Building a site quality assurance (QA) program sponsors can audit: internal audits, corrective and preventive action (CAPA), and training records

Start with a written QA plan the team actually uses

A QA plan is not a binder written to impress a qualification visit. It is a short, controlled document stating how your site will prevent errors, detect them early, correct them, and prove the correction worked.

Define its scope: which studies, processes, and records it governs. Name the owner by role, not just by person, so it survives turnover. At a standalone site, that is often the site director or a senior coordinator with protected time, under the oversight of the principal investigator (PI).

Reference, rather than repeat, your standard operating procedure (SOP) set. Link each QA activity to the governing standard operating procedure so an auditor can trace intention to procedure to record.

Include five elements sponsors look for: an annual audit and management review calendar; a documented, risk-based sample selection method; the corrective and preventive action workflow and timelines; the training matrix, with the rule that no delegated task is performed before training is complete; and metrics you will review, such as repeat findings, overdue actions, and training currency.

Align the plan with good clinical practice (GCP) from the start. Good clinical practice is the ethical and scientific standard governing how trials are designed, conducted, recorded, and reported. Review the plan annually and after any major change, recording the review even when no change is needed.

Schedule internal audits around risk, not convenience

Internal audits are the engine of the program, not rehearsals for a sponsor visit. They are your structured check of whether consent, source records, product handling, and data entry match the protocol and your procedures. For a standalone site, quarterly focused audits plus one broader annual audit is workable. Keep the schedule, and rotate topics so high-risk areas are not ignored.

Audit four areas first:

• Informed consent files. Was the correct approved version used, was consent obtained before any study procedure, are dates and signatures complete, was re-consent done when required, and was the process documented by the person who obtained consent?
• Source-to-database accuracy. Trace a sample of critical data from source to database: eligibility, endpoints, adverse events, concomitant medications, and visit dates. Document the sample, error rate, and whether any error affected eligibility, safety, or interpretation.
• Investigational product accountability. Reconcile product received, dispensed, returned, and destroyed against temperature logs, storage access, expiration dates, and dosing records. Confirm only trained, delegated staff handled it, and that any temperature excursion was assessed before further use.
• Training currency and delegation. Compare the delegation log with training files for the same period. If a coordinator performed a task in March, was protocol, good clinical practice, and procedure training completed before March? If not, that is a system finding, not a filing gap.

Write each audit as a short report: objective, scope, sample, method, findings by severity, and actions with owners and due dates. Discuss results with the principal investigator in a minuted meeting. Audits ending in assigned actions change behavior; audits filed away change nothing.

Make CAPA a discipline, not a form

Most sites have a corrective and preventive action form. Fewer have the discipline. The difference is whether the record proves the cause was found and removed, not merely that the error was fixed.

Separate the steps. Correction is the immediate fix, such as amending a missed signature with a dated note to file under your procedure. Root cause analysis asks why it happened: missing training, unrealistic workload, an ambiguous checklist, an absent system alert, or unclear supervision. Record the evidence considered, not just the conclusion.

Corrective action addresses the cause in the affected records and process. Preventive action extends the fix where the same cause could recur. If a consent checklist failed on one study, checking only that study is correction. Updating the checklist, retraining everyone who obtains consent, and adding a second-person check across studies is prevention.

Every record needs an effectiveness check, after the change has had time to operate. Define success before closure, for example no repeat consent version errors in the next twenty audited consents. Audit against that criterion and record the result. If it is not met, the item is not closed; it is extended, escalated, or reopened.

Set timelines by risk, with immediate containment for safety or eligibility issues, and track overdue items in management review. Sponsors trust two well-investigated records with effectiveness evidence far more than a claim that a site has never needed one.

Build training records that prove readiness before assignment

Training records fail audits for a predictable reason: they prove attendance, not qualification. A certificate alone does not show a person was trained on the current protocol version and authorized to perform the task unsupervised.

Build a role-based training matrix. For each role, list required training: human subject protection, good clinical practice, the protocol and amendments, relevant standard operating procedures, safety reporting, investigational product handling where applicable, and each system used. State the method, whether reading with attestation, instruction, observed practice, or supervised performance, and whether retraining is annual or change-triggered.

Sequence matters. Records must show three dates in order: training completed, delegation by the principal investigator, and first performance of the task. If the order is reversed, treat it as a finding and fix the system rather than backdating. Auditors notice chronology, and honesty with a documented fix builds more confidence than a perfect-looking file that fails tracing.

Keep curriculum vitae records, licenses, and certifications current, but do not confuse them with study-specific training on this protocol, this version, and this site process.

Make currency visible with a tracker flagging expiring certifications, amendment deadlines, and incomplete onboarding, reviewed monthly, so you can answer a monitor in minutes and show assignments were paused for anyone not current.

At Amavita Research Services, this discipline supports a cardiovascular practice with more than 18,000 active cardiology patients and zero United States Food and Drug Administration (FDA) Form 483 findings. Those facts do not replace training evidence; they are credible because the records can be traced.

Present the program in feasibility and qualification

Do not wait for a qualification visit to reveal your program. Introduce it in feasibility with specifics: date and areas of the last internal audit, open and closed corrective and preventive action items in aggregate, training currency rate, and the role that owns the QA plan. Share aggregates only, never participant-level or other-sponsor confidential information.

Prepare a one-page summary for qualification: plan approval date, audit calendar, corrective and preventive action workflow, training matrix structure, and last management review date. Keep records ready: a redacted audit report, a closed corrective and preventive action record with its effectiveness check, and a training tracker extract.

When a prior finding is raised, answer with the system response, not defensiveness: what was found, what cause was identified, what changed, and how effectiveness was verified.

I also lead bioaccess, a first-in-human contract research organization (CRO). Working on both sides has taught me the same lesson: sponsors do not expect perfection. They expect a site that detects its own problems, explains them, and proves the fix held.

Keep the program right-sized

A standalone site does not need enterprise software or a full-time quality department to be audit-ready. It needs a plan that is followed, audits on schedule, corrective and preventive action records ending in effectiveness evidence, and training files that respect chronology. Start with one high-risk audit this quarter, close its findings properly, review results with the principal investigator, and repeat. Within a year you will have a living program a sponsor can audit with confidence.