GUIDES: FDA Clinical Trial Compliance and GCP Inspection Readiness
How to Prepare for an FDA BIMO Inspection
A Clinical Investigator’s Compliance Guide
The FDA’s Bioresearch Monitoring (BIMO) program conducted more than 1,000 inspections in FY2023 alone. For cause, routine, and application-triggered inspections all follow the same process: FDA investigators review your study documentation against the protocol, federal regulations, and GCP requirements. The five finding categories that dominate BIMO inspections have not changed in years. This guide covers what FDA looks for, where sites most commonly fail, and what you must have ready before an inspector arrives.
81%
Protocol Deviation Findings
Protocol deviations and violations were cited in approximately 81% of FDA clinical investigator inspections with a finding. This is the single most common BIMO observation category and has held that position for more than a decade.
Published cross-sectional analysis of FDA BIMO citations
1,073
BIMO Inspections in FY2023
FDA’s BIMO program conducted 1,073 inspections in fiscal year 2023, approximately 79% of which were clinical investigators, IRBs, sponsors, CROs, and sponsor-investigators in drug, biologic, and device studies.
FDA BIMO Annual Program Summary, FY2023
6
Warning Letters to Investigators (FY2024)
FDA issued six Warning Letters to clinical investigators, sponsors, and IRBs in FY2024 through mid-year, four of which involved failure to conduct the investigation according to the investigational plan.
FDA Warning Letter Database, FY2024
What Is a BIMO Inspection and Who Gets Inspected
The Bioresearch Monitoring program is FDA’s mechanism for verifying the integrity of data submitted in support of regulatory applications and for confirming that clinical trial participants were adequately protected. FDA can conduct a BIMO inspection at any point during or after a clinical study. The three most common triggers are: routine surveillance inspections, for-cause inspections prompted by a complaint, a safety signal, or an irregularity in a submitted application, and application-triggered inspections conducted when an NDA, BLA, or PMA is under review.
BIMO inspections cover four entity types: clinical investigators, institutional review boards (IRBs), sponsors and monitors, and contract research organizations (CROs). This guide focuses on clinical investigator inspections, which represent the largest BIMO inspection category. The applicable regulations are primarily 21 CFR Part 312 (for IND studies), 21 CFR Part 812 (for IDE studies), 21 CFR Part 50 (informed consent), and 21 CFR Part 56 (IRB requirements). FDA’s compliance program guidance for clinical investigator inspections is CP 7348.811.
Important Note
This guide covers inspection preparation principles for FDA BIMO clinical investigator inspections. It is not legal or regulatory advice. Inspection findings depend on site-specific facts, the applicable protocol, and the specific regulations covering your study. Clinical investigators and research coordinators should consult regulatory counsel and their sponsor’s regulatory team for site-specific guidance. Requirements differ between drug/biologic studies (21 CFR Part 312) and device studies (21 CFR Part 812).
Primary Regulatory References for Clinical Investigator Inspections
21 CFR 312.60 to 312.68
General responsibilities of clinical investigators in IND studies: conduct according to protocol, recordkeeping, drug accountability, safety reporting, and IRB requirements.
21 CFR Part 50
Protection of human subjects: informed consent requirements. Covers when consent must be obtained, what must be disclosed, documentation requirements, and requirements for legally authorized representatives.
21 CFR Part 56
Institutional review boards: composition, operations, review procedures, records. Investigators must maintain documentation of IRB approval, continuing review approvals, and communications.
ICH E6(R2): GCP Guideline
The international GCP standard FDA formally adopted. Addendum R2 (2018) strengthened risk-based monitoring requirements and sponsor oversight obligations. FDA inspectors use ICH E6(R2) as the interpretive framework for GCP compliance.
What Happens During a BIMO Inspection
Most clinical investigator BIMO inspections follow a predictable sequence. Understanding the process removes the uncertainty that makes inspections feel more threatening than they are.
Most inspections are announced by a phone call or letter in advance. Unannounced inspections occur but are less common for clinical investigators. Notification does not mean your records will be reviewed in advance: it means you have time to organize, not to create or alter records.
The FDA investigator presents credentials and a Notice of Inspection (FDA Form 482). The investigator explains the scope and purpose. The principal investigator and key staff should be present. Keep the meeting brief and professional.
The investigator reviews study records: informed consent forms, case histories, delegation of authority logs, training records, investigational product accountability logs, IRB approvals, and protocol deviation records. This is the most time-intensive part of the inspection.
