SOP-700

Internal Quality Control and Quality Assurance Audits

Number: SOP-700
Category: Quality Assurance
Edition: Reference Edition 1.3
Approx. pages: 9

Download Word All Reference Edition documents

[YELLOW] the site fills in. [DEFAULT: green] a value the site may keep or change.

On this page

1. Purpose
2. Scope
3. Responsibilities
4. Definitions
5. Procedure
6. Related Forms and SOPs
7. References

1. Purpose

This SOP describes how [SITE NAME] checks its own work. It covers risk-based quality control (QC) of study records while a study is running, the annual internal audit program, how audits are conducted and reported, the quality metrics the site tracks, and the management review that uses those results. Findings that need corrective or preventive action move to SOP-703 Corrective and Preventive Action (CAPA).

2. Scope

This SOP applies to all clinical studies conducted at [SITE NAME], at every location, and to the site's quality system processes (training, delegation, SOP compliance, investigational product (IP) storage, computerized systems and service provider oversight).

In scope:

QC performed by site staff on site-generated records (consent, eligibility, source, case report forms (CRFs), IP records, safety reporting, regulatory records).
Internal audits of studies and processes, performed by site staff or by an external auditor engaged by the site.
Quality metrics, trending and management review.

Out of scope:

Sponsor monitoring (SOP-600 Sponsor Monitoring Visits), sponsor and IRB audits (SOP-701 Sponsor and IRB Audits) and regulatory inspections (SOP-702 FDA Inspections and Remote Regulatory Assessments). Sponsor monitoring does not replace the site's own QC.
The PI's medical review of data, which is an investigator duty and not QC.

Where a protocol, sponsor or IRB requirement is stricter than this SOP, follow the stricter requirement.

3. Responsibilities

Role	Responsibilities
Quality Lead	Owns this SOP. Approves each study QC plan, prepares the annual audit plan, conducts or arranges audits, maintains QC and audit records, compiles metrics, and prepares the management review. Does not QC or audit their own work.
Site Director	Provides resources for QC and audits, attends management review, approves the annual audit plan, and reviews audits of areas the Quality Lead manages directly. Where the Site Director is also the Quality Lead, the PI or the independent reviewer named under the SOP-102 5.3 Site decision reviews audits of areas the Quality Lead manages and signs the management review minutes (5.8.4).
Principal Investigator (PI)	Retains responsibility for oversight of delegated activities. Reviews QC and audit findings for their studies, takes part in audit opening and closing meetings, and approves study-level responses.
Sub-Investigator (Sub-I)	Answers QC findings that relate to their own activities (for example, eligibility assessments or AE causality).
Lead CRC / Clinical Research Coordinator (CRC)	Performs QC of other staff members' work when trained and assigned. Corrects their own errors found in QC, following SOP-306 Source Documentation and Data Integrity (ALCOA+).
Regulatory Coordinator	Performs or supports QC of regulatory records and the Investigator Site File (ISF). Corrects regulatory findings.
All Research Staff	Cooperate with QC and audits, answer questions truthfully, and correct findings by the agreed date.

4. Definitions

Term	Definition
Quality Control (QC)	The operational techniques and activities undertaken to verify that the requirements for quality of trial-related activities have been fulfilled (ICH E6(R3) Glossary). At this site, QC is a planned check of records by someone other than the person who created them.
Quality Assurance (QA)	All planned and systematic actions established to make sure that the trial is performed and the data are generated, recorded and reported in compliance with GCP and the applicable regulatory requirements (ICH E6(R3) Glossary). Internal audits and management review are QA activities.
Audit	A systematic and independent examination of trial-related activities and records to determine whether the activities were conducted, and the data were recorded, analyzed and accurately reported, according to the protocol, applicable SOPs, GCP and applicable regulatory requirements (ICH E6(R3) Glossary).
Critical to quality factors	The attributes of a trial that are essential to participant protection and the reliability of results (ICH E6(R3) Principle 6). For site QC, these are usually consent, eligibility, IP handling and dosing, safety reporting, primary endpoint data and blinding.
Finding	A gap between what was required (protocol, regulation, SOP) and what was done or recorded.
Critical finding	A finding that affected or could affect participant rights, safety or well-being, or the reliability of critical data. Examples: no valid consent before a study procedure, an ineligible participant dosed, an unreported SAE, falsified data.
Major finding	A finding that could affect participant safety or data reliability if not corrected, or a pattern of minor findings. Examples: wrong consent version signed, IP temperature excursion not assessed, delegation log not covering a task performed.
Minor finding	An isolated record-keeping gap with no expected effect on participants or data reliability. Examples: missing date on a log entry that can be established from other records, a filing error.
Important protocol deviation	As defined in SOP-308. The critical, major and minor grades in this SOP rate QC and audit findings for internal follow-up; they do not replace the sponsor-based classification of protocol deviations under SOP-308.
Corrective and Preventive Action (CAPA)	Actions taken to remove the cause of a finding and prevent it from recurring. See SOP-703.

