GCP Compliance: What It Actually Requires and How Each Obligation Is Proven

At a glance

• GCP compliance is not a posture or a maturity level. It is a set of named obligations under ICH E6(R3) and, for US IND trials, 21 CFR Part 312, each of which has to be demonstrated with a record.
• The obligations are split across three parties: the sponsor, the investigator, and the IRB/IEC. Most compliance failures are really allocation failures, where nobody owned the obligation.
• For every obligation there is an artifact that proves it. If you cannot name the artifact, you cannot demonstrate the obligation, and an inspection will treat it as not done.
• FDA inspections work by comparing what was submitted against source records. That comparison, not a policy document, is what tests compliance.
• Systems help with retrieval, legibility, and audit trails. They do not create compliance, and a well-run paper trial is more compliant than a badly run electronic one.

What GCP compliance actually means

“Are we GCP compliant?” is usually asked as if compliance were a state a whole organisation occupies. It is more useful, and much more testable, to read it as a question about specific obligations: which ones apply to us, who holds each, and what evidence shows we met it.

ICH E6(R3) is built that way. Its overarching principles are not values statements but conduct requirements. The first principle establishes the hierarchy everything else serves: the rights, safety and well-being of the participants are the most important considerations and should prevail over interests of science and society (ICH E6(R3) Principle 1.1). That is the tie-breaker for every operational decision that follows, and it is why a protocol deviation made to protect a participant is treated differently from one made for convenience.

From there the guideline allocates duties. The sponsor should ensure that the trial design and trial conduct, the processes undertaken and the information and data generated are of sufficient quality to ensure reliable trial results, trial participants’ safety and appropriate decision making (ICH E6(R3) §3.9.1). That is the sponsor’s overarching obligation, and note its shape: it is an obligation to ensure, which is discharged through oversight and evidence, not through personally performing the work.

On the US side, the investigator’s duty is stated just as plainly. The investigator is responsible for ensuring that an investigation is conducted according to the signed investigator statement, the investigational plan, and applicable regulations, and for protecting the rights, safety, and welfare of subjects under the investigator’s care (21 CFR §312.60). By signing Form FDA 1572, the investigator also commits to comply with all requirements regarding the obligations of clinical investigators and all other pertinent requirements in Part 312 (21 CFR §312.53(c)(1)(vi)(b)). Compliance for an investigator is therefore not abstract. It is the set of commitments they personally signed.

Who carries which obligation

Blurring the three roles is the most common structural mistake, and it produces gaps that surface only under inspection.

The sponsor owns trial-level quality: design, oversight of delegated activities, quality assurance and quality control, safety reporting, and the integrity of the data set as a whole. Delegating an activity to a CRO does not move the obligation. The sponsor still has to show it oversaw the work.

The investigator owns site-level conduct: qualification of the site team, protocol adherence, participant safety and consent, source data, and the accuracy of what leaves the site. The investigator’s agreement to the protocol is itself a recorded act, since the investigator or institution should sign the protocol or an alternative contract to confirm agreement with the sponsor (ICH E6(R3) §2.5.1).

The IRB/IEC owns independent review and continuing oversight of the ethics of the trial. It is not a vendor to the sponsor and its approval is not a formality to be collected.

When a finding lands, the useful diagnostic question is not “who made the error” but “who held this obligation, and did they have the means to discharge it.” A site asked to run procedures it was never resourced for is a sponsor oversight problem wearing a site-finding costume.

The evidence map

This is the part most compliance writing skips. An obligation you cannot evidence is, for practical purposes, an obligation you did not meet. Each core obligation has a natural artifact.

Investigator qualification. The requirement is explicit that qualification must be demonstrable: the investigators should be qualified by education, training and experience to assume responsibility for the proper conduct of the trial and should provide evidence of such qualifications (ICH E6(R3) §2.1.1). The artifact is the CV, the licence, and the trial-specific training record. Note that the guideline asks for evidence, not merely for the qualification to exist.

Delegation. The investigator should ensure a record is maintained of the persons and parties to whom the investigator has delegated trial-related activities, and documentation of delegation should be proportionate to the significance of those activities (ICH E6(R3) §2.3.3). The artifact is the delegation log, with date boundaries that actually match when each person worked. A delegation log signed once at startup and never updated is weaker evidence than no log at all, because it positively asserts something untrue.

Protocol adherence. The artifact is the deviation record, and critically the evidence of what was done about each deviation. Inspections look for whether the clinical investigator reported all protocol deviations to the IRB and the sponsor (FDA BIMO 7348.811, Part III). A deviation log that records events but shows no assessment or corrective action answers only half the question.

Data integrity. In generating, recording and reporting trial data, the investigator should ensure the integrity of data under their responsibility, irrespective of the media used (ICH E6(R3) §2.12.1). The phrase “irrespective of the media” is doing real work: paper and electronic records carry the same obligation. On the sponsor side, the sponsor should ensure the integrity and confidentiality of data generated and managed, and should apply quality control to the relevant stages of data handling to ensure that the data are of sufficient quality to generate reliable results (ICH E6(R3) §3.16.1). The artifacts are source records, the audit trail, and the data management documentation.

