GCP Inspections: What FDA and EMA Review, How to Prepare, and How to Respond to a 483

A Good Clinical Practice (GCP) inspection is a formal, on-site or remote examination conducted by a regulatory authority — most commonly the FDA’s Bioresearch Monitoring (BIMO) program in the US, or EMA and national competent authorities in the EU/EEA — to verify that a clinical trial was conducted, and its data recorded and reported, in compliance with the protocol, Good Clinical Practice, and applicable regulation. A GCP inspection is distinct from sponsor monitoring (the sponsor’s own routine oversight) and from a sponsor’s internal quality-assurance audit; see clinical trial auditing: types, process, and how it differs from monitoring for how the three functions relate. This guide covers who inspects, what inspectors actually review at a site or sponsor, the most common findings, how outcomes are classified, how sites and sponsors prepare, how to structure a mock inspection, and how to respond to a Form 483 observation.

Who Conducts GCP Inspections

FDA (United States). The FDA’s Bioresearch Monitoring (BIMO) program inspects clinical investigators, sponsors, monitors, CROs, and IRBs for compliance with GCP requirements. See FDA BIMO (Bioresearch Monitoring) Program for the program’s full scope, which also covers nonclinical (GLP) labs, bioequivalence testing facilities, and postmarketing safety reporting. BIMO inspections fall into three categories: routine/surveillance (periodic, for ongoing regulated activity, or tied to a marketing-application submission and pivotal-trial enrollment), directed (data audits tied to a specific submission), and for-cause (triggered by a complaint, required report, or safety signal, and may be unannounced). Routine clinical-investigator inspections are typically announced, with FDA commonly contacting the site to schedule on the order of a few days’ notice — a courtesy, not a legal requirement. For-cause inspections may come with minimal or no notice.

EMA and national competent authorities (EU/EEA). GCP inspections in the EU are carried out by the national competent authority of the relevant member state (for example, a country’s medicines agency), sometimes coordinated by EMA on behalf of the Committee for Medicinal Products for Human Use (CHMP) when tied to a centralized marketing-authorisation procedure. Both systems apply the same underlying GCP framework — ICH E6 — so the substance of what is inspected is broadly consistent across FDA and EU inspections even though notice practices, outcome classification, and reporting formats differ.

What Inspectors Actually Review

Inspectors work from the trial’s essential documents. ICH E6(R2) Section 8 defines essential documents as those which "individually and collectively permit evaluation of the conduct of a trial and the quality of the data produced," organized by trial stage (before the clinical phase begins, during conduct, after completion). Collectively, these make up the Trial Master File (TMF) — the same document set a sponsor audit reviews and a regulator inspects. In practice, an inspection typically works through:

• Source documents and source data verification. Inspectors compare data in the case report form (CRF) against the original source (clinic notes, lab reports, imaging, patient diaries) to confirm accuracy, completeness, and that records were contemporaneous. This is the same underlying discipline sponsor monitors perform routinely — see clinical trial monitoring: visit types, source data verification & the monitoring plan.
• Informed consent process and documentation. Inspectors check that consent was obtained before any protocol-specific procedure, using the IRB/ethics-committee-approved version in effect at the time, properly signed and dated by the subject (or legally authorized representative) and the person obtaining consent, with re-consent documented for any material protocol amendment.
• The Trial Master File. Completeness and timeliness of essential documents across all three ICH E6(R2) Section 8 stages — regulatory approvals, IRB correspondence, signed protocol and amendments, monitoring visit reports, safety reports, and closeout documentation. See Trial Master File Checklist: A Zone-by-Zone Guide for the standard zone structure inspectors and auditors both use to navigate a TMF.
• The Delegation of Authority (DoA) log. ICH E6(R2) Section 4.1.5 requires the investigator to maintain a list of appropriately qualified staff to whom significant trial-related duties have been delegated. Inspectors cross-check the DoA log against source documents to confirm that whoever performed a given task was actually delegated to perform it, within their delegated date range, and had documented qualifications on file. See Delegation of Authority Log Template: Annotated Structure.
• Investigational product accountability. Receipt, storage conditions, dispensing, returns, and reconciliation records for the investigational product, checked against the protocol’s dosing schedule and any temperature-excursion or deviation logs.
• Protocol compliance and deviation handling. Whether deviations were identified, documented, assessed for impact on subject safety or data integrity, and reported per the protocol and applicable regulation — not just whether deviations occurred.
• Adverse event and serious adverse event reporting. Timeliness and completeness of safety reporting against the protocol’s and regulator’s required timelines.

