Sponsor Oversight of CROs and Vendors: FDA BIMO and EMA GCP Inspection Findings

Sponsor oversight of CROs and vendors: what FDA BIMO and EMA GCP inspections have cited

FDA Bioresearch Monitoring (BIMO) inspections and EMA-requested GCP inspections apply the same accountability principle, with different regulatory consequences. A sponsor can outsource trial activities, but it cannot outsource accountability for them. Across FDA warning letters, Form FDA 483 observations in Drugs@FDA clinical inspection summaries, and GCP inspection outcomes reported in EPARs, the oversight findings fall into a small number of recurring patterns:

• Transfers of obligations that were missing, undocumented or unreported, or that the sponsor wrongly assumed had taken place.
• Monitoring delegated to a CRO without the sponsor checking that it actually happened, or that it worked.
• Sponsors that failed to act when CRO monitors reported investigator noncompliance.
• Weak oversight of data management, randomization and other system vendors, including subcontractors.
• Oversight failures serious enough that, in the EU, regulators treated pivotal data as unreliable, a heavier consequence than a citation.

The regulatory baseline: delegation without abdication

ICH E6(R3) lets a sponsor transfer trial-related activities to a CRO or other service provider. The sponsor cannot transfer ultimate responsibility for participant protection or data reliability, and any activity not specifically transferred stays with the sponsor ⁵⁰⁵¹. The guideline expects the sponsor to:

• record transferred activities in an agreement and select capable providers ⁵⁰⁵²
• have access to provider SOPs and performance metrics ⁵³
• oversee important transferred activities, including activities the provider subcontracts further ⁵³

Under US drug regulations, FDA has repeatedly said that monitoring may be transferred to a CRO only if the transfer is described in writing under 21 CFR 312.52 ^29820299. A CRO that assumes sponsor obligations faces the same regulatory action as a sponsor if it fails to perform them ²⁹⁴²⁹⁵. The device framework differs: FDA's BIMO compliance program notes that the device regulations do not provide for transfers of sponsor obligations to CROs ²⁸³. In device warning letters FDA has stated that monitoring may be delegated, but the sponsor remains ultimately responsible for it ¹⁸⁵.

How inspectors evaluate oversight

FDA. Compliance Program 7348.810, Sponsors, Contract Research Organizations and Monitors, directs investigators to evaluate how the sponsor oversees outsourced services. The focus is on services that are critical to efficacy or safety data, or that are linked to significant regulatory deviations ²⁸⁰²⁸¹. Investigators check:

• whether the sponsor has criteria for selecting CROs and vendors, including an assessment of their ability to comply with FDA regulations and GCP ²⁸²
• whether agreements define roles and regulatory responsibilities ²⁸²
• the written transfer-of-obligations documents, and whether the required statement was submitted to FDA. Unreported transfers are documented ²⁸³.

The program names site monitoring as a critical outsourced service ²⁸⁴.

EU. EudraLex Volume 10 describes sponsor and CRO inspections as either system inspections or trial-specific inspections ²¹²²²⁸. Inspectors examine:

• procedures for selecting and continually assessing contractors and subcontractors ²²⁹²³⁰
• documentation of which duties were delegated, and when ²²⁹²³⁰
• how trial-related work done by contractors and subcontractors is overseen, and a sample of contracts ²³⁰²³¹
• the audit program for contractors, and the sponsor's or CRO's review of monitoring reports ²³²²³³

Findings are graded critical, major or minor, and the inspection report gives an overall conclusion on GCP acceptability ²³⁴²²³.

