Study guide
3.4 Quality Audits, Regulatory Inspections, Non-Compliance & Root Cause Analysis / CAPA
ACRP Certified Professional ACRP-CP
Track your progress as you read
Finished sections get a check mark.
1 Chapter 1: GCP Principles, Roles & Delegation
1.1 The Eleven ICH E6(R3) Principles of GCP & Guideline Structure 1.2 Sponsor & Investigator Responsibilities and Delegation of Authority 1.3 Staff Training, Qualifications & Delegation of Authority Log (DOAL) 1.4 CRO Oversight, Vendor Management & Transfer of Regulatory Obligations (TORO)
2 Chapter 2: Essential Records, Source Documentation & Data Confidentiality
2.1 Essential Records Before, During and After the Trial (ICH E6(R3) Appendix C) 2.2 Trial Master File (TMF) and Investigator Site File (ISF) Structure & Inspection Readiness 2.3 Source Documentation, ALCOAC Principles & Medical Record Standards 2.4 Confidentiality, Privacy & Protection of Participant Personal Information
3 Chapter 3: Monitoring, Quality Management & Audits
3.1 Risk-Based Quality Management (RBQM) & Quality Management Systems (QMS) 3.2 Monitoring Visit Types: Site Selection, SIV, IMV, and Close-Out 3.3 Risk-Based Monitoring (RBM), Centralized Monitoring & Source Data Verification (SDV vs SDR) 3.4 Quality Audits, Regulatory Inspections, Non-Compliance & Root Cause Analysis / CAPA
4 Chapter 4: Site Feasibility, Start-Up, Facilities & Laboratory Operations
4.1 Site Feasibility Assessment, Capability Analysis & Investigator Selection 4.2 Contractual Agreements: Clinical Trial Agreements, Budgets, Indemnification & Financial Arrangements 4.3 Site Initiation Preparation, System Access & Regulatory Greenlight 4.4 Protocol Review, Operational Feasibility & Institutional Approvals 4.5 Site Facilities, Equipment Maintenance, Calibration & Trial Supplies 4.6 Biological Samples & Hazardous Goods: Collection, Storage, Disposal & Shipment
5 Chapter 5: Subject Recruitment, Retention & Study Visits
5.1 Subject Recruitment Strategies, Advertising Guidelines & Ethical Constraints 5.2 Screening, Eligibility Verification & Inclusion/Exclusion Adherence 5.3 Subject Retention, Compliance, Visit Scheduling & Protocol Window Management 5.4 Managing Lost to Follow-Up, Subject Withdrawal & Early Termination Procedures
6 Chapter 6: Protocol Compliance, Deviations & Site Close-Out
6.1 Protocol Compliance, Waivers vs. Violations & Deviation Management 6.2 Investigational Site Close-Out Activities & Final Reconciliations 6.3 Record Retention, Archiving Requirements & Post-Trial Responsibilities
7 Chapter 7: Research Ethics, Vulnerable Populations & Research Integrity
7.1 Historical Milestones: Nuremberg Code, Belmont Report & Declaration of Helsinki 7.2 Ethical Principles: Beneficence, Non-Maleficence, Autonomy, Justice & Equipoise 7.3 Vulnerable Populations (Pediatrics, Pregnant Women, Prisoners, Cognitively Impaired, Economically Disadvantaged) 7.4 Conflict of Interest, Research Misconduct & Fraud in Clinical Research
8 Chapter 8: Informed Consent & Institutional Review Boards (IRB/IEC)
8.1 Informed Consent Elements, Process & Ongoing Consent / Re-Consent Requirements 8.2 Assent in Minors & Legally Acceptable Representative (LAR) Requirements 8.3 IRB/IEC Composition, Functions, Review Types (Full, Expedited, Exempt) & Continuing Review
9 Chapter 9: Safety Reporting & Adverse Event Management (ICH E2A)
9.1 Adverse Events (AE) vs. Adverse Drug Reactions (ADR) & Serious Adverse Events (SAE) Definitions 9.2 Causality Assessment, Expectedness, Reference Safety Information (RSI) & SUSARs 9.3 Expedited Reporting Timelines (7-day fatal/life-threatening, 15-day other serious) & Periodic Safety Updates (DSUR)
