CRO Oversight Under RBM: What the Sponsor Cannot Delegate
A sponsor can transfer trial-related duties to a contract research organization, and under ICH GCP the responsibility for the quality and integrity of the trial data stays with the sponsor regardless. Under a risk-based approach this matters more, not less, because the decisions being delegated are judgments about what matters rather than a fixed schedule of visits.
Oversight findings are among the more common inspection outcomes in outsourced studies, and the shape is consistent: the transfer of duties existed, the reports arrived, and the sponsor could not demonstrate what it did with them. This post is about what the sponsor keeps, and how that is evidenced. The method being overseen sits in the risk-based quality management plan.
What Transfers and What Does Not
Execution transfers readily: visits, reports, central review, dashboards, follow-up with sites, documentation. Most sponsors delegate the drafting of the monitoring plan and the risk assessment too, which is reasonable, because the contract research organization usually has the operational knowledge to write a better first version.
What cannot transfer is the judgment underneath. Deciding what is critical to quality in this study is a statement about the purpose of the study, not about monitoring logistics. Approving a reduction in monitoring is an acceptance of risk. Accepting or challenging a tolerance limit breach is a decision about whether the results can still be believed.
A practical test at handover: can the sponsor explain why each critical factor is on the list, without reading from the plan. Where it cannot, the risk assessment has been outsourced rather than delegated, and that is what the critical-to-quality factor selection is meant to prevent.
Why a Risk-Based Study Raises the Bar
Under a fixed monitoring schedule, oversight has an easy proxy. Visits were due, visits happened, reports exist. The proxy is shallow but it is checkable.
Under a risk-based plan there is no equivalent count. The plan says visits are triggered by defined conditions, so the oversight question becomes whether the triggers fired and what followed, which requires looking at the underlying data rather than at a summary. A sponsor receiving only a monthly deck has no way to answer it.
This is why the reduction itself needs sponsor approval on the record. A reduced plan is an accepted risk, and accepted risks belong to the party that carries the responsibility.
What Oversight Evidence Looks Like
An inspector rarely asks whether a transfer of duties existed. The question is how the sponsor knew the plan was being followed.
The pattern across that table is that durable evidence shows the sponsor engaging with detail rather than receiving a summary. Sampling a small number of visit reports each quarter and recording the comments made is worth more than a year of status slides, because it demonstrates that someone looked at the work rather than at the reporting on the work.
Signal aging is the most useful single metric, and the one least often asked for. A study where signals are opened promptly and closed slowly is different from one where both happen quickly, and the difference is invisible in a count of signals raised.
The Clauses That Make Oversight Possible
Most oversight problems are contract problems discovered late. The clause that matters most is data access, and the distinction is between direct read access to the systems and a periodic extract prepared by the party being overseen.
Extracts are not adequate for risk-based oversight, because the sponsor cannot ask a question the extract was not built to answer. Direct read access, granted to named roles and running through to close-out, is what allows a sponsor to check a trigger independently.
Escalation thresholds are the second area worth specifying rather than assuming. Being told is different from being asked, and a plan that leaves the distinction to judgment tends to produce escalation after a decision has already been taken. The systems boundaries that decide where records sit are covered in which system owns which part of the study, and the document access question in giving monitors access without losing document control.
Keeping Oversight Proportionate
Oversight that duplicates the contract research organization's work is expensive and tends to collapse under its own weight. The workable version is a small number of deliberate checks run consistently: a sampled review of visit reports, a look at signal aging, a quarterly review of what changed in the risk assessment and why, and a recorded sponsor position on significant deviations.
Consistency matters more than volume. Four quarters of the same four checks, with decisions recorded, is stronger evidence than an intensive review conducted once when a problem appeared. Where this work is supported by systems rather than spreadsheets, the platform side sits with Clinera CTMS, and the way we build oversight and analytics into outsourced studies is described in our work with contract research organizations.
References
ICH E6(R3), Good Clinical Practice, which sets out that a sponsor may transfer trial-related duties to a contract research organization while retaining responsibility for the quality and integrity of the trial data, and that the transfer should be specified in writing. The FDA guidance Oversight of Clinical Investigations, A Risk-Based Approach to Monitoring, August 2013, and its 2019 questions and answers. EU Regulation 536/2014 for sponsor obligations in trials conducted in the European Union.
Current texts are at www.ich.org, www.fda.gov and health.ec.europa.eu.
Frequently Asked Questions
Can a sponsor delegate monitoring to a CRO?
Yes. ICH GCP allows a sponsor to transfer any or all trial-related duties to a contract research organization, provided the transfer is specified in writing. What does not transfer is responsibility for the quality and integrity of the trial data, which stays with the sponsor. In practice that means execution can move, and the judgments about what is critical, what monitoring is adequate and whether a breach is acceptable cannot.
What does adequate sponsor oversight look like in practice?
A small number of deliberate checks run consistently. Sampling visit reports each quarter and recording the sponsor's comments, reviewing the aging of open signals rather than the count raised, examining what changed in the risk assessment and why, and recording a sponsor position on significant deviations. Consistency matters more than intensity, because four quarters of the same checks demonstrates a system rather than a reaction.
Why does a risk-based study make oversight harder?
Because the easy proxy disappears. Under a fixed schedule, oversight can check that due visits happened. Under a risk-based plan, visits are triggered by defined conditions, so the question becomes whether the triggers fired and what followed. Answering that requires looking at the underlying data rather than at a summary, which is why a sponsor receiving only a monthly deck cannot evidence oversight of a risk-based plan.
What data access should the contract give the sponsor?
Direct read access to the systems for named sponsor roles, running through to close-out, rather than a periodic extract prepared by the party being overseen. The distinction matters because an extract can only answer the questions it was built for. A sponsor that wants to check independently whether a trigger fired, or how long signals stayed open, needs to query the data rather than receive a report about it.
Who approves a reduction in monitoring?
The sponsor, on the record. A reduced monitoring plan is an accepted risk, and accepted risks belong to the party that carries responsibility for the trial. The contract research organization can propose the reduction and will usually have the better operational basis for designing it, but approval is a sponsor decision and the reasoning should be documented at the time rather than reconstructed if the reduction is later questioned.
What are the common inspection findings on CRO oversight?
The recurring shape is that the written transfer of duties existed and reports were delivered, but the sponsor could not demonstrate what it did with them. Related findings include a risk assessment that was never revisited after study start, escalation thresholds that existed in the plan but not in practice, and sponsor access to data that was arranged only after a problem emerged rather than at contract.
