Sponsor Oversight of Decentralized Trial Elements: FDA BIMO Findings and Guidance Expectations

Sponsor oversight of decentralized and remote trial elements: FDA BIMO findings and current guidance expectations

FDA rarely issues a warning letter that names a "decentralized clinical trial" as the violation. What the public enforcement record does show is a group of findings in the areas decentralized elements put under strain. These include electronic data held by vendors, investigational product (IP) taken at home, virtual visits used in place of protocol-required in-person visits, remote consent, and monitoring that does not catch these problems. The same themes run through FDA's current guidance framework: the final decentralized elements guidance (September 2024), ICH E6(R3) (final, September 2025), the electronic systems Q&A (October 2024), the digital health technology (DHT) guidance (December 2023), and the remote regulatory assessment (RRA) guidances (2025). The common message is that decentralizing an activity does not decentralize responsibility for it.

Key takeaways

• FDA's guidance states that the regulatory requirements for a trial do not change because it has decentralized elements ²¹⁷, and that sponsor responsibilities are the same with or without them ³⁵⁶.
• The most significant sponsor-level case is the Applied Therapeutics warning letter. A contracted vendor deleted electronic clinical outcome assessment (eCOA) data and audit trails for all 47 subjects. FDA cited the sponsor under 21 CFR 312.58 and stated that using a vendor did not remove the sponsor's oversight responsibility ^295296302.
• Investigator-level letters show the DCT-adjacent failure modes. These include at-home IP with records that could not be reconciled, found at a remote close-out visit ¹¹⁴²⁴⁸; virtual visits substituted for protocol-required in-person safety assessments ³⁵⁰³⁵¹; and telephone reconsent without signed consent forms on file ³⁵².
• BIMO inspectors are told to examine how monitoring is divided among remote, onsite, and centralized monitors. They also check whether the sponsor ran independent user acceptance testing on vendor-supplied EDC and IRT systems, and they trace IP from shipment to final disposition ^340343345.

What FDA has cited

1. Vendor-controlled electronic data and audit trails (sponsor)

Applied Therapeutics, Inc. (December 3, 2024 warning letter ⁷⁶⁷¹) is the clearest example of a sponsor oversight failure involving a remotely operated electronic system. The sponsor used Pearson's Q-global, a web-based platform, to capture eCOAs that supported the primary and secondary efficacy endpoints ²⁹⁵. Two days after FDA preannounced a clinical site inspection, a third-party vendor contracted by the sponsor deleted the Q-global data and associated audit trails for all 47 enrolled subjects across the study sites. As a result, FDA could not access, copy, or verify the records during the sponsor inspection ²⁹⁶. FDA said the loss prevented it from verifying the accuracy, consistency, and completeness of the data or assessing the impact of reported discrepancies ²⁹⁷.

The sponsor said the vendor acted without consulting it. The sponsor recovered most data from backup, but source data for 11 subjects could not be recovered electronically ²⁹⁸²⁹⁹. Its proposed corrective actions included mapping data flow and storage, backing up third-party electronic data at the sponsor, removing vendors' ability to delete files, and maintaining auditable audit trails. FDA found the response inadequate for lack of procedural detail ³⁰¹²⁹⁷. The letter states that the sponsor retains ultimate oversight of the investigation and that using a vendor did not remove that responsibility ³⁰². The regulation cited was 21 CFR 312.58 (access to, and copying and verification of, records) ²⁹⁵⁷¹.

A related investigator finding involved an e-Diary. In the warning letter to Antonio E. Blanco, M.D./Vista Health Research (September 26, 2023), a subject was randomized without the protocol-required e-Diary documentation supporting eligibility ⁷⁴⁷⁵.