The investigator may interview the PI, research coordinators, pharmacists, and other study staff. Interviews assess whether staff understand the protocol and their responsibilities. Train staff to answer only what is asked, accurately and concisely.
The investigator presents preliminary observations verbally. If objectionable conditions were found, a Form 483 (Inspectional Observations) is issued. If no objectionable conditions exist, the inspection closes without a 483. The PI should take notes during the closeout meeting.
6
Post-Inspection Classification
FDA classifies the inspection as No Action Indicated (NAI), Voluntary Action Indicated (VAI), or Official Action Indicated (OAI). OAI can lead to a Warning Letter, disqualification proceedings, or referral for prosecution. A 483 response is required for all 483 observations.
The Five Top Finding Categories at Clinical Investigator Sites
Published analyses of FDA BIMO citation data consistently identify the same five finding categories at clinical investigator sites. These findings are not one-year anomalies. They reflect recurring, preventable gaps in site operations that FDA has been citing for more than a decade. Understanding them is the foundation of effective BIMO preparation.
1
Protocol Deviations and Violations (21 CFR 312.60)
CITED IN APPROXIMATELY 81% OF INSPECTIONS WITH A FINDING
Under 21 CFR 312.60, investigators are required to conduct studies in accordance with the signed investigator statement (Form FDA 1572) and the investigational plan. FDA consistently finds: subjects enrolled who did not meet eligibility criteria; sites operating off outdated protocol versions; required assessments not performed within protocol-specified windows; deviations that were never documented or reported to the sponsor and IRB.
WHAT FDA INVESTIGATORS LOOK FOR
- Protocol version in use at the site matches the current IRB-approved version
- All subject eligibility verifications are documented in source records
- All protocol deviations are documented, categorized (major/minor), and reported to the sponsor and IRB as required
- Required study visits and assessments are completed within protocol-specified windows and documented
- Any deviation from required procedures has a documented rationale and was not concealed
COMMON MISTAKE
Operating off an older protocol version after an amendment was approved. Sites frequently have the correct protocol in the regulatory binder but continue using outdated source document templates or order sets from the prior version. FDA will compare the protocol in your binder against the procedures actually documented in subject records.
2
Inadequate or Inaccurate Case Histories (21 CFR 312.62)
CITED IN APPROXIMATELY 58% OF INSPECTIONS WITH A FINDING
21 CFR 312.62(b) requires investigators to prepare and maintain adequate and accurate case histories that record all observations and other data pertinent to the investigation for each individual administered the investigational drug or employed as a control. Source documents must support every data point entered in the case report form (CRF). FDA inspectors trace every CRF entry back to a primary source record.
WHAT FDA INVESTIGATORS LOOK FOR
- Every CRF entry is supported by a contemporaneous source document (medical record, lab report, nursing note, or study worksheet)
- Adverse events recorded in source documents match what was reported in the CRF and to the sponsor
- Dates, times, and identifiers are consistent between source records and CRF entries
- No transcription errors, missing entries, or unexplained discrepancies between what the protocol required and what was documented
- Source documents were created at the time of the observation, not reconstructed later
COMMON MISTAKE
Relying on the EMR as the source without confirming that all study-specific observations required by the protocol are captured in the medical record. If a protocol requires a specific assessment that is not part of standard clinical care, it may not appear in the EMR automatically. A missing source document for a CRF entry is a case history deficiency.
3
Informed Consent Deficiencies (21 CFR Part 50)
CITED IN APPROXIMATELY 48% OF INSPECTIONS WITH A FINDING
21 CFR Part 50 establishes detailed requirements for the informed consent process: the eight basic elements of consent, documentation requirements, and the prohibition on enrolling subjects before valid consent is obtained. FDA inspectors cross-reference consent form versions, IRB approval dates, and enrollment dates to verify that subjects signed the correct consent version before any study procedures were performed.
WHAT FDA INVESTIGATORS LOOK FOR
- Consent form in each subject’s file is the IRB-approved version that was current at the time of consent
- Consent was signed and dated before any study procedure was performed (including screening procedures)
- Consent form is signed by both the subject (or LAR) and the person who conducted the consent discussion
- Subjects were re-consented with updated consent forms when protocol amendments changed material information
- Consent forms are complete: no blank signature lines, no missing dates, no correction fluid over required fields
COMMON MISTAKE
Using an outdated consent form version after a protocol amendment was approved. IRB approval of an amendment triggers a re-consenting obligation for enrolled subjects if the amendment changed information material to a subject’s willingness to continue participating. Sites that consent new subjects on updated forms but fail to re-consent existing subjects are frequently cited.