10 Chapter 10: Investigational Product (IP) Management & Accountability
10.1 Investigational Product Lifecycle, Labeling, Packaging & Blinding Procedures 10.2 IP Shipping, Receipt, Temperature Monitoring, Excursion Handling & Chain of Custody 10.3 IP Storage, Dispensing, Accountability Logs & Destruction/Return Procedures 10.4 Emergency Unblinding (Code Breaking) Protocols & Subject Safety Procedures
11 Chapter 11: Regulatory Frameworks, Submissions & Product Reference Information
11.1 Stakeholders, Regulatory Institutions & Global Frameworks in Clinical Research 11.2 Protocol Submission, Approval & Amendment Processes 11.3 Investigator's Brochure, Instructions for Use & Reference Product Information 11.4 Regulatory Reporting Requirements Before and After Marketing Authorisation
12 Chapter 12: Clinical Data Management, EDC & Electronic Records
12.1 Electronic Data Capture (EDC), eCRF Design & Clinical Data Management Systems (CDMS) 12.2 Computerised Systems, Data Governance & Audit Trails (ICH E6(R3) Annex 1 §4) 12.3 Data Validation, Edit Checks, Discrepancy / Query Management & Resolution 12.4 Medical Coding (MedDRA, WHO Drug), SAE Reconciliation, Data Transfer & Database Lock
13 Chapter 13: Trial Design, Biostatistics, Data Monitoring & Transparency
13.1 Phases of Clinical Research (Phase 0, I, II, III, IV) & Translational Medicine 13.2 Study Designs: Parallel, Crossover, Factorial, Adaptive & Non-Inferiority / Equivalence 13.3 Randomization Schemes, Stratification, Blinding Methods & Minimizing Bias 13.4 Endpoints (Primary, Secondary, Surrogate, Composite), Sample Size & Biostatistical Concepts (p-values, CI, ITT vs PP) 13.5 Interim Analyses, DSMB/IDMC Oversight & Efficacy and Safety Evaluation Milestones 13.6 Trial Registration, Results Transparency & Communicating Results to Participants
3.4 Quality Audits, Regulatory Inspections, Non-Compliance & Root Cause Analysis / CAPA
Key Takeaways Explain This Topic AI
Sponsor Quality Audits are independent, systematic quality assurance evaluations separate from routine monitoring, and their internal reports are confidential under ICH E6(R3) Annex 1 section 3.11.2.
Regulatory Inspections are official statutory reviews conducted by government authorities (FDA BIMO, EMA) to evaluate GCP compliance and data validity for marketing approvals.
An FDA Form 483 lists inspectional observations at the close of an inspection; the recipient has exactly 15 business days to respond in writing with a comprehensive CAPA plan.
Root Cause Analysis (RCA) must look beyond superficial human error to identify systemic failure modes using structured methodologies like the '5 Whys' and the Ishikawa (Fishbone) diagram.
A complete CAPA lifecycle consists of five stages: Problem Identification & Containment, Root Cause Analysis, SMART Action Plan Development, Implementation, and mandatory Effectiveness Verification.
Last updated: August 2026
Audits vs. Regulatory Inspections vs. Routine Monitoring
Exam scope note: This section cites national regulations (for example US Code of Federal Regulations provisions) because they shape day-to-day practice. ACRP states the ACRP-CP exam is referenced only to ICH Guidelines and that no country-specific framework is tested. Treat those citations as professional context; the provision examined here is ICH E6(R3) Annex 1 sections 3.11.1–3.11.2 (Quality Assurance and Audit) and 3.12 (Noncompliance) , with Principle 6.3 on preventing recurrence of serious noncompliance.
