BIMO inspection readiness for adverse event records

A BIMO inspection is an FDA inspection under the Bioresearch Monitoring program, which checks that people in clinical studies were protected and that the data submitted to FDA are accurate and reliable. For adverse event records, the inspector compares what the site reported with the source records. A site is ready when each adverse event record shows, on its own, the source, the grade, the attribution, who signed, and every change since.

Clinical investigators were the most inspected group in fiscal year 2024: 609 of the 1,076 BIMO inspections that received a final classification that year, according to FDA's FY 2024 BIMO metrics. "Safety reporting; failure to report and/or record adverse events" is among the six common clinical investigator observations it lists.

What is a BIMO inspection?

FDA inspects clinical investigators, sponsors and CROs, IRBs, nonclinical laboratories and bioequivalence sites under the Bioresearch Monitoring program, each against a published compliance program. Two cover adverse event records:

• Compliance Program 7348.811, Clinical Investigators and Sponsor-Investigators, issued July 22, 2020: the inspector's instructions at the site.
• Compliance Program 7348.810, Sponsors and Contract Research Organizations, issued September 15, 2021, including monitoring and safety reporting (Part III, H and J).

The regulations below are the drug and biologic rules in 21 CFR 312; device investigators report unanticipated adverse device effects under 21 CFR 812.150(a)(1).

SOPs should cite two December 2025 guidances: FDA's BIMO inspection processes guidance, which withdrew the June 2010 information sheet on inspecting clinical investigators, and investigator safety reporting, which replaced the January 2009 IRB reporting guidance.

What do BIMO inspectors check in an adverse event record?

BIMO inspectors check that each adverse event appears in source, matches the case report form, was graded and attributed as the protocol requires by a delegated investigator, reached the sponsor and the IRB as required, and carries an attributable signature and a complete audit trail. The table maps each question to Compliance Program 7348.811, Part III, with pages in FDA's PDF.

Inspection question	Where 7348.811 asks it	What the record should show
Is the event in the source?	III G.2 (p. 29): source records complete, accurate, attributable, contemporaneous	The dated note, lab value or report where the event first appears
Does the case report form match the source?	III G.3 (p. 31): adverse event documentation, severity, relationship to the product	The same term, grade, dates and attribution in every record
Was the event assessed as the protocol requires?	III E.3 (p. 22): monitoring and reporting of adverse events and serious adverse events	The grade, the criterion it meets and the scale version the protocol names
Did the right person assess it?	III C.3 (p. 19) and G.2: delegation, and who obtained and assessed the data	Attribution and sign-off by an investigator on the delegation log
Were serious events reported?	III N (p. 40) and F.3 (p. 25): safety reports to the sponsor, prompt reports to the IRB	Date the site learned of the event, date of the sponsor report, IRB correspondence
Who changed what, and why?	III G.3 and I.2 (p. 35): who corrected data, when, why, investigator aware	An audit trail with old value, new value, user, time and reason
Is the signature attributable?	III I.2: unique signature with printed name, date and time, and meaning	A signature manifestation on screen and on any printout
Are other safety records complete?	III H (p. 33): other study records, including MedWatch forms	Filed MedWatch forms and sponsor correspondence

Two regulations sit underneath most of these rows. 21 CFR 312.62(b) requires adequate and accurate case histories. 21 CFR 312.64(b) requires the investigator to report any serious adverse event to the sponsor immediately, with a causality assessment. The inspector does not scientifically evaluate the data or the protocol (III B); the question is whether the record supports the grade and the protocol's process was followed.

What does an inspection-ready adverse event record look like?

An inspection-ready adverse event record lets an inspector reconstruct the event from the record alone: the source entry, a matching case report form, the grade and scale version, an assessor on the delegation log, seriousness and reporting dates, every correction with its reason, and an attributable signature.

Take a hypothetical oncology protocol that names CTCAE v6.0. A dated clinic note records eight watery stools a day over baseline and admission for IV fluids. The case report form carries Diarrhea, Grade 3, under v6.0, whose criterion begins "Increase of >=7 stools per day over baseline; hospitalization indicated". The IV fluids also meet v6.0's "requires IV intervention", a Grade 3 clause that v5.0 does not have, which is why the record names the scale version. The event is serious because it led to inpatient hospitalization (21 CFR 312.32(a)). If a nursing note later moves the onset date, the audit trail keeps old value, new value, user, time and reason.

Which BIMO inspection findings involve adverse event records?

The Form FDA 483 observations that reach adverse event records are failure to report or record adverse events, inadequate or inaccurate case histories, failure to follow the investigational plan and, for sponsors and CROs, failure to ensure proper monitoring. By inspection type, in FDA's fiscal year 2024 metrics:

• Clinical investigators: failure to report or record adverse events; inadequate or inaccurate case histories, which include a source record and AE log that disagree; protocol deviations.
• Sponsor-investigators: failure to report serious adverse events to the sponsor; inadequate case histories.
• Sponsors and CROs: failure to ensure proper monitoring; and "Failure to submit an IND application; IND safety report" (see IND safety reports under 21 CFR 312.32).

FDA then classifies each inspection as No Action Indicated (NAI), Voluntary Action Indicated (VAI) or Official Action Indicated (OAI). Of the 609 clinical investigator inspections classified in fiscal year 2024, 484 were NAI, 110 VAI and 15 OAI. Under Compliance Program 7348.811 (Part V), compromised data integrity or reliability is one ground for OAI, and an adverse event record that cannot be reconstructed is a data integrity question.

