CRO Sponsor Oversight: How Sponsors Ensure Oversight of Outsourced Trial Activities

Status: 5 November 2026

Summary: A sponsor may outsource trial activities to a CRO, but ultimate responsibility stays with the sponsor. ICH E6(R3), Article 71 of EU Regulation 536/2014 and 21 CFR 312.52 all say so¹²³. Inspectors therefore expect more than a contract: they want evidence of risk-based oversight throughout the trial⁴. In EMA's 2024 annual report, 52.8% of all major and critical findings were attributed to the sponsor and only 1.5% to the CRO¹⁰.

1. What does sponsor oversight mean?

Sponsor oversight covers everything a sponsor does to ensure, and to show, that outsourced trial activities are carried out in line with GCP and the protocol. ICH E6(R3) gives sponsor oversight its own section 3.9. Oversight measures must be "fit for purpose" and proportionate to the trial's complexity and risks. Ultimate responsibility stays with the sponsor (3.6.6)¹. E6(R3) uses the general term "service provider", of which a CRO is one example⁵.

Delegation versus transfer of obligations: in the EU, the sponsor delegates tasks, and under Article 71 of Regulation 536/2014 this does not affect the sponsor's responsibility². In the US, 21 CFR 312.52 allows obligations to be transferred to a CRO, which then faces the same regulatory action as a sponsor for those obligations. Every transfer must be described in writing. Any obligation not described is deemed not to have been transferred³. Even after a transfer, the sponsor remains responsible for oversight¹.

2. Legal framework

ICH E6(R3): agreements with service providers must be documented before the activity starts (3.6.1). Anything not explicitly transferred stays with the sponsor (3.6.4). The sponsor selects the provider and assesses its suitability (3.6.7). It needs access to the provider's SOPs and performance metrics (3.6.8), and its oversight extends to subcontractors (3.6.9). Quality management follows the risk-based cycle in section 3.10¹. In the EU, the principles and Annex 1 have applied since 23 July 2025⁶. FDA published E6(R3) as final guidance in September 2025⁷. See GCP.

EU Regulation 536/2014: several articles matter for sponsor oversight²:

• Article 71: delegation of tasks
• Article 52: notification of serious breaches within 7 days
• Article 58: archiving of the trial master file for at least 25 years
• Article 74: a legal representative in the Union for sponsors not established in the EU

21 CFR 312: 312.52 governs the transfer of obligations. Sections 312.50 to 312.59 set out the general sponsor obligations, including monitoring (312.56)⁸. FDA's warning letter to Verdure Sciences of 10 November 2025 shows how strictly 312.52 is read. The contract and work order called the vendor only a "Service Provider" and described no transferred obligations, so all sponsor obligations stayed with the company⁹.

EMA and MHRA positions: the MHRA stresses that oversight is not just the initial vendor assessment and must be demonstrated throughout the trial⁴. In its 2024 annual report, EMA lists typical findings including inadequate documentation of third-party qualification and oversight, and no audits of partners or vendors¹⁰.

3. Selecting and qualifying CROs

Qualification starts before contracting and is scaled to the risk of the outsourced activities. The MHRA mentions several possible forms⁴:

• questionnaires
• review of SOPs and the quality management system
• site visits
• audits

What counts is a documented decision by the sponsor; the assessment must not be a form-filling exercise. A laboratory analysing primary endpoint samples, for example, warrants a higher risk rating than one doing exploratory analyses only⁴.

Typical assessment criteria are:

• quality management system
• experience in the indication and region
• inspection history
• staffing and training
• validated systems
• capacity

Subcontractors: the sponsor must know about every CRO subcontractor and agree to its use. The MHRA notes that this is often handled through tripartite agreements. If the sponsor delegates subcontractor oversight to the CRO, it must make sure the CRO has robust oversight mechanisms and a clear escalation route⁴.