A critical distinction on the ACRP-CP exam involves differentiating between routine monitoring, independent quality audits, and regulatory inspections. +-----------------------------------------------------------------------------------------+
- | THE THREE LEVELS OF OVERSIGHT |
- | |
- | 1. Routine Monitoring (CRA) --> Operational oversight & day-to-day data checks |
- | 2. Quality Audit (Sponsor QA) --> Independent systematic quality assurance (Internal) |
- | 3. Regulatory Inspection (FDA) --> Statutory legal compliance review (External) |
- +-----------------------------------------------------------------------------------------+
- Comparative Analysis
Parameter Routine Monitoring Quality Audit (Sponsor QA) Regulatory Inspection
Regulatory Reference ICH E6(R3) Annex 1 section 3.11.4 ICH E6(R3) Annex 1 section 3.11.2 ICH E6(R3) Glossary (Inspection)
Who Conducts It Clinical Research Associate (CRA / Monitor) Independent Quality Assurance (QA) auditor (sponsor or third-party) Regulatory Authority Inspector (e.g., FDA BIMO investigator, EMA inspector)
Relationship Part of the active study operations team Independent of clinical operations and monitoring teams External government regulatory official
Primary Objective Day-to-day verification of trial conduct, subject safety, consent, and data accuracy Systematic evaluation of trial conduct, SOP compliance, QMS integrity, and monitoring effectiveness Statutory assessment of participant protection, GCP compliance, and data validity for drug approval
Confidentiality Monitoring reports are reviewed by sponsor operations and filed in TMF Audit reports are confidential internal QA documents exempt from routine regulatory inspection (ICH E6(R3) Annex 1 3.11.2(c)) Inspection reports (EIR, Form 483, Warning Letters) become public records under Freedom of Information Act
Frequency Periodic, ongoing throughout the trial Sample-based (e.g., high-enrolling sites, routine vendor audits, or for-cause) Routine (pre-approval / marketing application) or For-Cause (whistleblower, safety signals)
- Regulatory Inspections: The FDA BIMO Program and EMA Framework
- The FDA Bioresearch Monitoring (BIMO) Program
The FDA BIMO program is a comprehensive, agency-wide program of on-site inspections and data audits designed to monitor clinical trials involving FDA-regulated investigational products. +----------------------------+
- | FDA BIMO PROGRAM |
- +----------------------------+
- |
- +------------------------------+------------------------------+
- | | |
- v v v
- +--------------------+ +--------------------+ +--------------------+
- | CLINICAL | | SPONSORS / | | INSTITUTIONAL |
- | INVESTIGATORS | | CROs | | REVIEW BOARDS |
- | - 21 CFR 312 / 812 | | - 21 CFR 312.50 | | - 21 CFR 56 |
- | - Form FDA 1572 | | - Vendor oversight | | - IRB composition |
- | - Source records | | - Monitoring plans | | - Meeting minutes |
- +--------------------+ +--------------------+ +--------------------+
- Types of Regulatory Inspections
Routine / Surveillance Inspections (Data Audits) :
Conducted in support of pending New Drug Applications (NDA), Biologics License Applications (BLA), or Premarket Approvals (PMA).
Sites selected based on high enrollment, significant contribution to primary efficacy data, or geographical representation.
For-Cause / Directed Inspections :
Triggered by specific concerns, such as:
Whistleblower complaints or former employee allegations.
Severe safety anomalies or high numbers of unexplained SAEs.
Unusual recruitment velocity (e.g., enrolling 100 subjects in 2 weeks when other sites enroll 5).
Suspicious statistical distributions or zero AE reporting flagged during centralized monitoring.
Prior history of non-compliance by the investigator.
Inspection Process & Regulatory Tools
Notice of Inspection (Form FDA 482) : The FDA investigator presents official credentials and the formal Form FDA 482 upon arrival at the facility.
Conduct : The inspector reviews original medical charts, informed consent documents, pharmacy logs, temperature records, DOAL, training files, and correspondence.
Exit Interview : The inspector meets with the PI and key staff to discuss findings.
- Inspection Outcomes and Enforcement Actions Inspection Exit Interview
- |
- v
- [Form FDA 483 Issued?]
- | |
- |-- No ------->|===> Establishment Inspection Report (EIR) Classified as NAI
- |
- +-- Yes -------> 15-Day Written Response with CAPA
- |
- v
- Agency Review of Response & EIR
- |
- +-----------+-----------+
- | |
- v v
- [VAI Response] [OAI Response]
- Voluntary action; Significant violations;
- Satisfactory CAPA FDA Warning Letter / Sanctions
- 1. FDA Form 483 (Inspectional Observations)
Issued to the PI/firm at the close of an inspection if the FDA investigator observes objectionable conditions representing violations of the Food, Drug, and Cosmetic Act or federal regulations.
The 15-Day Rule : The site/sponsor has exactly 15 business days from receipt of Form 483 to submit a comprehensive, formal written response detailing immediate corrections, root cause analysis, and systemic corrective actions.
2. Establishment Inspection Report (EIR) Classifications
Following the inspection, the FDA classifies the establishment's compliance status:
NAI (No Action Indicated) : No objectionable conditions or practices were found.
VAI (Voluntary Action Indicated) : Objectionable conditions were found, but they do not meet the threshold for regulatory action. The site is expected to voluntarily implement corrective actions.
OAI (Official Action Indicated) : Significant, serious objectionable conditions were found warranting formal regulatory, administrative, or judicial sanctions.
