TMF Inspection Readiness 2026: The Guide with Checklist for Biotechs and CROs
Last updated: 4 September 2026
Inspection readiness means your Trial Master File (TMF) is complete, current and independently navigable by an inspector at any time, without a clean-up sprint before an inspection. Inspectors recognise a ready TMF by three signals: the TMF is contemporaneous, filed as the trial happens rather than just before the inspection; it is complete and traceable through an index or TMF map; and the inspector is given direct, self-service read-only access rather than a staff member turning the pages. The EMA puts it plainly: the TMF should let the trial activities be reconstructed without additional explanation from staff. This guide sets out what EMA, MHRA, ICH GCP and the FDA expect, how a small biotech uses the TMF Reference Model pragmatically, and what a genuinely checkable readiness checklist looks like.
The TMF is the collection of essential documents that lets sponsors, CROs, investigators, auditors and inspectors evaluate how a trial was run and the quality of its data. The EMA TMF guideline (EMA/INS/GCP/856758/2018) requires that documents collectively permit confirmation of compliance with the protocol and GCP and the integrity of data collected without the need for additional explanation from sponsor, CRO or investigator staff. The MHRA sums it up: the TMF is the story of how the trial was conducted and managed, per the MHRA Inspectorate Blog.
Not only the sponsor. The MHRA reports CRO inspections as a category in their own right: in the 2018/19 reporting year, according to the MHRA GCP Inspections Metrics Report, 11 of the UK inspections were of CROs, against 8 commercial sponsors, 12 non-commercial organisations, 19 investigator sites and 7 Phase 1 units; one CRO received a critical finding in its own name during that period. The FDA inspects CROs under compliance program 7348.810 Sponsors and Contract Research Organizations, which treats any entity that has been transferred sponsor obligations in writing as a sponsor. A CRO is therefore subject to the requirements in this guide directly, not merely through its client. What does not change is that overall responsibility for the trial stays with the sponsor.
Contemporaneous means documents are filed close to the activity they relate to, not retrospectively. Article 57 of EU Regulation 536/2014 requires the TMF to contain the essential documents at all times. The EMA guideline clarifies in section 3.5.4 that documentation should be added in a timely manner during the trial and that the timelines for submission and filing of all documents to the TMF should be defined in procedural documents or TMF plans. No authority mandates a fixed number of days. Industry practice treats a filing window of a few days as normal, commonly 5 to 10 business days from finalisation or receipt; 30 days is sometimes discussed as an outer limit but is not a regulatory standard. The governing principle is that any document a later activity relies on must be in the TMF before that activity takes place.
Yes. The EMA guideline requires the TMF to be readily available and directly accessible to competent authorities. The MHRA Inspectorate Blog states the expectation clearly: inspectors want to navigate the eTMF themselves after basic training, without an expert turning the pages. For an archived eTMF, section 6.1 of the EMA guideline explicitly provides for read-only access with an audit trail. In the US, 21 CFR 312.68 obliges the investigator to let FDA officers access, copy and verify records, and 21 CFR 312.58 does the same for sponsor records. Electronic records fall under 21 CFR Part 11 and the FDA guidance on electronic systems (October 2024).
The revised ICH E6(R3) guideline came into effect in the EU/EEA on 23 July 2025 and has been adopted by the FDA. Three points matter for the TMF. First, R3 speaks of essential records rather than essential documents, widening the scope to data, metadata and audit trails. Second, sponsor oversight stays with the sponsor: duties can be delegated to a CRO, responsibility cannot. Third, R3 requires direct access to all essential records regardless of format or location, which favours hybrid inspections with system access granted in advance.
