# CRO Sponsor Oversight: How Sponsors Ensure Oversight of Outsourced Trial Activities

> Sponsor oversight of CROs: ICH E6(R3), EU Regulation 536/2014, 21 CFR 312.52, TORO, oversight plans, KPIs, audits, inspection findings and practical advice for small sponsors. Status November 2026.

- Source: https://info-pharma.de/en/cro-sponsor-oversight/
- Language: English (UK)
- Last updated: 2026-11-06
- Section: Home › Outsourcing/Decentralisation › CRO Sponsor Oversight
- Deutsche Fassung: https://info-pharma.de/cro-sponsor-oversight/index.html.md

---

*Status: 5 November 2026*

**Summary:** A sponsor may outsource trial activities to a CRO, but ultimate responsibility stays with the sponsor. ICH E6(R3), Article 71 of EU Regulation 536/2014 and 21 CFR 312.52 all say so[1][2][3]. Inspectors therefore expect more than a contract: they want evidence of risk-based oversight throughout the trial[4]. In EMA's 2024 annual report, 52.8% of all major and critical findings were attributed to the sponsor and only 1.5% to the CRO[10].

## 1. What does sponsor oversight mean?

Sponsor oversight covers everything a sponsor does to ensure, and to show, that outsourced trial activities are carried out in line with GCP and the protocol. ICH E6(R3) gives sponsor oversight its own section 3.9. Oversight measures must be "fit for purpose" and proportionate to the trial's complexity and risks. Ultimate responsibility stays with the sponsor (3.6.6)[1]. E6(R3) uses the general term "service provider", of which a CRO is one example[5].

**Delegation versus transfer of obligations:** in the EU, the sponsor *delegates* tasks, and under Article 71 of Regulation 536/2014 this does not affect the sponsor's responsibility[2]. In the US, 21 CFR 312.52 allows obligations to be *transferred* to a CRO, which then faces the same regulatory action as a sponsor for those obligations. Every transfer must be described in writing. Any obligation not described is deemed not to have been transferred[3]. Even after a transfer, the sponsor remains responsible for oversight[1].

## 2. Legal framework

**ICH E6(R3):** agreements with service providers must be documented before the activity starts (3.6.1). Anything not explicitly transferred stays with the sponsor (3.6.4). The sponsor selects the provider and assesses its suitability (3.6.7). It needs access to the provider's SOPs and performance metrics (3.6.8), and its oversight extends to subcontractors (3.6.9). Quality management follows the risk-based cycle in section 3.10[1]. In the EU, the principles and Annex 1 have applied since 23 July 2025[6]. FDA published E6(R3) as final guidance in September 2025[7]. See [GCP](https://info-pharma.de/en/gcp/).

**EU Regulation 536/2014:** several articles matter for sponsor oversight[2]:

- Article 71: delegation of tasks
- Article 52: notification of serious breaches within 7 days
- Article 58: archiving of the trial master file for at least 25 years
- Article 74: a legal representative in the Union for sponsors not established in the EU

**21 CFR 312:** 312.52 governs the transfer of obligations. Sections 312.50 to 312.59 set out the general sponsor obligations, including monitoring (312.56)[8]. FDA's warning letter to Verdure Sciences of 10 November 2025 shows how strictly 312.52 is read. The contract and work order called the vendor only a "Service Provider" and described no transferred obligations, so all sponsor obligations stayed with the company[9].

**EMA and MHRA positions:** the MHRA stresses that oversight is not just the initial vendor assessment and must be demonstrated throughout the trial[4]. In its 2024 annual report, EMA lists typical findings including inadequate documentation of third-party qualification and oversight, and no audits of partners or vendors[10].

## 3. Selecting and qualifying CROs

Qualification starts before contracting and is scaled to the risk of the outsourced activities. The MHRA mentions several possible forms[4]:

- questionnaires
- review of SOPs and the quality management system
- site visits
- audits

What counts is a documented decision by the sponsor; the assessment must not be a form-filling exercise. A laboratory analysing primary endpoint samples, for example, warrants a higher risk rating than one doing exploratory analyses only[4].