Common Inspection Findings

FDA Form 483 observations. When an FDA investigator identifies conditions that may constitute violations, they are documented in a Form FDA-483, a written list of "inspectional observations" presented at the end of the inspection. Recurring categories in clinical-investigator and sponsor inspections include: informed consent deficiencies (missing signatures/dates, use of an outdated consent version, procedures performed before consent); inadequate or missing source documentation; failure to follow the investigational plan (protocol deviations not identified or reported); inadequate drug/device accountability records; and deficient recordkeeping generally. DoA-log-specific findings are common enough to call out separately: undelegated task performance (a procedure done by someone not on the log, or outside their delegated date range), vague task descriptions ("all study procedures" instead of specific tasks), logs not updated after staffing changes, and delegated tasks lacking supporting qualification records in the investigator site file.

EMA/EU findings. EU GCP inspection findings are classified as critical, major, or minor based on their impact on subject safety, subject rights and well-being, or the reliability of trial results. A critical finding is considered totally unacceptable and may involve a pattern of major deficiencies, materially compromised data quality, or missing source documents; consequences can include data rejection or referral for regulatory/legal action. A major finding is a serious deficiency and a direct violation of GCP principles, with similar potential consequences. A minor finding is a less severe non-compliance not expected to materially affect subject safety or data integrity. The same deviation can be classified differently between inspections depending on its actual risk in context, so classification is not purely mechanical.

How Outcomes Are Classified

FDA inspections (BIMO and otherwise) are classified using the agency’s standard three-tier system: No Action Indicated (NAI) — no objectionable conditions found; Voluntary Action Indicated (VAI) — objectionable conditions found, but not warranting administrative or regulatory action (typically still accompanied by a Form 483); and Official Action Indicated (OAI) — an unacceptable compliance state warranting regulatory or administrative action, which for a clinical investigator can escalate toward disqualification proceedings. See inspection readiness for how these classifications map to a site’s day-to-day preparedness practices. FDA’s draft guidance on responding to Form 483 observations (issued March 2026) clarifies that a written response is technically voluntary but strongly encouraged as part of demonstrating corrective action.

EMA/EU outcomes flow from the critical/major/minor classification above: findings are compiled into an inspection report, the sponsor or investigator site is typically required to submit a Corrective and Preventive Action (CAPA) plan, and critical findings can affect an ongoing marketing-authorisation procedure or trigger referral for further regulatory action.

How Sites and Sponsors Prepare

• Treat the TMF as inspection-ready continuously, not just before a scheduled visit. Filing essential documents as they’re generated (not retrospectively reconstructing a TMF ahead of an inspection) is the single highest-leverage practice; a stale or incomplete TMF is itself one of the most common findings.
• Keep the DoA log current. Update it at every staffing change, use specific (not blanket) task descriptions, and confirm every delegated person’s qualification documentation is actually on file in the investigator site file — not just referenced.
• Run mock inspections or internal audits. A sponsor QA audit (see clinical trial auditing) or an internal mock inspection surfaces the same gaps a regulator would find, while there’s still time to correct them.
• Have a written inspection-conduct SOP. Define in advance who greets and manages the inspector, who retrieves documents, who can speak to which topics, and how requests are logged — ad hoc handling during a live inspection is itself a source of avoidable findings.
• Prepare for source data verification. Confirm CRF entries reconcile cleanly against source documents before an inspection, not during one; recurring SDV discrepancies are a leading driver of both monitoring findings and inspection observations.
• Plan the corrective action response in advance. Know the applicable response process and timeline (FDA Form 483 response, or an EU CAPA plan) so that, if findings do occur, the response is timely, specific, and tied to root cause rather than assembled reactively.
• Check public inspection history where available. FDA publishes inspection classification outcomes; reviewing a site’s or sponsor’s own prior history (see FDA Inspection Database: How to Search Inspection Classifications) can surface recurring gaps worth closing before the next inspection.

How to Run a Mock Inspection

A mock inspection is a rehearsal of a real FDA BIMO or EMA/national-authority GCP inspection, run internally (or by an independent consultant) before a regulator actually arrives. It is not itself an FDA requirement, but it is the practical way a site or sponsor turns the “how sites and sponsors prepare” practices above into a tested, evidence-based readiness state rather than an assumed one.

1. Scope it and pick an independent reviewer. Use someone who was not directly involved in day-to-day trial conduct — site QA staff, a sponsor’s audit function (the same independent function required under ICH E6(R2) Section 5.19 for sponsor audits), or a third-party consultant — so the exercise surfaces what an outside inspector would actually find, not what participants already assume is fine.
2. Set a realistic timeline. Give the same order of notice FDA typically gives for a routine inspection (on the order of a few days), rather than weeks of preparation time. Realistic time pressure is what surfaces retrieval and recall gaps that an unhurried internal review will not.
3. Walk the same document set a real inspector would request. Pull the Trial Master File, source documents for source data verification, the informed consent files, the Delegation of Authority log, investigational product accountability records, and the protocol deviation log — the same categories covered in “What Inspectors Actually Review” above.
4. Rehearse inspection conduct, not just documents. Test the site’s written inspection-conduct plan itself: who greets and manages the inspector, who retrieves records, who is authorized to answer which categories of question, and how requests and responses get logged during the visit.
5. Score findings the way a regulator would. Categorize each gap found using the same severity references inspectors use — FDA’s NAI/VAI/OAI framework or the EU critical/major/minor classification — so the mock exercise produces a genuinely comparable readiness signal rather than an unranked list of observations.
6. Close every finding with a documented corrective action and a re-check date. Assign a root cause, a corrective action, and a follow-up date confirming the fix actually held. Running this discipline during a mock inspection is, in effect, a rehearsal of the same corrective-action process a real Form 483 response would require.
7. Set a cadence tied to risk, not a calendar default. Sites approaching a marketing-application-triggered inspection, sites in active high-enrollment pivotal trials, or sites with a prior inspection finding warrant more frequent mock inspections than a study with no such history — there is no single FDA-mandated interval.

