A 90 day inspection readiness plan helps a clinical sponsor find and resolve inspection-relevant weaknesses while there is still enough time to test whether corrective actions work. The central deliverable is a current, retrievable and internally consistent evidence trail: who oversaw trial activities, how participant rights and safety were protected, what happened when problems arose, and how the sponsor verified remediation. Ninety days is an illustrative program-management horizon, not a regulatory notice period, FDA deadline or guarantee of inspection outcome.
This playbook is for a sponsor Clinical Quality/GCP lead, Regulatory Affairs, Head of Clinical Operations, Medical/Safety, Data Management, or executive sponsor anticipating an FDA Bioresearch Monitoring (BIMO) inspection or a major readiness decision. It assumes an ongoing or recently completed clinical investigation, possibly outsourced to a CRO, sites and specialist vendors. Inspection scope varies by product type, study and FDA assignment; a sponsor review is not automatically the same as a site, laboratory or investigator inspection.
Define the inspection scenario before building a checklist
Document what is known: whether a formal FDA inspection notice exists, the named legal entity or site, potential FDA program, investigational product and studies, contact channel, relevant geography, and the sponsor/CRO/site responsibilities. If the sponsor has only an internal target date, label the plan readiness exercise rather than implying an announced inspection. Establish a separate immediate-response protocol for actual FDA contacts, record requests, clinical holds or important safety concerns; those do not wait for a 90-day workstream.
FDA’s Bioresearch Monitoring (BIMO) program includes inspection of sponsors and CROs, clinical investigators and other regulated research participants, with focus on participant protection, compliance and trustworthy data. FDA issued final guidance in December 2025, Processes and Practices Applicable to Bioresearch Monitoring Inspections, discussing inspection interactions, records and communications. That guidance and the September 2025 FDA ICH E6(R3) GCP guidance are nonbinding recommendations. Applicable US regulations, including 21 CFR Parts 50, 56 and 312 as relevant to the study and inspected party, establish binding requirements. Do not describe the planning stages below as FDA-specified.
Review the relevant FDA BIMO compliance program for the anticipated inspection type. For an IND sponsor/CRO scenario, assess sponsor responsibilities, CRO written transfers and oversight evidence; for investigator/site inspections, assess investigator records and consent conduct, coordinating directly with the site and avoiding unauthorized assumption of site document custody. For devices or other products, establish the correct applicable rules instead of applying an IND-only checklist blindly.
The five-gate 90-day roadmap
Run the work as a short program with named owners, evidence links, decision dates and a weekly escalation forum. An evidence accepted status is different from document exists. Adapt timing to your actual notice and study risk; a real inspection request may demand action much sooner.
| Planning window | Sponsor deliverable | Owner and objective evidence | Stop/go question |
|---|---|---|---|
| Days 90–76: scope and baseline | Inspection scope, study inventory, obligation map, critical-risk register | Clinical QA + Regulatory; current protocol, IND records, key service agreements, prior findings | Do we know which activities and systems would need to be reconstructed? |
| Days 75–61: evidence reconstruction | Dated trail across participant protection, monitoring, safety, data and vendor oversight | Clinical Ops + QA + Medical/Data; direct record links, missing-item register | Can a reviewer trace a real subject or issue through accountable decisions? |
| Days 60–41: critical gap remediation | Risk-ranked deviations, CAPA/action plans, record corrections under control | QA + function owners; approved investigation, owners, training and objective corrections | Which unresolved gaps could affect safety, data reliability or compliance? |
| Days 40–21: mock exercise | Controlled request retrieval and factual interview rehearsal | Independent/mock lead; request log, timed retrieval evidence, observed gaps | Can the team locate and explain records consistently without scripting answers? |
| Days 20–0: final verification | Follow-up evidence, access test, open-issue disposition and leadership readiness decision | Sponsor QA + accountable leaders; closure/effectiveness proof and open-risk decisions | Is the evidence reliable, and do remaining gaps have an authorized escalation path? |
For genuine FDA contact, use the specified communication channel and applicable response procedures immediately. Continue other remediation transparently and document its actual dates. Never backdate or alter a source record to create the appearance that a control was previously in place. Corrections must be attributable, contemporaneous as possible, justified and traceable under relevant procedures.