4. Contractual foundations

Service agreement: the contract must be in place before work starts¹. It should state that the protocol and regulations take precedence over the CRO's internal procedures. The MHRA often finds that contracts lack key legal requirements, such as reporting urgent safety measures and serious breaches⁴.

TORO or responsibility matrix: "transfer of regulatory obligations" (TORO) is an industry term. It refers to the written allocation of each sponsor obligation that 21 CFR 312.52 requires³. In the EU, a task or responsibility matrix does the same job for delegation.

Quality agreement: it covers:

• the SOPs that apply
• reporting routes and timelines
• handling of deviations and CAPA
• audit and inspection rights
• use of subcontractors

Access rights: the sponsor needs access to data, systems and the TMF. EMA explicitly lists insufficient direct access to trial documentation as a finding¹⁰. On TMF structure see TMF and eTMF. Systems operated by a CRO are subject to the validation requirements described in Computer System Validation.

5. Operational oversight

Oversight plan and metrics: an oversight plan sets out which activities the sponsor monitors and with which metrics, thresholds and escalation routes. Key performance indicators measure CRO performance, such as timelines for monitoring reports or query turnaround. Key risk indicators flag risks at site level. E6(R3) does not define KRIs, but it requires access to performance metrics (3.6.8) and pre-specified "acceptable ranges" such as quality tolerance limits (3.10.1.3)¹. FDA's risk-based monitoring guidance and the 2023 Questions and Answers recommend documenting the risk assessment and updating it as the trial progresses¹²¹³. EMA described this approach as early as 2013¹⁴.

Governance and escalation: meetings should have a clear agenda and minutes that record actions with owners and due dates. The MHRA describes a case in which an action from a meeting that was never implemented led to a fatal overdose⁴. For potential serious breaches, the reporting clock starts as soon as anyone working on the sponsor's behalf identifies the issue, and that explicitly includes vendors⁴.

Audits, TMF oversight and CAPA: audits may take place before selection, during the trial and at its end, and may be trial-specific or process-based⁴. The sponsor should keep its own oversight file. The MHRA has seen oversight records lost when they were merged with the CRO's TMF at the end of a trial, so the oversight could no longer be reconstructed⁴. Deviations should be closed with root cause analysis, CAPA and an effectiveness check¹⁵.

Oversight instruments and inspection evidence

Oversight instrument	Purpose	Evidence for the inspection
Qualification (questionnaire, audit)	Show suitability before contracting	Assessment report with a documented decision
Contract, TORO/responsibility matrix	Allocate obligations unambiguously	Signed copies of all versions
Quality agreement	Set SOPs, reporting routes and audit rights	Valid, approved agreement
Oversight plan	Plan oversight by risk	Versioned plan with rationale
KPIs/KRIs	Measure performance and risk	Reports with trend analysis and follow-up actions
Governance meetings	Steer decisions	Minutes with actions, owners and due dates
Document review	Check the quality of CRO work	Reviewed monitoring reports, plans, deviation logs
Co-monitoring	Assess monitoring quality	The sponsor's own visit report
In-study audits	Independent check	Audit plan, reports, CAPA
TMF oversight	Ensure completeness	QC results, oversight file
Escalation, CAPA	Resolve issues	Escalation records, effectiveness checks
Subcontractor oversight	Close the chain of responsibility	Sponsor approval, CRO's assessment

FDA Compliance Program 7348.810 (version of 15 September 2021) instructs investigators to request all versions of contracts, oversight plans and meeting minutes¹¹¹⁵.

6. Typical inspection findings on inadequate sponsor oversight

EMA: in the GCP IWG's 2024 annual report, 67 inspections produced 335 major and critical findings, 152 of them from 18 sponsor inspections. By responsible party, 177 findings were attributed to the sponsor (52.8%), including 9 of 11 critical findings (81.8%). Five findings (1.5%) were attributed to the CRO¹⁰. A peer-reviewed analysis of shared FDA and EMA inspections found that, for sponsor and CRO inspections, trial management was FDA's most common finding area and documentation, including the TMF, was EMA's²².