4
Investigational Product Accountability Failures (21 CFR 312.62)
CONSISTENTLY IN THE TOP FIVE ACROSS ALL BIMO INSPECTION YEARS
21 CFR 312.62(a) requires investigators to maintain adequate records of the disposition of each unit of investigational drug: receipt, storage, dispensing, administration, and return or destruction. FDA inspectors perform full accountability reconciliations, comparing what was received against what was dispensed, administered, returned, and destroyed. Quantities must reconcile exactly.
WHAT FDA INVESTIGATORS LOOK FOR
- IP receipt logs showing date, quantity, lot number, and condition upon receipt for every shipment
- Storage condition records (temperature logs) covering the entire period IP was stored at the site
- Dispensing records showing subject ID, date, quantity dispensed, lot number, and name of person who dispensed
- Return or destruction records for unused IP, including quantities returned and disposition method
- Person who dispensed IP is listed on the delegation of authority log with that specific task
- No IP was administered to a subject not authorized under the protocol
COMMON MISTAKE
IP dispensed or verified by a staff member whose name does not appear on the delegation of authority log for that task. FDA cited this exact finding in a 2024 Warning Letter: IP was dispensed and verified by staff members not delegated those tasks. Each person who touches, moves, or documents IP must be explicitly listed on the DOA log with the applicable task.
5
Safety Reporting Gaps (21 CFR 312.64 and 312.32)
CONSISTENTLY IN THE TOP FIVE
Investigators must promptly report adverse events to the sponsor, and must immediately report any serious adverse event to the sponsor whether or not the investigator considers the event to be drug-related. FDA inspectors review adverse event records in source documents and compare them against what was reported to the sponsor and what the sponsor then reported to FDA. Discrepancies between what happened clinically and what was reported are a significant finding.
WHAT FDA INVESTIGATORS LOOK FOR
- All adverse events documented in source records appear in the adverse event log and were reported to the sponsor per the protocol’s reporting timeline
- All serious adverse events (SAEs) were reported to the sponsor immediately, regardless of causality assessment
- The investigator’s causality assessment for each SAE is documented
- Unanticipated problems involving risks to subjects or others were reported to the IRB
- No adverse events documented in subject records that do not appear in study reporting
COMMON MISTAKE
Failing to report an SAE because the investigator did not believe it was related to the study drug. Causality assessment does not gate SAE reporting. Investigators must report all SAEs to the sponsor immediately and allow the sponsor to make the regulatory determination about IND safety reporting. Withholding an SAE because it seemed unrelated is a violation of 21 CFR 312.64.
The Regulatory Binder: What Must Be in It and in What Condition
The regulatory binder (also called the Investigator Site File) is typically the first thing an FDA investigator requests. Its organization and completeness make an immediate impression and set the tone for the rest of the inspection. A well-organized binder does not guarantee a clean inspection, but a disorganized or incomplete one almost guarantees a difficult one.
Required Document
Common Gap
FDA Form 1572 (Investigator Statement)
Outdated version; missing sub-investigator signatures; IRB name not updated after IRB change
Current and all prior approved protocol versions
Only current version retained; no record of when amendments were implemented at the site
All IRB approvals and continuing review approvals
Gap in continuing review approvals; amendment approvals missing; IRB approval letter for current consent version not on file
All versions of the informed consent form
Only current version retained; no IRB-stamped copies; versions not clearly labeled with version date
Investigator Brochure (current version)
Outdated IB version; no record of when updated IB was received and distributed to study staff
Delegation of Authority (DOA) log
Missing staff members who performed study tasks; tasks not listed at the granular level FDA expects; dates not current
Training records for all study staff
GCP certificates expired or missing; no protocol-specific training records after amendments; equipment training not documented
CV and medical license for PI and all sub-investigators
Expired medical license on file; CV not updated within 2 years; no CV for sub-investigators added mid-study
Financial disclosure forms (FDA Form 3455 or 3454)
Not updated when circumstances changed; missing for sub-investigators; incorrect form version used
Protocol deviation log
Deviations documented in source records but not in a centralized log; major deviations not reported to sponsor and IRB; no CAPA documentation for recurring deviations
Sponsor and IRB correspondence
Incomplete email archive; verbal communications not reduced to writing; safety letters not filed with receipt date
Laboratory certifications and normal ranges
Expired lab certification; normal ranges from a lab not certified for clinical trials; ranges not updated when lab updated its reference intervals
Source: FDA BIMO Compliance Program Guidance 7348.811 | ICH E6(R2) Essential Documents | 21 CFR Parts 312 and 812
Delegation of Authority Log: The Most Misunderstood Document
The Delegation of Authority (DOA) log is one of the most frequently deficient documents at clinical investigator sites and one of the most consequential. Under GCP and FDA’s interpretation of 21 CFR 312.60, the principal investigator cannot personally perform every study task but remains responsible for ensuring all delegated tasks are performed by appropriately trained and qualified individuals. The DOA log is the mechanism that documents this delegation.
