GCP Inspections: What FDA and EMA Review, and How to Prepare

A Good Clinical Practice (GCP) inspection is a formal, on-site or remote examination conducted by a regulatory authority — most commonly the FDA’s Bioresearch Monitoring (BIMO) program in the US, or EMA and national competent authorities in the EU/EEA — to verify that a clinical trial was conducted, and its data recorded and reported, in compliance with the protocol, Good Clinical Practice, and applicable regulation. A GCP inspection is distinct from sponsor monitoring (the sponsor’s own routine oversight) and from a sponsor’s internal quality-assurance audit; see clinical trial auditing: types, process, and how it differs from monitoring for how the three functions relate. This guide covers who inspects, what inspectors actually review at a site or sponsor, the most common findings, how outcomes are classified, and how sites and sponsors prepare.

Who Conducts GCP Inspections

FDA (United States). The FDA’s Bioresearch Monitoring (BIMO) program inspects clinical investigators, sponsors, monitors, CROs, and IRBs for compliance with GCP requirements. See FDA BIMO (Bioresearch Monitoring) Program for the program’s full scope, which also covers nonclinical (GLP) labs, bioequivalence testing facilities, and postmarketing safety reporting. BIMO inspections fall into three categories: routine/surveillance (periodic, for ongoing regulated activity, or tied to a marketing-application submission and pivotal-trial enrollment), directed (data audits tied to a specific submission), and for-cause (triggered by a complaint, required report, or safety signal, and may be unannounced). Routine clinical-investigator inspections are typically announced, with FDA commonly contacting the site to schedule on the order of a few days’ notice — a courtesy, not a legal requirement. For-cause inspections may come with minimal or no notice.

EMA and national competent authorities (EU/EEA). GCP inspections in the EU are carried out by the national competent authority of the relevant member state (for example, a country’s medicines agency), sometimes coordinated by EMA on behalf of the Committee for Medicinal Products for Human Use (CHMP) when tied to a centralized marketing-authorisation procedure. Both systems apply the same underlying GCP framework — ICH E6 — so the substance of what is inspected is broadly consistent across FDA and EU inspections even though notice practices, outcome classification, and reporting formats differ.

What Inspectors Actually Review

Inspectors work from the trial’s essential documents. ICH E6(R2) Section 8 defines essential documents as those which "individually and collectively permit evaluation of the conduct of a trial and the quality of the data produced," organized by trial stage (before the clinical phase begins, during conduct, after completion). Collectively, these make up the Trial Master File (TMF) — the same document set a sponsor audit reviews and a regulator inspects. In practice, an inspection typically works through:

• Source documents and source data verification. Inspectors compare data in the case report form (CRF) against the original source (clinic notes, lab reports, imaging, patient diaries) to confirm accuracy, completeness, and that records were contemporaneous. This is the same underlying discipline sponsor monitors perform routinely — see clinical trial monitoring: visit types, source data verification & the monitoring plan.
• Informed consent process and documentation. Inspectors check that consent was obtained before any protocol-specific procedure, using the IRB/ethics-committee-approved version in effect at the time, properly signed and dated by the subject (or legally authorized representative) and the person obtaining consent, with re-consent documented for any material protocol amendment.
• The Trial Master File. Completeness and timeliness of essential documents across all three ICH E6(R2) Section 8 stages — regulatory approvals, IRB correspondence, signed protocol and amendments, monitoring visit reports, safety reports, and closeout documentation. See Trial Master File Checklist: A Zone-by-Zone Guide for the standard zone structure inspectors and auditors both use to navigate a TMF.
• The Delegation of Authority (DoA) log. ICH E6(R2) Section 4.1.5 requires the investigator to maintain a list of appropriately qualified staff to whom significant trial-related duties have been delegated. Inspectors cross-check the DoA log against source documents to confirm that whoever performed a given task was actually delegated to perform it, within their delegated date range, and had documented qualifications on file. See Delegation of Authority Log Template: Annotated Structure.
• Investigational product accountability. Receipt, storage conditions, dispensing, returns, and reconciliation records for the investigational product, checked against the protocol’s dosing schedule and any temperature-excursion or deviation logs.
• Protocol compliance and deviation handling. Whether deviations were identified, documented, assessed for impact on subject safety or data integrity, and reported per the protocol and applicable regulation — not just whether deviations occurred.
• Adverse event and serious adverse event reporting. Timeliness and completeness of safety reporting against the protocol’s and regulator’s required timelines.

