CRO Oversight: What Transfers, What Does Not, and the Records That Prove It

At a glance

• ICH E6(R3) and 21 CFR Part 312 do not say the same thing about whether responsibility can move to a CRO. The guideline says it stays with the sponsor; the US regulation lets it be formally transferred in writing. On a US IND trial you are subject to both, and the difference is set out below rather than smoothed over.
• Under Part 312, anything not named in that written transfer is deemed not transferred. Silence keeps the obligation with the sponsor.
• Oversight is a lifecycle, not a status: allocate, qualify, contract, oversee, and act when something slips. Each stage produces a record.
• Roles have to be allocated before activities start, and agreements documented before they start, not reconstructed later.
• The sponsor decides in advance what counts as an important protocol deviation. That definition is what makes vendor reporting meaningful.
• A problem you detected and did nothing about is a worse finding than one you missed. The obligation is to act proportionately to secure compliance.

The rule that governs everything else

Outsourcing in clinical research is routine, and the contracts are often sophisticated. What those contracts do to the regulatory duty is the first thing to get straight, and the two instruments that govern it do not answer the question the same way.

ICH E6(R3) is the stricter of the two. Agreements should clearly define the roles, activities and responsibilities for the clinical trial and be documented appropriately, and where activities have been transferred or delegated to service providers, the responsibility for the conduct of the trial, including the quality and integrity of the trial data, resides with the sponsor or investigator respectively (ICH E6(R3) Principle 10.2). On that reading, delegation moves the work and never the accountability.

21 CFR Part 312 is more permissive. A sponsor may transfer responsibility for any or all of the obligations set forth in that part to a contract research organization, any such transfer shall be described in writing, and where not all obligations are transferred the writing is required to describe each obligation being assumed by the organization (21 CFR §312.52(a)). It goes further: a contract research organization that assumes any obligation of a sponsor shall comply with the specific regulations applicable to that obligation and shall be subject to the same regulatory action as a sponsor for failure to comply with any obligation assumed (21 CFR §312.52(b)).

These two do not align, and this page does not attempt to reconcile them. The guideline locates responsibility with the sponsor irrespective of delegation. The regulation provides a mechanism by which a CRO formally assumes obligations and becomes directly answerable for them. A US IND trial is subject to both, so the safe operating posture is to satisfy the stricter instrument: transfer obligations in writing where you intend to, and still oversee them as though the accountability never left. If your arrangement depends on the difference between these two positions, that is a question for regulatory counsel, not for a blog.

One part of Part 312 is unambiguous and worth acting on immediately. Any obligation not covered by the written description shall be deemed not to have been transferred (21 CFR §312.52(a)). Silence does not split the difference; it leaves the obligation with the sponsor. A transfer schedule that lists services rather than regulatory obligations therefore transfers very little, whatever the parties believed they were agreeing.

This is why “the CRO handled that” is never a complete answer to an inspection question. Either the obligation was never transferred in writing, in which case it was always yours, or it was, and the follow-up becomes what you did to oversee it.

Allocation comes before activity

The sequence matters, and the standard is specific about it. Prior to initiating clinical trial activities, the sponsor should determine the roles and allocate their trial-related activities accordingly (ICH E6(R3) §3.3).

Two things follow. Allocation is a deliberate act rather than a residue of how work happened to get divided, and it happens before the work starts. A trial where nobody can say who owned a given activity until someone went looking is a trial where allocation never actually occurred.

The most common failure here is not a wrong allocation but an absent one. Activities split across a sponsor, a CRO and a site leave seams, and duties fall into them because each party assumed another held it. When a finding lands in one of those seams, the useful question is not who made the error but who was supposed to own this, and did they have the means to discharge it.

Qualification and selection are the first stage of oversight

Selecting a vendor is not a procurement decision that precedes oversight. It is the first exercise of it, because an unqualified provider cannot be oversighted into competence.

For investigators the standard is explicit, and the reasoning carries across to service providers. The sponsor is responsible for selecting the investigators and institutions, and each investigator should be qualified by education, training and experience and should demonstrate they have adequate resources and facilities to properly conduct the trial (ICH E6(R3) §3.7.1). Note the two limbs: qualified, and adequately resourced. A capable provider without capacity for your trial fails the second limb, and that failure surfaces months later as missed timelines and thin documentation.