No. The TMF Reference Model is not a regulation but a voluntary taxonomy that has become the de-facto standard, now used by virtually all sponsors, CROs and eTMF vendors. It organises TMF content into a three-tier hierarchy of zones, sections and artefacts and, in version 3.3.1 (released 11 August 2023), uses 11 zones. It labels artefacts as core (required by ICH GCP or law) or recommended (relevant only if produced). Since October 2025 it is maintained under CDISC as the TMF Standard Model v1, which replaces the artefact and sub-artefact terminology with record groups and record types and expands the taxonomy to over 2,000 record types; version 3.3.1 remains valid until 2027.
A small biotech should treat the model as a starting point and cut it down to a study-specific TMF plan with a TMF index. You do not adopt every artefact blindly; you select those relevant to your phase, design and scope and document the selection. The MHRA Inspectorate Blog also warns against the misconception that only the documents listed in ICH GCP section 8 are needed; data management records and decision-related correspondence belong in the TMF too. An overarching mapping document listing every essential record and its location is, per the MHRA, the simplest way to make distributed systems inspection-proof.
The TMF plan is the blueprint. It defines structure and index, names the role responsible for creating, reviewing, approving and filing each document type, and sets filing timelines and QC cycles. There is exactly one TMF per trial, comprising the sponsor TMF and the investigator TMF (investigator site file). Some documents belong to only one side, such as the master randomisation list in the sponsor TMF and the subject identification code list in the investigator TMF.
Set a measurable filing SLA, for example filing within 5 to 10 business days of finalisation or receipt, and measure filing cycle time by artefact type. The timeliness metric is your early-warning system: a sudden pile of uploads just before an inspection tells inspectors the TMF was not maintained as the trial ran.
Measure completeness as the proportion of expected documents actually filed, against the TMF index at each milestone. Inspection-ready organisations commonly target around 95 per cent completeness shortly after milestones and 100 per cent before the relevant regulatory submission. Define realistic tolerance limits in the TMF plan and document a justification for every gap. A monthly review cycle run by the TMF lead or clinical QA is common practice.
Where a CRO holds part of the TMF, the EMA guideline says the sponsor needs access to the CRO-maintained part of the sponsor TMF, for example by remote access to the eTMF, to fulfil its oversight duty. The contract should set out which party holds which part, structure and indexing, access rights, filing timelines, archiving, and how the TMF will be made available to authorities.
Write the inspection scenario itself into the contract as well. Four points belong there: the CRO supports an inspection at the sponsor and provides requested documents and system access without delay, against a defined response time in hours or business days. It grants inspectors direct read-only access to the TMF part it maintains on request. It informs the sponsor of its own regulatory contacts and inspections touching the trial. And it names a point of contact for the inspection period. Without such clauses, response time in a live inspection rests on goodwill, and that is precisely where inspections come unstuck: a recurring EMA finding is contracts that fail to address the right to inspect third parties, and the MHRA has repeatedly had to add inspector days because of problems obtaining access to the TMF.
Prepare a storyboard that holds a factual, pre-agreed explanation for known risks or gaps: what happened, whether it touched participant safety or data integrity, and what was done. Set up inspector access: a dedicated read-only role in the eTMF, tested before arrival. Assign team roles: a team leader, a person for TMF navigation and document retrieval (back office), subject-matter experts, and direct communication with the inspector (front office). Run a process that logs, prioritises and promptly answers inspector requests. Bring any involved CROs in early and confirm who is reachable there during the inspection.
The difference is not merely a work style but a data-integrity risk. A continuously maintained TMF mirrors the trial in real time; a TMF stuffed in backlog sprints just before an inspection leaves traces. Inspectors are data-savvy and read upload dates in the audit trail: a spike of uploads immediately before the inspection proves the TMF was not kept contemporaneously. The MHRA Inspectorate Blog records that for commercial sponsors the most frequent major finding is in relation to record keeping and essential documents, and that problems with access to and provision of the TMF have repeatedly forced extra inspector days. Industry analyses of the MHRA metrics put record keeping and essential documents at roughly 18 per cent of all findings at sponsor inspections.