Common Inspection Findings

FDA Form 483 observations. When an FDA investigator identifies conditions that may constitute violations, they are documented in a Form FDA-483, a written list of "inspectional observations" presented at the end of the inspection. Recurring categories in clinical-investigator and sponsor inspections include: informed consent deficiencies (missing signatures/dates, use of an outdated consent version, procedures performed before consent); inadequate or missing source documentation; failure to follow the investigational plan (protocol deviations not identified or reported); inadequate drug/device accountability records; and deficient recordkeeping generally. DoA-log-specific findings are common enough to call out separately: undelegated task performance (a procedure done by someone not on the log, or outside their delegated date range), vague task descriptions ("all study procedures" instead of specific tasks), logs not updated after staffing changes, and delegated tasks lacking supporting qualification records in the investigator site file.

EMA/EU findings. EU GCP inspection findings are classified as critical, major, or minor based on their impact on subject safety, subject rights and well-being, or the reliability of trial results. A critical finding is considered totally unacceptable and may involve a pattern of major deficiencies, materially compromised data quality, or missing source documents; consequences can include data rejection or referral for regulatory/legal action. A major finding is a serious deficiency and a direct violation of GCP principles, with similar potential consequences. A minor finding is a less severe non-compliance not expected to materially affect subject safety or data integrity. The same deviation can be classified differently between inspections depending on its actual risk in context, so classification is not purely mechanical.

How Outcomes Are Classified

FDA inspections (BIMO and otherwise) are classified using the agency’s standard three-tier system: No Action Indicated (NAI) — no objectionable conditions found; Voluntary Action Indicated (VAI) — objectionable conditions found, but not warranting administrative or regulatory action (typically still accompanied by a Form 483); and Official Action Indicated (OAI) — an unacceptable compliance state warranting regulatory or administrative action, which for a clinical investigator can escalate toward disqualification proceedings. See inspection readiness for how these classifications map to a site’s day-to-day preparedness practices. FDA’s draft guidance on responding to Form 483 observations (issued March 2026) clarifies that a written response is technically voluntary but strongly encouraged as part of demonstrating corrective action.

EMA/EU outcomes flow from the critical/major/minor classification above: findings are compiled into an inspection report, the sponsor or investigator site is typically required to submit a Corrective and Preventive Action (CAPA) plan, and critical findings can affect an ongoing marketing-authorisation procedure or trigger referral for further regulatory action.

How Sites and Sponsors Prepare

• Treat the TMF as inspection-ready continuously, not just before a scheduled visit. Filing essential documents as they’re generated (not retrospectively reconstructing a TMF ahead of an inspection) is the single highest-leverage practice; a stale or incomplete TMF is itself one of the most common findings.
• Keep the DoA log current. Update it at every staffing change, use specific (not blanket) task descriptions, and confirm every delegated person’s qualification documentation is actually on file in the investigator site file — not just referenced.
• Run mock inspections or internal audits. A sponsor QA audit (see clinical trial auditing) or an internal mock inspection surfaces the same gaps a regulator would find, while there’s still time to correct them.
• Have a written inspection-conduct SOP. Define in advance who greets and manages the inspector, who retrieves documents, who can speak to which topics, and how requests are logged — ad hoc handling during a live inspection is itself a source of avoidable findings.
• Prepare for source data verification. Confirm CRF entries reconcile cleanly against source documents before an inspection, not during one; recurring SDV discrepancies are a leading driver of both monitoring findings and inspection observations.
• Plan the corrective action response in advance. Know the applicable response process and timeline (FDA Form 483 response, or an EU CAPA plan) so that, if findings do occur, the response is timely, specific, and tied to root cause rather than assembled reactively.
• Check public inspection history where available. FDA publishes inspection classification outcomes; reviewing a site’s or sponsor’s own prior history (see FDA Inspection Database: How to Search Inspection Classifications) can surface recurring gaps worth closing before the next inspection.

Frequently Asked Questions

How much notice does FDA give before a GCP inspection?

Routine clinical-investigator inspections are typically announced, often with FDA contacting the site on the order of a few days’ notice as a courtesy — not a legal requirement. For-cause inspections, triggered by a complaint, safety signal, or data-integrity concern, may come with minimal notice or none at all.

What is the difference between a Form 483 observation and a Warning Letter?

A Form 483 is issued at the conclusion of an inspection and lists inspectional observations. A Warning Letter is a separate, more serious communication issued later, after FDA review, when the agency believes there are violations of regulatory significance — not every 483 leads to a Warning Letter. See FDA Form 483 for the full distinction.

Do inspectors only look at the TMF, or do they also review source documents at the site?

Both. The TMF establishes that required essential documents exist and are complete, but inspectors also verify data against original source documents (clinic notes, lab results, pharmacy records) to confirm the TMF’s contents are accurate, not merely present.

Is a sponsor audit the same thing as a regulatory GCP inspection?

No. An audit is the sponsor’s own internal quality-assurance function, required under ICH E6(R2) Section 5.19, conducted by sponsor or CRO staff independent of the trial. A GCP inspection is conducted by a regulatory authority (FDA, EMA, or a national competent authority) with statutory inspection powers. See clinical trial auditing for the full comparison, including how monitoring fits alongside both.