BIMO inspection checklist for adverse event records

Run items 1, 6, 9, 10 and 11 of this FDA inspection readiness check at study start, all twelve at each monitoring visit, and all twelve again when the pre-announcement call arrives. Section numbers are 7348.811, Part III.

1. Protocol in force. Collect every protocol version and amendment with its IRB approval date, noting each one's adverse event definitions, grading scale version and reporting timelines (III E).
2. Reconcile the AE log, CRF and source. Compare term, grade, onset, resolution, seriousness and attribution for each participant (III G.3), as a monitor does in source data verification.
3. Trace each event from source to sponsor report. Follow every serious adverse event, plus one event per attribution category, with nobody who entered them in the room (III G.2).
4. Serious adverse event timing. Confirm when the site learned of each one, when it reached the sponsor, and the causality assessment (21 CFR 312.64(b)), and that the databases agree (SAE reconciliation).
5. IRB reporting. Confirm unanticipated problems involving risk went to the IRB promptly (21 CFR 312.66), and deaths and serious adverse experiences as the IRB requires (III F.3).
6. Delegation. Match everyone who graded, attributed or signed against the delegation log and Form FDA 1572 (III C).
7. Corrections. Confirm each change after entry or signature shows old and new values, who, when and why, and that the investigator knew (III G.3 and I.2).
8. Signatures. Confirm each electronic signature shows printed name, date and time, and meaning, such as approval (21 CFR 11.50).
9. Systems. List every system holding adverse event data, with its SOPs, access list (deactivated accounts included) and training records (III I.1).
10. Data originators. Confirm every person and system that enters or changes adverse event data is on the sponsor's list of authorized data originators (FDA's 2024 electronic systems Q&A, Q20).
11. Copies on request. Confirm FDA can access each system on arrival and get copies, audit trails included (December 2025 BIMO guidance, Part IV).
12. Other safety records. File MedWatch forms and sponsor safety correspondence where the inspector will look (III H).

What changes when software suggests the grade?

Compliance Program 7348.811 asks of AI what it asks of any electronic system: who or what originated each data element, how changes are tracked, and how the investigator reviewed the data (III I.2). FDA's October 2024 Q&A adds that a data originator may be a person or a computer system (Q20). 21 CFR 11.10(e) calls for secure, computer-generated, time-stamped audit trails. Q12 says their components must include the date and time of each change, the individual who made it, and the old and new values.

For a grade that software proposed and an investigator signed, that gives three tests:

• What does one record yield with nobody present? If answering takes an interview with the coordinator, the record is incomplete.
• Are the proposal and the decision separately retrievable? If suggestion and determination share one field, the record cannot show who decided.
• What does a correction after signature look like? Under 21 CFR 11.10(e), record changes shall not obscure previously recorded information.

Part 11 for AI-assisted adverse event grading maps each control to what the record should hold.

How Burna AI supports BIMO inspection readiness

Burna AI is built for HIPAA and 21 CFR Part 11. For the parts of the record a grading system controls, today:

• Source. Each grade traces to the line in the medical record that produced it, and a grade whose citation set is incomplete is flagged before it is signed.
• Grade. Every adverse event in a note is graded against the CTCAE version the protocol names, with both versions live on one engine.
• Attribution. Each event is scored for attribution against every drug in the regimen, using WHO-UMC and Kramer, with the reasoning shown.
• Signature. A grade becomes a record when a qualified investigator signs it with a 21 CFR Part 11 electronic signature, and the signature carries what was accepted, what was overridden and the citation set as signed.
• Reports, export and access. The platform produces FDA MedWatch, IRB and serious adverse event reports from the graded record, the graded record exports for a sponsor or a monitor, and every access to patient data is recorded.

Delegation, IRB submission, training, SOPs and record retention stay with the site and the sponsor. See what Burna AI does today, what the Burna AI audit trail includes and the architecture a security review asks about. AI suggests, clinicians decide. Human-in-the-loop, always.

Common questions about BIMO inspections

What triggers a BIMO inspection?

Three things trigger a BIMO inspection: FDA's review of a submission or marketing application, a periodic schedule for establishments with ongoing activities such as IRBs, and a complaint or required report that raises possible noncompliance or a safety issue. FDA's December 2025 guidance describes all three (Part III.B).

Are BIMO inspections announced in advance?

Usually, and for domestic inspections generally by phone (December 2025 guidance, Part IV.A). Compliance Program 7348.811 has the inspector report any attempt to delay an inspection by more than ten business days without sufficient justification (III A.2, p. 15).

What happens after a BIMO inspection?

At the close-out, the inspector discusses the findings and, if appropriate, issues a Form FDA 483. A response is not required, but the December 2025 guidance (Part IV.D) encourages a written one within 15 U.S. business days, addressing each observation with corrective and preventive actions. FDA then classifies the inspection and publicly posts the final classification on its inspections dashboard.

How long must adverse event records be kept?

Under 21 CFR 312.62(c), two years after a marketing application is approved for the indication or, if none is filed or approved, two years after the investigation is discontinued and FDA is notified. Audit trails are kept as long as the records (21 CFR 11.10(e)); a sponsor can require longer.

To see what an AI-assisted adverse event record shows a BIMO inspector, from source line to signature: Book a 15-minute conversation.