5. Procedure

5.1 How the site's quality checks fit together

5.1.1

The site uses three layers of checking:

QC during study conduct (section 5.2 to 5.4): routine, planned checks of study records by a second person, done close to the time the work is done.
Internal audits (section 5.5 and 5.6): periodic, independent examination of a study or a process against requirements, done by someone not involved in the work.
Metrics and management review (section 5.7 and 5.8): trend data across studies and staff, reviewed by site leadership.

5.1.2

The Quality Lead keeps all QC records, audit records and metrics in the quality file at [QUALITY FILE LOCATION]. Study-specific findings that are protocol deviations are also recorded in the study records (section 5.4.5) so that monitors and inspectors see them in the study file.

5.2 Study QC plan

5.2.1

Before the first participant is consented in a new study, the Quality Lead and the Lead CRC agree a study QC plan and record it on the QC plan page of F-700-01 Internal QC Review Checklist. The plan is filed in the quality file with a copy in the ISF.

5.2.2

The QC plan identifies the critical to quality factors for the study from the protocol, the sponsor's risk information (if provided), and the site's own experience. At minimum the plan covers:

informed consent process and documentation (SOP-301 Informed Consent Process and Documentation)
eligibility verification (SOP-303 Screening, Eligibility Verification and Enrollment)
IP receipt, storage, dispensing, accountability and temperature records (SOP-304 Investigational Product Management)
AE and SAE identification and reporting timeliness (SOP-500, SOP-501)
source to CRF consistency for primary endpoint and key safety data (SOP-306, SOP-307)
delegation log coverage of the tasks actually performed (SOP-302 Delegation of Authority)

5.2.3

The default QC sampling scheme is:

Consent and re-consent: 100% QC of every signed consent, within the time in SOP-301 5.11.3. Consent QC is not sampled; the sampling in this section applies to the other areas.
Eligibility: every participant's eligibility is prepared on F-303-02 and signed by an investigator before randomization (SOP-303); this is not QC. Independent QC covers 100% of the first [DEFAULT: 3] participants in each study, required before randomization or first dose. After that, a sample of [DEFAULT: 1 in 5] participants, completed within the time the study QC plan sets (before or after randomization). A sampled participant found ineligible after randomization is reported to the PI the same day and handled under SOP-308.
IP accountability and temperature records: QC for each active study [DEFAULT: monthly]. For unblinded records in blinded studies, the reviewer and frequency follow 5.3.5.
Safety reporting timeliness: 100% QC of SAE reports for timeliness and completeness.
Source to CRF: a sample of visits for the first participant enrolled and then [DEFAULT: one visit per active participant per quarter], focused on the primary endpoint and safety data.

5.2.4

The Quality Lead may reduce sampling for a low-risk study (for example, a single-visit or observational study) or increase QC for higher-risk studies (for example, first-in-human, complex dosing, device implantation, vulnerable populations, new staff or a new therapeutic area for the site) and records the reason on F-700-01. Consent QC (100%) and the first-participant eligibility QC in 5.2.3 are not reduced.

5.2.5

QC returns to 100% for a staff member or study when any of the following occurs, and stays at 100% until [DEFAULT: 3] consecutive reviews have no major or critical finding:

a critical finding, whether found by QC, a monitor or an audit
a major finding of the same type as another major finding within [DEFAULT: 3 months], whether found by QC, a monitor or an audit
a protocol amendment or consent form revision that changes the reviewed process

5.2.5.1

Minor monitor or audit findings do not return an area to 100% QC; they are corrected and counted in the metrics (5.7). The Quality Lead records on F-700-01 whether 100% QC applies to a staff member or a study, the trigger and the date it ends.

5.3 Who performs QC

5.3.1

QC is never self-review. The reviewer is a trained staff member who did not perform or document the activity being checked. The person who obtained consent does not QC that consent. The person who completed an eligibility checklist does not QC that checklist.

