Good Clinical Practice (GCP) inspections by the FDA’s Bioresearch Monitoring (BIMO) program and by EMA and national competent authorities in the EU/EEA consistently turn up the same handful of problem areas, year after year, across sites, sponsors, and IRBs/ethics committees. This guide focuses on those recurring violation categories — what inspectors actually find, why they keep happening, and the specific prevention measures that address the root cause rather than just the symptom. For the inspection process itself — who inspects, what triggers a visit, how findings are classified, and how to prepare a site or trial master file — see GCP Inspections: What FDA and EMA Review, and How to Prepare. For what happens after an inspection produces written findings, see the FDA Form 483 dictionary term.
Where This Data Comes From
FDA’s own compliance program guidance (7348.809) and its annual BIMO inspection summaries, along with published cross-sectional analyses of inspection citations, consistently rank the same categories at the top for clinical-investigator inspections: failure to follow the investigational plan/protocol, inadequate or inaccurate case histories and study records, informed consent deficiencies, inadequate investigational-product accountability, and safety-reporting gaps. One published cross-sectional analysis of FDA clinical-investigator citations found protocol non-adherence cited in roughly 81% of inspections with a finding, inadequate case histories in roughly 58%, and informed consent issues in roughly 48% — treat these as one study’s figures illustrating relative ranking, not a universal annual constant, since FDA does not publish a single standardized percentage breakdown across all fiscal years. On the EU side, EMA’s published analyses of GCP inspection findings (conducted at the request of the CHMP) similarly show source documentation, informed consent, and protocol compliance as the categories generating the most critical and major findings, with “Trial Management (Sponsor)” and “Investigational Site” as the leading finding categories overall. FDA’s fiscal-year BIMO trend writeups (industry law-firm summaries of FDA’s own inspection classification data) show IRB-related findings, particularly informed consent form deficiencies and continuing-review failures, becoming a larger share of warning letters in more recent years.
1. Informed Consent Deficiencies
Informed consent is the single most frequently cited ethical problem in both FDA and EMA inspection findings. It shows up in a narrow, recurring set of forms:
- Outdated or superseded consent forms. The site continues using a prior version of the ICF after an IRB/ethics-committee-approved amendment, or after a protocol change that should have triggered re-consent.
- Missing or incomplete signatures/dates. A subject, LAR, witness, or investigator signature or date is missing, illegible, or inconsistent with the visit date in source records.
- Consent obtained after study procedures began. Screening or study-specific procedures documented as occurring before the signed consent date.
- Failure to re-consent after a material protocol amendment, a new safety finding, or an updated risk disclosure.
- Consent process not adequately documented — no contemporaneous note confirming the subject had adequate time to consider participation, ask questions, and consent voluntarily.
Root causes: version-control gaps between the IRB-approved ICF and what’s actually in use at the site; delegation of the consent conversation to staff without adequate training on what must be documented; and treating consent as a one-time signature event rather than an ongoing process.
Prevention measures: maintain a single controlled ICF version-tracking log tied to IRB approval dates; build a site SOP that requires a documented consent-version check at every visit where an amendment is pending; train everyone authorized to consent subjects (not just the PI) on ICH E6 consent-process requirements, not just the signature mechanics; and use a delegation-of-authority log to confirm only trained, delegated staff obtain consent. See the four principles of informed consent, a worked, annotated ICF example, consent timing and re-consent rules, and ICF (Informed Consent Form).
2. Protocol Deviations and Non-Adherence to the Investigational Plan
Deviating from the IRB-approved, sponsor-finalized protocol — without prior IRB approval, except where necessary to eliminate an immediate hazard to subjects — is consistently the most cited FDA clinical-investigator finding. Common patterns include out-of-window visits and assessments, unapproved changes to inclusion/exclusion criteria applied in practice, missed or substituted procedures, and dosing errors.
Root causes: protocols that are operationally unrealistic for the site’s patient population or staffing (a design problem, not just a conduct problem); inadequate protocol training at site initiation; and no systematic process for logging and trending deviations, so a recurring pattern goes unnoticed until an inspection surfaces it.