Typical assessment criteria are:

- quality management system
- experience in the indication and region
- inspection history
- staffing and training
- validated systems
- capacity

**Subcontractors:** the sponsor must know about every CRO subcontractor and agree to its use. The MHRA notes that this is often handled through tripartite agreements. If the sponsor delegates subcontractor oversight to the CRO, it must make sure the CRO has robust oversight mechanisms and a clear escalation route[4].

## 4. Contractual foundations

**Service agreement:** the contract must be in place before work starts[1]. It should state that the protocol and regulations take precedence over the CRO's internal procedures. The MHRA often finds that contracts lack key legal requirements, such as reporting urgent safety measures and serious breaches[4].

**TORO or responsibility matrix:** "transfer of regulatory obligations" (TORO) is an industry term. It refers to the written allocation of each sponsor obligation that 21 CFR 312.52 requires[3]. In the EU, a task or responsibility matrix does the same job for delegation.

**Quality agreement:** it covers:

- the SOPs that apply
- reporting routes and timelines
- handling of deviations and CAPA
- audit and inspection rights
- use of subcontractors

**Access rights:** the sponsor needs access to data, systems and the TMF. EMA explicitly lists insufficient direct access to trial documentation as a finding[10]. On TMF structure see [TMF and eTMF](https://info-pharma.de/en/tmf-etmf/). Systems operated by a CRO are subject to the validation requirements described in [Computer System Validation](https://info-pharma.de/en/computer-system-validation/).

## 5. Operational oversight

**Oversight plan and metrics:** an oversight plan sets out which activities the sponsor monitors and with which metrics, thresholds and escalation routes. Key performance indicators measure CRO performance, such as timelines for monitoring reports or query turnaround. Key risk indicators flag risks at site level. E6(R3) does not define KRIs, but it requires access to performance metrics (3.6.8) and pre-specified "acceptable ranges" such as quality tolerance limits (3.10.1.3)[1]. FDA's risk-based monitoring guidance and the 2023 Questions and Answers recommend documenting the risk assessment and updating it as the trial progresses[12][13]. EMA described this approach as early as 2013[14].

**Governance and escalation:** meetings should have a clear agenda and minutes that record actions with owners and due dates. The MHRA describes a case in which an action from a meeting that was never implemented led to a fatal overdose[4]. For potential serious breaches, the reporting clock starts as soon as anyone working on the sponsor's behalf identifies the issue, and that explicitly includes vendors[4].

**Audits, TMF oversight and CAPA:** audits may take place before selection, during the trial and at its end, and may be trial-specific or process-based[4]. The sponsor should keep its own oversight file. The MHRA has seen oversight records lost when they were merged with the CRO's TMF at the end of a trial, so the oversight could no longer be reconstructed[4]. Deviations should be closed with root cause analysis, CAPA and an effectiveness check[15].

**Oversight instruments and inspection evidence**

| Oversight instrument | Purpose | Evidence for the inspection |
| --- | --- | --- |
| Qualification (questionnaire, audit) | Show suitability before contracting | Assessment report with a documented decision |
| Contract, TORO/responsibility matrix | Allocate obligations unambiguously | Signed copies of all versions |
| Quality agreement | Set SOPs, reporting routes and audit rights | Valid, approved agreement |
| Oversight plan | Plan oversight by risk | Versioned plan with rationale |
| KPIs/KRIs | Measure performance and risk | Reports with trend analysis and follow-up actions |
| Governance meetings | Steer decisions | Minutes with actions, owners and due dates |
| Document review | Check the quality of CRO work | Reviewed monitoring reports, plans, deviation logs |
| Co-monitoring | Assess monitoring quality | The sponsor's own visit report |
| In-study audits | Independent check | Audit plan, reports, CAPA |
| TMF oversight | Ensure completeness | QC results, oversight file |
| Escalation, CAPA | Resolve issues | Escalation records, effectiveness checks |
| Subcontractor oversight | Close the chain of responsibility | Sponsor approval, CRO's assessment |

FDA Compliance Program 7348.810 (version of 15 September 2021) instructs investigators to request all versions of contracts, oversight plans and meeting minutes[11][15].