The scale is visible in the EMA GCP Inspectors Working Group Annual Report 2022: across 36 CHMP inspections, 470 findings were recorded, of which 17 were critical (3.6 per cent), 260 major (55.3 per cent) and 193 minor (41.1 per cent), an average of 13 findings per inspection. The Essential Documents sub-category was the single most frequent, with 58 findings (24 minor, 33 major, 1 critical). Retrospective clean-up does not address these findings, because it does not cure the underlying problem: the loss of ongoing oversight. More in the most common TMF findings.
Continuous readiness is largely a matter of process, but the system has to carry it. Vendor-neutrally, an eTMF should provide:
To test these requirements against specific products, see the criteria in the eTMF software comparison. A pre-validated, EU-hosted eTMF such as Docuply, integrated with eQMS and eDMS, is one way to provide these capabilities without carrying the validation burden yourself.
Keep the TMF continuously ready, run a full completeness and quality review 6 to 8 weeks ahead, write storyboards for known gaps, set up inspector read-only access, and rehearse the flow in a mock inspection.
Yes. The MHRA runs CRO inspections as a separate category: 11 in the UK in the 2018/19 reporting year and 5 the following year, the latter carrying 4 critical, 25 major and 41 other findings. The FDA inspects CROs under compliance program 7348.810. A CRO therefore needs its own inspection-readiness programme and cannot rely on the sponsor to cover it.
Documents that individually and collectively permit evaluation of trial conduct and data quality. Since 2025, ICH E6(R3) uses the term essential records and includes data, metadata and audit trails.
There is no legal day count. The EMA requires timely filing and timelines defined in the TMF plan; 5 to 10 business days from finalisation or receipt is common industry practice.
The sponsor remains responsible. Duties can be delegated to a CRO, oversight cannot; the sponsor needs access to CRO-held TMF parts. That does not exempt the CRO from being inspected in its own right.
Support and supply: provide requested documents and system access without delay, grant inspectors direct read-only access to the TMF part it maintains on request, and name a point of contact for the inspection period. This belongs in the contract, with a defined response time.
Yes. EMA and MHRA expect inspectors to navigate the TMF themselves after a brief introduction; a dedicated read-only role with an audit trail is the clean solution.
No. It is voluntary but a de-facto standard. Use it as a starting point and derive a study-specific index.
Under EU law, at least 25 years after the end of the trial; the FDA requires at least 2 years after approval or discontinuation under 21 CFR 312.62. ICH E6(R3) defers to the applicable regulatory requirements.
What do inspectors expect from a TMF?
The TMF is the collection of essential documents that lets sponsors, CROs, investigators, auditors and inspectors evaluate how a trial was run and the quality of its data. The EMA TMF guideline (EMA/INS/GCP/856758/2018) requires that documents collectively permit confirmation of compliance with the protocol and GCP and the integrity of data collected without the need for additional explanation from sponsor, CRO or investigator staff. The MHRA sums it up: the TMF is the story of how the trial was conducted and managed, per the MHRA Inspectorate Blog.
Who gets inspected, only the sponsor?
Not only the sponsor. The MHRA reports CRO inspections as a category in their own right: in the 2018/19 reporting year, according to the MHRA GCP Inspections Metrics Report, 11 of the UK inspections were of CROs, against 8 commercial sponsors, 12 non-commercial organisations, 19 investigator sites and 7 Phase 1 units; one CRO received a critical finding in its own name during that period. The FDA inspects CROs under compliance program 7348.810 Sponsors and Contract Research Organizations, which treats any entity that has been transferred sponsor obligations in writing as a sponsor. A CRO is therefore subject to the requirements in this guide directly, not merely through its client. What does not change is that overall responsibility for the trial stays with the sponsor.
What does contemporaneous filing mean?