FDA BIMO findings

1. Transfers of obligations that were missing, undocumented or unreported

• Verdure Sciences (warning letter, November 10, 2025). Verdure argued that its clinical study agreement had transferred sponsor obligations to a third-party vendor. FDA disagreed. The agreement named Verdure as "Sponsor" and the vendor as "Service Provider," and it did not specify any transferred obligations. A clause requiring the vendor to follow the protocol and applicable law was not enough to transfer them. Verdure therefore remained responsible for having an IND in effect, which it did not ²⁹⁶²⁹⁷.
• ICON Clinical Research (warning letter, November 27, 2009). The contracts transferred site monitoring, protocol-violation tracking and source-document verification to the CRO. FDA cited the CRO directly under 21 CFR 312.50, 312.52 and 312.56(a) ²⁹⁴²⁹⁵.
• Angela D. Ritter, M.D. (warning letter, June 7, 2024). In an expanded-access setting, the sponsor-investigator said she had relied on a CRO for IND maintenance, FDA correspondence, IRB submissions and annual reports. FDA held that she remained ultimately responsible for oversight and compliance ^{315316319320321}.
• DOTAREM (clinical inspection summary). A problem with the transfer-of-obligations notification was discussed verbally with the sponsor but was not cited on a Form FDA 483 ³⁶⁹. Transfer documentation is checked even when it does not produce a written observation.

2. Monitoring delegated, but not overseen

• Johnson & Johnson PRD (warning letter, August 10, 2009). J&J contracted out monitoring visits, but FDA found the sites were not adequately monitored. Monitors missed drug-accountability and case-history deficiencies, including records showing study drug given to different subjects at exactly the same time ²¹.
• Pfizer (warning letter, April 9, 2010). FDA cited a repeat failure to ensure proper monitoring. Widespread overdosing across sites went undetected and uncorrected ³¹².
• TCA Cellular Therapy (warning letter, August 15, 2011). The contracted monitor stopped performing. The sponsor later found that the last monitoring visit had taken place in August 2008 ³¹³³¹⁴.
• FIRDAPSE (NDA 208078). After CRO monitoring responsibility changed hands, neither the sponsor nor the CRO made a monitoring visit for at least a year ³⁶⁰.
• SUBLOCADE (NDA 209819). Most obligations had been transferred to a CRO. The sponsor still failed to perform the monitoring-oversight functions it had kept under its own plan, and inadequate drug accountability went undetected until after closeout ³⁶³.
• NUPLAZID (NDA 207318). The sponsor gave its CRO a complete, final monitoring plan only after sites had been initiated and subjects enrolled ³⁵⁷.
• AMZEEQ (NDA 212379). The sponsor relied on the CRO's SOPs for monitoring, and monitors missed significant site noncompliance ³⁶¹³⁶².
• Device sponsors.
  • Orthometrix: a contracted monitor overlooked eligibility miscalculations, and FDA asked for a corrective-action plan from the sponsor ¹⁸⁷¹⁸⁸.
  • Silimed: the plan named a central monitor who had made no on-site visit since 2003 and had delegated audits to regional CRAs without documentation ¹⁸⁹.
  • Alan L. Schneider, M.D.: FDA rejected a proposal to use an outside monitoring group that came with no qualification procedure and no oversight plan ¹⁸⁵.

3. Not acting on what CRO monitors reported

FDA treats a sponsor's failure to act on CRO-identified problems as a failure to secure investigator compliance:

• Rezurock (NDA 214783). Kadmon received a Form 483 for not bringing a noncompliant site into compliance promptly. Twenty-one of 24 interim monitoring reports showed inadequate oversight, including missing source data, unassessed adverse events and unreported deviations ¹³³.
• Poteligeo (BLA 761051). The CRO monitor had flagged problems with investigator oversight, delegation logs and source-data verification. The sponsor received a 483 for not bringing the persistently noncompliant site into compliance or terminating it ¹³⁵.
• Kyprolis (NDA 202714). The sponsor's procedures for reviewing CRO-identified protocol deviations, and for handling repeated deviations reported by monitors, were inadequate ³⁵⁸.
• Duavee (NDA 022247). Pfizer was classified VAI for delays in bringing investigators into compliance and in reviewing site monitoring reports. The CRO was classified NAI ¹³⁹.
• Device sponsors. Orthocon kept working with an investigator who had enrolled ineligible subjects after CRO visits documented the problem ¹⁸⁶. BSD Medical brought in a CRO to supplement monitoring but still did not resolve a noncompliant investigator's deviations ¹⁹⁰¹⁹¹.

