A risk-based audit program focuses limited resources on the vendors and processes that matter most to participant safety and data reliability, and times audits to when they can change outcomes. For most small sponsors, that means auditing critical vendors at qualification, early in the study, before key milestones such as database lock and whenever risk signals appear, and then making sure findings lead to effective corrective action.
Which vendors should you audit?
Prioritize vendors with a direct impact on safety or key data: the full-service CRO, central laboratories, safety and pharmacovigilance providers, and providers of systems such as EDC and randomization. Raise the priority for vendors that are new to you, have had previous findings, provide complex or novel services, or rely heavily on subcontractors.
When should audits happen?
At qualification, before award, to confirm capability.
Early in the study, to confirm processes are working as planned.
Mid-study, if performance or complexity warrants it.
Before database lock or a submission, to confirm data and documentation are in order.
For cause, when indicators such as deviation trends, data issues or staff turnover suggest a problem.
What kinds of audits are there?
Vendor and system audits, study-specific process audits, investigator site audits and trial master file audits. Some can be performed remotely, while others benefit from being on site. Choose the format that best answers the question you're asking.
Who should perform audits?
Qualified auditors who are independent of the operational work, often experienced consultants for small sponsors. The sponsor should define the scope based on its risks and its oversight plan, rather than accepting a generic audit agenda.
How should you act on findings?
Classify findings by severity. Require a corrective and preventive action plan from the vendor. Review that plan for adequacy, especially its root cause analysis. Then verify that the actions were taken and worked. An audit that ends with a report and no follow-up adds cost without adding control.
Why document your audit program?
A short, risk-based audit plan explaining which vendors and processes will be audited, when and why shows that audit decisions were deliberate. Inspectors may ask for evidence that audits took place and that findings were addressed, and a clear plan makes that easy to show.
How do audits fit with ongoing oversight?
Audits are snapshots. They complement, but do not replace, continuous oversight through governance meetings, key performance and risk indicators, document review and site feedback. Use what you learn from ongoing oversight to decide where and when to audit, and use audit findings to sharpen what you monitor afterward. Together, the two give a far more reliable picture of vendor performance than either can alone, and they show inspectors a sponsor that knows what is happening in its study.
Keep reading: Vendor Qualification Is Not Vendor Oversight