## 6. Typical inspection findings on inadequate sponsor oversight

**EMA:** in the GCP IWG's 2024 annual report, 67 inspections produced 335 major and critical findings, 152 of them from 18 sponsor inspections. By responsible party, 177 findings were attributed to the sponsor (52.8%), including 9 of 11 critical findings (81.8%). Five findings (1.5%) were attributed to the CRO[10]. A peer-reviewed analysis of shared FDA and EMA inspections found that, for sponsor and CRO inspections, trial management was FDA's most common finding area and documentation, including the TMF, was EMA's[22].

**MHRA:** the 2018/2019 metrics report cites, among other things, a lack of effective sponsor QC of an eTMF and a lack of appropriate oversight and suitable systems at the sponsor[17]. For 2019/2020, the ECA's summary of the MHRA report gives 4 critical findings at non-commercial sponsors, including findings on sponsor oversight. Commercial sponsors also had 4 critical findings, all relating to pharmacovigilance[18]. In one case study, a sponsor with no oversight file could not demonstrate its oversight, and the CRO reported SUSARs late[16][15].

**FDA BIMO:** besides the Verdure Sciences case[9], the warning letter to Applied Therapeutics (27 November 2024) shows that using a vendor does not reduce the sponsor's responsibility. A vendor deleted eCOA data, including audit trails, for 47 participants after the inspection was announced[19].

## 7. Practical recommendations for small sponsors

- Before the trial starts, draw up a responsibility matrix or TORO that allocates every obligation, and leave nothing ambiguous[3][9].
- Focus oversight, by risk, on a few critical areas: safety reporting, the primary endpoint, data management and the TMF[4].
- Keep your own oversight file under your own control from day one[4].
- Write into contracts the reporting duties for serious breaches and urgent safety measures, access to systems and the TMF, and the requirement for your approval of subcontractors[4][10].
- Keep the effort manageable, bearing in mind that software solutions now make oversight much simpler and more manageable, for example supplier or vendor management solutions or systems with these functions built in[21].
- For the United Kingdom, take account of the MHRA's expectation of a documented E6(R3) gap analysis[20].

## FAQ

### What does sponsor oversight mean?

The sponsor's risk-based, documented oversight of all outsourced trial activities for the whole duration of the trial (ICH E6(R3) 3.9)[1].

### Is the sponsor responsible if the CRO makes mistakes?

Yes. Ultimate responsibility stays with the sponsor (E6(R3) 3.6.6, Article 71 of Regulation 536/2014)[1][2]. In the US, the CRO is also liable for obligations transferred to it in writing (21 CFR 312.52)[3].

### What belongs in an oversight plan?

The activities to be overseen, KPIs and KRIs with thresholds, the frequency and form of reviews, governance meetings, escalation routes, audit and co-monitoring planning, and oversight of subcontractors[4].

### What is a TORO?

A "transfer of regulatory obligations": the written document under 21 CFR 312.52 that describes which sponsor obligations pass to the CRO. Any obligation not listed is deemed not transferred[3].

### How often should a sponsor audit its CRO?

No regulation sets a fixed frequency. The MHRA recommends risk-based planning, with audits before selection, during the trial and at its end, depending on how critical the outsourced activities are[4]. Missing vendor audits are a documented EMA finding[10].

