Who Inspects, on What Authority, and What They May Demand

Part of Regulatory Affairs and the Jurisdiction Map: Inspections and Regulatory Correspondence.

About 6 minutes. Free, in your language, no account needed.

Why this matters

A regulatory inspection is not an audit. An audit is something a sponsor arranges, on terms it influences, with findings it owns. An inspection is conducted by a statutory authority exercising a legal power, and the sponsor's role is to comply rather than to negotiate.

Understanding the authority's actual powers, which are broader than teams expect and narrower than they fear, determines whether an inspection goes well.

Who inspects

The national regulatory authority of any country where the trial runs, inspecting sites, the sponsor, and frequently the vendors the sponsor used.

A foreign authority, where a trial conducted in one country supports an application in another. An authority routinely inspects sites outside its own territory when data from those sites is being used to support a marketing application in its jurisdiction. Teams are surprised by this, and they should not be: the data is being offered to that regulator, and the regulator may verify it.

The ethics committee, in some jurisdictions, with its own oversight visits.

The consequence is that a single site can be inspected by its own national authority, and separately by a foreign authority whose market the data supports, on different scopes and different criteria.

What they may demand

Powers vary with the national instrument, and the common core is broad:

Access to the premises where the trial is or was conducted, including the pharmacy, the laboratory and wherever records are held.

Access to records, including source documents, the trial master file, correspondence, electronic systems and their audit trails, and financial records relating to the trial.

To interview staff, including people the sponsor would rather they did not interview, and without a sponsor representative present where the inspector so requires.

To take copies of records.

To inspect the investigational product and its storage, handling and accountability records.

What an inspector generally may not demand is another participant's identifiable information beyond what the inspection requires, and access to material genuinely outside the inspection's scope. These are real limits and they are narrow. A team that spends an inspection litigating them has chosen a poor strategy.

What they are actually looking for

Inspectors are not hunting for typographical errors. They are testing a small number of propositions:

That the participants were real, eligible, and consented before anything happened to them.

That what the record says happened, happened, verifiable against source.

That the product given was the product intended, traceable from receipt to administration.

That safety information moved to the people who needed it, inside the required time.

That the sponsor oversaw what it delegated, with evidence rather than assertion.

That deviations were identified, reported and acted on, rather than absent because nobody looked.

Almost every finding of consequence maps to one of these. A team that prepares against these six propositions prepares well; a team that prepares by tidying the file prepares for the wrong thing.

The regulatory professional's role during an inspection

You are usually not the person answering questions about clinical conduct. Your role is narrower and specific.

You own the regulatory history. What was authorized, when, by whom, under what conditions, and how each modification was handled per jurisdiction. If an inspector asks when the site became authorized to run version 4 of the protocol, that answer is yours and it should take seconds.

You own the correspondence record. Every question from the authority and every answer, with dates.

You do not speculate. "I do not know, and I will find out and come back to you within the hour" is a complete and professional answer. A guess that turns out to be wrong converts a documentation question into a credibility question, and credibility is the thing you cannot rebuild during the inspection.

In practice

An authority announces an inspection of the sponsor covering a trial that ran in nine countries.

The regulatory lead's preparation is a single document: a chronology per country. Authorization date and reference. Each modification with its classification, its submission date, its authorization date, and the date each site implemented. Each safety report with its clock and its recipients. Each regulatory question with its answer and dates.

Nine columns, four years, one page per country.

On the second day the inspector asks why a site implemented a modification eleven days before the authorization in that country. The lead has the row. The implementation date is correct, the authorization date is correct, and the eleven day gap is real and was self-identified and reported two years ago, with the report in the file.

The finding that results is about the original deviation, which is unavoidable. What does not happen is the far worse outcome where the sponsor cannot explain its own chronology and the inspector concludes that nobody was tracking it.

What this looks like when it goes wrong

An inspector asks for the authorization covering the protocol version in use at a site, and the team produces the most recent authorization in the file.

It is the wrong document: it covers a later version, and the site had been running an earlier one for four months due to a staggered rollout. The team, not realizing, states that the site was authorized for what it was running.

The statement is incorrect. When the inspector establishes the actual sequence from the site's own records, the sponsor has not only a deviation but an incorrect statement made during an inspection.

The deviation was survivable. The incorrect answer was not necessary, and it happened because someone answered from memory under pressure instead of from the chronology.

Key takeaways