4. Data, randomization and system vendors

Several clinical inspection summaries trace data problems to vendors:

• Rezurock. A data-management CRO made dataset-export errors ¹³⁴.
• Goprelto (NDA 209963). A CRO transposed the 4% and 8% dose groups in the NDA data. The sponsor found and corrected the error ¹³⁷.
• Trulance (NDA 208745). A CRO's eligibility portal miscalculated around daylight-saving time, and data-system problems led the sponsor to migrate to another CRO's system ¹³⁸.
• Praluent (BLA 125559). Randomization and titration errors required corrective and preventive action by the sponsor and its vendors ¹³⁰.

In these cases the sponsor's detection and correction appear to have supported data acceptability. That outcome depends on oversight being able to catch the error.

5. Substituting other bodies for sponsor monitoring

FDA has rejected reliance on bodies that cannot take over the sponsor's monitoring duties:

• Oeyama-Moto (2016). The sponsor pointed to IRB minutes; FDA said an IRB cannot assume the monitoring responsibility ²⁰.
• Henry Lin, M.D. (2010). FDA found that the DSMB documents addressed adverse events, not protocol compliance ¹⁹.
• CXL-USA (2015) and Thomas Tooma, M.D. (2015). Site "self-monitoring" and reliance on surgeons were not accepted as monitoring ²⁹⁸²⁹⁹.

What adequate oversight looked like

Clinical inspection summaries also record positive outcomes:

• Besremi (BLA 761166). The sponsor's monitoring plan and trial oversight were adequate ¹²⁸.
• Triferic (NDA 206317). The CRO's oversight was found generally adequate after its audits led to two noncompliant sites being discontinued ¹²⁹.
• Signifor LAR (NDA 203255). The CRO was classified NAI ¹²⁷.

EMA GCP inspection findings reported in EPARs

The EU findings show the same failure modes. The EPARs often report the consequence for the assessment directly.

Cross-cutting lessons for sponsors

• Write down the transfer, and report it where required. Inspectors read the agreements. A "service provider" clause did not transfer sponsor obligations in the Verdure letter ²⁹⁶²⁹⁷, and FDA investigators document unreported transfers ²⁸³.
• Keep retained functions visible. SUBLOCADE and Ritter show that when most obligations go to a CRO, the obligations the sponsor keeps are the ones most likely to lapse ³⁶³³¹⁹.
• Treat changes of CRO or monitor as high-risk events. The FIRDAPSE and TCA findings both followed a change or loss of the monitoring provider ³⁶⁰³¹⁴.
• Act on monitoring reports. Several 483s were issued even though the CRO had correctly identified the problem; the sponsor simply did not escalate or close the site ^133135186.
• Extend oversight to subcontractors and system vendors. ICH E6(R3) expects this ⁵³. EU inspectors graded its absence as a major finding in Ranluspec ²⁵⁵, and EudraLex Volume 10 makes subcontractor assessment an explicit inspection subject ²²⁹²³⁰.
• Expect different consequences in each jurisdiction. In the FDA material reviewed here, oversight failures often led to warning letters or 483s while the data were still accepted ¹³²¹³³. In several EPARs, though not all, the same kind of failure led CHMP to treat pivotal data as unreliable ^156163151260.

Many of the FDA warning letters that directly address CRO monitoring date from 2005 to 2016 and were issued under 21 CFR Part 312 and earlier versions of ICH E6, not E6(R3). More recent sponsor-oversight findings appear mainly as 483 observations in clinical inspection summaries. Useful follow-up questions for Rhizome include how often these findings cluster by therapeutic area or application type, how inspectors handled transfer-of-obligations statements for specific products, and how sponsor responses were evaluated in particular closeout letters.