3. Escalated Regulatory Enforcement Actions
FDA Warning Letter : A formal, publicly published notification issued for serious GCP violations (e.g., failure to obtain informed consent, failure to report SAEs, failure to maintain drug accountability). Requires a formal written response within 15 business days.
Notice of Opportunity for Hearing (NOOH) : Formal administrative proceeding initiating disqualification of an investigator.
Investigator Disqualification / Debarment : The FDA legally bars an investigator from receiving investigational drugs or devices under 21 CFR 312.70 / 812.119, placing them on the FDA Disqualified/Restricted Investigator List (the "Blacklist").
Clinical Hold : An FDA order under 21 CFR 312.42 to suspend an ongoing clinical trial or prevent its initiation due to participant safety risks.
Root Cause Analysis (RCA): Methodologies and Depth
When non-compliance or quality defects occur, simply retraining an individual or correcting a single data entry is insufficient. Regulatory agencies and GCP standards require identifying the underlying systemic root cause .
1. The "5 Whys" Technique
An iterative interrogative technique used to explore the cause-and-effect relationships underlying a clinical trial defect. Defect: Subject 103 received an expired vial of Investigational Product.
|-- Why #1: Why did the subject receive expired IP?
| --> The CRC pulled the vial from the primary shelf without checking the expiry date.
|-- Why #2: Why was an expired vial on the primary dispensing shelf?
| --> The site staff failed to remove it when the expiration date passed.
|-- Why #3: Why was it not removed when it expired?
| --> There was no monthly inventory reconciliation protocol in the site pharmacy SOP.
|-- Why #4: Why was there no monthly reconciliation protocol?
| --> The site adopted a generic pharmacy SOP that lacked trial-specific IP accountability rules.
|-- Why #5: Why was a generic SOP adopted without review?
--> (ROOT CAUSE): Inadequate quality governance and lack of a qualified pharmacist review
during study start-up.
- 2. The Ishikawa (Fishbone / Cause-and-Effect) Diagram
- Categorizes potential root causes across six fundamental domains: PEOPLE METHODS MACHINES
- Staff turnover Inadequate SOPs EDC software bug
- Lack of training Ambiguous protocol Centrifuge failure
- \ \ /
- \ \ /
- +-------------------------+-------------------+
- | | ===> [QUALITY DEFECT]
- +-------------------------+-------------------+
- / / \
- / / \
- Faulty lab kits Missing source docs High clinic workload
- Wrong tube additive Uncalibrated device Power outage
- MATERIALS MEASUREMENT ENVIRONMENT
- Corrective and Preventive Action (CAPA) Development
A CAPA plan is a structured, regulatory-compliant framework to remediate identified non-compliance and prevent its recurrence.
Component Definition Real-World Clinical Example
Correction / Containment Immediate action taken to contain the defect and protect currently enrolled subjects. Immediately quarantine all remaining expired IP vials; conduct clinical safety assessment and liver function tests on Subject 103.
Root Cause Analysis (RCA) Systematic investigation to identify the fundamental systemic vulnerability. Fishbone analysis reveals lack of documented monthly pharmacy expiration tracking and absence of dual-staff sign-off.
Corrective Action (CA) Action taken to eliminate the cause of an existing non-conformity to prevent its recurrence. Revise Site Pharmacy SOP to mandate bi-weekly expiration audits; implement dual-independent-check log before any IP is dispensed.
Preventive Action (PA) Action taken to eliminate the cause of a potential non-conformity across other trials/departments. Perform comprehensive inventory audits across all active clinical trial drug storage units across the entire institution.
Effectiveness Check Pre-planned, objective evaluation conducted after a defined period to verify the CAPA resolved the issue permanently. Audit 100% of IP dispensations at 30, 60, and 90 days post-implementation to confirm zero expired dispensations and 100% compliance with dual sign-off.
SMART Criteria for CAPA Plans
Every action item in an audit/inspection CAPA plan must meet the SMART criteria:
Specific : Clearly define what action will be taken, which SOP will be modified, or what training will occur.
Measurable : Establish objective metrics (e.g., 100% attendance, zero repeat deviations).
Achievable / Assignable : Assign a single named responsible owner with appropriate authority (e.g., Lead Pharmacist, PI).
Realistic / Relevant : Ensure the action directly addresses the root cause identified.
Time-bound : Establish strict, unambiguous deadlines (e.g., "Completed within 30 calendar days of CAPA approval" ).