Prevention measures: log every deviation at the time it’s identified, not retrospectively, and classify it consistently (routine vs. important/serious, per your SOP and, where applicable, the EU Clinical Trials Regulation’s “serious breach” threshold); review deviation logs at a fixed cadence to spot trends that indicate a systemic issue rather than isolated human error; and involve site staff in a feasibility review before activation so the protocol as written matches what the site can actually execute. See Protocol Deviation and Protocol Deviation vs. Protocol Violation for how deviations are distinguished from more serious violations/serious breaches, and the site initiation visit checklist for building protocol training into activation.
3. Inadequate or Inaccurate Source Documentation
Source documentation failures — incomplete, inaccurate, or non-contemporaneous records that undermine confidence in the reported trial data — are one of the largest categories in both FDA case-history citations and EMA critical findings. Typical findings: source notes written well after the visit rather than contemporaneously, discrepancies between source and the eCRF that were never resolved or explained, missing source for reported endpoints or adverse events, and uncontrolled corrections (no initials/date, or use of correction fluid instead of a single strike-through).
Root causes: source documents that don’t actually capture everything the protocol requires; staff completing documentation from memory well after the visit; and no independent review step to catch ALCOA+ gaps before monitoring visits or an inspection do.
Prevention measures: build source-document templates directly from the protocol’s visit/assessment schedule so nothing has to be reconstructed later; document at the time of the encounter, not at the end of the day or week; apply ALCOA+ principles consistently (attributable, legible, contemporaneous, original, accurate, plus complete, consistent, enduring, available); and have a second qualified staff member periodically self-audit source against the eCRF before a monitoring visit. See Good Documentation Practices (GDP) in Clinical Trials and the trial master file checklist for how source documentation fits into the broader essential-documents record.
4. Investigational Product (Drug/Device) Accountability Failures
Sponsors and investigators are required to maintain adequate records of the investigational product’s receipt, storage, dispensing, use, and disposition (21 CFR 312.62), and inadequate accountability/control of investigational product is a top-five recurring FDA finding. Common problems: incomplete or inconsistent accountability logs (dispensed quantities that don’t reconcile with what was received and returned), storage conditions (temperature, security) not documented or out of the protocol-specified range, and product dispensed to a subject not authorized under the protocol or without documented PI/delegate authorization.
Root causes: accountability treated as a paperwork exercise separate from actual dispensing practice, rather than reconciled in real time; and no routine cross-check between accountability logs, temperature logs, and the drug/device shipment records from the sponsor or depot.
Prevention measures: reconcile accountability logs against dispensing records at every visit, not just before a monitoring visit; use continuous temperature monitoring with documented excursion procedures rather than periodic manual checks alone; and restrict dispensing access to staff named on the delegation-of-authority log with documented investigational-product training. See FDA Form 1572 (Statement of Investigator) and the delegation-of-authority log template.
5. IRB/Ethics Committee Non-Compliance
Findings here span both the investigator/site side (proceeding with a change before IRB approval, except to eliminate an immediate hazard; failing to submit required continuing-review materials on time) and the IRB’s own operations (21 CFR Part 56 requirements around quorum, documented risk/benefit determinations, and consent-form review). FDA fiscal-year trend summaries have flagged IRB-related findings, particularly informed consent form deficiencies and continuing/ongoing review lapses, as a growing share of recent warning letters.
Root causes: sites treating continuing review as an administrative renewal rather than a substantive re-approval requirement; and IRBs (particularly smaller or single-purpose ones) lacking a systematic tracking mechanism for approval expiration dates across an active protocol portfolio.
Prevention measures: track IRB approval and continuing-review expiration dates against a calendar with enough lead time to avoid a lapse; route every protocol amendment, and every ICF version change, through IRB approval before implementation except in a genuine immediate-hazard situation, and document that exception basis contemporaneously; and, for sites relying on a central/single IRB, confirm local-context review requirements are still being met where applicable. See IRB (Institutional Review Board), the IRB/REC approval process, and Continuing Review (IRB).