How to Respond to a Form 483 Observation

Responding in writing to a Form 483 is, as noted above, technically voluntary — but FDA actively encourages it, and an adequate, timely response is a recognized factor in whether an inspection’s findings escalate toward a Warning Letter. The agency’s own recommended window is 15 business days from issuance; a response submitted after that window risks being treated as untimely and may not be factored into how FDA classifies the inspection.

1. Read every observation carefully before drafting anything. Confirm exactly what was observed, and whether responsibility sits with the site, the sponsor, or a CRO — a response should not take on, or deflect, an obligation that belongs to a different party.
2. Do a real root cause analysis for each observation. A response that only describes the specific instance being fixed, without identifying why the underlying condition occurred, is weaker evidence of control than one that traces the observation back to a process, training, or system gap.
3. Structure the response observation by observation. For each numbered item on the 483, restate the observation, state the root cause, describe the corrective action already completed and the corrective action planned (with specific target dates, not open-ended language like “will be addressed”), and describe the preventive action that stops the same condition recurring elsewhere.
4. Support every commitment with evidence, not intentions. Attach or reference the revised SOP, training records, an updated Delegation of Authority log, or whatever documentation demonstrates the corrective action is actually in place rather than merely promised.
5. Address systemic scope where it applies. If the same root cause could plausibly affect other trials, sites, or staff, say so and describe the broader corrective action — FDA’s assessment of a response factors in whether the firm addressed the condition narrowly or systemically.
6. Route the draft through QA and regulatory review before submission. Given the escalation risk to a Warning Letter, most sites and sponsors have regulatory affairs (and, increasingly, counsel) review the response before it goes out.
7. Submit within the recommended window and retain a copy. Keep the response, and evidence of the corrective actions it commits to, in the site regulatory file or Trial Master File — both for institutional memory and because a firm’s prior response history can itself be reviewed in a later inspection or audit.

FDA published its first draft guidance specifically on Form 483 response content in March 2026 (“Responding to FDA Form 483 Observations at the Conclusion of a Drug CGMP Inspection,” Federal Register docket 2026-04578). As of this writing that guidance remains in draft and is scoped to drug CGMP manufacturing inspections, not BIMO/GCP inspections specifically — the response principles above reflect long-standing general FDA practice and CAPA methodology, not that draft guidance’s specific (and not yet finalized) requirements.

Frequently Asked Questions

How often should a site run a mock FDA inspection?

There is no fixed FDA-mandated interval. Common practice is to run one ahead of an inspection made more likely by a marketing-application submission or high pivotal-trial enrollment, and after any prior inspection or audit finding, rather than on a fixed calendar schedule.

How long does a site have to respond to a Form 483?

Responding is technically voluntary, but FDA recommends a written response within 15 business days of issuance. A late response risks not being factored into FDA’s classification of the inspection and is a recognized risk factor for escalation toward a Warning Letter.

How much notice does FDA give before a GCP inspection?

Routine clinical-investigator inspections are typically announced, often with FDA contacting the site on the order of a few days’ notice as a courtesy — not a legal requirement. For-cause inspections, triggered by a complaint, safety signal, or data-integrity concern, may come with minimal notice or none at all.

What is the difference between a Form 483 observation and a Warning Letter?

A Form 483 is issued at the conclusion of an inspection and lists inspectional observations. A Warning Letter is a separate, more serious communication issued later, after FDA review, when the agency believes there are violations of regulatory significance — not every 483 leads to a Warning Letter. See FDA Form 483 for the full distinction.

Do inspectors only look at the TMF, or do they also review source documents at the site?

Both. The TMF establishes that required essential documents exist and are complete, but inspectors also verify data against original source documents (clinic notes, lab results, pharmacy records) to confirm the TMF’s contents are accurate, not merely present.

Is a sponsor audit the same thing as a regulatory GCP inspection?

No. An audit is the sponsor’s own internal quality-assurance function, required under ICH E6(R2) Section 5.19, conducted by sponsor or CRO staff independent of the trial. A GCP inspection is conducted by a regulatory authority (FDA, EMA, or a national competent authority) with statutory inspection powers. See clinical trial auditing for the full comparison, including how monitoring fits alongside both.