5.3.2

The Quality Lead assigns reviewers and records them in the study QC plan. Reviewers must be trained on this SOP and on the protocol, and the training must be recorded on F-103-01 Staff Training Log.

5.3.3

At small sites, staff cross-check each other (for example, CRC A reviews CRC B's consents and CRC B reviews CRC A's). Where the Quality Lead role is combined with another role, the Quality Lead's own work is reviewed by another trained staff member or an external reviewer.

5.3.4

QC of medical judgments (eligibility decisions that need clinical interpretation, AE causality, clinical significance of abnormal results) checks only that the judgment was made by a delegated investigator and documented. A reviewer who is not an investigator does not override medical judgments. Questions go to the PI.

5.3.5

In blinded studies, QC of unblinded records (for example, unblinded IP preparation, dispensing and accountability records, and randomization records) is performed, in this order of preference: by the sponsor's unblinded monitor, where the sponsor provides one, with the monitor's review recorded on F-700-01 as the QC; otherwise by any unblinded staff member who was not involved in the dispensing being checked; otherwise by an external reviewer at least [DEFAULT: quarterly]. The reviewer returns findings to blinded staff only in a form that does not reveal treatment assignment, and sends findings that would reveal it only to unblinded staff and, where needed, the sponsor's unblinded monitor (SOP-305).

5.4 Performing and recording QC

5.4.1

The reviewer performs QC within the timeframe in the QC plan [DEFAULT: consent QC within the time in SOP-301, 5.11.3; eligibility QC for the first 3 participants before randomization or first dose (5.2.3)].

5.4.2

The reviewer uses F-700-01 Internal QC Review Checklist and records the participant ID, visit or record reviewed, date of review, items checked, and each finding with its classification (critical, major or minor).

5.4.3

The reviewer does not correct another person's records. The reviewer returns findings to the person who created the record, or, if that person is unavailable, to the Lead CRC. The record owner makes the correction following SOP-306, with a current date and an explanation where needed. Late entries are dated when made, never backdated.

5.4.4

The record owner documents the correction on F-700-01 and returns it. The reviewer confirms the correction and closes the finding.

5.4.5

The reviewer escalates findings as follows:

Critical finding: the reviewer informs the PI and Quality Lead the same day. The PI assesses participant safety first. The Quality Lead opens a CAPA under SOP-703.
Major finding: reported to the PI and Quality Lead within [DEFAULT: 2 business days]. The Quality Lead opens a CAPA under the triggers in SOP-703 5.1.2.
Minor finding: corrected and captured in the QC metrics. A CAPA is opened only if a trigger in SOP-703 5.1.2 is met.
Consent errors, any grade: the reviewer tells the PI the same day (SOP-301 5.12.2), and the PI assesses the effect on the participant's rights and safety.
Any grade: a finding that is a protocol deviation is also recorded on F-308-01 Protocol Deviation Log and classified (important or not) and assessed for sponsor and IRB reporting under SOP-308 Protocol Deviations and Noncompliance. A critical finding that is a deviation will usually be an important deviation, but the SOP-308 classification governs.

5.4.6

A finding that may indicate fabrication or falsification (for example, a signature that does not match, data recorded for a visit that did not occur) is not discussed with the person involved. The reviewer reports it to the Quality Lead or Site Director under SOP-704 Research Misconduct and Fraud Reporting.

5.4.7

The Quality Lead reviews completed F-700-01 records at least [DEFAULT: monthly] to confirm QC is being done to plan, findings are closed, and sampling changes in section 5.2.5 have been applied.

5.5 Annual internal audit plan

5.5.1

By [MONTH] each year, the Quality Lead prepares the annual internal audit plan on Part 1 of F-700-02 Annual Audit Plan and Audit Report. The Site Director approves the plan.

