ICH E6(R3) Inspection Readiness: How Sponsors Prepare for a GCP Inspection
Last updated: October 2026
Under ICH E6(R3), a sponsor has to show that quality was designed into the trial from the start. That means identifying critical-to-quality factors, running a documented risk management cycle, overseeing service providers in proportion to risk, and owning data governance, computerised systems included. For sponsor inspection readiness, a complete TMF is necessary but not enough. Inspectors want to see why the sponsor made each decision and how it actually exercised oversight. The evidence they look for includes a living risk assessment, quality tolerance limit monitoring, a justified monitoring strategy, oversight records for CROs and vendors, robust safety reporting, a system inventory with audit trail reviews, and SOPs, training and CAPA with effectiveness checks. This guide sets out what that evidence looks like and which provisions require it.
In brief
- E6(R3) turns the risk-based approach of E6(R2) into a closed six-step cycle (section 3.10.1). It also adds a dedicated section on sponsor oversight (3.9), a separate data governance section (4), and the concept of “essential records” (Appendix C).
- The sponsor keeps ultimate responsibility whenever it outsources work. E6(R3) 3.6.6, 21 CFR 312.52 and Article 71 of EU Regulation 536/2014 all say so. The FDA only recognises a transfer of obligations if it is specifically set out in writing.
- At a sponsor inspection, the FDA works from Compliance Program 7348.810 (version of 15 September 2021). It focuses on seven areas: vendor oversight, monitoring, safety reporting, data handling and systems, investigational product, investigator selection, and records retention.
What E6(R3) changes for sponsors: overview (as of October 2026)
| Topic | E6(R2) | E6(R3) | Evidence inspectors expect from the sponsor |
|---|---|---|---|
| Quality by design and critical-to-quality factors | 5.0: quality management focused on critical processes and data | 3.10 and Principles 6/7: quality built into design; critical-to-quality factors per ICH E8(R1) | Documented identification of critical-to-quality factors during protocol development; description of the quality management approach in the clinical study report |
| Risk management | 5.0.1–5.0.7 | 3.10.1.1–3.10.1.6: identification, evaluation, control, communication, review, reporting | Version-controlled risk assessment, review minutes, a record of who was told about which risks |
| Quality tolerance limits | 5.0.4 and 5.0.7: predefined QTLs; important deviations reported in the CSR | 3.10.1.3: “acceptable ranges” (e.g. QTLs at trial level); 3.10.1.6: exceedances and remedial actions go in the CSR | Rationale for the limits, monitoring history, an investigation of every exceedance, the corresponding CSR section |
| Monitoring | 5.18 (5.18.3 risk-based) | 3.11.4 with monitoring plan (3.11.4.3); centralised monitoring and remote visits explicitly covered | Justified monitoring strategy, centralised monitoring outputs, traceable changes to the plan |
| Oversight of service providers | 5.2 (5.2.2 oversight extends to subcontractors) | 3.6 (3.6.4, 3.6.6–3.6.9) and the new 3.9 (3.9.5: oversight must be “fit for purpose”) | Agreements in place before work starts, responsibility matrix, oversight plan, KPI reviews, audits, governance minutes |
| Computerised systems | 5.5.3: validation, SOPs, audit trail | 3.16.1(x) and 4.3: system record, proportionate requirements, user register, defect reporting process | System inventory with validation status, risk-based validation rationale, role and access lists |
| Data governance | No dedicated section | New section 4: safeguarding blinding (4.1), data life cycle (4.2), metadata and audit trails (4.2.2), review (4.2.3) | Data flow diagram, data management plan, audit trail review plan and records, unblinding controls |
| Safety reporting | 5.16, 5.17 | 3.13 | Timeline tracking, safety database versus clinical database reconciliation, current reference safety information |
| Essential records | Section 8: “essential documents” | Appendix C: “essential records”, explicitly including data and metadata; scope proportionate to risk | A record of where essential records are held; a TMF that lets the reader reconstruct decisions |
The section mapping follows the ICH Step 4 presentation (2025) and the EMA Step 5 text of E6(R3).
What does ICH E6(R3) actually change for sponsors?
