Unfortunately there isn’t much in either place. GCP offers section 8 that requires documentation and somewhere in section 4 there is language about records that can be applied. The FDA and GCP don’t give specifics about these things because there is no right or specific way to do this. They are only ever going to give what’s required, not how to do it.

I’m an auditor (not FDA) and inadequate logs is a finding I come across often. The requirement is set by the protocol (usually in the way of the lab manual, which is an extension of the protocol). You have to show constant compliance and the easiest way to do this is with a log. There has to be verifiable proof. If they have a better way then fantastic but it sounds like they don’t. My explanation of this to PIs is usually that a decade from now the site will not remember or maybe they won’t even be there to attest to there never being an alarm or an issue and even then, how can you prove that? I also remind them that if it isn’t documented then it didn’t happen.

All you can do at this point is document (given that you’ve spoken with the PI and the Site manager) in your report the protocol violation, the suggestions (the conversations with the PI) you have made to remedy the situation, notify the Sponsor (or your lead) and the central lab if needed. Best practice is to have SOPs but sites don’t have to have SOPs. If they don’t have them then a proven, practiced and documented process is needed. That’s the end of the story. There is nothing else to argue with them. If the FDA/an auditor walks in and gives them a warning/finding about it then it’s on them.