| name | audit-preparation |
| description | Prepare for regulatory audits and inspections from FDA, EMA, and sponsors including checklist generation, document review, gap analysis, CAPA preparation, and common findings remediation. |
Audit Preparation
Purpose
Prepare Talosix for regulatory audits and inspections of EDC systems used in clinical trials. Covers FDA inspections, EMA inspections, sponsor audits, and internal quality audits with systematic readiness assessment.
When to Use
- Notification of upcoming regulatory inspection
- Scheduled sponsor audit
- Internal audit program execution
- Post-audit CAPA development and tracking
- Ongoing inspection readiness maintenance
- New client due diligence audit
Audit Types
FDA Inspection
Triggers: Pre-Approval Inspection (PAI), routine surveillance, for-cause investigation, NDA/BLA review.
Scope typically covers:
- 21 CFR Part 11 compliance
- System validation documentation
- Data integrity controls
- Electronic signature implementation
- Audit trail review
- Change control records
- SOPs and training records
- CAPA history
Duration: Typically 3-5 days on-site (or remote).
EMA/National Competent Authority Inspection
Triggers: GCP inspection program, marketing authorization application, for-cause.
Scope typically covers:
- EU Annex 11 compliance
- Computerised system validation
- Data integrity per ALCOA+ principles
- GDPR compliance for clinical data
- Vendor qualification
- Business continuity
Sponsor Audit
Triggers: Vendor qualification, periodic oversight, for-cause.
Scope varies by sponsor but typically includes:
- System validation summary
- SOPs and compliance documentation
- Security and access controls
- Data handling procedures
- Change control and release management
- Incident and CAPA history
- Business continuity and disaster recovery
- Subcontractor management
Pre-Audit Preparation
Phase 1: Audit Notification Response (Days 1-3)
- Acknowledge receipt of audit notification
- Identify audit scope from notification letter
- Assign audit coordinator (typically QA lead)
- Form preparation team with subject matter experts
- Establish preparation timeline working backward from audit date
- Communicate audit details to all affected departments
Phase 2: Document Readiness Review (Days 3-14)
Core Document Inventory
Verify availability and currency of:
Validation Documentation:
[ ] Validation Master Plan (current version)
[ ] System validation protocols (IQ, OQ, PQ)
[ ] Validation execution records
[ ] Validation summary reports
[ ] Requirements traceability matrix
[ ] Risk assessments
SOPs:
[ ] All GxP SOPs current (not past review date)
[ ] SOP index/master list
[ ] Superseded SOP archive accessible
Training Records:
[ ] Training matrix for all system users
[ ] Training records for current SOPs
[ ] Role-specific qualification records
[ ] CV/resume file for key personnel
Change Control:
[ ] Change control register (complete)
[ ] Recent change requests (last 12-24 months)
[ ] Emergency change records
[ ] Change implementation evidence
Quality Records:
[ ] CAPA log (open and closed)
[ ] Deviation log
[ ] Incident reports
[ ] Internal audit reports
[ ] Management review minutes
System Records:
[ ] System configuration documentation
[ ] Access control matrix (current)
[ ] User account list with roles
[ ] Periodic access review records
[ ] Audit trail samples
[ ] Backup and recovery test records
[ ] Disaster recovery test records
[ ] Security assessment reports
Document Gap Analysis
For each document category:
| Document | Required | Available | Current | Complete | Gap | Remediation | Owner | Due Date |
|----------|----------|-----------|---------|----------|-----|-------------|-------|----------|
Phase 3: System Readiness Verification (Days 7-21)
Technical Checklist
Audit Trail:
[ ] Audit trail active on all GxP tables
[ ] Audit trail entries include who, what, when, old value, new value
[ ] Reason for change captured where required
[ ] Audit trail cannot be disabled by users
[ ] Audit trail readable and exportable
[ ] Sample audit trail report generated and reviewed
Access Controls:
[ ] All accounts are individual (no shared/generic accounts)
[ ] Dormant accounts disabled (per policy, typically 90 days)
[ ] Role assignments appropriate (no excessive privileges)
[ ] Password policy enforced (complexity, expiration, history)
[ ] Session timeout configured and working
[ ] Account lockout functioning
Electronic Signatures:
[ ] Signatures require unique ID + password
[ ] Signature meaning displayed and recorded
[ ] Signed records show signer name, date/time, meaning
[ ] Consecutive signatures require full re-authentication
[ ] Signature binding to record is intact
System Administration:
[ ] Time synchronization verified (NTP)
[ ] SSL/TLS certificates valid and not expiring soon
[ ] Backup schedule current and verified
[ ] Most recent backup restoration test documented
[ ] System monitoring active
[ ] Capacity adequate
Phase 4: Personnel Preparation (Days 14-28)
Staff Briefing Checklist
[ ] All potential interviewees identified
[ ] Audit conduct expectations communicated
[ ] Subject matter experts assigned to audit topics
[ ] Back room team assembled (document retrieval, real-time support)
[ ] Roles defined: audit host, scribe, runners, SMEs
[ ] Practice sessions conducted for key topics
Interview Preparation Topics:
[ ] System description and intended use
[ ] Validation approach and current validated state
[ ] Change control process (walk through recent example)