Gate 1: scope, authority and high-consequence risks
Name an inspection coordinator and backup with authority to route requests, track deadlines, control communication and obtain vendor/source records. Determine who can speak to protocol, monitoring, safety, data, investigational product and vendor management. Confirm approval and legal/Regulatory routes for official responses. Do not assume a new “war room” supersedes formal document custodians or existing regulatory reporting duties.
Map the current and historical protocol versions, amendments, investigator and site portfolio, monitoring plans, safety procedures, quality agreements, delegated activities and key vendor changes. Under 21 CFR 312.52, where applicable, written transfers of sponsor obligations to CROs matter; a commercial SOW alone should not be assumed to describe every regulatory obligation. Check who retained responsibilities and whether any major subcontracting changed evidence ownership.
Rank open concerns by potential impact on participant rights and safety, data reliability, relevant requirements, and the sponsor’s ability to reconstruct activity. A low-risk late administrative filing does not warrant the same response as an unresolved serious safety-reporting discrepancy or unexplained primary-endpoint modification. Define quality and medical escalation routes that operate independently of routine inspection-preparation meetings.
Gate 2: reconstruct the story from source records
Use representative tracer pathways rather than relying only on a completeness percentage. For participant rights, select informed-consent events and check approved version, timing, signatures/attribution, reconsent and associated site evidence where accessible. For safety, trace an important event from source notification through medical assessment, safety-system records, applicable reporting and follow-up. For protocol conduct, connect deviations to sponsor review and corrective action. For data integrity, trace a critical data point through source, EDC/audit trail, external transfer, reconciliation and analysis or query disposition.
For monitoring and oversight, reconstruct a significant finding from monitor report or quality signal through the sponsor’s knowledge, escalation, remediation and evidence of closure. For vendor interfaces, verify who was responsible for an activity, how errors were communicated, and whether the receiving function accepted the result. Inspect the source systems or controlled copies permitted by agreements; a screenshot detached from its context may be inadequate to explain what occurred.
Identify records that cannot be promptly retrieved because of access rights, system migrations, vendor handoffs, broken links or incomplete document indexes. An evidence gap is not automatically proof of a regulatory violation, but it creates an inspection challenge and needs an owner, a valid retrieval plan and a truthful explanation. Do not construct substitute evidence after the fact.
Gate 3: remediate and verify—not just assign training
For material gaps, distinguish immediate containment, root-cause investigation, corrective action, preventive controls where relevant, and effectiveness verification. Training may be one action, but often does not address a defective interface, unclear contractual owner, inappropriate system privilege or weak data reconciliation. Record when each measure actually occurred and which records demonstrate its result. Escalate significant findings through the sponsor’s established quality and regulatory processes without waiting for a mock inspection to conclude.
An effective finding register should include: ID; actual event and date; affected study/site/vendor; source evidence; impact on rights, safety and reliability; applicable regulation/procedure; owner; immediate control; investigation and root-cause status; action due date; independent review; closure evidence; residual risk and management decision. Separate overdue commitments from tasks for which objective closure evidence has been verified.
Gate 4: run a realistic mock request and interview exercise
A mock FDA inspection should test retrievability and factual explanation, not produce memorized responses. Prepare a simulated request log using realistic categories: signed protocols and amendments, investigator/site and IRB records (as applicable), monitoring and oversight, safety, essential records, system controls, data changes, CRO transfers and CAPA. Assign request IDs, receipt time, custodian, source location, due time, quality review and actual handoff time. Review whether the retrieved record is complete, approved, current for the requested period, and consistent with the sponsor’s narrative.
