1What clinical quality assurance means in GCP.
ICH E6(R3), the guideline for good clinical practice adopted on 6 January 2025, defines quality assurance as “All those planned and systematic actions that are established to ensure that the trial is performed and the data are generated, documented (recorded) and reported in compliance with GCP and the applicable regulatory requirement(s).” Quality control is different: “The operational techniques and activities undertaken to verify that the requirements for quality of the trial-related activities have been fulfilled.”¹
The sponsor is responsible for both. Section 3.11 says the sponsor establishes, implements and maintains quality assurance and quality control processes and documented procedures so that trials are conducted, and data generated, recorded and reported, in compliance with the protocol, GCP and the regulations. Quality assurance “should be applied throughout the clinical trial” and includes risk-based strategies to find potential or actual causes of serious noncompliance so that corrective and preventive action can follow. Within trials, “monitoring and data management processes are the main quality control activities.”¹
E6(R3) also makes quality a design principle. Quality is “fitness for purpose”; factors critical to quality should be identified prospectively; and strategies should be in place to “avoid, detect, address and prevent recurrence of serious noncompliance”.¹
2What a GCP QA function does.
E6(R3) assigns these responsibilities to the sponsor. It does not require every trial to be audited: audits, “when performed”, should be proportionate to the trial’s risks. This is the work a GCP QA function carries.
| Activity | What E6(R3) asks |
|---|---|
| Audit | Audits independent of and separate from routine monitoring or QC, proportionate to the trial’s risks, by auditors independent of what they audit and qualified by training and experience (3.11.2) |
| Audit programme | Documented procedures on what to audit, how, how often, and the form and content of reports; a plan guided by the trial’s importance to submissions, its size, type and complexity, risks to participants and known problems (3.11.2.2) |
| Service provider oversight | Assess and select providers, document transferred activities in agreements, and oversee important activities, including any subcontracted (3.6) |
| Noncompliance | Proportionate action to secure compliance; for significant noncompliance, root cause analysis and CAPA; notification of serious noncompliance as the regulations require (3.12) |
| Quality management | A risk-based approach covering risk identification, evaluation, control, communication, review and reporting, with important quality issues reported in the clinical trial report (3.10) |
The purpose of a sponsor’s audit, in E6(R3)’s words, is “to evaluate whether the processes put in place to manage and conduct the trial are appropriate to ensure compliance with the protocol, GCP and the applicable regulatory requirements”. Observations and findings are documented, and the sponsor provides an audit certificate where regulations require one.¹
Delegation does not move accountability. A sponsor may transfer any or all of its trial activities to a service provider, but “the ultimate responsibility” for participants’ rights, safety and well-being and the reliability of the data stays with the sponsor. Service providers should run appropriate quality management of their own and report incidents that might affect participant safety or results.¹
Data and computerised systems are part of the scope. E6(R3) has a section on data governance covering audit trails, data review, corrections, transfers, retention and validation of computerised systems.¹ FDA’s 2024 questions and answers on electronic systems in clinical investigations say audit trails must capture changes to electronic records, who made them and when, and that periodic audit trail review should be based on a risk assessment.²
3The legal basis in the US and the EU.
E6(R3) is guidance. The binding obligations come from each jurisdiction’s law.³⁴
| Obligation | US: 21 CFR Part 312 | EU: Regulation (EU) No 536/2014 |
|---|---|---|
| Comply with GCP | Sponsor ensures the investigation follows the plan and protocols in the IND (312.50) | Sponsor and investigator ensure the trial follows the protocol and GCP, taking account of ICH GCP (Article 47) |
| Monitoring | Sponsor ensures proper monitoring and monitors progress (312.50, 312.56) | Sponsor monitors adequately, to an extent set by assessing the trial’s characteristics (Article 48) |
| Noncompliance | Sponsor promptly secures compliance, or ends the investigator’s participation and notifies FDA (312.56(b)) | Sponsor reports a serious breach within seven days of becoming aware of it (Article 52) |
| Delegation | Transfers to a CRO must be in writing; the CRO is then treated as a sponsor for those obligations (312.52) | Tasks may be delegated in a written contract without prejudice to the sponsor’s responsibility (Article 71) |
| Records | Kept 2 years after a marketing application is approved, or 2 years after investigational use ends and FDA is notified (312.57, 312.62) | Trial master file archived for at least 25 years after the end of the trial (Article 58) |
FDA has issued E6(R3) as guidance for industry, dated September 2025.⁵ In the EU, the principles and Annex 1 have applied since 23 July 2025; Annex 2, on pragmatic and decentralised trials and trials using real-world data, reached Step 4 at ICH on 3 June 2026 and takes effect in the EU on 15 January 2027.⁶
4Audit reports and inspections.
