MHRA GCP Inspections: What to Expect and the Most Common Findings

An MHRA Good Clinical Practice inspection tests one thing above all others: whether a clinical trial was run the way its records claim it was. Inspectors from the Medicines and Healthcare products Regulatory Agency examine the systems, documents and decisions behind a trial, grade what they find as critical, major or other, and expect a corrective action plan for every finding. The recurring findings are predictable, and each one traces back to a control a site or sponsor either had in place or did not.

This guide explains what an MHRA GCP inspection involves at each stage, how findings are graded, the areas inspectors write up most often, and what changes under the 2026 UK regulations and ICH-GCP E6(R3). It is written for research teams at NHS sites, sponsors and contract research organisations who want to understand the inspection before it arrives.

Key takeaways

• Most inspections are risk-based and announced. The MHRA gives notice and requests a dossier within 30 days. Triggered inspections, prompted by a serious breach or whistleblower, can come with little or no notice.
• Findings are graded critical, major or other based on impact on participant safety and data reliability. A critical finding routes to a cross-agency action group and can lead to trial suspension.
• The most common finding area is record keeping and essential documents. Data integrity, sponsor oversight, investigational product management and protocol compliance follow close behind.
• A finding is a symptom. Each one points to a missing control: an unsigned delegation log, an incomplete Trial Master File, an audit trail no one reviewed.
• Readiness is a daily state, not a pre-inspection project. The trials that inspect well are the ones where the evidence was already current when the notice arrived.

What is an MHRA GCP inspection?

An MHRA GCP inspection is a formal examination of an organisation, or a specific clinical trial, to verify compliance with Good Clinical Practice and UK clinical trials legislation. Good Clinical Practice is the ethical and scientific quality standard for designing, conducting, recording and reporting trials involving human participants. In the UK it is defined by ICH-GCP E6(R3) and enforced through the amended Clinical Trials Regulations that took full effect on 28 April 2026.

The MHRA inspects a wide range of organisations. The list includes pharmaceutical companies, contract research organisations, universities, NHS hospitals, charities, GP practices and laboratories that analyse trial samples. Any organisation that sponsors a trial, provides a sponsor or investigator function, or holds essential records can be inspected. Sites reading this will most often sit inside a systems inspection of their sponsor or a trial-specific inspection of a study they run.

The purpose is protective, not punitive. An inspection confirms that participant rights and safety were upheld and that the trial data can be trusted. The new UK Clinical Trials Regulations reinforced that purpose with a proportionate, risk-based approach to oversight across the trial lifecycle.

Which inspections are routine and which are triggered?

The MHRA runs two broad types of GCP inspection. The distinction matters because it changes how much warning an organisation gets and what the inspector is looking for.

Risk-based routine inspections make up the majority. They are announced and fall into two forms. A systems inspection examines the procedures an organisation uses across its trials, then selects a sample of studies, and sometimes one or two investigator sites, to test how those procedures work in practice. A trial-specific inspection assesses a single study and any organisation involved in it, often because the trial supports a marketing authorisation application. The MHRA sets an organisation’s inspection frequency using clinical trial applications, previous compliance history, organisational changes and external intelligence.

Triggered inspections respond to a specific concern. The prompt might be a serious breach notification, a whistleblower, a referral from the Health Research Authority or intelligence from another MHRA department. In rare circumstances the MHRA gives little or no notice for these. A triggered inspection is narrower and sharper, and it starts from a suspicion that the law has been broken.

The organisations that inspect well treat every day as inspectable, because a triggered inspection does not wait for a convenient moment.

What happens before an MHRA inspection?

For an announced inspection, the process starts weeks before anyone arrives. The MHRA notifies the organisation and requests a GCP inspection dossier and a clinical trials spreadsheet, to be returned within 30 days. The dossier gives inspectors the map they will use to plan the visit.

The Trial Master File sits at the centre of preparation. Inspectors will select trials for TMF review, and the complete file has to be accessible on request, including any electronic systems that together form the TMF. Where a sponsor has subcontracted activities, the service provider must also give access. A TMF that cannot be produced readily, or is incomplete enough to obstruct the inspection, is itself a critical finding under the regulations. The essential documents that make up the file are set out in the ICH-GCP Chapter 8 essential documents checklist.

What happens during the inspection?

