FDA & EMA Inspection Questions: 10-Year Data Analysis

This article is a qualitative synthesis of inspection-readiness themes: informed consent workflows, safety-reporting reconciliation, vendor/CRO oversight, and data integrity controls. These are organising themes for preparation, rather than empirically ranked question clusters. The article does not document a reproducible ten-year FDA/EMA GCP dataset, sampling method or original statistical analysis.

For each theme, the following sections map illustrative questions to useful evidence: approved blank informed-consent versions and approvals; safety-event reconciliation records and reportability decisions; contracts, monitoring records and oversight follow-up; and system validation, audit trails and access controls. Keep evidence in the appropriate investigator or sponsor repository and protect participant confidentiality.

Current FDA E6(R3) guidance incorporates flexible, risk-based approaches. Pre-assembled evidence packages are a practical recommendation for organising retrieval and identifying gaps; the article does not establish that they reduce citation rates or guarantee compliant trial conduct.

The conduct of clinical trials is subject to rigorous regulatory oversight in both the United States and the European Union. In the U.S., FDA’s Bioresearch Monitoring (BIMO) program routinely inspects clinical investigators, institutional review boards (IRBs), sponsors, and contract research organizations (CROs) to ensure compliance with Good Clinical Practice (GCP) and applicable regulations (as codified in 21 CFR Parts 50, 56, 312, etc.). FDA Form 483 is titled Inspectional Observations; it records inspector observations and is not a final agency determination of a violation. FDA Form 483 FAQ In the EU/EEA, Member States authorise and oversee clinical trials, while EMA maintains CTIS. EMA explanation of the Clinical Trials Regulation

FDA has issued final E6(R3) guidance. EMA’s E6(R3) Principles and Annex 1 took effect on 23 July 2025. These are current guidance records for this discussion; E6(R2) references in older inspection material are historical. FDA guidance is nonbinding; applicable statutes and regulations remain the legal requirements. FDA E6(R3); EMA E6 status and scope; FDA final guidance.

This report synthesizes regulatory guidance and practical readiness advice. It does not present an original ten-year FDA/EMA inspection study. The chosen themes are not a measured ranking, and FDA and EMA inspection selection and findings cannot be compared without defined years, denominators and comparable site types. Manufacturing GMP non-compliance statements are outside this GCP discussion.

The key themes examined include:

• Informed Consent Workflows: Documentation and control of patient consent, including version control, training, and IRB oversight.
• Safety Reporting Reconciliation: How adverse events are captured and reconciled, with separate assessment of the reporting obligations for each recipient.
• Vendor and CRO Oversight Documentation: Evidence of sponsor oversight of outsourced activities: quality agreements, vendor qualification, monitoring and follow-up.
• Data Integrity Controls: Controls over electronic trial data (EDC, eTMF, eCRF, lab data, etc.) including system validation, audit trails, backups, and access controls.

Each theme is discussed below, followed by a consolidated evidence checklist and hypothetical illustrations. The focus is on preparing relevant records and clear explanations in advance.

This qualitative discussion uses four readiness themes rather than a statistical classification of FDA and EMA findings. It does not estimate the prevalence of deficiencies across inspections or derive inspection outcomes from guidance alone.

• Investigator Responsibilities / Protocol Compliance: Prepare to explain how eligibility, required procedures and investigator oversight were documented.
• Data Integrity: Prepare source records, data-flow descriptions and records of changes for authorised review.
• Informed Consent: Prepare to show approved consent materials, the applicable documentation and any lawful exception, with identifiable participant records under investigator/institution control.
• Safety and Adverse Event Reporting: Distinguish investigator reporting to the sponsor from sponsor expedited reporting to FDA. Under 21 CFR 312.64(b), investigators immediately report SAEs with a causality assessment, subject to the provision for study endpoints. For an individual expedited IND report, seriousness and unexpectedness alone are insufficient: a suspected adverse reaction requires evidence suggesting a causal relationship. Other qualifying safety findings are also covered by 21 CFR 312.32. Investigator reports; FDA IND safety reporting.
• Sponsor and Vendor Oversight: Prepare contracts, qualification evidence, monitoring records and follow-up of delegated activities.
• Site Infrastructure and TMF: Prepare an accurate TMF map, staff qualification records and appropriate access arrangements.