2. Sponsor-investigator reliance on a partner's EDC and remote safety oversight

Amy Lightner, MD (sponsor-investigator, March 25, 2025) was cited for inadequate oversight of an industry partner's EDC system and of study-record retention ¹⁵¹⁶. During the inspection, complete source records were unavailable because the IP supplier had closed its EDC system. Files it had provided to investigators lacked source adverse event (AE) data ³⁰⁶. FDA rejected a forward-looking fix (switching to an academic EDC for future trials) because it did not explain how she would secure access to EDC systems and source records for the required retention period ³⁰⁷. FDA also found no documentation that protocol-required AE data had been sent to the independent medical monitor or the DSMB ³⁰⁸³⁰⁹. The regulations cited were 21 CFR 312.50 (sponsor monitoring), 312.57(c) (record retention), and 312.60 ^310304305.

3. At-home investigational product and accountability

Maria E. De La Torre Silva, M.D. (July 27, 2026) ran a study in which subjects received sealed kits, took the study drug at home, and were responsible for returning the kits ¹¹⁴²⁴⁶. For six subjects, three sources disagreed: subjects' self-reported doses in EDC, the site master accountability log, and EDC return records ²⁴⁷. In correspondence about a remote close-out visit, the sponsor reported that kits recorded as dispensed, with nightly doses logged, still had tamper-resistant seals on both ends ²⁴⁸. FDA stated that at-home administration did not relieve the investigator of responsibility for recording dates, quantities, and subject use. FDA cited 21 CFR 312.62(a), plus 312.60 for a separate protocol deviation ^114249250. FDA cited the inadequate records, not the remote visit itself ²⁵⁰. The sponsor detected the discrepancy at close-out, after dosing was complete, so earlier reconciliation during monitoring could have caught it sooner.

4. Virtual visits replacing protocol-required in-person visits

Mehran Michael Bahrami, M.D. (March 5, 2025) held virtual Day 3, 5, 10, and 15 visits when the protocol required in-person visits. As a result, the required vital signs, physical examinations, and safety laboratory tests were not done. FDA cited 21 CFR 312.60 ³⁵⁰³⁵¹. This is the main compliance risk in hybrid designs: a remote visit is acceptable only when the protocol allows it.

5. Remote (telephone) reconsent

Namita A. Goyal, M.D. (October 10, 2024) had IRB permission for telephone reconsent of subjects who had completed the study. Notes recorded phone reconsent, but the site could not find the corresponding dated, signed consent forms ³⁵². FDA listed it under the charge of failing to conduct the investigation according to the investigational plan, 21 CFR 312.60 ³⁵³.

6. Monitoring plans and CRO reliance

The letters below are general monitoring and CRO-reliance failures, not findings about decentralized elements. They are included as analogs: they show the oversight gaps that remote and centralized monitoring are meant to close.

• United Health Products, Inc. (March 24, 2025): no effective, implemented clinical monitoring plan, inconsistent site-initiation records, and missing interim monitoring reports. As a result, the sponsor did not detect eligibility and informed consent violations ¹³¹⁴.
• CAO Group, Inc. (October 15, 2018): failed to monitor a device investigation or secure investigator compliance ¹².
• Angela D. Ritter, M.D. (sponsor-investigator, June 7, 2024): relied on a CRO for protocol changes, FDA communications, and IRB submissions. A patient received 50 additional doses beyond the authorized expanded-access treatment without an effective amended IND. FDA stated that Ritter remained ultimately responsible ^331332333334.
• A Form 483 issued to Burzynski Research Institute (March 15, 2013) cited failure to carry out the audits required by its own monitoring plan, with inaccurate assessments for 18 of 27 subjects reviewed ^291292293.

Summary of cited deficiencies

Investigator letters are site findings, not charges against a sponsor. They matter here as failures that sponsor monitoring is expected to catch.

How BIMO inspects sponsors, CROs, and monitors

The compliance program for Sponsors, Contract Research Organizations and Monitors (CP 7348.810, September 15, 2021) ⁶² tells FDA investigators to:

• Monitoring: obtain the list of monitors, review selection criteria and qualifications, and determine how responsibilities are divided among remote, onsite, blinded, and unblinded monitors. Monitoring may be onsite, remote, or centralized, with intensity matched to risk ³⁴⁰.
• CRO transfers: review contracts and transfer-of-obligations documents, determine whether required transfer statements were submitted to FDA, and assess oversight of significant outsourced activities ³⁴¹³⁴².
• Electronic systems and vendors: examine agreements for critical system services such as EDC and IRT. For vendor-supplied systems, inspectors determine whether the sponsor did independent user acceptance testing and review testing, sign-off, go-live, change control, revalidation, patches, and training records ³⁴³³⁴⁴.
• IP accountability: trace shipment, receipt, allocation, and final disposition, including through IRT, and reconcile amounts shipped against amounts used, returned, or disposed ³⁴⁵.