The inspection itself combines interviews with a review of documentation. Inspectors talk to the people who run the trial, examine the TMF and other records, and may visit any relevant department during an on-site visit. Teams should expect requests for additional documentation on the spot, such as line listings, database extracts or floor plans.

At the close, the lead inspector gives a verbal summary of the findings and offers the organisation a chance to correct any misunderstandings. The grades attached at this point are provisional. The inspector can change them when writing the report, so the verbal debrief is a moment to clarify facts rather than a final verdict.

Hybrid inspections are now common. Inspectors increasingly ask for direct access to the clinical systems used for oversight during the trial, not only the archived documents. A sponsor that runs its oversight through a live inspection-ready platform can grant that access; a sponsor that reconstructs oversight from spreadsheets after the fact cannot.

How are MHRA inspection findings graded?

The MHRA grades deficiencies at three levels. The grade reflects the impact on participant safety, on data reliability, and on whether the failure is isolated or systematic.

The grade drives the consequence. A critical finding is referred to the GCP Inspection Action Group, a cross-agency body that oversees critical findings and decides what happens next. Major and other findings still require a documented response, but they do not carry the same escalation risk.

What are the most common MHRA GCP inspection findings?

The MHRA publishes GCP inspection metrics that show where inspectors find problems. The pattern is stable across reporting years. Record keeping and essential documents is consistently the single largest category, accounting for close to a fifth of all sponsor findings. Data integrity, sponsor oversight, investigational product management and protocol compliance follow. Each area below pairs what inspectors typically write up with the control that prevents it.

Record keeping and essential documents

This is the most frequently cited area. Findings include missing essential documents, superseded versions still filed as current, documents filed late, and gaps that no one flagged. The underlying issue is rarely a lost document. It is the absence of a system that shows, at any moment, which documents should be present and which are missing.

• Weak: a TMF index that is reconciled by hand once a quarter, so a gap can sit unnoticed for weeks.
• Strong: a completeness model that surfaces every expected-but-absent document in real time, with an owner attached to each gap.

Data integrity

Data integrity is a persistent inspection theme, and it is where a large share of serious findings concentrate. Inspectors look for electronic systems that lack adequate controls: shared login credentials, the ability to delete raw data, incomplete or absent audit trails, and undocumented reprocessing. The standard is ALCOA+, meaning records that are attributable, legible, contemporaneous, original, accurate and complete, consistent, enduring and available.

The control is a system where every user has a unique identity, every change writes an audit trail, and raw records cannot be silently altered or removed. An audit trail that exists but is never reviewed is now a finding in its own right, because inspectors expect documented, risk-based review of the trail, not merely its presence.

Sponsor oversight and vendor management

Sponsors carry ultimate responsibility for GCP, including for the work of contractors and service providers. Findings arise where a sponsor delegated activity to a CRO or vendor but could not evidence continuous oversight of it. The MHRA has reminded sponsors, through published infringement notices, that suitably robust contracts and adequate oversight mechanisms would have identified the non-compliances before they became findings.

The control is a live oversight layer rather than a periodic report. A sponsor that can see study documentation and operational data across its providers in one place can demonstrate oversight as a continuous process, which is exactly what E6(R3) now expects.

Investigational product and pharmacy management

IMP findings appear in both CRO and site inspections. They cover accountability gaps, storage and temperature control, and reconciliation that does not balance across the receipt-to-destruction chain. The pharmacy record is where an inspector proves the product was controlled, which is why it is held in a separate electronic Pharmacy Site File.

The control is a complete, contemporaneous accountability record. The drug accountability log has to reconcile at every step, with entries made at the time and no gaps between dispensing and return.

Protocol compliance

Protocol findings cover unreported or poorly managed deviations, out-of-window visits, incorrect dosing and eligibility breaches. A single deviation is rarely the problem. The finding lands where deviations were not detected, not assessed for impact, or not escalated when the pattern demanded it.

The control is a deviation process that captures the event, assesses its impact on safety and data, and escalates a recurring or serious issue into a corrective and preventive action. Where a deviation reveals a systemic cause, it should feed CAPA management rather than sit closed in a log.

Delegation and training

Inspectors check that every person who performed a trial task was delegated to do it, with an effective date before the activity, and was trained for it. Findings arise from unsigned or retro-dated delegation logs, activities performed before delegation, and training records that do not join up to the delegated task.

The control links three records: the delegation of authority log, the task, and the training evidence. An activity performed before its effective date is unauthorised regardless of a later signature, so timing is the real control.

