Sponsor and IRB Audits

1. Purpose

This SOP describes how [SITE NAME] prepares for, hosts and follows up on audits of its studies by sponsors, contract research organizations (CROs) acting for sponsors, independent auditors engaged by sponsors, and IRBs.

2. Scope

This SOP applies to every audit of a study or process at [SITE NAME] performed by or for a sponsor or an IRB, whether on site, remote or a mix of both, routine or for-cause.

It does not cover:

• routine monitoring visits (SOP-600 Sponsor Monitoring Visits)
• FDA inspections and remote regulatory assessments (SOP-702 FDA Inspections and Remote Regulatory Assessments)
• internal audits (SOP-700 Internal Quality Control and Quality Assurance Audits)

Where the protocol, the clinical trial agreement (CTA), the sponsor or the IRB sets a stricter requirement, follow the stricter requirement.

3. Responsibilities

4. Definitions

5. Procedure

5.1 Audit versus monitoring

• A monitoring visit is part of the sponsor's routine quality control of the study. The monitor is part of the study team, visits on a schedule, and works with the site to resolve issues as the study runs (SOP-600).
• An audit is independent of the study team. The sponsor's quality assurance group or a contracted auditor examines whether the study and the site's processes meet the protocol, GCP and regulations. Audits are usually one-time events with a formal report and a required written response.
• An IRB audit (sometimes called post-approval or compliance review) examines compliance with the IRB-approved protocol, consent process and IRB determinations. Central IRBs may audit routinely or for cause.

5.2 Notification and scheduling

• auditor name(s), organization, and whom they represent (sponsor, CRO, IRB)
• study, protocol number and the scope (study audit, process audit, specific concern)
• proposed dates, expected duration and format (on site, remote, or both)
• agenda, including meetings requested with the PI and staff
• list of records to have ready, and electronic systems the auditor needs to access
• whether the audit is routine or for cause, if the requester will say

5.3 Preparation

• ISF, using F-204-01 Investigator Site File Index
• signed consent forms and F-301-01 Informed Consent Process Notes for all participants
• source documents and access to the electronic health record (EHR) for study participants only
• F-303-01 Screening and Enrollment Log and F-303-02 Eligibility Verification Checklists
• F-304-01 Investigational Product Accountability Log, F-304-02 Temperature Monitoring Log and any F-304-03 Temperature Excursion Reports
• F-302-01 Delegation of Authority Log, staff training records and CVs
• safety records (F-500-01, F-501-01), F-308-01 Protocol Deviation Log, F-600-01 Monitoring Visit Log and follow-up letters
• IRB and sponsor correspondence

• Missing or incorrect entries are corrected following SOP-306 Source Documentation and Data Integrity (ALCOA+), with the current date and an explanation. Records are never backdated, re-created or altered to look contemporaneous.
• An issue that cannot be corrected is documented on F-306-01 Note to File with the facts and the corrective action, and logged on F-308-01 if it is a deviation.

• a private room with workspace, internet access and a telephone
• read-only EHR and system accounts, limited to study participants and time-limited to the audit, set up under SOP-401 Computerized Systems and Electronic Records
• availability of the PI, Sub-Is, CRCs, IP Manager and Regulatory Coordinator at agreed times

• Answer the question asked, truthfully, and only from your own knowledge.
• If you don't know, say so and offer to find the person who does. Don't guess or speculate.
• Use the records to answer where possible.
• Report any concern raised by the auditor to the liaison right away.

5.4 Conduct of the audit

• keeps a duplicate of every copy given, filed with the audit records
• marks copies of site proprietary material "Confidential"
• provides copies of participant records redacted and checked under the single redaction rule in SOP-400 5.4.1; direct review of identified records on site or through read-only access is permitted under the consent and authorization (SOP-400 Participant Privacy and HIPAA in Research)

5.5 Closeout meeting

5.6 Written response and CAPA

• the correction already made, with the date
• the root cause, scaled to the severity of the finding (SOP-703)
• the corrective and preventive actions, owners and target dates
• how the site will check the actions worked

5.7 Records

6. Related Forms and SOPs

• F-702-01 Inspection Request and Document Log (used for audits)
• F-703-01 CAPA Record
• F-700-01 Internal QC Review Checklist
• F-204-01 Investigator Site File Index
• F-306-01 Note to File
• F-308-01 Protocol Deviation Log
• SOP-306 Source Documentation and Data Integrity (ALCOA+)
• SOP-308 Protocol Deviations and Noncompliance
• SOP-400 Participant Privacy and HIPAA in Research
• SOP-401 Computerized Systems and Electronic Records
• SOP-502 Unanticipated Problems and Reportable New Information
• SOP-600 Sponsor Monitoring Visits
• SOP-700 Internal Quality Control and Quality Assurance Audits
• SOP-702 FDA Inspections and Remote Regulatory Assessments
• SOP-703 Corrective and Preventive Action (CAPA)
• SOP-903 Network Oversight of Member Sites (Metrics, Central QA, Escalation) (Model N only)
• SOP-905 Network Data, Systems, Privacy and Records Across Sites (Model N only)
• Appendix B Central and Site Responsibility Matrix (Model N only)

7. References