Under E6(R3), the sponsor has to show that it managed quality up front, not merely that it checked quality after the fact. The core of the change is defining critical-to-quality factors, running a documented risk management cycle, and taking responsibility for data and systems across their whole life cycle.
Section 3.10 asks the sponsor to build quality into trial design (quality by design). The sponsor must also identify the factors likely to have a meaningful impact on participants’ rights and safety and on the reliability of results. Section 3.10.1 breaks risk management into six steps: identification (3.10.1.1), evaluation (3.10.1.2), control (3.10.1.3), communication (3.10.1.4), review (3.10.1.5) and reporting (3.10.1.6). There is also a new section on sponsor oversight (3.9), which has no equivalent in E6(R2). A separate section 4 on data governance covers the data life cycle, metadata, audit trails, unblinding and computerised systems for sponsors and investigators alike.
Quality tolerance limits are now framed as “pre-specified acceptable ranges”. Under 3.10.1.3, the sponsor sets them “where relevant”, explicitly “e.g., quality tolerance limits at the trial level”, to help control risks to critical-to-quality factors. Under 3.10.1.6, the sponsor summarises important quality issues, including any exceedance of these ranges, together with the remedial action taken, in the clinical study report (see ICH E3). The guideline does not define key risk indicators (KRIs). In practice, KRIs are site-level signals that flag emerging problems as the trial runs. QTLs, by contrast, target systematic problems across the whole trial, and only QTLs trigger the CSR reporting obligation.
“Essential documents” (E6(R2) section 8) become “essential records” in Appendix C. The term explicitly covers data and metadata in any format, and the scope depends on trial design and risk. Sponsors and sites must keep a record of where essential records are held. When E6(R3) takes effect in the EU, the US and the UK is set out, together with CRO obligations, on our eQMS for CROs page.
Does the sponsor remain responsible when it outsources to a CRO?
Yes. A sponsor can transfer tasks, but ultimate responsibility for participant protection and data reliability always stays with it. E6(R3), 21 CFR 312.52 and EU Regulation 536/2014 all agree on this. Every transfer therefore has to be set out in writing, and the sponsor has to be able to show that oversight actually took place.
Under E6(R3) 3.6, agreements with service providers must be documented before the activities begin (3.6.1). Transferred activities are recorded in an agreement, and anything not specifically transferred stays with the sponsor (3.6.4). Ultimate responsibility rests with the sponsor (3.6.6). The sponsor selects the provider and assesses its suitability (3.6.7), needs access to SOPs and performance metrics (3.6.8), and must extend oversight to activities the provider subcontracts onward (3.6.9). Under 3.9.5, the range and extent of oversight should match the trial’s complexity and risks. The selection and oversight of investigators and service providers are described as fundamental to that process.
In the US, 21 CFR 312.52 allows obligations to be transferred to a CRO only in writing. The FDA reads this strictly, as the Warning Letter to Verdure Sciences of 10 November 2025 shows. The contract and work order called the vendor a “Service Provider” but listed no specific obligations, so every sponsor obligation stayed with the company. In the EU, Article 71 of Regulation 536/2014 permits delegation by written contract without prejudice to the sponsor’s responsibility. Article 72 covers shared responsibility under co-sponsorship.
A defensible oversight record usually has these components:
- Risk-based vendor qualification before contract award (questionnaire, an audit where criticality warrants it, a review of inspection history).
- A responsibility matrix that assigns every obligation clearly, including to subcontractors.
- An oversight plan with KPIs, thresholds and escalation routes.
- Minuted governance meetings that show what the sponsor decided.
- The sponsor’s own reviews, for example sampling monitoring reports and checking safety cases.
The FDA Compliance Program 7348.810 (Part III, section F) directs investigators to collect every version of the agreements, the oversight plans and the meeting minutes, and to establish whose SOPs were actually followed. The MHRA Inspectorate blog (2018) shows what happens when that evidence is missing. One sponsor had no oversight file, its oversight of the CRO could not be reconstructed, and the CRO reported SUSARs late without the sponsor noticing. What the CRO itself must evidence is covered on our eQMS for CROs page.
What does the FDA check during a sponsor inspection?
The FDA inspects sponsors under Compliance Program 7348.810, “Sponsors and Contract Research Organizations”. The current published version has been in effect since 15 September 2021. The focus is trial oversight, including monitoring, vendor audits, training and data management. A scientific evaluation of the results is explicitly out of scope.