E6(R3) protects the audit function. To preserve its independence and value, regulators “should not routinely request the audit reports”, but may ask case by case when there is evidence or suspicion of serious GCP noncompliance or in legal proceedings.¹ FDA’s Compliance Policy Guide 130.300 says FDA does not review or copy quality assurance audit reports in routine inspections, but does in directed or for-cause inspections of a sponsor or monitor of a clinical investigation.⁷ For IT service providers, FDA says it will generally not review sponsors’ audit reports of their electronic systems, products and services.²
In the EU, Member States appoint inspectors to supervise compliance with the Regulation, and the inspection report goes to the inspected entity and the sponsor and is submitted through the EU portal.⁴
5How it runs in Seal.
Seal’s clinical operations blueprint brings permitted records from the EDC, CTMS, safety database and eTMF into one review, through scoped connections or supplied exports, and keeps sponsor, CRO and site responsibilities explicit. Neil can prepare a review brief with source references, evidence gaps and proposed follow-up, and the study team decides; a proposed query stays distinct from one issued, and a site response from reviewer acceptance. In CTMS, each milestone links to the evidence behind it, and sponsor oversight shows delegated CRO work alongside that evidence.
The eTMF generates expected evidence from study, country, site and vendor events under an approved TMF plan, keeps each artifact’s provenance, classification and QC, gives every gap an owner and due date, and gives inspectors read-only access to the live record. In audit management, each audit engagement keeps its focus, scope and evidence requests, an evidence package references each source at the version selected for it, and a finding links its assessment, change and verification as separate records.
References
- 1ICH E6(R3), Guideline for Good Clinical Practice, principles 6 and 7, sections 3.6, 3.10 to 3.12 and 4, and glossary, ICH, adopted 6 January 2025. https:/
/ database. ich. org/ sites/ default/ files/ ICH_ E6%28R3%29_ Step4_ FinalGuideline_ 2025_ 0106. pdf (read 6 November 2026) - 2Electronic Systems, Electronic Records, and Electronic Signatures in Clinical Investigations: Questions and Answers, guidance for industry, FDA, October 2024, questions 10 and 12. https:/
/ www. fda. gov/ media/ 166215/ download (read 6 November 2026) - 321 CFR Part 312, Investigational New Drug Application, sections 312.50, 312.52, 312.56, 312.57 and 312.62, eCFR. https:/
/ www. ecfr. gov/ current/ title- 21/ chapter- I/ subchapter- D/ part- 312 (read 6 November 2026) - 4Regulation (EU) No 536/2014 on clinical trials on medicinal products for human use, Articles 47, 48, 52, 58, 71 and 78, EUR-Lex, 16 April 2014. https:/
/ eur- lex. europa. eu/ legal- content/ EN/ TXT/ HTML/ ?uri=CELEX:32014R0536 (read 6 November 2026) - 5E6(R3) Good Clinical Practice, guidance for industry, FDA, September 2025. https:/
/ www. fda. gov/ media/ 169090/ download (read 6 November 2026) - 6ICH E6 Good clinical practice, scientific guideline, European Medicines Agency. https:/
/ www. ema. europa. eu/ en/ ich- e6- good- clinical- practice- scientific- guideline (read 6 November 2026) - 7CPG Sec. 130.300, FDA Access to Results of Quality Assurance Program Audits and Inspections, FDA, June 2007. https:/
/ www. fda. gov/ regulatory- information/ search- fda- guidance- documents/ cpg- sec- 130300- fda- access- results- quality- assurance- program- audits- and- inspections (read 6 November 2026)
AQuestions and answers
What changed in ICH E6(R3)?
E6(R3) replaced E6(R2) with a new structure: overarching principles, Annex 1 on how to apply them, and Annex 2 for non-traditional trials such as pragmatic and decentralised designs. It puts quality by design, critical to quality factors and a proportionate, risk-based approach at the centre, includes a section on data governance, and uses the term service provider, which covers CROs. ICH adopted the principles and Annex 1 on 6 January 2025.
What is the difference between clinical QA and monitoring?
Monitoring is quality control: it checks, as the trial runs, that participants are protected and the data are reliable. A sponsor’s audit is independent of and separate from monitoring, and asks whether the processes for running the trial are fit to ensure compliance with the protocol, GCP and the regulations.
Does a CRO need its own quality assurance?
Yes. E6(R3) says any service provider performing trial activities should implement appropriate quality management and report incidents that might affect participant safety or results. The sponsor still keeps ultimate responsibility and should oversee the important activities it has transferred.
How often should GCP audits be done?
No fixed frequency is set, and E6(R3) does not require every trial to be audited. It asks the sponsor to define audit frequency in documented procedures and to base its audit plan on the trial’s importance to submissions, its size, type and complexity, the risks to participants and any problems already identified.
Can regulators see our GCP audit reports?
Not routinely. E6(R3) says regulators should not routinely request audit reports, but may on a case-by-case basis when serious GCP noncompliance is suspected or in legal proceedings. FDA’s policy also allows it to review audit records in for-cause inspections of a clinical sponsor or monitor.
Can GCP audits be done remotely?
Yes. E6(R3) expects the sponsor’s documented audit procedures to say how audits are done, on site, remotely or both, alongside what to audit, how often and what the audit report contains.