, it didn't happen. Ensure all verbal communications with investigators or monitors regarding safety deviations are backed by email logs or meeting minutes.
• Live System Protection: Never grant an FDA investigator unrestricted admin access to live production databases. Always route data pulls through validated, read-only reporting environments or certified data export packages.
• Daily Debriefs: During an active audit, hold a mandatory 15-minute end-of-day debrief with the internal response team to catalog requested documents, identify emerging compliance gaps, and prep strategy for the following day.

Common Pitfalls to Avoid

• Outdated DoA Logs: Allowing staff to perform clinical tasks before signing the Delegation of Authority log.
• Orphaned Queries: Leaving data queries unresolved or un-reviewed by the PI prior to database lock.
• Excursion Blind Spots: Failing to document a documented temperature excursion mitigation protocol immediately upon discovery.

Metric Thresholds

• eTMF Completeness Index: $\ge 98%$ complete at any given time.
• Query Resolution Rate: $\le 5$ days average turnaround time.
• ICF Compliance: Exactly $100%$ zero-tolerance for un-consented trial procedures.

---

7. Frequently Asked Questions (FAQ)

Q1: What is the protocol if an FDA investigator requests unredacted subject medical records containing Personal Health Information (PHI)?
A: Under HIPAA and the Informed Consent Form authorization signed by the subject, FDA investigators have the legal right to review original medical records containing PHI. Redactions should not be applied to medical records unless explicitly mandated by local privacy laws that supersede federal regulatory authority. Consult Legal Counsel immediately if jurisdictional conflicts arise.

Q2: How should the audit team handle a document request for an eTMF record that cannot be located?
A: Do not fabricate, retroactively create, or back-date documents. Immediately notify the Lead Auditor and Quality Assurance. Log the missing document as a protocol/process deviation, launch an immediate root-cause investigation, and document all search efforts to demonstrate good-faith compliance and transparency to the inspector.