An FDA audit is no reason to panic: These 10 steps can help you prepare

Here’s what to expect and what you can do

The problem with Food and Drug Administration (FDA) audits is that once you know inspectors are coming, there’s really very little you can do. "You can’t fix the data," says Michael Hamrell, PhD, founder and president of Moriah Consulting in Yorba Linda, CA. "At that point, you can just have the records available and accessible and show the inspectors what they ask for as quickly as possible."

But knowledge is power, and knowing how an audit works can help you sail through, says Erich K. Jensen, project manager of the education and certification core at the University of Michigan’s Center for the Advancement of Clinical Research (CACR) in Ann Arbor. Jensen has developed a course designed specifically to highlight what happens during an FDA audit and what can be done to make the process as easy as possible.

The first thing is to understand that from the FDA’s perspective, "if you did not document it, it did not happen," says Jensen, who has worked in the past with Parke Davis and Warner Lambert (now Pfizer).

"They want to see paper and electronic records," he explains. To a lesser degree, inspectors want to talk to personnel, but only as a means of leading them to records that validate what the interviewees tell them.

For the most part, the investigators, doctors, and study coordinators are the focus of FDA audits. Very occasionally, sponsors are audited, Jensen says. Contract organizations such as labs that do clinical pathology, pharmacies, or biomedical engineering departments that create medical devices may get a visit. IRBs also may be targeted. Usually, says Jensen, an audit covers phase III trials that involve multisite studies. The focus is most often on high patient enrolling sites.

Jensen has divided up a typical audit into 10 steps:

1. Selecting the site. A marketing application usually triggers an FDA audit within about six months, Jensen says. It can be faster if the drug or device is on a fast-track approval. Most often, the three highest enrolling sites are chosen, and if the IRB at a selected site hasn’t been audited in more than five years and is within easy distance of the audit site, then that IRB also may be targeted for an audit.

This all changes if there is a for-cause audit, Jensen adds. Those audits can occur for a variety of reasons, including an investigator who has had trouble before, if the study is of singular importance, or even if there is something in the media that prompts a lot of public attention.

For instance, while Jensen was at Parke Davis, the company was seeking approval for an Alzheimer’s drug. The study was being run in the United Kingdom by a prominent physician who advertised in newspapers for patients. The FDA chose to audit that site because of the way enrollment was conducted and the media attention it generated.

For-cause audits also may arise due to patient complaints. The University of Michigan had one such for-cause audit last year at which the FDA spent three weeks reviewing records. Investigators doing a large number of studies or someone working on a study that isn’t part of their everyday practice, such as an asthma study done by a cardiology group, also can trigger audits. If a study site has safety and efficacy results that differ greatly from another site or if lab results are "outside the range of biological expectations," then Jensen says the FDA may decide to do a for-cause audit. Lastly, studies that may have a major impact on medical practices may lead the FDA to your door.

2. Contacting the site. The FDA will call to arrange the visit if it is not a for-cause audit. In the latter case, says Hamrell, inspectors may just appear or give minimal notice of a visit. If they do show up unannounced, they already are in a mindset for finding a problem, he adds, and areas of concern on which they will want to focus.

For instance, if inspectors are concerned about enrollment, they’ll ask to see appointment books and charts. They may even ask for phone numbers of the patients you have enrolled to check and see if they really were part of the study and showed up for appointments. In one case, Hamrell recalls, a physician made up patients, made up data, and now sits in jail for fraud. "That was a rare and egregious case, but it does happen."

Jensen says that even if an audit isn’t a surprise inspection, the FDA will become suspicious if the audit date is delayed by too much time. If staff members are away on vacation, or there is some other legitimate reason for delaying the visit, the FDA likely will be amenable. But he says you want to make it happen as quickly as possible.

During the initial contact, the FDA may request some information in advance. In most cases, auditors probably have data from a drug or device marketing application already. However, they might want specific information. Jensen recalls a case where an investigator wanted a list of patients who were screened but not included in the study. "He was looking for some bias," he adds.

If the FDA doesn’t request any specific information, Jensen says you can take the initiative and ask if there is something in particular investigators want to look at, or any particular information they would like to see in advance.

3. Arranging the visit. Visits usually last three to five days, Jensen says, although they can go anywhere from one day to six weeks. In a typical audit, inspectors target only a specific study. In a for-cause investigation, they’ll review more than one trial.

Once the date is arranged, let all the key personnel know the date and time of the visit — the investigator, IRB, and coordinator must know. In addition, depending on the subject of the investigation, lab and pharmacy personnel might need to know. General counsel should be notified, too, says Jensen, as well as any industry sponsor. In the latter’s case, they often have quality assurance departments that will send out teams to help prepare for the inspection and do a mock audit.

Make sure you assign a site escort or facilitator to the investigator. He points out that the most likely candidate for this is the study coordinator or IRB compliance coordinator. This will be the main point of interaction throughout the audit.

Assemble all the relevant documents for the audit in one place, Jensen suggests, paying particular emphasis to requesting patient charts for the trial. If you are at a high-enrolling site, the FDA may say in advance what specific charts it wants. In one recent inspection at the University of Michigan, Jensen says there was three weeks notice and it took the entire time to locate all the required patient charts. In the recent for-cause inspection, the chart for the patient who made the complaint was put on the top of the pile. "It set a really positive tone that we didn’t have anything to hide," he notes.

If it is a for-cause inspection, Jensen says to generate a list of all the studies the investigator has done.