The evidentiary posture is the same one that runs through the whole standard. Investigators should be qualified by education, training and experience to assume responsibility for the proper conduct of the trial and should provide evidence of such qualifications (ICH E6(R3) §2.1.1). Qualification you cannot evidence is qualification you cannot rely on.

The artifact at this stage is the qualification record: what you assessed, against what criteria, and what you concluded. A vendor file containing only a signed contract does not show that selection was an oversight activity.

The agreement has to exist before the work does

Agreements made by the sponsor with the investigator or institution, service providers and any other parties involved with the clinical trial, such as an independent data monitoring committee or an adjudication committee, should be documented prior to initiating the activities (ICH E6(R3) §3.6.1).

Prior to initiating is the operative phrase, and it is routinely violated in practice by work starting under a letter of intent while the master agreement is negotiated. The regulatory problem is not the commercial informality. It is that for the period before the agreement exists, the allocation of responsibilities is undocumented, and if something goes wrong in that window there is no record of who held what.

The agreement is also where Principle 10.2’s first instruction is discharged. Roles, activities and responsibilities clearly defined means the agreement should be specific enough that a reader can determine which party performs each trial-related activity. Schedules that list deliverables without allocating regulatory responsibilities satisfy the commercial need and not the GCP one.

Scope changes, and the agreement that has to change with them

An agreement executed correctly at startup goes stale the moment the trial changes, and protocol amendments routinely change what a vendor is doing. The standard treats this as a live obligation rather than a filing exercise: agreements should be updated when necessary to reflect significant changes in the activities transferred (ICH E6(R3) §3.6.2).

The failure mode is familiar to anyone who has run an amendment. The protocol changes, the work changes with it, the vendor absorbs the new activity on a call, and the agreement still describes the old division of labour. Nobody has decided to leave an activity unallocated. It simply drifts out of the document while continuing to be performed.

Why that matters is stated plainly, and it is the single most useful sentence in this area. Any of the sponsor’s trial-related activities that are transferred to and assumed by a service provider should be documented in an agreement, and the sponsor’s trial-related activities that are not specifically transferred to and assumed by a service provider are retained by the sponsor (ICH E6(R3) §3.6.4).

Read that next to the US rule and the two instruments converge, which is worth noting because they diverge on so much else in this area. Part 312 says any obligation not covered by the written description is deemed not to have been transferred; E6(R3) says activities not specifically transferred are retained by the sponsor. Different words, same effect. An activity that is being performed by a vendor but is not named in a current agreement is, as a matter of both, still yours.

That makes change control on the agreement a compliance activity rather than a contracting chore. The practical test after any amendment is short: has what the vendor actually does changed, and does the agreement still say so? If the answer to the first is yes and the second is no, the sponsor has silently reacquired an obligation it believes it delegated.

What ongoing oversight actually requires

The sponsor’s standing duty is broad. The sponsor should ensure that the trial design and trial conduct, the processes undertaken and the information and data generated are of sufficient quality to ensure reliable trial results, trial participants’ safety and appropriate decision making (ICH E6(R3) §3.9.1). More pointedly for delegated work, the sponsor should ensure that trial processes are conducted in compliance with the trial protocol and related documents as well as with applicable regulatory requirements and ethical standards (ICH E6(R3) §3.9.2).

Both are obligations to ensure. That verb is the whole of the oversight duty: it is discharged by knowing, with evidence, rather than by doing the work yourself.

On a US IND trial there is a flat statutory duty alongside it. The sponsor shall monitor the progress of all clinical investigations being conducted under its IND (21 CFR §312.56). No qualifier, no delegation clause. If a CRO performs the monitoring, the sponsor is still the party that must be monitoring the progress of the investigation, which in practice means overseeing the monitor.

It is worth being clear about what monitoring is, because the term gets used loosely. Quality control should be applied using a risk-based approach to each stage of the data handling, and within clinical trials, monitoring and data management processes are the main quality control activities (ICH E6(R3) §3.11.3). Monitoring is quality control, not an audit and not a formality. A monitoring arrangement that produces reports nobody reads is not oversight; it is expenditure.

How much oversight is proportionate follows the standard’s general instruction: clinical trial processes and risk mitigation strategies should be proportionate to the importance of the data being collected and the risks to trial participant safety and data reliability (ICH E6(R3), Principles). A vendor handling a critical endpoint warrants more scrutiny than one shipping supplies. Scaling down is permitted; what you must be able to show is the reasoning.