Who Must Be Listed
Every person who performs any study-related task must be listed on the DOA log. This includes research coordinators, nurses, pharmacists, lab technicians, data entry staff, and any other person who touches study data or performs any procedure for study purposes. If a person performed a task and is not on the DOA log for that specific task, FDA treats it as an unauthorized action.
Task Specificity
The DOA log must list specific tasks, not just role names. “Research coordinator” is not a task. “Administer IP,” “perform informed consent process,” “collect blood samples,” “enter data in eCRF,” and “check eligibility criteria” are tasks. FDA inspectors look for the specific task performed and verify it is listed on the DOA log for the person who performed it.
Dates and Signatures
The DOA log must show the date each delegation began and, when applicable, ended. A staff member who left the study team must have an end date. The PI must sign the DOA log to authorize each delegation. Each delegated staff member must also sign to confirm they accept the delegated responsibilities and have the required training and qualification.
Cross-Referencing Training Records
Every person listed on the DOA log must have training records that support the tasks they are delegated. FDA inspectors routinely cross-reference the DOA log against the training record file. A person listed as authorized to perform IP administration must have documented training in IP handling under the study protocol before that authorization was effective.
Preparing for the Inspection: A Pre-BIMO Readiness Checklist
Pre-BIMO Inspection Readiness Checks
Protocol version audit
Confirm the protocol version in your regulatory binder matches the current IRB-approved version. Check that all site SOPs, order sets, source document templates, and visit schedules reflect the current protocol version, not a prior amendment.
Consent form audit
Verify every enrolled subject was consented on the correct version for the time of their consent. Confirm all re-consenting obligations from protocol amendments have been completed and documented. Check every consent form for completion (no blank signatures, dates present, legible).
DOA log completeness check
Review your DOA log against your actual study roster. Every person who performed any study task must be listed with the specific tasks. Compare against your training records file to confirm every person listed on the DOA log has training documentation supporting their delegated tasks.
IP accountability reconciliation
Perform a complete IP accountability reconciliation before the inspection: total received minus total dispensed minus total returned/destroyed should equal current inventory. Any discrepancy must be investigated and explained before an FDA investigator finds it unexplained.
Adverse event and SAE audit
Review all adverse events documented in source records and confirm each one appears in the AE log and was reported to the sponsor per protocol timelines. Confirm all SAEs were reported to the sponsor immediately regardless of causality. Check that all sponsor SAE acknowledgments are on file.
Source document to CRF verification
For a sample of subject records, trace every CRF entry back to a source document. Confirm dates and values match. Flag any CRF entry that cannot be supported by a source document and investigate before the inspection.
IRB approval continuity check
Confirm that there is no gap in IRB approval coverage: initial approval, all continuing review approvals, and all amendment approvals must form an unbroken chain from study initiation to present. Any gap in IRB approval coverage means that study activity continued without valid IRB oversight, which is a serious finding.
Source: FDA BIMO Compliance Program Guidance 7348.811 | ICH E6(R2) | 21 CFR Parts 50, 56, 312
Managing the Inspection: Practical Guidance for Staff
How your team behaves during an inspection matters as much as what your records show. FDA investigators are experienced and trained to identify evasion, confusion, and inconsistency. These practical guidelines apply to everyone who may interact with the investigator during an inspection.
- Answer only what is asked. Volunteering information beyond what is requested is the most common inspection communication mistake. Answer the specific question asked, accurately and briefly, and stop. If you do not know the answer, say so and offer to find out.
- Do not speculate. If you are asked why something was done a certain way and you do not know, say you do not know rather than guessing. An inaccurate speculative answer is worse than an honest statement that you need to check.
- Produce records promptly. When the FDA investigator requests a document, retrieve it promptly. Delays in record retrieval raise questions about document availability and organization. Have a designated person responsible for retrieving records throughout the inspection.
- Document everything during the inspection. Keep your own notes of every document requested, every question asked, and every response given. These notes are the basis of your post-inspection response if a Form 483 is issued.