The practical lesson is to organise evidence by likely question area and identify the responsible person and record location before an inspection. The sections below offer examples of this approach; they do not promise that any fixed pack will satisfy every inspector.

What inspectors ask. Inspectors often start a clinical inspection by reviewing informed consent procedures. Typical questions might include: “Show me the signed informed-consent forms (ICFs) for each subject. Were the correct, IRB-approved versions used? How is consent documented? When did each subject sign? If a consent form was amended, how were subjects re-consented? What training did staff receive on obtaining consent? Is there an audit trail showing updates? How do you ensure that someone didn’t start a study procedure before consent?”

Under 21 CFR 50.27, consent documentation ordinarily uses an IRB-approved written form signed and dated by the participant or legally authorised representative, subject to the specified exception. Review the applicable requirements and approved process rather than treating page initials or automatic re-consent as universal regulatory requirements.

Investigator and sponsor evidence

Keep identifiable signed consents and participant-identification records separately under investigator/institution control. Arrange authorised inspector access to those records there. Sponsor/CRO-shared participant information should generally be pseudonymised. The sponsor pack should focus on approved blank consent versions, approvals, implementation records and appropriately pseudonymised oversight evidence. Do not treat assembly of a sponsor TMF as authority to transfer identifiable consents; assess any exceptional disclosure under applicable privacy law. EMA TMF guideline, section 4.1.3.

• Approved blank consent forms. Index the approved versions and amendments, approval letters and implementation dates. Distinguish these blank materials from participant-signed forms retained at the site.

• Signed consent records. Make the applicable signed and dated records available for authorised inspection under investigator/institution control. Retain electronic consent records with the relevant signatures, metadata and audit trails; inspection printouts are convenient extracts, not a substitute for adequate electronic preservation. Computerised systems and electronic data guideline.

• Re-consent documentation. Assess whether new information affects willingness to continue, its relevance to existing participants and their trial stage. Follow the IRB/IEC determination and approved communication process; document the decision, communication and re-consent where needed. Not every amendment automatically requires every active participant to sign again. FDA informed consent guidance; E6(R3), section 2.8.2.

• Consent tracking logs. A subject-tracking worksheet (sometimes called a Consent Log or Recruitment Log) showing enrollment dates, consent dates, and coded identifiers for sponsor-shared records. Inspectors may check that no subject’s participation date precedes their consent date. A reconciliation of enrollment lists against the consent log helps demonstrate completeness (e.g. explaining any screening failures or withdrawals).

• Training and SOPs. Documentation that staff were trained on the consent process (reviews of consent-specific SOPs, training logs, delegate logs). If inspectors ask “how do you conduct consenting?”, having a simple process map or SOP with training signatures makes the answer clear.

• Audit trails and QC. Prepare relevant version histories and QC records. Use pseudonymised sponsor oversight records; retain identifiable consent evidence in the investigator-controlled repository. Upload dates alone do not establish that consent was obtained correctly.

Table 1. Consent questions and evidence locations

Hypothetical example: An inspector requests Subject 003’s consent and its approval history. The site retrieves the signed record from its investigator-controlled files and the applicable approval. If new information arose, the site also retrieves the documented decision and communication or re-consent where needed. The sponsor uses its approved blank versions and pseudonymised oversight records to explain its role.

What inspectors ask. Inspectors may ask how adverse events are captured, assessed, reconciled and reported: “Does the site record match the clinical and safety databases? Who assessed seriousness, expectedness and causality? What was reported, to whom and when? Why did another event not require expedited reporting?”