Use a qualified independent reviewer where possible. Interview SMEs on their own responsibilities: what they did, which system holds the evidence, what they do not know, and who can answer another function’s question. Do not coach speculation or concealment. Where a record is absent, distinguish “not found yet,” “not required for this activity,” and “required but missing,” and document the appropriate response after verification. Maintain a single authorized communication route for any actual FDA inspection.
Copyable request-readiness control table
| Request family | Primary custodian / supporting function | Acceptance test | Escalation trigger |
|---|---|---|---|
| Sponsor/CRO delegation | Regulatory + Clinical Operations | Current and historical signed transfer/responsibility records retrievable | Major activity lacks documented owner or access |
| Monitoring and important findings | Clinical Ops + QA | Tracer from finding through sponsor assessment and closure | Significant unresolved participant/data risk |
| Safety and medical review | Medical + PV/Safety | Event chronology and reconciliation supported by source evidence | Reporting discrepancy or unexplained serious event handling |
| Subject consent and site conduct | Site owner + CRO + sponsor oversight | Approved forms and contemporaneous site records available as applicable | Potential invalid consent or essential source-record gap |
| EDC and data lineage | Data + IT/CSV + statistics | Role access, audit trail, validation and critical endpoint reconstruction | Unexplained changes, unavailable system version or data lineage failure |
| CAPA and controlled documents | QA + functional owner | Approved investigation, version history and effectiveness evidence | False closure, repeat critical trend or undocumented change |
The table is an inspection simulation framework, not an official FDA document request list. Requests vary with inspection type, context and the inspector’s needs. The team should ensure lawful access and confidentiality rather than automatically copying source or patient data into an uncontrolled repository.
Example: a reassuring dashboard hides an unresolved handoff
Hypothetical sponsor scenario. A CRO dashboard shows 97% monitoring follow-ups closed. During a tracer, QA discovers that one high-impact issue concerning eligibility source evidence was closed in the CRO tracker, but the site correction never reached the sponsor’s accepted CAPA record. The sponsor first checks whether the issue affects current participant protection or analysis; Clinical Operations and QA reconstruct who received which record; the site and CRO confirm factual evidence; the authorized function decides whether further corrective action and regulatory assessment are needed. The mock exercise documents the mismatch and tests the correction, without rewriting the original record or claiming the issue had always been controlled. This is not a BioBoston CRO case study or claimed client outcome.
Gate 5: decide what is ready and what remains open
Report to leadership with three categories: verified controls, controlled exceptions with evidence-based risk decisions, and unresolved high-impact gaps requiring immediate action or escalation. Keep the actual event dates, approval status and record locations visible. A promise to produce records later should not count as current readiness. A critical participant-safety or integrity concern must follow applicable response and reporting pathways regardless of whether it improves the mock score.
Run a final limited tracer set after major corrective actions to check whether the process works end to end. Confirm that designated SMEs and backups have access to the actual records, that document-request controls work, and that vendor personnel understand their contractual and regulatory communication roles. Verify the next review date and update the inspection evidence index as studies close or systems change.
The existing BioBoston CRO 30-Day FDA Inspection Readiness Plan focuses on short-notice prioritization. This 90-day playbook instead emphasizes reconstructing actual oversight evidence, remediating systemic weaknesses and testing retrieval before the last month. For specialized independent rehearsal, see Mock FDA Inspection services. Explore Mock FDA Inspection support to plan a risk-focused exercise appropriate to your sponsor, study and inspection scenario.
Regulatory distinction: Applicable FDA regulations in 21 CFR Parts 50, 56 and 312 govern relevant studies; FDA’s December 2025 BIMO inspection-process guidance and September 2025 E6(R3) GCP guidance are nonbinding. The 90-day phases, request log and readiness classifications are sponsor planning examples, not official FDA requirements. Reviewer recommended: senior Clinical QA/BIMO lead with Regulatory, Clinical Operations, Medical/Safety, Data/IT and counsel as appropriate. Refresh after inspection notices, protocol/vendor changes, new findings or FDA regulatory/guidance updates.