The Compliance Program 7348.810 covers, among other areas: organisation and personnel, ClinicalTrials.gov registration, selection and monitoring of investigators, outsourced services, monitoring procedures, QA activities, safety and adverse event reporting, DSMBs, safety oversight, data collection and handling, electronic records, records retention, financial disclosure and investigational product. Inspections are usually pre-announced, generally at least five calendar days in advance according to the programme. A sponsor may answer a Form FDA 483 in writing within 15 business days, and that response can shape the agency’s next steps. The programme still refers to E6(R2). Its substance, however, largely matches E6(R3), which the FDA has adopted as final guidance.
The legal basis is 21 CFR 312.50–312.59:
- 312.50: general sponsor responsibilities, including qualified investigators, proper monitoring and keeping investigators informed.
- 312.53: selecting investigators and monitors.
- 312.55: informing investigators.
- 312.56: reviewing ongoing investigations; an investigator who does not comply must be brought into compliance or removed.
- 312.57: recordkeeping and retention.
- 312.58: FDA access to records.
- 312.59: disposition of unused investigational drug.
The Warning Letter to Applied Therapeutics (dated 27 November 2024, published in December 2024) shows what this means in practice. Two days after the FDA pre-announced an inspection, a contracted vendor deleted eCOA data and the associated audit trails for all 47 participants. The FDA cited 21 CFR 312.58 and made clear that using a vendor does not reduce the sponsor’s responsibility. For aggregate inspection statistics on sponsors and CROs, see our eQMS for CROs page.
Which safety reporting obligations do inspectors test at the sponsor?
Inspectors test whether the sponsor assesses incoming SAEs systematically, reports on time and reconciles its data. In the US, IND safety reports fall due within 7 or 15 calendar days; in the EU, SUSARs within 7 or 15 days. Without traceable timeline tracking, a missing record is often treated as a systemic failure.
Under 21 CFR 312.32, the sponsor must submit an IND safety report no later than 15 calendar days after determining that the information qualifies for reporting. For unexpected fatal or life-threatening suspected adverse reactions, the FDA must be notified no later than 7 calendar days after the sponsor first receives the information. Annual reports follow under 312.33. In the EU, the investigator reports SAEs to the sponsor within 24 hours under Article 41 of Regulation 536/2014. The sponsor reports SUSARs to EudraVigilance under Article 42: within 7 days for fatal or life-threatening cases and within 15 days for all others. It submits the annual safety report (in practice the DSUR) under Article 43. Serious breaches of the Regulation or the protocol must be notified through CTIS within 7 days of the sponsor becoming aware of them (Article 52).
The Compliance Program 7348.810 (sections J and L) sets out where inspectors probe. Who decides whether a case is reportable? Is there a separate safety database, and how is it reconciled with the EDC? How is unblinding handled after an SAE? How does aggregate safety data feed into updates of the investigator’s brochure? A sponsor that can show when the clock started for every case, and can produce a signed reconciliation, will hold up to these questions.
How does a sponsor demonstrate risk-based monitoring and RBQM during an inspection?
The monitoring strategy has to follow visibly from the risk assessment, and every change to it has to be documented. Inspectors expect a living risk assessment, a rationale for the type and intensity of monitoring, centralised monitoring outputs, QTL tracking and evidence that the sponsor acted on signals.
The FDA’s risk-based monitoring guidance (2013) and its companion Questions and Answers (April 2023) recommend documenting the risk assessment methodology and revisiting the assessment as the trial progresses. They also recommend deriving the type, frequency and extent of monitoring from it. According to Compliance Program 7348.810 (section H), investigators check whether the monitoring plan was followed, whether and why it was changed, and whether source data verification matched the pre-specified extent. The EMA set out the same logic in its Reflection Paper on risk based quality management (2013). E6(R3) 3.11.4 builds on it and lists the factors that shape the monitoring strategy: trial purpose, design, blinding, safety profile and endpoints.
An inspection-ready RBQM package contains:
- The initial risk assessment and every dated revision, with its trigger.
- The rationale for each QTL.
- QTL tracking logs, with an investigation of every exceedance.