Distinct reporting obligations

• Investigator to sponsor: 21 CFR 312.64(b) requires immediate SAE reporting with a causality assessment, whether or not considered drug related, with its specific provision for study endpoints. 21 CFR 312.64.
• Sponsor IND safety reports: An individual serious, unexpected event must also meet the suspected-adverse-reaction causality criterion for reporting under 21 CFR 312.32(c)(1)(i). Other specified findings can independently qualify. Qualifying information is reported to FDA and participating investigators as soon as possible, no later than 15 calendar days after the sponsor determines it qualifies; unexpected fatal or life-threatening suspected adverse reactions must be reported to FDA as soon as possible, no later than seven calendar days after initial receipt. FDA IND reporting criteria and timeframes.
• EU reporting: Use the Clinical Trials Regulation framework. SUSARs are submitted through EudraVigilance; annual safety reports use CTIS. Other safety notifications follow their applicable CTR routes. EMA safety-reporting requirements; CTIS Sponsor Handbook.
• IRB reporting: Follow the applicable procedures for unanticipated problems involving risks to participants or others. FDA’s current investigator guidance states that investigators must submit IND safety reports to the IRB; other events can also qualify as unanticipated problems. Do not equate every SAE with an expedited IND report. 21 CFR 56.108; FDA investigator safety-reporting guidance.
• Periodic reporting: Keep applicable annual safety reports separately from expedited individual reports.

Evidence to prepare

• Safety reconciliation logs. A reconciliation worksheet or report that matches every SAE entry in the clinical trial database (CRF) to an entry in the pharmacovigilance (PV) database. This typically consists of a table showing, for each SAE: subject ID, event date, description, and database record numbers (one from EDC, one from PV). The log should highlight any discrepancies (e.g. differences in severity or outcome) and their resolution. Inspectors may ask to see how the safety database was cross-checked against source documents; a reconciliation summary should point to the underlying records and documented discrepancy resolution.

• Report archives and reportability decisions. Retain the relevant investigator notifications, submitted regulatory reports, acknowledgements and IRB submissions, with dates and recipient-specific assessments. Do not expect an ICSR or expedited FDA/IRB report for every SAE. For events not requiring expedited reporting, retain the assessment and rationale; consult current submission instructions rather than assuming one paper form fits every route.

• Periodic safety report summaries. If applicable (for ongoing INDs), evidence that Annual Reports or Development Safety Update Reports (DSURs) were filed on time. These reports aggregate trial-wide safety data. Inspectors may ask for the last submitted DSUR or Annual Report to check consistency with the database.

• Correspondence logs. Communications to investigators, ethics committees, and agencies about safety issues. For instance, letters notifying sites of important safety changes, or IRB meeting minutes where trial safety was discussed. This shows closed-loop safety monitoring.

• SOPs and training. Prepare procedures and training records that distinguish the reporting obligations, responsible parties and applicable timelines.

A useful principle is that of “proactive reconciliation”. Industry sources emphasize that the pharmacovigilance (PV) group should lead the process of aligning SAE data, often involving Clinical Operations and Data Management teams (^[1]). In practice, sponsors should have an established workflow (perhaps monthly or at database lock) to reconcile SAE counts. Evidence of that workflow (meeting notes, email threads, final reconciliation spreadsheets) can help explain how discrepancies were identified and resolved.

What inspectors ask. Regulators know that modern trials involve multiple external partners. Accordingly, they deeply scrutinize sponsor oversight of any delegated tasks. Questions include: “What are the duties delegated to each CRO or vendor? Show me the quality agreement or contract specifying roles. How do you oversee the CRO’s work? Provide documentation of oversight activities: meeting minutes, audit logs, metrics. How did you monitor vendor compliance?” Essentially, an inspector will map trial tasks (monitoring, data entry, drug supply, labs, etc.) to responsible parties and then probe for evidence that the sponsor managed those relationships.

A transfer of sponsor obligations to a CRO must be described in writing under 21 CFR 312.52(a). Subsection (b) applies the relevant regulatory obligations and regulatory action to the CRO for the obligations it assumes; it is not the writing provision. 21 CFR 312.52. E6(R3) describes sponsor responsibility and oversight of service providers. Current FDA E6(R3) guidance.

Evidence to prepare

• Contracts and Quality Agreements. For each CRO or vendor, a formal written agreement that specifies quality expectations, responsibilities, and deliverables. This typically includes a CRO Quality Management Plan or coordination group minutes. Inspectors often request to see the section of the CTA that defines delegated functions. Having the CTA indexed in the TMF (or available electronically) is critical.

• Vendor Qualification Records. Prepare qualification assessments, relevant checklists and evidence of vendor suitability. Distinguish these records from independent audit reports.

• Oversight Plans and Metrics. Documents such as a Sponsor Oversight Plan or CRO oversight charter that outline how the sponsor monitors the CRO. For example, some sponsors use periodic “CRO performance scorecards” or CAPA matrices. Evidence might include reports on monitoring visit completion rates, data query trends, or TMF review scores.