Contemporaneous means documents are filed close to the activity they relate to, not retrospectively. Article 57 of EU Regulation 536/2014 requires the TMF to contain the essential documents at all times. The EMA guideline clarifies in section 3.5.4 that documentation should be added in a timely manner during the trial and that the timelines for submission and filing of all documents to the TMF should be defined in procedural documents or TMF plans. No authority mandates a fixed number of days. Industry practice treats a filing window of a few days as normal, commonly 5 to 10 business days from finalisation or receipt; 30 days is sometimes discussed as an outer limit but is not a regulatory standard. The governing principle is that any document a later activity relies on must be in the TMF before that activity takes place.
Can an inspector demand direct access to the eTMF?
Yes. The EMA guideline requires the TMF to be readily available and directly accessible to competent authorities. The MHRA Inspectorate Blog states the expectation clearly: inspectors want to navigate the eTMF themselves after basic training, without an expert turning the pages. For an archived eTMF, section 6.1 of the EMA guideline explicitly provides for read-only access with an audit trail. In the US, 21 CFR 312.68 obliges the investigator to let FDA officers access, copy and verify records, and 21 CFR 312.58 does the same for sponsor records. Electronic records fall under 21 CFR Part 11 and the FDA guidance on electronic systems (October 2024).
What does ICH GCP E6(R3) change for the TMF?
The revised ICH E6(R3) guideline came into effect in the EU/EEA on 23 July 2025 and has been adopted by the FDA. Three points matter for the TMF. First, R3 speaks of essential records rather than essential documents, widening the scope to data, metadata and audit trails. Second, sponsor oversight stays with the sponsor: duties can be delegated to a CRO, responsibility cannot. Third, R3 requires direct access to all essential records regardless of format or location, which favours hybrid inspections with system access granted in advance.
Do I have to implement the entire TMF Reference Model?
No. The TMF Reference Model is not a regulation but a voluntary taxonomy that has become the de-facto standard, now used by virtually all sponsors, CROs and eTMF vendors. It organises TMF content into a three-tier hierarchy of zones, sections and artefacts and, in version 3.3.1 (released 11 August 2023), uses 11 zones. It labels artefacts as core (required by ICH GCP or law) or recommended (relevant only if produced). Since October 2025 it is maintained under CDISC as the TMF Standard Model v1, which replaces the artefact and sub-artefact terminology with record groups and record types and expands the taxonomy to over 2,000 record types; version 3.3.1 remains valid until 2027.
A small biotech should treat the model as a starting point and cut it down to a study-specific TMF plan with a TMF index. You do not adopt every artefact blindly; you select those relevant to your phase, design and scope and document the selection. The MHRA Inspectorate Blog also warns against the misconception that only the documents listed in ICH GCP section 8 are needed; data management records and decision-related correspondence belong in the TMF too. An overarching mapping document listing every essential record and its location is, per the MHRA, the simplest way to make distributed systems inspection-proof.
The preparation process step by step
Step 1: Define the TMF plan and responsibilities
The TMF plan is the blueprint. It defines structure and index, names the role responsible for creating, reviewing, approving and filing each document type, and sets filing timelines and QC cycles. There is exactly one TMF per trial, comprising the sponsor TMF and the investigator TMF (investigator site file). Some documents belong to only one side, such as the master randomisation list in the sponsor TMF and the subject identification code list in the investigator TMF.
Step 2: Ongoing filing with SLAs and contemporaneousness metrics
Set a measurable filing SLA, for example filing within 5 to 10 business days of finalisation or receipt, and measure filing cycle time by artefact type. The timeliness metric is your early-warning system: a sudden pile of uploads just before an inspection tells inspectors the TMF was not maintained as the trial ran.
Step 3: Periodic completeness and quality reviews
Measure completeness as the proportion of expected documents actually filed, against the TMF index at each milestone. Inspection-ready organisations commonly target around 95 per cent completeness shortly after milestones and 100 per cent before the relevant regulatory submission. Define realistic tolerance limits in the TMF plan and document a justification for every gap. A monthly review cycle run by the TMF lead or clinical QA is common practice.