Arrange a good workspace for the investigator. If it is a normal audit, don’t put the auditors in a room with records from a bunch of different sites, he adds. "They may end up fishing." Ensure access to a photocopier, too. Even better, do the photocopying for the auditors, and make two copies of everything requested. That way, not only do you have knowledge of what they are looking at, but you can keep a record of the process. If you have future contact with the FDA about the audit, you can refer directly to the packet of information you made for yourselves.

4. Arriving at the site. Upon arrival, the inspector presents the site with a form 482. That lists out the regulations under which the FDA is given the authority to inspect. To see a sample of the form, see the FDA web site at

There may be only one inspector or up to three in a for-cause investigation, Jensen says. In the latter case, one may come from the regional office to deal with compliance issues, while others may come from headquarters to review the medical or scientific aspects of the trial.

5. Showing data. The FDA will request that data and documents it wants to see related to the trial being audited. You don’t have to show inspectors everything, though. You don’t have to present financial information that is not related to the required financial disclosures of the principal investigators and their family members.

You do not have to provide information on salaries or budgets. You also do not have to provide personnel data such as performance appraisals and job ratings. But you do have to show inspectors any job descriptions and training records they request.

6. Interviewing personnel. While the investigator and trial coordinator of the specific study are the most likely people the FDA will want to interview, there may be questions better answered by others, says Jensen. For instance, if there are pharmacy questions, bring the investigational drug expert on your staff to the inspectors. "Pick the most knowledgeable and calmest people you have," he adds. "They will be asked a lot of really minor and seemingly bothersome questions."

Because the FDA is a government agency, nearly all its records and manuals are on-line, including the manuals for inspections. Jensen says he has seen inspectors follow the documents verbatim. A copy of the manual is available at

Jensen says there is a lot of psychology involved in the FDA audit interviews. "Be cool, calm, and collect your thoughts. Be concise." People often talk a lot when they are nervous. Avoid this temptation, he says. "If you have a closed question that requires only a yes or no answer, that’s all you have to say." That said, the FDA is trained to ask open-ended questions. "But try to be short. Be polite, and be cooperative."

It’s best to have the information you need at your fingertips, but if you don’t, get it. If it will take some time to retrieve, tell the inspectors and explain why.

Never guess at questions, either, warns Jensen. If you don’t understand the question, ask for a clarification. If you can’t answer, say you don’t have the expertise, but you will get someone who does. Don’t answer outside the scope of the question or go off on tangents.

And don’t ask the auditors unsolicited questions such as, "Is this all you wanted?" or "Did you also want this?" Don’t answer hypothetical questions either, like, "How can you do this if you are running six trials?" If you aren’t running six trials and never have, you cannot honestly answer the question and you should not try.

Lastly, Jensen says you should never sign affidavits. If an inspector asks you to sign something that summarizes what you just said, tell him or her politely that you have to contact your general counsel about signing anything.

7. Conducting the exit interview. This is usually done with the investigator and study coordinator at the end of the entire audit. However, Jensen recommends that you try to have a mini-exit interview at the end of each day. Ask how things are going and what you can do to prepare for the next day. "You should know along the way how things are going," he says. Such conversations can help to alleviate any misunderstandings and incorrect assessments.

The exit interview will be a recap of the findings and a description of any deviation from the regulations that the inspectors have found. The FDA may, at this time, suggest corrective action, although usually the site is responsible for that. Whatever you do, don’t make suggestions to the FDA about what you might do differently at this time.

"I recommend that you give it some thought and time," he says. Tell the FDA that you will get back to them, rather than locking yourself into some new standard operating procedure when all that may be required is a simple small change to the existing policies.

8. Departure.

At this point, the auditor will present a Form 483 (available on line at Any observations on the form are not listed in a particular order or ranked.

Hamrell says most of what the FDA finds relates to "sloppy and careless work and a lack of attention to detail." For instance, there might be a missing document or an undated consent form. "A nurse will look at it, a coordinator will look at it, and an investigator will look at it. But no one will notice the problem."

He also has seen a lot of problems with sites not following a protocol. For instance, the study might require a blood draw at a particular visit, but a patient leaves without the draw. "Have a list," Hamrell says. "Check it off before the patient is out the door."

These things sound easy and straightforward, he adds, but they are constant issues that come up in audits.

Other common findings include inadequate and inaccurate records, failure to report adverse events, IRB problems, and inadequate drug accountability, says Jensen.

9. The report. These are forwarded from the local district office for evaluation at headquarters. Anyone can request a copy.

10. Outcome. There are three possibilities: No Action Indicated; Voluntary Action Indicated; and Official Action Indicated. The latter involves a warning letter. Samples can be found at

Having a finding other than No Action Indicated isn’t the end of the world, says Hamrell. "It depends on what they are and how severe they are," he says. "It’s like a speeding ticket. You may have to pay a fine, but if you do what you have to do, there is no lasting problem. Then again, if you’re going 200 in a 25 zone and cause an accident, you may end up in jail."

The consequences for severe problems can be anything from disqualifying the investigator to criminal misconduct and jail time.

"The FDA isn’t expecting perfection," Hamrell says. "We are all human. But if you make sure you have the proper procedures in place and you follow them, then you’re going to have it a lot easier."

A lot of what happens is just plain carelessness, he concludes.

"Do it right the first time. Check and recheck your data. Review your procedures. If you delegate something to your staff, it still will all come back to you. Have the checks and balances in place. If you are part of a busy medical practice and you’ve had a bad day, a busy day with a lot of patients coming through, it can be hard to get it all right. So check it and check it again," he points out.