• Audit Certificates and Follow-Up. Prepare applicable audit certificates and CAPA implementation evidence. E6(R3) says authorities should not routinely request independent audit reports, while allowing case-specific access where serious GCP noncompliance is suspected or in legal proceedings. Handle report requests under the applicable inspection requirements rather than routinely including every report in an inspection pack. E6(R3) audit provisions.

• Meeting Minutes and Communications. Regular oversight meetings (steering committee, vendor status meetings) should have minutes or slides. Inspectors will ask if issues raised were resolved; having email chains or governance meeting minutes showing action items closed is persuasive.

• Delegation Logs. A delegation of authority log (or trial management chart) that records who is responsible for each task. This helps inspectors verify that everyone who performed a regulated task was qualified—and that the sponsor knows who did what.

To illustrate the level of detail expected, consider sponsor TMF review. Avoca’s Q&A on inspection readiness points out that “inspectors will likely review the CRO TMF audit trails to see if [the sponsor] has been accessing and reviewing the CRO records” (^[2]). In other words, having screenshots or exports of the CRO’s eTMF audit trail showing sponsor logins and reviews can help explain oversight activities. If inspectors question how you verify a CRO’s TMF, you can pull the audit records (ideally validated) alongside the underlying review records and follow-up.

Table 2. Vendor oversight questions and evidence

Hypothetical example: A sponsor outsources data management. For an oversight question, it could retrieve the signed agreement, routine data-review meeting records, data-query metrics and documented follow-up. These records help explain what was reviewed and how identified issues were addressed. They do not establish an inspection outcome.

In summary, demonstrating robust vendor oversight requires forethought and documentation. Inspectors’ questions here form another cluster for which having an evidence package (oversight plans, logs, correspondence) can support retrieval and a clear explanation of the sponsor’s activities.

What inspectors ask. Data integrity – ensuring that trial data are reliable and unaltered – is often the central theme of regulatory scrutiny in trials. Inspectors will challenge an organization on questions like: “How do you ensure your electronic systems (EDC, eTMF, ePRO, lab systems) maintain accurate, verifiable records? Can you show me audit trails for any changes or deletions in the database? How is data entry validated? What controls prevent unauthorized access? How do you back up and secure your data? What steps do you take if an electronic system is upgraded or changed?” Another common line of inquiry is “spot check some data points in the system versus source documents; then show where the audit trail record is.” The goal is to verify the ALCOA principles (Attributable, Legible, Contemporaneous, Original, Accurate) in practice.

For clinical-trial data governance, use current GCP guidance and applicable requirements. E6(R3) addresses data throughout their life cycle and includes computerised-system validation, security and user management. FDA E6(R3), sections 4.2 and 4.3.

Evidence to prepare

• System Validation Documentation. Prepare the system’s intended-use requirements, risk assessment, validation records and relevant change controls. A summary report helps locate the underlying evidence; it does not by itself establish compliance with every applicable requirement.

• Audit Trails and Change Logs. Prepare interpretable audit trails showing entries, changes, deletions, timestamps and accountable users. Exports can assist inspection review; they do not by themselves demonstrate adequate retention. Preserve the original electronic records or validated certified copies with relevant metadata, signatures and audit trails, including required access and dynamic functionality. Static versions of dynamic data are not adequate substitutes. EMA computerised-systems guideline.

If paper CRFs or nondigital data were transformed electronically, inspectors may ask to see evidence of correct transcription. Preparation here means: have final CRFs with investigator signatures on file, and if data were entered later, prepare the relevant transcription and verification records.

• Access Control Reports. Electronic systems should have access logs or user lists. Inspectors may ask “who can change the data?” Evidence can be a list of system users and their roles, showing that e.g. monitors can enter queries without access that would reveal treatment allocation, and only authorized data managers can perform database lock. For example, a screenshot of the user-role matrix or a printed excerpt of authorization lists addresses this.

• SOPs and Training Records. Prepare relevant procedures for data entry, query resolution, system use and access control, with training records for the staff’s assigned roles.

• Backups and Contingency Plans. Evidence that data were routinely backed up (e.g. IT logs) and that there was a restore plan for disasters. For critical data (like final locked database), inspectors may want to see the backup schedule or confirmation that a backup occurred after database lock.