Pharmacovigilance and safety reporting

Safety findings sit among the most serious. In the MHRA metrics, all critical observations at commercial sponsors in one reporting year related to pharmacovigilance. Findings cover late or missing expedited safety reports, weak reconciliation between safety and clinical databases, and inadequate signal management.

The control is a safety reporting process with defined timelines, clear ownership and reconciliation built in, so that a reportable event cannot slip past its deadline unnoticed.

Read also: What is inspection readiness in clinical trials? for how these controls combine into a single readiness state across a research network.

What do findings look like by organisation type?

The MHRA reports findings by the type of organisation inspected. The figures below come from the GCP inspection metrics report covering 1 April 2019 to 31 March 2020, and they illustrate where critical and major findings concentrate. Figures vary year to year, so treat them as a pattern rather than a fixed benchmark.

Two points stand out. Investigator sites recorded no critical findings in this period but the highest count of other findings, which reflects the volume of operational documentation held at site level. CROs carried the heaviest major-finding load, consistent with the breadth of sponsor functions they perform. The lesson for a site is that most findings are documentation findings, and documentation is the area a site controls most directly.

What happens after the inspection?

The inspection report is emailed to the organisation after the visit. The organisation must respond with a corrective and preventive action plan that addresses each finding. For some inspections the MHRA also requires an impact assessment or periodic progress reports on the CAPA actions.

• Report issued. Findings are confirmed in writing, with final grades that may differ from the verbal debrief.
• CAPA response. The organisation submits a plan against each finding. The lead inspector may ask for clarification, usually with one opportunity to add information.
• Statement issued. Once responses are adequate, the MHRA issues a GCP inspection statement and closes the inspection.
• Critical findings escalate. Critical findings go to the Inspection Action Group, which can require periodic reporting, early re-inspection, referral to other regulators, suspension of the trial authorisation, an infringement notice, or prosecution.

A strong CAPA response addresses root cause, not just the immediate symptom. A response that fixes one document without fixing the process that let it drift invites a repeat finding, and the MHRA treats inadequate action on previously reported major findings as grounds for a critical grade. The worked CAPA example shows what a root-cause response looks like end to end.

How does ICH-GCP E6(R3) change what inspectors expect?

ICH-GCP E6(R3) reshaped the emphasis of GCP, and inspection focus is moving with it. Three shifts matter for how a trial is inspected.

• Essential records, not just essential documents. E6(R3) frames the evidence base as essential records that must be available for inspection, covering informed consent, source records, case report forms, monitoring reports, safety reports and data management records.
• Risk-based quality by design. Inspectors increasingly ask whether a sponsor genuinely built a risk-based, quality-by-design framework, rather than applying controls uniformly regardless of risk.
• Continuous, evidenced oversight. Sponsors are expected to run their own oversight systems and to show oversight as a continuous process, which is why hybrid inspections request direct access to live systems.

These shifts reward organisations that treat governance as a running state. A quality management system that documents controlled processes, and the internal audit programme that tests them, produce the evidence an E6(R3) inspection now looks for.

How AQ supports inspection readiness

Most inspection findings are readiness failures that surfaced under scrutiny. A missing document, an unreviewed audit trail, a delegation gap: each was present long before the inspector arrived, waiting to be found. The AQ connected compliance platform is built to hold that evidence in a current, inspectable state across the modules an inspection touches: eISF, ePSF, eTMF, QMS, CAPA and Digital DoA in one connected environment.

AQ tracks document completeness in real time and attaches an owner to every gap. It gives each user a unique identity and writes an audit trail on every change. It links delegation, task and training so the join an inspector looks for is already made. It routes a recurring deviation into a CAPA with root-cause structure. Across a research network, it lets a hub grant controlled, time-boxed access to the live systems a hybrid inspection now asks to see.

AQ does not pass an inspection for you. It does not make a judgement about impact, write a CAPA response, or replace the quality expertise of a research team. The MHRA inspects people and processes, and AQ is the system that keeps the evidence of those processes complete, attributable and available. AQ aligns to ICH-GCP E6(R3), the UK Clinical Trials Regulations, ALCOA+ and 21 CFR Part 11, and is delivered under G-Cloud, DSPT and Cyber Essentials. The judgement stays with the team; the platform makes sure the record is ready.

See it in context. Book a 30-minute product tour to see how AQ keeps inspection evidence current across a connected research network.