The companion program for Clinical Investigators and Sponsor-Investigators (CP 7348.811, July 22, 2020) recognizes on-site, remote, and centralized monitoring. Inspectors collect monitoring logs and follow-up communications and check whether the investigator acted on monitor-identified deficiencies ⁶³⁶⁴. For sponsor-investigators, they determine whether monitoring occurred and whether a systematic, prioritized, risk-based approach was used ⁶⁵.

FDA can also use remote regulatory assessments. Under Processes and Practices Applicable to Bioresearch Monitoring Inspections (final, December 19, 2025), BIMO RRAs may include remote interactive evaluations and records requests under FD&C Act section 704(a)(4) "in advance of or in lieu of" an inspection ¹⁶⁶¹⁹³. An RRA is not itself an inspection ¹⁹⁴. Establishments using electronic systems should be ready to give FDA access to them when inspectors arrive ³²¹. The Conducting Remote Regulatory Assessments Q&A (final, June 24, 2025) separates mandatory records requests from voluntary remote interactive evaluations ^188190191. A draft guidance on remote interactive evaluations of drug manufacturing and BIMO facilities (October 26, 2023) remains not for implementation ¹⁹⁶.

What current FDA guidance expects

Conducting Clinical Trials With Decentralized Elements (final, September 18, 2024)

• Same obligations, coordinated execution. Sponsors must make sure decentralized activities are properly coordinated and that contracted networks of local health care providers (HCPs) are qualified. They must also keep records of those networks and other service providers, including roles and assigned activities ³⁵⁶.
• Investigator vs. local HCP roles. Investigators stay responsible for supervising delegated activities and for reviewing data from local HCPs. Local HCP tasks should be within ordinary clinical practice. Activities that are unique to research, or that require knowledge of the protocol or IP, belong with trained trial personnel ²¹⁸²¹⁹. Every investigator in an IND drug trial must complete Form FDA 1572 ²²⁰.
• Data management plan. Sponsors should describe data origin and flow from every source, the methods and technologies used for remote data acquisition, and the service providers involved in data handling ²⁴⁰. Records should capture visit type, location, date, and data originator. Remote personnel who enter data directly into the eCRF should be on the sponsor's authorized data originator list ²²⁶³⁶².
• Monitoring plan. Sponsors must ensure proper monitoring. The risk-based plan should cover protocol compliance, data quality and integrity, review frequency, and aspects unique to the decentralized design. FDA recommends centralized monitoring to detect data problems and potential deviations ²²⁶²⁴⁴.
• IP shipment. Sponsors should state in trial documents how IP integrity and stability, including temperature control, will be maintained during shipment ²⁴¹. Investigators must authorize release by distributors, ensure receipt, and document the return or disposal of unused product ²⁴².
• Safety. The protocol should say how AEs identified remotely will be evaluated and managed, including escalation to urgent or in-person care ²²⁴³⁶⁰.
• Electronic systems and DHTs. Systems that produce required records are subject to 21 CFR part 11. Telehealth visits must be documented in compliant systems ²²⁸. Sponsors should make sure DHTs are available and suitable for all participants, including a sponsor-provided option ³⁵⁷.
• Inspections. For an investigator-site inspection, the investigator should name a physical location and a responsible person who can facilitate access to paper or electronic records and to trial personnel interviews ²⁴⁵.

