Types and Scopes of Audits
Part of Good Clinical Practice (GCP) — ICH E6(R3): Audits, Inspections and Compliance.
About 6 minutes. Free, in your language, no account needed.
Why this matters
Sites often use the words monitoring, audit and inspection as if they mean the same thing. They do not. Each has a different actor, a different purpose and a different consequence. If you tell a regulatory inspector that "the monitor already checked that", you have answered the wrong question. Knowing which review you are in tells you who is asking, what they may see, and what happens next.
Three different activities, three different actors
ICH E6(R3) is the current revision of the Good Clinical Practice (GCP) guideline. Its Glossary defines all three terms. Learn them apart.
| Activity | Who performs it | What it is |
|---|---|---|
| Monitoring | The sponsor, or a service provider acting for the sponsor | Ongoing oversight of trial progress. A quality control activity. |
| Audit | The sponsor, a service provider (including a contract research organization, CRO) or the institution | A systematic and independent examination. A quality assurance activity. |
| Inspection | A regulatory authority | An official review of documents, facilities, records and other resources. |
E6(R3) defines an audit as "A systematic and independent examination of trial-related activities and records". The word independent is doing real work. Section 3.11.2 states that the purpose of a sponsor's audit "is independent of and separate from routine monitoring or quality control functions". An audit asks a wider question than a monitoring visit. It asks whether the processes used to manage and conduct the trial are appropriate to ensure compliance with the protocol, GCP and applicable regulatory requirements.
An inspection is different again. Only a regulatory authority inspects. The Glossary also notes that "Some aspects of the inspection may be conducted remotely." The Glossary definition of Direct Access says the same thing: access "may be performed on-site or remotely".
Who may audit, and how the audit is planned
Section 3.11.2.1 sets two requirements for auditors. The sponsor appoints individuals who are independent of the clinical trial or processes being audited. The sponsor also ensures those auditors are qualified by training and experience. An auditor who helped write the monitoring plan cannot independently audit it.
Audits are not automatic. Section 3.11.2 says that "When performed, audits should be conducted in a manner that is proportionate to the risks associated with the conduct of the trial." Proportionality decides both whether an audit happens and how deep it goes.
Section 3.11.2.2(b) lists what guides the audit plan and program:
- Importance of the trial — how much it matters to regulatory submissions.
- Number of participants in the trial.
- Type and complexity of the trial.
- Level of risk to trial participants.
- Any identified problems already known.
Section 3.11.2.2(a) adds that the sponsor's own procedures set what to audit, how to audit (on-site and/or remote), how often, and the form and content of audit reports. Section 3.11.2.2(c) requires the auditor's findings to be documented. Section 3.11.2.2(e) requires an audit certificate where applicable regulatory requirements demand one.
Who may see the audit report
This is the point most people get wrong. Section 3.11.2.2(d) states:
"To preserve the independence and value of the audit function, the regulatory authority(ies) should not routinely request the audit reports. Regulatory authority(ies) may seek access to an audit report on a case-by-case basis (i.e., when evidence or suspicion of serious GCP noncompliance exists or in the course of legal proceedings)."
So the audit report is not a routine inspection deliverable. A regulator may still ask for it, but only case by case, and only on those two grounds. The reason is in the text itself. If every audit report went straight to a regulator, sponsors would audit less honestly.
Monitoring: site and centralized
Section 3.11.4 states that monitoring "is one of the principal quality control activities". It also requires that monitoring "should be performed by persons not involved in the clinical conduct of the trial at the site being monitored". E6(R3) describes two kinds:
- Site monitoring (3.11.4.1) — monitoring of activities at the investigator site, including its pharmacy and local laboratories. It may be performed on-site and/or remotely, and may include remote, secure, read-only access to source records.
- Centralized monitoring (3.11.4.2) — evaluation of accumulated data by the sponsor's qualified staff, such as a medical monitor, data scientist or biostatistician. It can complement site monitoring, reduce its extent or frequency, "or be used on its own". It helps identify systemic or site-specific issues.
E6(R3) does not require 100% source data verification. Section 3.11.4.5.4(b) says checking reported data against source records "can be done on the basis of using samples and supported by data analytics, as appropriate". Section 3.11.4.3 says the monitoring plan "should focus on aspects that are critical to quality".
In practice
Dr. Sarah runs a Phase III hypertension site for ABC Pharmaceuticals. Three things happen in one quarter.
In March her monitor, Elena, reviews a sample of source records against the electronic case report forms and raises four queries. That is monitoring, a routine quality control activity.
In June the sponsor's quality assurance group sends an auditor, Tomas. Tomas has never worked on this trial. He does not re-check Elena's queries. He asks how the site decides who may take consent, and asks to see the evidence. That is an audit, and Tomas is independent by design.
In September a regulatory authority notifies the site of an inspection. Part of it will be a remote review of the electronic site file. Dr. Sarah's coordinator asks whether she should hand the inspector Tomas's audit report. The answer is no, not as a routine matter. Under section 3.11.2.2(d), regulators should not routinely request audit reports. If the inspector does request it case by case, the sponsor decides how to respond.
An audit tests the system. Monitoring tests the trial. An inspection tests both, on behalf of the public.
Key takeaways
- Monitoring is a sponsor quality control activity, an audit is a systematic and independent examination by the sponsor, a service provider or the institution, and an inspection is an official review by a regulatory authority.
- ICH E6(R3) section 3.11.2.1 requires auditors to be independent of the trial or processes being audited and qualified by training and experience.
- Section 3.11.2.2(b) says the audit plan is guided by the trial's importance to submissions, participant numbers, trial type and complexity, risk to participants, and any identified problems.
- Under section 3.11.2.2(d), regulatory authorities should not routinely request audit reports and may seek access only case by case, where evidence or suspicion of serious GCP noncompliance exists or in legal proceedings.
- Monitoring under E6(R3) may be site monitoring, performed on-site and/or remotely, or centralized monitoring, which may be used on its own.
- ICH E6(R3) does not require 100% source data verification; sampling supported by data analytics is acceptable, focused on what is critical to quality.