MHRA: the 2018/2019 metrics report cites, among other things, a lack of effective sponsor QC of an eTMF and a lack of appropriate oversight and suitable systems at the sponsor¹⁷. For 2019/2020, the ECA's summary of the MHRA report gives 4 critical findings at non-commercial sponsors, including findings on sponsor oversight. Commercial sponsors also had 4 critical findings, all relating to pharmacovigilance¹⁸. In one case study, a sponsor with no oversight file could not demonstrate its oversight, and the CRO reported SUSARs late¹⁶¹⁵.

FDA BIMO: besides the Verdure Sciences case⁹, the warning letter to Applied Therapeutics (27 November 2024) shows that using a vendor does not reduce the sponsor's responsibility. A vendor deleted eCOA data, including audit trails, for 47 participants after the inspection was announced¹⁹.

7. Practical recommendations for small sponsors

• Before the trial starts, draw up a responsibility matrix or TORO that allocates every obligation, and leave nothing ambiguous³⁹.
• Focus oversight, by risk, on a few critical areas: safety reporting, the primary endpoint, data management and the TMF⁴.
• Keep your own oversight file under your own control from day one⁴.
• Write into contracts the reporting duties for serious breaches and urgent safety measures, access to systems and the TMF, and the requirement for your approval of subcontractors⁴¹⁰.
• Keep the effort manageable, bearing in mind that software solutions now make oversight much simpler and more manageable, for example supplier or vendor management solutions or systems with these functions built in²¹.
• For the United Kingdom, take account of the MHRA's expectation of a documented E6(R3) gap analysis²⁰.

FAQ

What does sponsor oversight mean?

The sponsor's risk-based, documented oversight of all outsourced trial activities for the whole duration of the trial (ICH E6(R3) 3.9)¹.

Is the sponsor responsible if the CRO makes mistakes?

Yes. Ultimate responsibility stays with the sponsor (E6(R3) 3.6.6, Article 71 of Regulation 536/2014)¹². In the US, the CRO is also liable for obligations transferred to it in writing (21 CFR 312.52)³.

What belongs in an oversight plan?

The activities to be overseen, KPIs and KRIs with thresholds, the frequency and form of reviews, governance meetings, escalation routes, audit and co-monitoring planning, and oversight of subcontractors⁴.

What is a TORO?

A "transfer of regulatory obligations": the written document under 21 CFR 312.52 that describes which sponsor obligations pass to the CRO. Any obligation not listed is deemed not transferred³.

How often should a sponsor audit its CRO?

No regulation sets a fixed frequency. The MHRA recommends risk-based planning, with audits before selection, during the trial and at its end, depending on how critical the outsourced activities are⁴. Missing vendor audits are a documented EMA finding¹⁰.

