How should a sponsor oversee a CRO it has contracted to run a trial?

Short answer

Write down exactly which activities move to the CRO, check that it is qualified before selecting it, and then oversee its work in proportion to risk through agreed metrics, reviews of its outputs and escalation routes. In the EU and under E6(R3), the sponsor keeps ultimate responsibility for the trial.

Why

E6(R3) lets a sponsor transfer any or all trial activities, but says ultimate responsibility for participants' safety and the reliability of the data stays with the sponsor. EU Article 71 says the same. US law is slightly different: under 21 CFR 312.52 a contract research organization that assumes an obligation in writing becomes subject to the same regulatory action as a sponsor for that obligation, and any obligation not described in writing stays with the sponsor.

So the contract is not paperwork, it is the map of duties. Good oversight starts with selection: quality system, experience with the indication, and audit history. Then it continues through the trial: monitoring report review, key metrics such as query ageing and SAE timeliness, access to systems and data, governance meetings, and audits of high risk activities.

Subcontracting by the CRO must also be visible to the sponsor. The level of oversight should follow risk. A CRO running randomization for a pivotal trial needs closer attention than one archiving paper files.

How to work it through

Define each transferred activity in the agreement, including subcontracting rules.
Assess the CRO's qualifications, quality system and audit history before selection.
Agree measurable indicators tied to critical to quality factors, such as SAE timeliness and important deviation rates.
Review the CRO's key outputs, for example a sample of monitoring reports, rather than only its summaries.
Hold regular governance meetings with a clear escalation path for issues.
Audit the highest risk activities and record oversight decisions in the trial master file.

An example

A biotech transfers monitoring, data management and safety processing for a 300 participant phase 2 trial. The contract lists 14 activities and requires notice before any subcontracting. Monthly, the sponsor reviews 10 percent of monitoring reports and tracks SAE forwarding time, targeted at 24 hours.

In month 5 the median rises to 3 days at one country team. Escalation finds staff turnover, the CRO adds trained staff, and an audit in month 7 confirms the fix. Each step is filed as oversight evidence.

Where the answer stops holding

Oversight intensity must match the sponsor's own capacity, and a very small sponsor may rely more heavily on audits and metrics than on direct review. Indicators can be gamed or can lag real problems, so metrics alone are not oversight. The US and EU differ in how far a written transfer moves legal liability, so legal advice may be needed for contracts.

A strong answer covers

Written transfer of specific activities
Ultimate responsibility stays with the sponsor under E6(R3) and EU law
US 21 CFR 312.52 nuance on CRO liability
Risk based metrics plus direct review of outputs
Visibility of subcontracting and documented oversight

Common mistakes

Believing outsourcing transfers responsibility for trial quality.
Overseeing only through the CRO's own dashboards.
Leaving activities out of the contract and assuming the CRO will cover them.

The interviewer might ask next

What would you do if the CRO's metrics looked good but an audit found serious problems?