- Centralised monitoring reports and the actions they led to.
- The CSR narrative required by 3.10.1.6.
In its guidance on E6 compliance (2026), the MHRA states that its inspectors use the sponsor’s risk assessment to judge whether the annexes were applied proportionately. Any departure from the guideline has to be justified in that risk assessment.
What data governance and system evidence do inspectors expect from the sponsor?
The sponsor must keep an inventory of its important computerised systems and show that they were validated on a risk basis. It must also show that access is role-controlled and that audit trails are reviewed according to a plan. This applies even when a CRO or technology vendor operates the systems.
Under E6(R3) 3.16.1(x), the sponsor keeps a record of its important systems, covering their use, functionality, interfaces and validation status. It ensures that requirements for validation, audit trails, user management, backup and IT security are implemented proportionately. It also maintains a register of authorised users and their roles. Section 4 adds that audit trails must not be disabled (4.2.2). Review of data, audit trails and metadata is a planned, risk-based activity (4.2.3). Validation rests on a risk assessment (4.3.4). Access is revoked once it is no longer needed (4.3.8). The EMA Guideline on computerised systems and electronic data in clinical trials (2023) requires procedures for trial-specific, risk-based audit trail review. It also makes clear that the sponsor must not have exclusive control of data entered by the investigator.
The Compliance Program 7348.810 (section N) is equally specific. Investigators trace data flow from source to CSR and review the sponsor’s own user acceptance testing for vendor-supplied systems. They also ask whether audit trails could be switched off, and they examine database lock and unlock records. Details on electronic records and signatures are covered in our Part 11 guide.
Which SOP, training and CAPA evidence belongs in inspection readiness?
Inspectors expect SOPs that reflect E6(R3), role-based training that is documented, and CAPA whose effectiveness has actually been verified. A gap analysis from E6(R2) to E6(R3) should exist in writing, because the MHRA may examine it at inspection.
The MHRA guidance (2026) expects sponsors to have assessed the Principles and Annex 1 against their quality management system and to have documented that assessment. For ongoing trials it requires a documented impact assessment. A line-by-line assessment is explicitly not required. Training should be proportionate to each person’s role and documented, and can draw on the ICH training materials. Where SOPs were not followed, FDA investigators check under Compliance Program 7348.810 whether an impact assessment was done and whether CAPA was implemented. For system faults, they check for a root cause analysis. A CAPA is only closed once a documented effectiveness check shows the problem has not recurred. This is the evidence sponsors most often leave out. Filing in the TMF is only one part of inspection readiness. TMF plans, filing timelines, completeness, inspector access to the eTMF, storyboards, front and back room set-up and mock inspections are covered in our TMF inspection readiness guide.
Does integrating quality processes with the eTMF make evidence easier to produce? Partly. Inspectors typically follow chains across several systems: from a deviation, to CAPA, to an SOP change, to training. At the same time, E6(R3) Appendix C requires the sponsor to record where its essential records are held. When deviations, CAPA, SOP versions and training records are linked to the eTMF, such chains can be shown in minutes rather than pieced together over days. Integration has limits, though. It does not replace substantive oversight, and data held in CRO systems (EDC, the safety database, often the CRO’s own eTMF) stays outside it. Every added system must also be validated and overseen in its own right. The conclusion depends on the sponsor’s situation. A single-study sponsor whose full-service CRO runs the eTMF should first secure contractual access and build its own oversight file. Once several studies and vendors run in parallel, an integrated, pre-validated platform noticeably reduces the reconciliation effort. For orientation, see the eQMS software comparison and the eTMF software comparison.
Decision guide: what should small sponsors do first?
First Phase I trial with a full-service CRO
Before start-up, record in a responsibility matrix which sponsor obligations transfer to the CRO. For the US, declare the transfer to the FDA under 21 CFR 312.23(a)(1)(viii), because 21 CFR 312.52 treats any obligation not specifically transferred in writing as not transferred. In parallel, build your own oversight file containing CRO qualification, an oversight plan and governance minutes. Ultimate responsibility stays with you under E6(R3) 3.6.6.