• Data Review and QC. Prepare documented data reviews, query resolutions and reconciliation results that can be traced to the relevant source records.

• Example of ALCOA documentation. The EMA expects that preparation includes a “diagram of data flows” and definitions of source data and how it is captured (^[3]). While not usually demanded in a standard inspection, having a summary of how source data (medical records, case report forms, e-lab reports, etc.) feed into the EDC, and how audit trails are maintained, provides context to the data integrity narrative.

To put it concretely, if an inspector picks a subject and says “show me how we know this lab value wasn’t later changed illicitly,” the site or sponsor should be prepared to retrieve the timestamps and accountable person from the lab report, and then the audit log showing any EDC entry or change. Being able to say “the system automatically recorded that this entry was made on [date/time] by [username], and no alterations were made thereafter” should be supported by the underlying records, rather than asserted from an export alone.

Table 3. Data integrity controls and current GCP mappings

These mappings refer to FDA’s final E6(R3) text; apply the requirements and guidance relevant to the trial and jurisdiction.

Hypothetical example: An inspector asks when a lab value was entered and corrected. Prepare the source laboratory record and the audit trail showing the original entry, subsequent correction, responsible user and reason. Keep relevant source records under the appropriate custodian’s control, with authorised inspection access. Indexing these records can make retrieval easier without replacing the underlying data.

Table 4 consolidates the practical checklist. Tables 1–3 provide the consent, vendor and data detail. This is an organising aid, not proof that compliant trial conduct or a favourable inspection outcome follows from having a folder.

Table 4. Inspection questions and evidence to prepare

Use the relevant investigator or sponsor repository rather than a single combined consent binder. EMA’s TMF guideline calls for identifiable consents to stay under investigator/institution control and for sponsor-shared participant information generally to be pseudonymised. EMA TMF guideline. Keep record locations and access arrangements current, and use this checklist with the detailed provisions in the preceding sections.

This article does not provide a defined ten-year interval, inspection-record inventory, agency-specific sample sizes, coding method, annual counts or ranked results. Accordingly, it presents a qualitative synthesis and makes no original quantitative FDA/EMA trend claim.

FDA publishes fiscal-year spreadsheets summarising regulations cited on system-generated Form 483s. The agency notes that these are not a comprehensive listing of inspectional observations and that some forms are manually prepared. FDA Inspection Observations data and limitations. Counts of observations, forms and inspections have different denominators; a claim about one should not be restated as prevalence in another.

A reproducible trend analysis would need a fixed interval, included programmes and records, agency-specific sampling and coding rules, clear denominators and reproducible results. Without those elements, the four readiness themes should remain practical organising choices.

The following are hypothetical illustrations of document retrieval. They are not accounts of actual inspections, evidence of fewer findings or documented client experience.

1. Site Consent Governance: An inspector asks to review a participant’s consent and the applicable approval history. The site retrieves the signed and dated record from its investigator-controlled files, together with the approved version and relevant communication records. Sponsor oversight materials use approved blank versions and appropriately pseudonymised evidence.
2. Safety Reconciliation at Sponsor: An inspector requests a reconciliation for a reporting period. The safety team retrieves the relevant comparison of site notifications, clinical records and safety-database entries, with discrepancies, their resolution and recipient-specific reportability assessments. Any required submissions and acknowledgements can be traced from that record.
3. CRO Oversight and Data Integrity: An inspector asks how outsourced data management was overseen. The sponsor retrieves the written agreement, oversight plan, review records, follow-up actions and relevant retained electronic data and audit trails. Applicable audit certificates and CAPA evidence are distinguished from independent audit reports.

These illustrations show how question-based indexing could support retrieval. They do not establish a causal relationship between preparation and inspection outcomes.

These readiness themes suggest several practical steps for clinical-trial quality programmes:

• Risk-Based Preparation: Allocate effort according to participant and data risks, with routine review of consent, safety, oversight and data controls. Maintain logs and follow-up records during trial conduct rather than assembling them only when an inspection is announced.