ICH E6(R3) Good Clinical Practice (final, September 8, 2025)

• A sponsor may transfer activities to service providers but retains overall responsibility for trial conduct and data integrity. Transferred activities should be documented in an agreement, and anything not transferred stays with the sponsor ³⁹⁰³⁹¹. Oversight should include QA and QC and be proportionate to complexity and risk ³⁹²¹⁰².
• Computerised systems should be fit for purpose, with risk-based validation. Sponsors should document each important system's functionality, interfaces, validation status, access controls, and security. They should implement audit trails, user management, and security proportionately ^393394395. Site-staff permissions should follow the investigator's delegations ³⁹⁶.
• The sponsor should not have exclusive control of data captured in data acquisition tools. Investigators need timely access to their participants' data and metadata ^398400401. This principle applies directly to the Applied Therapeutics and Lightner findings.
• Monitoring may combine on-site, remote, and centralized approaches. The plan should account for decentralized settings ¹⁰⁴. The draft Annex 2 (December 30, 2024) adds expectations for overseeing service providers and their essential records, and for getting timely, actionable safety information to investigators from remote visits and DHTs ^9080105.

Electronic systems and DHT guidance

• Electronic Systems, Electronic Records, and Electronic Signatures in Clinical Investigations: Q&A (final, October 1, 2024): sponsors should have access to all study-related records maintained by IT service providers, because those records may be reviewed in a sponsor inspection. FDA may inspect providers when data integrity is in doubt, regardless of any transfer of obligations ¹⁴⁶¹⁴⁹. Validation should be risk-based and preserve authenticity, integrity, and confidentiality ¹⁵³.
• Digital Health Technologies for Remote Data Acquisition in Clinical Investigations (final, December 22, 2023): DHTs must be fit for purpose, and validation should support the proposed use ¹⁴⁷¹⁵¹. DHT data and metadata should be transferred securely to a durable electronic repository. FDA treats that repository as the electronic source for inspection ¹⁵⁴¹⁵⁶.

Monitoring, CRO oversight, and remote consent

• Oversight of Clinical Investigations: A Risk-Based Approach to Monitoring (final, August 7, 2013) and its Q&A (final, April 12, 2023) support combined on-site, centralized, and remote monitoring focused on critical data and processes ^45444647. Under 21 CFR 312.52, transferring monitoring to a CRO requires a written transfer and does not remove the sponsor's duty to oversee the CRO. Ongoing review of CRO monitoring reports and metrics is recommended ⁵².
• Considerations for the Conduct of Clinical Trials of Medical Products During Major Disruptions Due to Disasters and Public Health Emergencies (2023) says remote monitoring should be documented in the same detail as on-site activity ⁵⁰⁵¹.
• Use of Electronic Informed Consent: Q&A (final, December 15, 2016): consent may be obtained remotely. If it is not personally witnessed, the system must verify the signer's identity, and the participant must receive a copy ^230233235237.

Mapping the cited failures to guidance expectations

Practical oversight points for sponsors

1. Contract for control of data. Vendor agreements for eCOA, ePRO, EDC, IRT, and DHT platforms should prohibit unilateral deletion. They should guarantee sponsor and investigator access to data and audit trails for the full retention period, and provide for FDA inspection access. These are the gaps behind the Applied Therapeutics and Lightner letters ^301307149.
2. Test vendor systems independently. BIMO inspectors ask whether the sponsor performed its own user acceptance testing and controlled changes on vendor-supplied systems ³⁴³³⁴⁴.
3. Write the data-flow map before first patient in. The DCT guidance's data management plan (data sources, remote acquisition methods, service providers) is the same artifact Applied Therapeutics proposed only after the fact ²⁴⁰³⁰¹.
4. Reconcile direct-to-patient and at-home IP during the trial, not at close-out. Use IRT and centralized monitoring to flag gaps between self-reported dosing, dispensing, and returns ³⁴⁵²²⁶.
5. Make visit modality a protocol variable. Define which visits may be remote, and monitor for unauthorized substitution of virtual visits for required in-person safety assessments ²⁴³³⁵⁰.
6. Document remote oversight as thoroughly as on-site oversight. Monitoring reports, communications with medical monitors and DSMBs, and remote monitoring activities should all leave an inspectable record ^5030864.
7. Prepare for remote assessment. FDA may request records under section 704(a)(4) before or in place of an inspection, so electronic systems should be ready for prompt, controlled FDA access ¹⁹³³²¹.