Ethical oversight. The artifact is the IRB approval and continuing review correspondence. Inspectors determine whether the clinical investigator assured that an IRB provided initial and continuing review and approval of the study (FDA BIMO 7348.811, Part III). “Assured” is the operative word: the site cannot treat IRB review as someone else’s filing problem.

Quality management. Quality assurance should be applied throughout the clinical trial and includes implementing risk-based strategies to identify potential or actual causes of serious noncompliance with the protocol, GCP and applicable regulatory requirements to enable corrective and preventive action (ICH E6(R3) §3.11.1). Quality control should be applied using a risk-based approach to each stage of data handling, and within clinical trials, monitoring and data management processes are the main quality control activities (ICH E6(R3) §3.11.3). The artifacts are monitoring reports, QC records, and the CAPA trail.

Audit, where performed. The purpose of a sponsor’s audit, which is independent of and separate from routine monitoring or quality control functions, is to evaluate trial conduct, and audits should be proportionate to the risks associated with the trial (ICH E6(R3) §3.11.2). Two things follow. Audit is not mandatory on every trial, and an “audit” performed by the monitoring team is not an audit.

Handling noncompliance. Noncompliance with the protocol, SOPs, GCP or applicable regulatory requirements by an investigator, institution, or by members of the sponsor’s staff should lead to appropriate and proportionate action by the sponsor to secure compliance (ICH E6(R3) §3.12.1). The artifact is the record of what the sponsor did. Detecting noncompliance and doing nothing is itself the finding.

How compliance is actually tested

Compliance is not assessed by reading your SOPs. FDA bioresearch monitoring inspections involve evaluation of the clinical investigator’s practices and procedures to determine compliance with applicable regulations, and where the inspection follows a marketing application, they include a comparison of the data submitted to FDA with source documents and case report forms (FDA BIMO 7348.811, Part III).

Read that carefully, because it defines the whole exercise. The test is a reconciliation between what you reported and what the underlying records show. Every obligation above is checked through that lens. Inspectors also determine whether the source records identify study personnel involved in obtaining and assessing data collected at the clinical site, with special attention to primary and key secondary endpoints (FDA BIMO 7348.811, Part III), which is why the delegation log and the source records have to agree with each other and with the 1572.

The practical implication is that compliance work which does not end in a record is not compliance work. A training session with no attendance record, an oversight call with no documented outcome, a monitoring visit whose findings never reach a report: each of these may have genuinely improved the trial and will still read as absent.

Where teams actually fail

The failure modes cluster, and they are mostly structural rather than careless.

Obligations that were never allocated. Activities split between a sponsor, a CRO, and a site, with each assuming another party held a duty. This is why the allocation of activities is itself something to record rather than assume.

Evidence generated too late. Records reconstructed near a submission or an inspection. Contemporaneity is part of what makes a record credible, and a backfilled log is often worse than a gap, because it raises a question about everything else.

Documents that contradict each other. The 1572, the delegation log, the training records, and the source data each tell a story about who did what. When those stories diverge, the inspection stops being about the discrepancy and starts being about your control system.

Detected problems with no visible response. Given the §3.12.1 obligation to act proportionately on noncompliance, a deviation log with no corresponding action record is an admission rather than a defence.

Treating GCP as the site’s job. The sponsor obligations in §3.9.1 and §3.11 do not transfer with the work. Oversight has to be evidenced by the sponsor.

Where systems help, and where they do not

Electronic systems earn their place on three specific things: retrieval, legibility, and the audit trail. When an inspector asks for the consent version in force on a given date, a well-configured eTMF answers in seconds and a filing cabinet does not. Audit trails give you a contemporaneity record that paper cannot produce.

What systems do not do is create compliance. The obligations above are indifferent to media, as §2.12.1 makes explicit. A system can make a delegation log easy to keep current; it cannot make anyone keep it current. It can enforce a field, but it cannot make the value in that field true. Most inspection findings involving electronic systems are not system defects but process defects that the system faithfully recorded.

Two cautions are worth stating plainly. Configuring a system to make deviations hard to record does not reduce deviations, it reduces their visibility, which is the opposite of what §3.11.1 asks for. And migrating records between systems is a data integrity event that needs its own evidence, not a background IT task.

The short version

GCP compliance is an auditable state, not a posture. Work out which obligations apply, name the party that holds each one, and for every obligation identify the artifact that would prove it to someone who was not there. Where that artifact does not exist, you have found a real gap. Where it exists but contradicts another record, you have found a more serious one.

Sources

• ICH E6(R3) Good Clinical Practice, version R3
• 21 CFR Part 312, Investigational New Drug Application (current as of 4/14/2026)
• FDA Compliance Program 7348.811, Bioresearch Monitoring: Clinical Investigators and Sponsor-Investigators (implementation date 07/22/2020)