## References

1. EMA: ICH E6(R3) Guideline for good clinical practice (GCP), Step 5. https://www.ema.europa.eu/en/documents/scientific-guideline/ich-e6-r3-guideline-good-clinical-practice-gcp-step-5_en.pdf (accessed 5 November 2026)
2. Regulation (EU) No 536/2014 on clinical trials on medicinal products for human use (consolidated version). https://eur-lex.europa.eu/eli/reg/2014/536/2022-12-05/eng (accessed 5 November 2026)
3. eCFR: 21 CFR 312.52 – Transfer of obligations to a contract research organization. https://www.ecfr.gov/current/title-21/chapter-I/subchapter-D/part-312/subpart-D/section-312.52 (accessed 5 November 2026)
4. MHRA Inspectorate Blog: Sponsor Oversight – Part 1 (26 July 2018). https://mhrainspectorate.blog.gov.uk/2018/07/26/sponsor-oversight-part-1/ (accessed 5 November 2026)
5. MHRA Inspectorate Blog: ICH E6 (R3) Good Clinical Practice (26 May 2023). https://mhrainspectorate.blog.gov.uk/2023/05/26/ich-e6-r3-good-clinical-practice/ (accessed 5 November 2026)
6. European Commission, ACT EU: Good clinical practice modernisation. https://accelerating-clinical-trials.europa.eu/our-work/good-clinical-practice-modernisation_en (accessed 5 November 2026)
7. FDA: E6(R3) Good Clinical Practice (GCP), Guidance for Industry. https://www.fda.gov/regulatory-information/search-fda-guidance-documents/e6r3-good-clinical-practice-gcp (accessed 5 November 2026)
8. eCFR: 21 CFR Part 312, Subpart D – Responsibilities of Sponsors and Investigators. https://www.ecfr.gov/current/title-21/chapter-I/subchapter-D/part-312/subpart-D (accessed 5 November 2026)
9. FDA: Warning Letter Verdure Sciences, Inc., MARCS-CMS 717259 (10 November 2025). https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/warning-letters/verdure-sciences-inc-717259-11102025 (accessed 5 November 2026)
10. EMA: Annual Report of the GCP Inspectors' Working Group 2024 (EMA/INS/GCP/37608/2025). https://www.ema.europa.eu/en/documents/report/annual-report-good-clinical-practice-inspectors-working-group-2024_en.pdf (accessed 5 November 2026)
11. FDA: Compliance Program 7348.810, Sponsors and Contract Research Organizations (15 September 2021). https://www.fda.gov/media/75916/download (accessed 5 November 2026)
12. FDA: Oversight of Clinical Investigations – A Risk-Based Approach to Monitoring (2013). https://www.fda.gov/media/116754/download (accessed 5 November 2026)
13. FDA: A Risk-Based Approach to Monitoring of Clinical Investigations – Questions and Answers (April 2023). https://www.fda.gov/media/121479/download (accessed 5 November 2026)
14. EMA: Reflection paper on risk based quality management in clinical trials (2013). https://www.ema.europa.eu/en/documents/scientific-guideline/reflection-paper-risk-based-quality-management-clinical-trials_en.pdf (accessed 5 November 2026)
15. Docuply: ICH E6(R3) Inspection Readiness for sponsors. https://docuply.io/en/ich-e6-r3-inspection-readiness-sponsors/ (accessed 5 November 2026)
16. MHRA Inspectorate Blog: Sponsor Oversight – Part 2 (25 September 2018). https://mhrainspectorate.blog.gov.uk/2018/09/25/sponsor-oversight-part-2 (accessed 5 November 2026)
17. MHRA: GCP Inspections Metrics Report, 1 April 2018 – 31 March 2019 (12 February 2021). https://assets.publishing.service.gov.uk/media/602a8e3cd3bf7f03190cbe43/GCP_INSPECTIONS_METRICS_2018-2019_final_12-02-21.pdf (accessed 5 November 2026)
18. ECA Academy: MHRA's GCP Inspection Metrics (summary of the MHRA 2019/2020 report). https://www.gmp-compliance.org/gmp-news/mhras-gcp-inspection-metrics (accessed 5 November 2026)
19. FDA: Warning Letter Applied Therapeutics, Inc., MARCS-CMS 696833 (dated 27 November 2024). https://www.fda.gov/inspections-compliance-enforcement-and-criminal-investigations/warning-letters/applied-therapeutics-inc-696833-12032024 (accessed 5 November 2026)
20. MHRA: Clinical trials for medicines: compliance with ICH E6 good clinical practice in the United Kingdom (2026). https://www.gov.uk/guidance/clinical-trials-for-medicines-compliance-with-ich-e6-good-clinical-practice-gcp-in-the-united-kingdom (accessed 5 November 2026)
21. Docuply: Supplier Management. https://docuply.io/en/supplier-management/ (accessed 5 November 2026)
22. Therapeutic Innovation & Regulatory Science: Descriptive Analysis of Good Clinical Practice Inspection Findings from U.S. Food and Drug Administration and European Medicines Agency (2022). https://link.springer.com/article/10.1007/s43441-022-00417-w (accessed 5 November 2026)