Define “important” before you need the definition

Vendor escalation only works if both parties agree in advance on what has to be escalated, and the standard puts that decision on the sponsor. The sponsor should determine necessary trial-specific criteria for classifying protocol deviations as important, important deviations being the subset that may significantly impact the completeness, accuracy or reliability of the trial data, or that may significantly affect a participant’s rights, safety or well-being (ICH E6(R3) §3.9.3).

Left undefined, this becomes the most predictable failure in the whole relationship. The CRO applies its own threshold, the sponsor assumes a different one, and the gap is invisible until a deviation that mattered was never escalated. The fix costs an afternoon at startup.

When the provider is noncompliant

Detection is not the end of the obligation. Noncompliance with the protocol, standard operating procedures, GCP or applicable regulatory requirements by an investigator or institution, or by members of the sponsor’s staff, should lead to appropriate and proportionate action by the sponsor to secure compliance (ICH E6(R3) §3.12.1).

The word securing is doing work there. The action has to be aimed at actually restoring compliance, not merely at recording that a conversation happened. And proportionate cuts both ways: an escalation out of proportion to a minor finding is as much a misjudgement as an inadequate response to a serious one.

The hardest version of this is commercial. Acting on a CRO’s noncompliance can mean confronting a vendor you depend on and cannot easily replace mid-trial. The regulation does not recognise that difficulty, and an issue you documented but did not act on is a worse position than one you never found, because the record now shows you knew.

The investigator side of the same rule

Principle 10.2 says the responsibility resides with the sponsor or investigator respectively, and that second half is easy to skip. Sites delegate too, and the same logic applies to them.

The investigator may delegate trial-related activities to other persons or parties, and may be supported by the sponsor in identifying a suitable service provider; however, the investigator retains the final decision on whether the service provider intended to support the investigator is appropriate, based on information provided by the sponsor, and the investigator retains the ultimate responsibility and should maintain appropriate oversight of the persons or parties undertaking the delegated activities (ICH E6(R3) §2.3.1).

This matters in sponsor-arranged vendor models, where a central lab, imaging vendor or eCOA provider is selected by the sponsor but serves the site. The sponsor can recommend. The investigator still decides whether that provider is appropriate for their site, and still owes oversight of the work done under their responsibility. A site that treats a sponsor-mandated vendor as somebody else’s problem has misread its own position.

Audit is not more monitoring

Sponsors sometimes respond to vendor concerns by increasing monitoring, which is the wrong instrument. The purpose of a sponsor’s audit, which is independent of and separate from routine monitoring or quality control functions, is to evaluate trial conduct, and audits should be conducted in a manner proportionate to the risks associated with the conduct of the trial (ICH E6(R3) §3.11.2).

Two consequences. Audit is deliberately independent, so an audit carried out by the team that runs the monitoring is not an audit in this sense, whatever it is called internally. And audit is risk-proportionate rather than routine, which means a vendor audit programme on a fixed annual cadence, untied to risk, is both over-serving low-risk providers and under-serving the ones that matter.

Quality assurance is the wider frame: it should be applied throughout the clinical trial and includes implementing risk-based strategies to identify potential or actual causes of serious noncompliance with the protocol, GCP and applicable regulatory requirements, so that corrective and preventive action can follow (ICH E6(R3) §3.11.1). Vendor oversight is one input to that system, not a parallel process beside it.

The evidence map

Each stage produces an artifact. If you cannot name it, you cannot demonstrate the oversight.

• Allocation (§3.3): a documented division of trial-related activities, dated before activities began.
• Qualification and selection (§3.7.1, §2.1.1): the assessment record, covering both competence and capacity.
• Agreement (§3.6.1, 21 CFR §312.52(a)): executed before work started, allocating regulatory obligations and not only deliverables. On a US IND trial, name each obligation being assumed, because anything the writing does not name is deemed not transferred.
• Ongoing oversight (§3.9.1, §3.9.2, 21 CFR §312.56): monitoring reports and, critically, evidence that the sponsor reviewed and acted on them. Oversight governance with no output record is invisible.
• Deviation criteria (§3.9.3): the written definition of important, agreed at startup.
• Noncompliance response (§3.12.1): what was found, what was done, and whether it worked.

The pattern across all six is the same. The obligation is on the sponsor, the work may sit elsewhere, and the record is what closes the gap between those two facts.

Sources

• ICH E6(R3) Good Clinical Practice, version R3
• 21 CFR Part 312, Investigational New Drug Application (current as of 4/14/2026)