Beyond the Checklist: What Makes a GCP Audit Truly Valuable?
CLINVERIS Insights | GCP Auditing & Clinical Quality
A well-completed checklist does not necessarily mean a well-controlled process. The real value of a GCP audit lies in understanding what happens beyond the documentation.
In recent years, checklists have become increasingly popular across the clinical research industry. We see them everywhere: on LinkedIn, in training materials, in quality management systems and, of course, in audit preparation.
Many are well designed, practical and visually attractive. With the growing use of AI, creating comprehensive checklists has become easier than ever.
And there is nothing inherently wrong with that. I use AI myself, and I believe it can be an excellent tool for organising information and supporting preparation.
However, there is one aspect that concerns me.
Are we sometimes becoming so focused on completing the checklist that we forget to understand the process behind it?
In my view, this question is particularly relevant to GCP auditing.
A checklist is a tool, not an audit strategy
A checklist can help an auditor ensure that important requirements have been considered. It provides structure, supports consistency and reduces the likelihood of overlooking specific areas.
But an audit is not simply an exercise in verifying whether documents exist or whether individual activities have been recorded.
A genuinely valuable GCP audit should help answer more fundamental questions:
Do the processes actually work as intended?
Are responsibilities clearly understood and consistently implemented?
Are identified risks appropriately controlled?
Can the organisation demonstrate that its controls are effective?
What happens when the normal process does not go according to plan?
A document may be complete, approved and correctly filed, while the process it describes remains ineffective.
And this is where an auditor's professional judgement becomes essential.
A practical example: Investigational Medicinal Product management
Consider a hypothetical investigator site audit focusing on Investigational Medicinal Product (IMP) management.
The auditor reviews a checklist covering several important areas:
Temperature monitoring records are complete.
Temperature excursions are documented.
Access to IMP storage is restricted.
IMP accountability records are accurate and up to date.
Everything appears satisfactory.
All four items could potentially be marked as reviewed.
But what happens when we look a little deeper?
1. Temperature monitoring
The temperature logs are complete. However, the temperature data loggers are removed annually for calibration.
How was the IMP storage temperature monitored during that period?
Is there evidence of an alternative monitoring arrangement?
If no such evidence is available, can we really conclude that storage conditions were adequately controlled throughout the entire period?
2. Temperature excursions
A temperature excursion has been properly documented, and the affected IMP was quarantined while awaiting the sponsor's decision.
But how were the storage conditions of the quarantined IMP monitored?
Was the quarantine arrangement appropriate, and can compliance with the required storage conditions be demonstrated?
Documenting an excursion is important. Maintaining control over the affected IMP while the issue is being resolved is equally important.
3. Restricted access
The IMP storage room is locked, and access is described as restricted.
However, when blinded site personnel are asked for the key, they can obtain it within two minutes.
Does the access control process genuinely protect restricted information and materials?
Who is authorised to access the storage area, how are access permissions controlled, and could the arrangements create a risk to trial blinding?
A locked door does not necessarily mean effective access control.
4. IMP accountability
The accountability records appear accurate and up to date.
However, during the physical inventory, two additional IMP vials are identified at the site, although the documentation indicates they should already have been destroyed.
How did this discrepancy arise?
Was there an error in documentation, a failure in the destruction process or a broader weakness in IMP reconciliation?
And, importantly, what does this tell us about the effectiveness of the process?
In each of these examples, the initial documentation review might suggest that the relevant checklist requirement has been addressed.
Yet a closer examination raises important questions about process implementation, oversight and the reliability of the available evidence.
The difference is not necessarily in what the auditor checked, but in how deeply the auditor understood what was being checked.
From identifying discrepancies to understanding risk
Finding a discrepancy is not the final objective of an audit.
The next step is to understand its significance.
Not every documentation gap represents the same level of risk. Not every deviation indicates a systemic failure.
An experienced auditor should be able to distinguish between an isolated error and a potential weakness in the quality management system.
This requires looking beyond the immediate observation.
For example, an IMP accountability discrepancy may prompt questions about staff responsibilities, reconciliation practices, sponsor oversight, escalation procedures and the effectiveness of previous corrective actions.
The objective is not to generate as many findings as possible.
It is to identify meaningful weaknesses, assess their potential impact and provide a sound basis for corrective and preventive actions.
This is also consistent with the direction of ICH E6(R3), which emphasises proportionate, risk-based quality management and the importance of processes that protect trial participants and support reliable trial results.
What makes a GCP audit truly valuable?
For me, the value of an audit rests on four essential elements.
1. Understanding the process
Before assessing compliance, the auditor needs to understand how the process is designed, how it operates in practice and how responsibilities are distributed among the people involved.
2. Following the evidence
An audit should not stop at the first document that appears to confirm compliance.
The auditor needs to connect procedures, records, interviews and actual practices to understand whether the evidence is consistent.
3. Applying professional judgement
Checklists and regulatory requirements provide a framework. Experience, critical thinking and an understanding of clinical trial operations help the auditor recognise which issues warrant closer attention.
4. Supporting meaningful improvement
A useful audit finding should be clear, evidence-based and sufficiently informative to help the organisation investigate causes and develop effective corrective and preventive actions.
A well-written audit report should not simply describe what was wrong. It should provide meaningful insight into where the quality system may need strengthening.
The role of AI and checklists in modern GCP auditing
AI is increasingly useful for organising regulatory information, developing audit preparation materials and supporting structured documentation reviews.
But it cannot replace the auditor's responsibility to evaluate evidence critically, understand the operational context and exercise independent professional judgement.
The same applies to checklists.
They can tell us what to look at.
They cannot, by themselves, tell us whether what we are looking at makes sense.
And perhaps this is the most important distinction.
Completing a checklist demonstrates that questions were asked. A valuable audit demonstrates that the right questions were asked, the answers were critically evaluated and the implications were understood.
Final thoughts
A successful GCP audit should never be measured solely by the number of checklist items completed or the number of findings raised.
Its real value lies in helping an organisation understand whether its processes are effective, whether important risks are adequately controlled and where improvements may be needed.
Ultimately, auditing is not about checking boxes.
It is about understanding processes, challenging assumptions and identifying what truly matters for participant protection and data reliability.
And that is where meaningful clinical quality begins.
Agnieszka Sokol
Founder | CLINVERIS — Clinical Quality Consulting
Clarity in Quality. Confidence in Compliance.
Comments