- Do not alter, recreate, or backdate records. Any alteration of records after an inspection has been announced, or during an inspection, is a serious federal offense. If a record is missing or incomplete, the appropriate response is to note the gap and explain what happened, not to create a document that did not previously exist.
- Involve your sponsor. Notify your sponsor immediately when you receive notice of a BIMO inspection and keep them informed throughout. The sponsor has regulatory obligations that depend on inspection developments at your site. Many sponsors have inspection support teams available to assist.
Responding to a Form 483
If the FDA investigator identifies objectionable conditions, a Form 483 (Inspectional Observations) is issued at the closeout meeting. A 483 is not a final agency action and is not equivalent to a Warning Letter. It is a list of observations that the investigator believes require a response. A written response should be sent to the FDA district office within 15 business days of the inspection closeout.
A strong 483 response addresses each observation specifically, acknowledges what occurred, provides root cause analysis, describes the corrective actions already implemented, and commits to specific additional actions with timelines. A response that disputes every observation without acknowledgment is generally less effective than one that demonstrates genuine corrective action. FDA evaluates both the content of the response and the speed and credibility of corrective action taken.
Key Takeaways
Protocol Deviations Are the Top Finding for a Reason
81% of inspections with a finding include a protocol deviation observation. The most reliable prevention is a site-level deviation management process that catches, documents, categorizes, and reports every deviation in real time rather than discovering them during a pre-inspection audit when they are harder to explain and already late to report.
Your DOA Log and Training Records Must Match
FDA inspectors routinely cross-reference the DOA log against training records. Every person listed as authorized to perform a study task must have training documentation supporting that authorization, with the training completed before the task was delegated. A DOA log entry without a supporting training record is a dual finding: unauthorized delegation and inadequate training records.
Source Documents Must Support Every CRF Entry
FDA inspectors trace CRF entries back to primary source records. A data point in a CRF that cannot be found in a source document is not just a case history deficiency: it raises data integrity questions that can affect the integrity classification of the entire inspection and, if serious enough, the regulatory application the trial data supports.
Preparation Is Continuous, Not Pre-Inspection
A BIMO inspection can be announced with little notice. Sites that maintain ongoing inspection readiness through regular internal audits, real-time deviation management, and contemporaneous documentation are in a fundamentally different position than those who scramble to organize records after receiving an inspection notification.
Frequently Asked Questions
Can I refuse to let FDA inspect my site?
No. Investigators who agree to conduct a clinical investigation under an IND or IDE agree to permit FDA inspections as a condition of that agreement. Refusing or substantially obstructing an FDA inspection is a serious violation that can result in disqualification proceedings. If you have legal concerns about the scope or conduct of an inspection, contact your institutional legal counsel immediately but do not refuse access to the inspector.
What is the difference between a 483 and a Warning Letter?
A Form 483 is issued at the end of an inspection and lists the investigator’s observations. It is a preliminary action, not a final agency determination. A Warning Letter is issued after a review of the full inspection record and 483 response, and represents FDA’s conclusion that significant violations occurred that require correction. A 483 does not automatically lead to a Warning Letter, and a strong corrective action response can prevent escalation.
What happens if FDA disqualifies a clinical investigator?
A disqualified investigator may not receive investigational articles and may not conduct any clinical investigations for which an IND is required. The sponsor and IRB must be notified. Data from studies conducted by the disqualified investigator may be rejected in pending regulatory applications. Disqualification is a significant enforcement action with serious long-term consequences for the investigator’s ability to conduct clinical research.
Do we need to notify our sponsor when we receive an inspection notice?
Yes. Notify your sponsor immediately upon receipt of an inspection notification. The sponsor has their own regulatory obligations that depend on the inspection, including potential IND reporting obligations, and many sponsors have inspection support resources available to assist the site. Check your clinical trial agreement and the protocol for specific notification requirements.
Government and Regulatory Sources
Industry References
Related VelSafe Articles
Inspection Readiness Is a Year-Round Program, Not a Pre-Inspection Sprint
The sites that receive NAI or VAI inspection classifications are rarely the ones who scrambled to prepare after receiving a BIMO notification. They are the ones who maintain continuous documentation discipline, run periodic internal audits against the same finding categories FDA cites most often, and manage deviations, adverse events, and IP accountability in real time. Build inspection readiness into your site operations from the first day of the study. The inspection clock starts the day you open enrollment, not the day you receive an FDA letter. Find more clinical trial compliance resources at velsafe.com.