Trial running in the EU and the US
Run one combined timeline tracker for both jurisdictions’ reporting and archiving duties. It should cover SUSAR timelines under Article 42 of Regulation 536/2014 and IND safety reports under 21 CFR 312.32, serious breaches under Article 52 (7 days), and TMF archiving for at least 25 years under Article 58. A sponsor without an EU establishment needs a legal representative in the Union under Article 74. A single E6(R3) 3.10 risk assessment gives both regulators a common basis.
Inspection announced for four weeks’ time
Start with the areas that FDA Compliance Program 7348.810 and EU member state inspectors routinely probe: agreements in all versions, oversight evidence, safety reporting timeliness and reconciliation, the system inventory and audit trail reviews, the monitoring plan and its rationale, and open CAPA. Prepare a short narrative of how you assessed risk and oversaw the CRO. Document any gaps openly rather than “fixing” them retrospectively, because backdated records damage data integrity far more than a documented gap does. Inspection logistics are covered in our TMF inspection readiness guide.
First move from E6(R2) to E6(R3) SOPs
Start with a documented gap analysis against the Principles and Annex 1. Give priority to section 3.10 (risk management and acceptable ranges), 3.9 (oversight), 3.16.1(x) and section 4 (systems and data governance), and Appendix C (essential records). For ongoing trials, produce an impact assessment and record justified deviations, as the MHRA explicitly expects. Then train by role and keep records, rather than giving every member of staff the same course.
FAQ
What changes for sponsors under ICH E6(R3)?
Sponsors must plan quality up front: they identify critical-to-quality factors and run a documented risk management cycle under section 3.10.1. E6(R3) also adds a dedicated section on sponsor oversight (3.9), a data governance section (4) with clear duties for computerised systems, and the term “essential records” in Appendix C in place of “essential documents” (ICH E6(R3)).
What does the FDA inspect at a sponsor?
The basis is Compliance Program 7348.810, version of 15 September 2021. The FDA examines organisation, investigator selection and monitoring, oversight of outsourced services, safety reporting under 21 CFR 312.32, data handling including validation and audit trails, investigational product, and records retention under 21 CFR 312.57. Scientific evaluation of the trial results is not part of the inspection.
Is the sponsor responsible if the CRO makes mistakes?
Yes, ultimate responsibility stays with the sponsor (E6(R3) 3.6.6; Article 71 of Regulation 536/2014). In the US, the FDA can hold a CRO accountable for obligations transferred to it in writing under 21 CFR 312.52. Failures of oversight, however, are attributed to the sponsor, as the 2024 Warning Letter to Applied Therapeutics shows.
What are quality tolerance limits?
Quality tolerance limits are pre-specified thresholds at the level of the whole trial. They are designed to reveal systematic problems with critical-to-quality factors, such as an unusually high rate of missing primary endpoint data. E6(R3) 3.10.1.3 gives them as an example of “acceptable ranges”. Important exceedances and the remedial action taken must be reported in the clinical study report under 3.10.1.6.
Do SOPs need to be updated for E6(R3)?
Yes, wherever existing SOPs do not cover the new expectations, typically risk management, sponsor oversight, computerised systems and essential records. The MHRA expects a documented assessment of the quality management system against the Principles and Annex 1, but not a line-by-line one. Ongoing trials also need an impact assessment.
How do I demonstrate risk-based monitoring during an inspection?
With a chain of documents: a version-controlled risk assessment, a monitoring plan that justifies the type and intensity of monitoring by reference to those risks, centralised monitoring reports, QTL tracking, and evidence of plan changes and their triggers. Under Compliance Program 7348.810, FDA investigators check whether the plan was followed and why it was changed; the expectations are set out in the FDA Questions and Answers on risk-based monitoring (2023).
What are the SUSAR timelines in the EU and the US?
In the EU, the sponsor reports fatal or life-threatening SUSARs within 7 days of becoming aware of them and all others within 15 days (Article 42 of Regulation 536/2014). In the US, 21 CFR 312.32 uses the same 7 and 15 calendar day periods. There, however, the 15-day clock starts only once the sponsor has determined that the information qualifies for reporting.
Author: Jan Krikava – A former life science consultant who founded Docuply on the back of his own consulting experience. 14 years of experience in quality management. Business Informatics B. Sc. LinkedIn: linkedin.com/in/jan-krikava
