FDA BIMO Inspection Findings: Common Form 483 and Warning-Letter Citations for Clinical Investigators, Sponsors, and CROs

What FDA BIMO inspections cite most often: the recurring Form 483 and warning-letter findings

FDA's Bioresearch Monitoring (BIMO) program inspects the parties responsible for the integrity of clinical data and the protection of trial subjects: clinical investigators, sponsors, monitors, contract research organizations (CROs), and IRBs. When an inspection surfaces significant deviations, the field investigator issues a Form FDA 483, and where the conduct warrants it, the relevant center follows with an untitled or warning letter. The citations in those letters are remarkably consistent from year to year, and they map to a small number of regulatory provisions: 21 CFR Part 312 (drug/biologic IND studies), Part 812 (device IDE studies), Part 50 (informed consent), and Part 56 (IRBs). This overview walks through the deviations FDA cites most often for each actor, with the exact regulatory hooks and the fact patterns that trigger them.

Clinical investigators

Clinical-investigator letters cluster around four themes: not following the protocol, inadequate records, informed-consent failures, and failures to protect subjects or report to the IRB. These are the highest-frequency BIMO findings overall.

1. Failure to follow the investigational plan or protocol

This is the single most common clinical-investigator citation, keyed to 21 CFR 312.60 for drug studies and 21 CFR 812.100 / 812.110(b) for device studies ^105106114. The recurring fact patterns are:

• Missed, late, or out-of-window protocol procedures, such as omitted ECGs, skipped screening or baseline assessments, and follow-up visits performed outside the allowed window, cited under 21 CFR 812.100 and 812.110(b) and, in drug studies, 21 CFR 312.60 and 312.62(b) ^103111116118.
• Enrolling ineligible subjects or ignoring inclusion/exclusion criteria ^11111480.
• Implementing protocol changes without required prior sponsor, IRB, or FDA approval, cited under 21 CFR 812.150(a)(4) and 812.35(a)(1) ^103110115.
• Inadequate supervision of delegated site staff who performed protocol activities incorrectly, cited under 21 CFR 312.60 and 812.110(b) ¹¹⁴¹²².
• Failure to document or promptly report deviations to the sponsor or IRB, cited under 21 CFR 812.140(a)(4) and 812.150(a)(3)/(a)(6) ⁸⁰¹⁰⁹.

2. Inadequate records, case histories, and test-article accountability

FDA frequently cites investigators for failing to maintain adequate and accurate case histories under 21 CFR 312.62(b) (drugs) and 812.140(a)(3) (devices) ^5568737174. Typical conduct includes late entries made months or years after the fact without rationale, changed assessments (for example, altering an adverse-event relatedness determination) without explanation, unsigned or undated forms, and source-to-CRF mismatches ^5545707282.

Accountability findings are a distinct and frequent sub-category:

• Drug disposition: failure to maintain records of the disposition of the drug, including dates, quantity, and use by subjects, under 21 CFR 312.62(a) ⁵⁵⁷⁵.
• Device accountability: failure to maintain accurate, complete, and current records of receipt, use, or disposition of a device (type, quantity, dates, batch/code mark) under 21 CFR 812.140(a)(2)(i), and missing records tying device exposure to individual subjects under 812.140(a)(3) ⁷¹⁷⁴.

3. Informed consent deficiencies

Consent findings are cited under Part 50 and are among the most common investigator observations ²⁷³³⁴³. The recurring categories are:

• Consent obtained after study procedures had already begun, with screening, drug administration, or device implantation performed before the form was signed, cited under 21 CFR 50.20 (often paired with 312.60 or 812.100) ^27333743.
• Use of the wrong, outdated, or non-IRB-approved consent form, cited under 21 CFR 50.27(a) and 50.20 ^37344140.
• Documentation failures, including forms not signed or dated by the subject or investigator, cited under 21 CFR 50.27(a) and 812.140(a)(3)(i) ³⁰⁴⁰³⁸.
• Missing required elements under 21 CFR 50.25, such as the statement that the activity involves research, that participation is voluntary, or the description of foreseeable risks, and failure to disclose alternatives under 50.25(a)(4) ²⁸⁴⁴.
• Exculpatory "hold harmless" language that asks subjects to waive legal rights, cited under 21 CFR 50.20 ²⁸⁴⁴.
• Consent by the wrong signer rather than the legally authorized representative, and use of an expired form ⁴⁷⁴⁰.

4. Failure to protect subjects and report to the IRB

FDA frames the investigator's overarching duty under 21 CFR 312.60 as protecting the rights, safety, and welfare of subjects, and cites inadequate supervision when a site cannot show it met that duty ⁵¹⁴. The associated reporting failures are:

• Failure to promptly report unanticipated problems and changes in research activity to the IRB under 21 CFR 312.66, including telling an IRB there were "no adverse events" while holding lists of hospitalizations, and failing to submit protocol amendments, study discontinuations, or a clinical hold ³⁵¹⁰¹¹.
• In device studies, failure to submit a complete, accurate report of an unanticipated adverse device effect to the sponsor and reviewing IRB within 10 working days under 21 CFR 812.150(a)(1), with serious events reported late or not at all ⁴.
• Failure to submit progress reports at least yearly under 21 CFR 812.150(a)(3) ¹¹⁶.