Step 4: CRO oversight and access to CRO-held TMF parts
Where a CRO holds part of the TMF, the EMA guideline says the sponsor needs access to the CRO-maintained part of the sponsor TMF, for example by remote access to the eTMF, to fulfil its oversight duty. The contract should set out which party holds which part, structure and indexing, access rights, filing timelines, archiving, and how the TMF will be made available to authorities.
Write the inspection scenario itself into the contract as well. Four points belong there: the CRO supports an inspection at the sponsor and provides requested documents and system access without delay, against a defined response time in hours or business days. It grants inspectors direct read-only access to the TMF part it maintains on request. It informs the sponsor of its own regulatory contacts and inspections touching the trial. And it names a point of contact for the inspection period. Without such clauses, response time in a live inspection rests on goodwill, and that is precisely where inspections come unstuck: a recurring EMA finding is contracts that fail to address the right to inspect third parties, and the MHRA has repeatedly had to add inspector days because of problems obtaining access to the TMF.
Step 5: Prepare for the inspection itself
Prepare a storyboard that holds a factual, pre-agreed explanation for known risks or gaps: what happened, whether it touched participant safety or data integrity, and what was done. Set up inspector access: a dedicated read-only role in the eTMF, tested before arrival. Assign team roles: a team leader, a person for TMF navigation and document retrieval (back office), subject-matter experts, and direct communication with the inspector (front office). Run a process that logs, prioritises and promptly answers inspector requests. Bring any involved CROs in early and confirm who is reachable there during the inspection.
The inspection-readiness checklist
Phase 1: Ongoing (continuous readiness)
- A TMF plan exists, is approved and names the role responsible for creating, reviewing, approving and filing each document type.
- The study-specific TMF index derives traceably from the TMF Reference Model; deviations are documented.
- A filing SLA is defined and measured, target: 5 to 10 business days from finalisation or receipt to filing.
- Filing cycle time is tracked by artefact type and reviewed monthly.
- Completeness is measured against the TMF index, target around 95 per cent after each milestone.
- A TMF map lists every essential record and its storage location across all systems.
- The eTMF audit trail is active and captures date, time and user for creation, upload, change and deletion.
- Access rights are role-based; sensitive documents such as randomisation codes are restricted.
- The sponsor has contractually defined access to CRO-held TMF parts and exercises it in a documented way.
- The CRO contract contains an inspection clause with a defined response time for providing documents and system access.
- Correspondence on key decisions is filed continuously, not collected in private inboxes.
- The eTMF is validated; validation evidence can be produced on request.
Phase 2: 6 to 8 weeks before the inspection
- A full completeness and quality review across all zones; identified gaps get a documented justification or a remediation plan with deadlines.
- A timeliness report is produced; clusters of late uploads are explained or corrected.
- Storyboards for known risks and gaps are written and internally approved.
- The inspector read-only role in the eTMF is set up and verified with a test user.
- Involved CROs are informed, have named a point of contact for the inspection period and confirmed availability of their TMF part.
- An inspection team with defined roles (team leader, front office, back office, SME) is named and trained.
- A mock inspection or dry run with real-time document retrieval has been carried out.
- Naming conventions are consistent so documents can be identified without being opened.
Phase 3: During the inspection
- Every inspector request is logged with a timestamp, an owner and a status.
- Requested documents are provided promptly; no retrospective changes are made to existing records.
- Requests touching CRO-held records are routed through the named CRO contact and served within the contractual response time.
- The front office answers only the questions asked, factually; storyboards are used where needed.
Continuous readiness vs. cleaning up before the audit
The difference is not merely a work style but a data-integrity risk. A continuously maintained TMF mirrors the trial in real time; a TMF stuffed in backlog sprints just before an inspection leaves traces. Inspectors are data-savvy and read upload dates in the audit trail: a spike of uploads immediately before the inspection proves the TMF was not kept contemporaneously. The MHRA Inspectorate Blog records that for commercial sponsors the most frequent major finding is in relation to record keeping and essential documents, and that problems with access to and provision of the TMF have repeatedly forced extra inspector days. Industry analyses of the MHRA metrics put record keeping and essential documents at roughly 18 per cent of all findings at sponsor inspections.