• Cross-Functional Coordination: Each cluster spans multiple stakeholders. For instance, informed consent involves clinical staff, IRBs, and data managers; safety reporting involves clinicians, PV, and statisticians; data integrity involves IT, data managers, and quality assurance. Effective readiness requires breaking down silos so that the “evidence pack” for each cluster can be assembled across departments. Companies increasingly use integrated systems (eTMF, CTMS, QMS software) to share visibility, but these must be configured to flag or store cluster-relevant documents.

• Training and Culture: The recurring nature of these questions highlights the need for a strong culture of compliance. Training programs should emphasize that “inspectors can ask any question” and staff should know where the answer lies (^[4]). Regular mock inspections or tabletop drills (especially using actual inspector questions as triggers) can habituate teams to retrieve evidence quickly. The outward mindset – that inspections test the quality system, not just individual tasks – should guide how evidence is collected and stored.

• Technological Enablement: FDA’s Remote Regulatory Assessments (RRAs) are distinct from inspections under sections 704(a)(1) and 704(a)(5) of the FD&C Act. The final guidance describes both mandatory and voluntary assessments, depending on the legal authority and circumstances. Plan record transfer or remote interaction according to FDA’s request and applicable access controls; do not assume a universal VPN requirement. FDA final RRA guidance.

• Regulatory Updates: FDA’s final Processes and Practices Applicable to Bioresearch Monitoring Inspections guidance has been issued under the Food and Drug Omnibus Reform Act of 2022 (FDORA). It addresses BIMO inspection processes and practices to the extent not already specified in public guides and manuals. FDA final BIMO guidance. Use the current E6(R3) implementation records described in the introduction when updating readiness materials.

• Regional Requirements: Check trial-specific and jurisdiction-specific obligations rather than assuming one pack is sufficient everywhere. EMA’s GCP Q&A addresses an investigator’s contemporaneous, independent CRF copy; that answer should not be expanded into a claim that investigators must hold copies of every essential document. EMA GCP Q&A on investigator CRF copies. Maintain the appropriate investigator and sponsor records with their privacy and access controls.

This qualitative synthesis organises inspection preparation around informed consent, safety reporting, vendor oversight and data integrity. It does not establish four dominant clusters from a ten-year FDA/EMA dataset, nor does it measure the effect of evidence packs on findings.

Prepare indexed records, responsible staff and documented explanations for each area. Keep identifiable participant records under investigator/institution control, use appropriately pseudonymised sponsor evidence and preserve the relevant electronic records and metadata. Treat inspection extracts as retrieval aids and apply reporting criteria to each recipient separately.

Organisation alone does not establish compliance or guarantee an inspection outcome. FDA also distinguishes a Form 483 observation from a final agency determination of a violation. FDA Form 483 FAQ. The practical aim is clear, timely retrieval of evidence that accurately reflects trial conduct.

• FDA: E6(R3) Good Clinical Practice (GCP), September 2025. Source.
• EMA: ICH E6 Good clinical practice - Scientific guideline. Source.
• EMA: ICH E6(R3) Guideline for good clinical practice, Principles and Annex 1, Step 5. Source.
• FDA: E6(R3) Good Clinical Practice, final guidance. Source.
• FDA: Investigator Responsibilities—Safety Reporting for Investigational Drugs and Devices. Source.
• EMA: CTIS Sponsor Handbook, version 6.4. Source.
• 21 CFR 50.27: Documentation of informed consent. Source.
• FDA: Informed Consent Guidance for IRBs, Clinical Investigators, and Sponsors. Source.
• 21 CFR 312.64: Investigator reports. Source.
• FDA: IND Application Reporting: IND Safety Reports. Source.
• 21 CFR 56.108: IRB functions and operations. Source.
• 21 CFR 312.52: Transfer of obligations to a contract research organization. Source.
• EMA: Guideline on the content, management and archiving of the clinical trial master file. Source.
• EMA: Guideline on computerised systems and electronic data in clinical trials. Source.
• EMA: Q&A: Good clinical practice (GCP). Source.
• FDA: Conducting Remote Regulatory Assessments - Questions and Answers. Source.
• FDA: Processes and Practices Applicable to Bioresearch Monitoring Inspections. Source.
• FDA: FDA Form 483 Frequently Asked Questions. Source.
• FDA: Inspection Observations. Source.
• EMA: Reporting safety information on clinical trials. Source.
• EMA: Clinical Trials Regulation becomes fully applicable. Source.