5.5.2

The Quality Lead selects audits based on risk. Inputs include:

studies that are new to the site in design, product type (for example, first device study, first cell therapy study) or therapeutic area
studies with high enrollment, high complexity or vulnerable populations
QC and monitoring findings and trends from the previous year
sponsor audit, IRB audit or FDA inspection findings
new PIs, new Sub-Is, new locations, staff turnover
new or changed computerized systems and service providers
open or recently closed CAPAs that need an effectiveness check

5.5.3

The plan includes at least [DEFAULT: one internal audit per year, alternating between a study audit one year and a process audit the next], scaled up where the number of active studies and PIs warrants. Process audits rotate through, for example:

training and qualification files (SOP-103)
delegation of authority (SOP-302)
IP storage, temperature monitoring and accountability (SOP-304)
equipment calibration and local laboratory records (SOP-312)
computerized systems, access control and user accounts (SOP-401)
record retention and archive (SOP-402)
service provider oversight (SOP-105)
SOP system and training compliance (SOP-100)

5.5.4

The Quality Lead may add for-cause audits during the year (for example, after a critical finding or an allegation under SOP-704) and records each addition and its reason on F-700-02.

5.6 Audit conduct and report

5.6.1

Auditor selection. The auditor is qualified by training and experience in GCP auditing and is independent of the study or process being audited. The Quality Lead may audit studies and processes they do not manage. Where no internal person is independent (for example, an audit of the Quality Lead's own processes, or a small site where every staff member works on the study), the audit is done by the independent reviewer named under SOP-102 5.3 or by an external auditor engaged and overseen under SOP-105.

5.6.2

Notification. The auditor notifies the PI and study team of the audit scope, dates and records needed at least [DEFAULT: 10 business days] in advance. For-cause audits may be unannounced when the Site Director approves.

5.6.3

Opening meeting. The auditor confirms scope, schedule, staff availability and system access with the PI or process owner.

5.6.4

Audit activities. The auditor:

reviews the records against the protocol, applicable regulations, ICH E6(R3) and site SOPs
selects participant records using a documented sample (for example, all participants enrolled in the first month plus a random sample)
traces data from source to CRF and from CRF back to source for the sampled records
interviews staff about how they perform their tasks
reviews system access, audit trails and delegation for the tasks performed
records evidence for each finding (record, participant ID, date, requirement not met)

5.6.5

Closing meeting. The auditor presents the findings and their proposed classification to the PI or process owner, the Quality Lead (if not the auditor) and the Site Director. Factual errors are corrected at the meeting.

5.6.6

Audit report. The auditor issues the report on Part 2 of F-700-02 within [DEFAULT: 15 business days of the closing meeting]. The report states scope, records reviewed, sample method, findings with classification and evidence, and any observations or recommendations. The auditor signs and dates the report.

5.6.7

Response. The PI or process owner responds within [DEFAULT: 30 calendar days of report issue] with a correction for each finding and, for major and critical findings, a CAPA under SOP-703. The Quality Lead tracks responses to closure.

5.6.8

Distribution and confidentiality. The audit report goes to the PI or process owner, the Site Director and the Quality Lead. Internal audit reports are internal QA records. The site confirms to sponsors or inspectors that an audit took place (for example, by the audit plan and a dated statement of audit completion) without routinely sharing the full report. Findings that are protocol deviations are recorded in the study records under SOP-308 regardless of the audit report's distribution.

5.7.1

At least [DEFAULT: quarterly], the Quality Lead compiles quality metrics from F-700-01, F-308-01 Protocol Deviation Log, F-600-02 Monitoring Follow-Up Action Tracker, F-501-01 SAE Reporting Tracker, F-502-01 Reportable New Information Assessment, F-400-01 Privacy Incident Report, F-703-01 CAPA Record and F-103-01 Staff Training Log. This quarterly metrics review is the site's single periodic review of those logs; SOP-400, SOP-501, SOP-502, SOP-600 and SOP-703 point to it and do not hold separate quarterly reviews. Metrics include:

QC findings by type (consent, eligibility, IP, safety, source/CRF), classification, study and staff member
protocol deviations per enrolled participant, by category and study
SAE reports sent to the sponsor late against the protocol timeline
consent errors as a percentage of consents reviewed
monitoring findings and open action items older than [DEFAULT: 30 days]
query volume and age where the sponsor provides EDC reports
CAPA count, overdue CAPAs and CAPAs that failed their effectiveness check, and repeated root causes across CAPAs (SOP-703 5.8)
open IRB-required actions on F-502-01 and their age
privacy incidents by type and any systemic cause (SOP-400)
monitor access on F-401-01 checked against active monitor assignments (SOP-600)
staff training completion against requirement

5.7.2

The Quality Lead looks for repeated findings across studies, staff or locations, and opens a CAPA where a trend meets a trigger in SOP-703 5.1.2.