6. Adverse Event and Safety Reporting Gaps
Failure to report or record adverse events per the protocol and applicable regulation rounds out the FDA top-five clinical-investigator finding categories, and safety reporting also features in sponsor/CRO-directed findings (e.g., failure to submit required IND safety reports). Typical patterns: adverse events identified in source notes but not carried through to the eCRF or reported per the required timeline; and safety events initially misclassified (e.g., not flagged as serious) so the required reporting clock never starts.
Root causes: unclear internal ownership of “who reports what, by when” between site, sponsor, and CRO; and inadequate staff training on the protocol-specific (not just generic) adverse-event reporting requirements and timelines.
Prevention measures: build a protocol-specific safety-reporting quick-reference (who, what, timeline, to whom) into site initiation materials rather than relying on generic GCP training alone; and reconcile the site’s safety log against the sponsor’s safety database periodically, not just at monitoring visits.
How Violations Get Classified and Escalate
On the FDA side, observations an inspector believes may violate the FD&C Act or related regulations are documented on a Form 483 at the close of inspection; FDA then classifies the inspection as No Action Indicated, Voluntary Action Indicated, or Official Action Indicated, with OAI findings carrying the risk of a Warning Letter or further regulatory action. EMA and national competent authorities classify findings as critical, major, or minor, with critical findings (most often tied to source documentation, informed consent, and protocol compliance) carrying the greatest risk to trial data integrity or subject protection. The mechanics of both processes, and how to prepare for an inspection itself, are covered in GCP Inspections: What FDA and EMA Review, and How to Prepare — this page intentionally does not duplicate that process detail.
Building a Violation-Prevention Program, Not Just a Response Plan
The categories above share a common thread: nearly every recurring violation traces back to a gap between what the protocol/regulation requires and what routine site or sponsor practice actually does, discovered too late to fix quietly. A prevention-oriented program, rather than a purely reactive one, typically includes: risk-based, ongoing self-audits (not just pre-monitoring-visit scrambles) covering consent, source documentation, and product accountability; a functioning CAPA (Corrective and Preventive Action) process that addresses root cause, not just the individual instance; protocol-specific (not generic) training refreshed at amendment points, not only at study start; and a clear escalation path so staff raise a suspected deviation or documentation gap immediately rather than waiting for it to surface externally. See clinical trial auditing: types, process, and how it differs from monitoring and clinical trial monitoring for how ongoing oversight functions fit around this.
Frequently Asked Questions
What is the single most common GCP violation?
Across FDA clinical-investigator inspections, failure to follow the investigational plan/protocol is consistently the most cited category, followed closely by inadequate case histories/source documentation and informed consent deficiencies. EMA’s inspection-findings analyses similarly point to source documentation, informed consent, and protocol compliance as the leading sources of critical and major findings. Exact rankings vary by year and by whether you’re looking at clinical-investigator, sponsor/CRO, or IRB inspections specifically.
Is a GCP violation the same as a protocol deviation?
No. A protocol deviation is any departure from the IRB-approved protocol; not every deviation rises to the level of a GCP violation or a “serious breach” under the EU Clinical Trials Regulation. See Protocol Deviation vs. Protocol Violation for how the terms and their regulatory thresholds differ.
What happens after a GCP violation is found during an inspection?
FDA documents observations on a Form 483 and classifies the inspection outcome (NAI/VAI/OAI); serious or unresolved findings can escalate to a Warning Letter or further action. EMA/national authorities classify findings as critical, major, or minor and follow up through the sponsor’s/site’s corrective action commitments. See FDA Form 483 and GCP Inspections: What FDA and EMA Review, and How to Prepare for the full process.
Who is responsible for preventing GCP violations — the site, the sponsor, or the IRB?
All three have distinct, overlapping obligations under ICH E6: the investigator for conduct at the site, the sponsor for oversight/monitoring and investigational-product control, and the IRB/ethics committee for ongoing protection of subject rights and welfare through initial and continuing review. Prevention requires each party addressing its own category of recurring findings rather than assuming another party will catch it.