The scale is visible in the EMA GCP Inspectors Working Group Annual Report 2022: across 36 CHMP inspections, 470 findings were recorded, of which 17 were critical (3.6 per cent), 260 major (55.3 per cent) and 193 minor (41.1 per cent), an average of 13 findings per inspection. The Essential Documents sub-category was the single most frequent, with 58 findings (24 minor, 33 major, 1 critical). Retrospective clean-up does not address these findings, because it does not cure the underlying problem: the loss of ongoing oversight. More in the most common TMF findings.
What an eTMF system must deliver for this
Continuous readiness is largely a matter of process, but the system has to carry it. Vendor-neutrally, an eTMF should provide:
- Completeness dashboards showing the actual state against the expected document set by milestone, country and site.
- Automated filing reminders and escalations that enforce the filing SLA operationally.
- Complete, tamper-evident audit trails for creation, upload, change and deletion, compliant with 21 CFR Part 11.
- Powerful metadata-based search and retrieval so documents can be found without being guided.
- Role-based access control including a dedicated read-only role for inspectors and graduated rights for CRO users and sponsor oversight.
- System validation with retrievable evidence, plus archiving and lock functions at study close-out.
To test these requirements against specific products, see the criteria in the eTMF software comparison. A pre-validated, EU-hosted eTMF such as Docuply, integrated with eQMS and eDMS, is one way to provide these capabilities without carrying the validation burden yourself.
FAQ
How do I prepare a TMF for an inspection?
Keep the TMF continuously ready, run a full completeness and quality review 6 to 8 weeks ahead, write storyboards for known gaps, set up inspector read-only access, and rehearse the flow in a mock inspection.
Are CROs inspected in their own right?
Yes. The MHRA runs CRO inspections as a separate category: 11 in the UK in the 2018/19 reporting year and 5 the following year, the latter carrying 4 critical, 25 major and 41 other findings. The FDA inspects CROs under compliance program 7348.810. A CRO therefore needs its own inspection-readiness programme and cannot rely on the sponsor to cover it.
What are essential documents under ICH GCP?
Documents that individually and collectively permit evaluation of trial conduct and data quality. Since 2025, ICH E6(R3) uses the term essential records and includes data, metadata and audit trails.
How quickly must a document be filed in the TMF?
There is no legal day count. The EMA requires timely filing and timelines defined in the TMF plan; 5 to 10 business days from finalisation or receipt is common industry practice.
Who is responsible for the TMF, sponsor or CRO?
The sponsor remains responsible. Duties can be delegated to a CRO, oversight cannot; the sponsor needs access to CRO-held TMF parts. That does not exempt the CRO from being inspected in its own right.
What must a CRO do during a sponsor inspection?
Support and supply: provide requested documents and system access without delay, grant inspectors direct read-only access to the TMF part it maintains on request, and name a point of contact for the inspection period. This belongs in the contract, with a defined response time.
Can an inspector go directly into the eTMF?
Yes. EMA and MHRA expect inspectors to navigate the TMF themselves after a brief introduction; a dedicated read-only role with an audit trail is the clean solution.
Is the TMF Reference Model mandatory?
No. It is voluntary but a de-facto standard. Use it as a starting point and derive a study-specific index.
How long must a TMF be retained?
Under EU law, at least 25 years after the end of the trial; the FDA requires at least 2 years after approval or discontinuation under 21 CFR 312.62. ICH E6(R3) defers to the applicable regulatory requirements.
Author: Jan Krikava – Former life sciences consultant who founded Docuply based on his own consulting experience. 14 years’ experience in quality management. B.Sc. in Business Informatics. LinkedIn: linkedin.com/in/jan-krikava