Sponsors, monitors, and sponsor-investigators

Sponsor letters, typically captioned "Sponsor/Monitor/Contract Research Organization," concentrate on oversight failures. The dominant theme is inadequate monitoring, followed by failure to secure investigator compliance, weak investigator selection and agreements, and safety-reporting and accountability gaps.

1. Failure to ensure proper monitoring

This is the sponsor equivalent of the investigator's protocol finding and appears in most sponsor letters, cited under 21 CFR 812.40 (devices), 21 CFR 312.56 (drugs), and 21 CFR 812.25(e) for the requirement to include written monitoring procedures in the investigational plan ^{1239592125127124}. Common fact patterns:

• No written monitoring procedures, or an incomplete or ineffective monitoring plan ^1239213052.
• No monitoring visits, or visits too infrequent, too late, or limited to closeout rather than ongoing conduct ^{95125128131133}.
• Failure to detect and correct protocol deviations, eligibility problems, consent problems, or delayed adverse-event reporting during monitoring ^92124132134.
• Failure to maintain monitoring records demonstrating that monitoring occurred and what it found ^1235025.
• Monitors not qualified by training and experience ^9553127.

2. Failure to secure investigator compliance

When a sponsor knows or should know an investigator is not complying, 21 CFR 812.46(a) (devices) and 21 CFR 312.56(b) (drugs) require the sponsor to promptly secure compliance or discontinue shipments and terminate the investigator ⁹²⁹⁹. FDA cites sponsors that allowed subjects meeting exclusion criteria to be treated, or that failed to close a noncompliant site despite repeated deviations ⁹⁹¹⁰². Responses that do not address how compliance will be secured are called out specifically ⁹⁵.

3. Investigator selection, agreements, and financial disclosure

• Failure to select investigators qualified by education, training, and experience under 21 CFR 812.43(a) and 312.50, including selecting an investigator outside the study's clinical specialty or one previously sanctioned for negligence ⁸⁹⁹⁰⁹⁶.
• Failure to obtain a signed investigator agreement containing the commitment to conduct the study per the investigational plan and regulations, under 21 CFR 812.43(c)(4)(i) ⁸⁷.
• Failure to obtain sufficient, accurate financial disclosure information under 21 CFR 812.43(c)(5) and 21 CFR Part 54 ⁸⁸⁹³.
• Failure to supply investigators with the investigational plan and prior investigation information under 21 CFR 812.45 ⁸⁸.

4. Safety reporting, recordkeeping, and test-article accountability

• Failure to evaluate and report unanticipated adverse device effects to FDA and the reviewing IRB within 10 working days under 21 CFR 812.46(b)(1) and 812.150(b)(1), and failure to document all adverse events under 812.140(b)(5) ⁴⁸⁶³⁵⁶.
• Failure to submit progress reports at least yearly under 21 CFR 812.150(b)(5) ⁵².
• Failure to maintain accurate, complete, and current records of shipment, receipt, use, or disposition of a device under 21 CFR 812.140(b)(2) and 812.140(a)(2)(i), including consignee, quantity, shipment dates, and batch/code marks ^48495458.
• For drug studies, failure to maintain records of receipt, shipment, or disposition of the investigational drug under 21 CFR 312.57(a) ⁵⁹⁶¹⁵³.

Contract research organizations and transferred obligations

CRO findings turn on 21 CFR 312.52: a sponsor may transfer obligations to a CRO only in writing, the writing must specify which obligations are transferred (or state that all are), and the CRO then assumes those obligations and is subject to the same regulatory action as a sponsor for failing them ^2223242526. The recurring deficiencies are failure to document the transfer in writing at all, and failure to actually carry out the transferred monitoring duty, with sponsors claiming monitoring was handled by the CRO, the investigators, or an IRB while producing no adequate monitoring records ^22232425. FDA treats the sponsor as still responsible unless the transfer is properly documented and the obligations are performed ²²²⁶. The duty to ensure proper monitoring is cited alongside under 21 CFR 312.50 and 312.56(a) ²²²⁵.

Data integrity: falsification, backdating, and fictitious subjects

The most serious BIMO findings involve fabricated or falsified data, which support investigator disqualification and, at the sponsor level, citations under 21 CFR 312.56(b) for failure to secure compliance. FDA has cited falsified case report forms and documentation supporting a fictitious subject, describing potential fabrication of study subjects and study data ⁸⁶. Backdating of informed consent documents has been treated as falsification and tied to 21 CFR 50.27 and 312.56(b), and cited as grounds for disqualification ⁸⁵. These findings originate in the same records-integrity review that produces the more routine case-history and consent-documentation observations, which is why source-document verification is where sites and sponsors are most exposed.

Where the risk concentrates

Read together, the BIMO enforcement record points to a short list of provisions that generate most Form 483 observations and warning-letter citations: 21 CFR 312.60 / 812.100 (protocol adherence and supervision), 312.62 / 812.140 (case histories and accountability), Part 50 (consent), 312.66 / 812.150 (IRB and safety reporting) for sites, and 312.56 / 812.40 / 812.46 and 312.52 (monitoring, securing compliance, and documented transfer of obligations) for sponsors and CROs. The common denominator across actors is documentation that cannot reconstruct what happened to the subject and the test article, which is the exact gap a BIMO inspection is designed to find.