[ ] Incident management (walk through recent example)
[ ] Data integrity controls
[ ] User access management
[ ] Audit trail functionality
[ ] Electronic signature process
[ ] Backup and disaster recovery
[ ] Vendor management
[ ] Training process
Interview Guidelines
- Answer only what is asked; do not volunteer extra information
- If unsure, say "I will verify and provide that information"
- Never guess or speculate
- Refer to documented procedures
- Be prepared to demonstrate system functionality live
- Have printed copies of key documents available as backup
During the Audit
Daily Audit Management
Morning:
[ ] Review agenda for the day
[ ] Confirm SME availability
[ ] Prepare requested documents
During sessions:
[ ] Scribe documents all questions and responses
[ ] Track all document requests
[ ] Note potential observations immediately
[ ] Escalate concerns to audit coordinator
Evening:
[ ] Debrief with preparation team
[ ] Review day's observations and commitments
[ ] Prepare documents requested for next day
[ ] Update management on audit progress
[ ] Plan remediation for any identified gaps
Observation Response
When an auditor raises an observation:
- Listen fully; do not interrupt
- Confirm understanding by restating
- If additional context would help, provide it factually
- If evidence exists that addresses the concern, offer to provide it
- Document the observation exactly as stated
- Do not argue or become defensive
Post-Audit Activities
Audit Report Response
Timeline
| Activity | FDA | EMA | Sponsor |
|---|
| Response due | 15 business days (483) | Per inspection report | Per audit report |
| CAPA plan due | With response | Typically 30 days | Typically 30 days |
| CAPA completion | As committed | As committed | As committed |
CAPA Development
For each finding/observation:
CAPA Record:
CAPA ID: CAPA-[YYYY]-[SEQ]
Finding Reference: [Audit report item number]
Finding Category: Critical / Major / Minor / Observation
Finding Description:
[Exact text from audit report]
Root Cause Analysis:
- Method used: [5-Why / Fishbone / Fault Tree]
- Root cause identified: [Description]
- Contributing factors: [List]
Corrective Action (fix the specific instance):
- Action: [Description]
- Owner: [Name]
- Due date: [Date]
- Evidence of completion: [What will demonstrate completion]
Preventive Action (prevent recurrence):
- Action: [Description]
- Owner: [Name]
- Due date: [Date]
- Evidence of completion: [What will demonstrate completion]
Effectiveness Check:
- Method: [How effectiveness will be verified]
- Date: [When effectiveness will be checked]
- Owner: [Name]
Common Audit Findings for EDC Systems
21 CFR Part 11 Findings
| Finding | Root Cause | Remediation |
|---|
| Shared user accounts | Operational convenience | Enforce individual accounts; update SOP |
| Incomplete audit trail | Configuration gap | Enable audit trail on all GxP fields; verify |
| Missing reason for change | System configuration | Configure mandatory reason for change fields |
| Inadequate password controls | Policy not enforced technically | Implement technical password policy controls |
| No periodic access review | Process gap | Implement quarterly access review procedure |
| Audit trail modifiable | System design flaw | Implement immutable audit trail; revalidate |
| E-signature not linked to record | Implementation gap | Fix signature binding; revalidate |
Validation Findings
| Finding | Root Cause | Remediation |
|---|
| Incomplete validation | Scope gaps | Gap analysis and supplemental validation |
| No traceability matrix | Documentation gap | Create RTM; verify coverage |
| Test scripts lack detail | Inadequate review | Revise test scripts; re-execute as needed |
| Validation not maintained | Change control gap | Assess cumulative changes; revalidate |
| No periodic review | Process gap | Implement periodic review SOP; execute |
Data Integrity Findings
| Finding | Root Cause | Remediation |
|---|
| Data deleted without audit trail | System gap | Implement soft delete with audit trail |
| Backdated entries possible | No system control | Implement system-generated timestamps |
| No backup verification | Process gap | Implement and document backup restore tests |
| Inadequate data review | Process gap | Implement documented data review procedures |
Ongoing Inspection Readiness
Monthly Activities
- Review and resolve open CAPAs
- Verify training records current
- Check SOP review dates
Quarterly Activities
- User access review
- Audit trail sample review
- Backup restoration test
- CAPA effectiveness checks
- Update document inventory
Annual Activities
- Internal audit (full scope)
- Risk assessment review
- Validation periodic review
- Disaster recovery test
- Management review of quality metrics
- Mock inspection (recommended)
Output Format
When preparing for an audit, generate:
- Tailored preparation checklist based on audit type and scope
- Document inventory with gap analysis
- Technical system readiness checklist
- Personnel preparation guide with interview topics
- CAPA templates for identified gaps
- Daily audit management checklist
Regulatory References
- FDA Compliance Program Guidance Manual 7348.811 (Bioresearch Monitoring - Sponsors, CROs, and Monitors)
- FDA Regulatory Procedures Manual Chapter 5 (Establishment Inspections)
- EMA Procedure for GCP Inspections
- ICH E6(R2) - GCP (Section 5.5.3)
- 21 CFR Part 11
- EU Annex 11
- FDA Form 483 response guidance
- FDA Warning Letter response guidance