References

1. EMA: ICH E6(R3) Guideline for good clinical practice (GCP), Step 5. https://www.ema.europa.eu/en/documents/scientific-guideline/ich-e6-r3-guideline-good-clinical-practice-gcp-step-5_en.pdf (accessed 5 November 2026)
2. Regulation (EU) No 536/2014 on clinical trials on medicinal products for human use (consolidated version). https://eur-lex.europa.eu/eli/reg/2014/536/2022-12-05/eng (accessed 5 November 2026)
3. eCFR: 21 CFR 312.52 – Transfer of obligations to a contract research organization. https://www.ecfr.gov/current/title-21/chapter-I/subchapter-D/part-312/subpart-D/section-312.52 (accessed 5 November 2026)
4. MHRA Inspectorate Blog: Sponsor Oversight – Part 1 (26 July 2018). https://mhrainspectorate.blog.gov.uk/2018/07/26/sponsor-oversight-part-1/ (accessed 5 November 2026)
5. MHRA Inspectorate Blog: ICH E6 (R3) Good Clinical Practice (26 May 2023). https://mhrainspectorate.blog.gov.uk/2023/05/26/ich-e6-r3-good-clinical-practice/ (accessed 5 November 2026)
6. European Commission, ACT EU: Good clinical practice modernisation. https://accelerating-clinical-trials.europa.eu/our-work/good-clinical-practice-modernisation_en (accessed 5 November 2026)
7. FDA: E6(R3) Good Clinical Practice (GCP), Guidance for Industry. https://www.fda.gov/regulatory-information/search-fda-guidance-documents/e6r3-good-clinical-practice-gcp (accessed 5 November 2026)
8. eCFR: 21 CFR Part 312, Subpart D – Responsibilities of Sponsors and Investigators. https://www.ecfr.gov/current/title-21/chapter-I/subchapter-D/part-312/subpart-D (accessed 5 November 2026)
9. FDA: Warning Letter Verdure Sciences, Inc., MARCS-CMS 717259 (10 November 2025). https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/warning-letters/verdure-sciences-inc-717259-11102025 (accessed 5 November 2026)
10. EMA: Annual Report of the GCP Inspectors' Working Group 2024 (EMA/INS/GCP/37608/2025). https://www.ema.europa.eu/en/documents/report/annual-report-good-clinical-practice-inspectors-working-group-2024_en.pdf (accessed 5 November 2026)
11. FDA: Compliance Program 7348.810, Sponsors and Contract Research Organizations (15 September 2021). https://www.fda.gov/media/75916/download (accessed 5 November 2026)
12. FDA: Oversight of Clinical Investigations – A Risk-Based Approach to Monitoring (2013). https://www.fda.gov/media/116754/download (accessed 5 November 2026)
13. FDA: A Risk-Based Approach to Monitoring of Clinical Investigations – Questions and Answers (April 2023). https://www.fda.gov/media/121479/download (accessed 5 November 2026)
14. EMA: Reflection paper on risk based quality management in clinical trials (2013). https://www.ema.europa.eu/en/documents/scientific-guideline/reflection-paper-risk-based-quality-management-clinical-trials_en.pdf (accessed 5 November 2026)
15. Docuply: ICH E6(R3) Inspection Readiness for sponsors. https://docuply.io/en/ich-e6-r3-inspection-readiness-sponsors/ (accessed 5 November 2026)
16. MHRA Inspectorate Blog: Sponsor Oversight – Part 2 (25 September 2018). https://mhrainspectorate.blog.gov.uk/2018/09/25/sponsor-oversight-part-2 (accessed 5 November 2026)
17. MHRA: GCP Inspections Metrics Report, 1 April 2018 – 31 March 2019 (12 February 2021). https://assets.publishing.service.gov.uk/media/602a8e3cd3bf7f03190cbe43/GCP_INSPECTIONS_METRICS_2018-2019_final_12-02-21.pdf (accessed 5 November 2026)
18. ECA Academy: MHRA's GCP Inspection Metrics (summary of the MHRA 2019/2020 report). https://www.gmp-compliance.org/gmp-news/mhras-gcp-inspection-metrics (accessed 5 November 2026)
19. FDA: Warning Letter Applied Therapeutics, Inc., MARCS-CMS 696833 (dated 27 November 2024). https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/warning-letters/applied-therapeutics-inc-696833-12032024 (accessed 5 November 2026)
20. MHRA: Clinical trials for medicines: compliance with ICH E6 good clinical practice in the United Kingdom (2026). https://www.gov.uk/guidance/clinical-trials-for-medicines-compliance-with-ich-e6-good-clinical-practice-gcp-in-the-united-kingdom (accessed 5 November 2026)
21. Docuply: Supplier Management. https://docuply.io/en/supplier-management/ (accessed 5 November 2026)
22. Therapeutic Innovation & Regulatory Science: Descriptive Analysis of Good Clinical Practice Inspection Findings from U.S. Food and Drug Administration and European Medicines Agency (2022). https://link.springer.com/article/10.1007/s43441-022-00417-w (accessed 5 November 2026)