5.7.3

The Quality Lead shares the quarterly metrics summary with the Site Director and PIs and, in summary form without personal blame, with all research staff at a staff meeting.

5.8 Management review

5.8.1

The Site Director, Quality Lead and PIs hold a management review at least [DEFAULT: annually], and also after any FDA inspection with a Form FDA 483 or any critical audit finding.

5.8.2

The inputs are:

quality metrics and trends for the period
internal audit results and status of the annual audit plan
sponsor audits, IRB audits, FDA inspections and remote regulatory assessments
CAPA status and effectiveness
integrity concerns reported under SOP-704 (in summary, without identifying reporters)
business continuity test results (SOP-705)
staffing, workload, training and resource needs
regulatory changes and SOP review status (SOP-100)

5.8.3

The outputs are decisions and actions with owners and dates, for example: SOP revisions, additional QC, training, staffing changes, new CAPAs and the next year's audit plan priorities.

5.8.4

The Quality Lead records the review in minutes signed by the Site Director (or, where the Site Director is also the Quality Lead, by the PI or the independent reviewer named under the SOP-102 5.3 Site decision) and files them with the year's F-700-02. Actions are tracked to completion on F-703-01 where they are CAPAs, or in the minutes for other actions.

F-700-01 Internal QC Review Checklist
F-700-02 Annual Audit Plan and Audit Report
F-703-01 CAPA Record
F-308-01 Protocol Deviation Log
F-103-01 Staff Training Log
F-400-01 Privacy Incident Report
F-501-01 SAE Reporting Tracker
F-502-01 Reportable New Information Assessment
F-600-02 Monitoring Follow-Up Action Tracker
SOP-100 Writing, Approving and Controlling SOPs
SOP-102 Site Organization, Roles and Staff Responsibilities
SOP-105 Oversight of Service Providers and Vendors
SOP-301 Informed Consent Process and Documentation
SOP-302 Delegation of Authority
SOP-303 Screening, Eligibility Verification and Enrollment
SOP-304 Investigational Product Management
SOP-305 Randomization, Blinding and Emergency Unblinding
SOP-306 Source Documentation and Data Integrity (ALCOA+)
SOP-307 Case Report Forms, EDC Entry and Query Resolution
SOP-308 Protocol Deviations and Noncompliance
SOP-400 Participant Privacy and HIPAA in Research
SOP-501 Serious Adverse Event and Expedited Safety Reporting
SOP-502 Unanticipated Problems and Reportable New Information
SOP-600 Sponsor Monitoring Visits
SOP-701 Sponsor and IRB Audits
SOP-702 FDA Inspections and Remote Regulatory Assessments
SOP-703 Corrective and Preventive Action (CAPA)
SOP-704 Research Misconduct and Fraud Reporting
SOP-705 Business Continuity and Emergency Preparedness
F-903-01 Member Site Performance and Quality Scorecard (Model N only)
SOP-900 Network Governance, SOP Hierarchy and Local Addenda (Model N only)
SOP-903 Network Oversight of Member Sites (Metrics, Central QA, Escalation) (Model N only)
SOP-905 Network Data, Systems, Privacy and Records Across Sites (Model N only)
Appendix B Central and Site Responsibility Matrix (Model N only)

7. References

Reference	Title
21 CFR 312.60	General responsibilities of investigators
21 CFR 312.62	Investigator recordkeeping and record retention
21 CFR 812.100	General responsibilities of investigators (devices)
21 CFR 812.140	Records (devices)
ICH E6(R3) Principles 6 and 7	Quality built into trial design and conduct; risk-proportionate processes
ICH E6(R3) Annex 1, 2.3	Investigator Responsibilities (delegation and oversight)
ICH E6(R3) Annex 1, 2.12	Records
ICH E6(R3) Annex 1, 3.11	Quality Assurance and Quality Control (sponsor; used here as a model for site QA)
ICH E6(R3) Glossary	Audit, Quality Assurance, Quality Control
FDA Guidance (2009)	Investigator Responsibilities: Protecting the Rights, Safety, and Welfare of Study Subjects
ISO 14155 (current edition)	Clinical investigation of medical devices for human subjects: Good clinical practice (device studies)

Independent Site SOP Library. Licensed CC BY-NC 4.0 by the American Institute for Medical Research (AIMR), with added permission for any site's internal use (license terms). Not legal advice: each adopting site confirms state law, IRB and sponsor requirements with its own counsel and owns every step it approves.