ICH in Focus: ICH E6(R2): What Does Third-Party Oversight Mean for Investigators, Sponsors, and CROs?

Madeleine Kennedy headshot

Madeleine Kennedy, Syneos Health

Over the past 20 years, the outsourcing of research and development (R&D) has become increasingly prevalent. The regulatory impact of this trend is reflected in the ICH Guideline E6(R2) from the International Council for Harmonization, in that several addenda have been made under the “Investigator” and “Sponsor” sections of the guideline. In this column, we will examine these updates and suggest ways that investigators, sponsors, and contract research organizations (CROs) can implement these changes.

Investigator Oversight of Third Parties

ICH E6(R2) addresses investigator oversight responsibilities of third parties in Addendum 4.2.6:

“If the investigator/institution retains the services of any individual or party to perform trial-related duties and functions, the investigator/institution should ensure this individual or party is qualified to perform those trial-related duties and functions and should implement procedures to ensure the integrity of the trial-related duties and functions performed and any data generated.”

To comply with this new requirement, investigators/institutions should retain in their files evidence that the third parties are qualified to assume responsibilities for the specific study and the contractual agreements with the third parties. Where the third parties are individuals, these should be listed in the site’s delegation of authority log. Where the third parties are entities (e.g., a pharmacy), a responsible party of that entity should be listed in the site’s delegation of authority log, and the entity should maintain its own internal delegation of authority log.

It is also essential that the third parties receive and document any study-specific training that is pertinent to their roles. Furthermore, it is not adequate for investigators/institutions to assume that the services performed by the third parties and the data generated will meet integrity expectations. The investigator/institution should put in place a process for assuring themselves of this throughout the study, and should retain evidence that the process has been followed.

In some cases, the investigator will contract with the third party, while in other cases the institution will assume the obligation. Even if the institution holds the contract, the investigator is ultimately accountable for the quality of the services being provided by any third parties on their studies.

Sponsor Oversight of CROs

Now let’s turn to sponsor oversight of CROs. Just as in the prior version of ICH E6, Section 5.2 of ICH E6(R2) addresses the fact that sponsors may transfer responsibilities to CROs, that this transfer should be in writing, and that any responsibilities not specifically transferred are retained by the sponsor. In addition, this section states that where responsibilities are delegated to CROs, the CROs are responsible for complying with all ICH requirements related to those sponsor responsibilities.

What is different in ICH E6(R2) is the additional requirement under section 5.2.2 that, “The sponsor should ensure oversight of any trial-related duties and functions carried out on its behalf, including trial-related duties and functions that are subcontracted to another party by the sponsor’s contracted CRO(s).”

Let’s examine the first part of this sentence. Similar to Addendum 4.2.6 in the “Investigator” section of the guideline, it is not sufficient for sponsors to assume that because they have subcontracted services, the services performed by their third parties are being performed according to the guideline. Sponsors need to ensure that there is appropriate oversight, and the evidence of the oversight needs to be retained.

When inspecting sponsors, regulators are increasingly assessing the sponsor’s oversight of the CROs it utilizes. The types of evidence that regulators look for include the following:

  1. Selection and qualification of the CRO to ensure that the CRO that has been selected meets the requirements of the sponsor
  2. A contractual agreement that makes clear exactly which tasks have been delegated to the CRO
  3. Ongoing oversight of the CRO to confirm throughout the study that the CRO continues to meet the sponsor’s requirements

Ongoing oversight has been handled differently across sponsors, ranging from a hands-off approach to one that can feel like micromanagement to the CRO. The challenge is finding a middle ground where the sponsor has sufficient data to be confident that it has a finger on the pulse of the services being provided by the CRO.

Many sponsors have traditionally relied on a quality plan or agreement to document quality expectations to be met by the CRO. Such plans or agreements may include, but are not limited to, reports required of the CRO, criteria for and/or frequency of communications with the sponsor, and details on the handling of escalations (e.g., regarding quality issues). However, these types of quality plans/agreements have typically been more reactive than proactive, in that their focus has been more on issue management, audits, and inspections than on proactive risk management.

Enhanced Oversight by Collaborative Quality Risk Management

ICH E6(R2) provides the perfect platform for enhancing sponsor oversight. The guideline invites sponsors to partner with their CROs early on to proactively identify the critical data and processes associated with their protocol, to assess the associated risks that will inform the cross-functional monitoring strategy, and to perform ongoing risk management throughout the study.  If these steps are performed in a collaborative and transparent manner, sponsors will benefit by having the data they need to feel confident they have adequate oversight of their CROs. It will also reassure them that the CRO is not just informing them of issues once they have occurred, but is also actively engaged in preventing the issues from occurring in the first place.

Technology can also significantly assist in enabling sponsor oversight. By using “Key Risk Indicator” dashboards and sharing the data with their sponsors, CROs can provide real-time data and evidence of proactive risk management on the study.

Impact on CRO Interactions

For quality risk management to be effective, it needs to include all functions involved in a study—beginning with investigator site selection and covering all interactions among the functions, all the way to the generation of the clinical study report. For example, data reviews by data management units will inform the monitoring performed at the investigator site and vice versa. This cross-functional approach allows the sponsor to have a holistic picture of the state of quality for the duration of the study.

As a result, if study functions are outsourced to different CROs, those CROs will need to become more comfortable sharing data from their quality risk management activities with other CROs contracted to perform different functions on the study. This might include data that a CRO previously considered proprietary (whether shared directly or indirectly through the sponsor), which will likely impact the current outsourcing model that minimizes interactions among the CROs supporting a given study.

Oversight of CRO Subcontractors

Now let’s turn to the second part of Addendum 5.2.2: “The sponsor should ensure oversight of any trial-related duties and functions carried out on its behalf, including trial-related duties and functions that are subcontracted to another party by the sponsor’s contracted CRO(s).”

In the past, it was thought to be acceptable for a sponsor not to intervene to a great extent in CRO subcontractor arrangements, since the contract was between the CRO and its subcontractor. Most sponsors limited their oversight to assuring themselves through audits that their CROs had a process in place for qualifying their subcontractors, while some went further by requiring their CROs to seek sponsor pre-approval of their third parties. This level of oversight is no longer adequate, as responsibility has been put squarely on sponsors to ensure oversight of functions that their CROs subcontract.

What does this mean? Sponsors will most likely require that all subcontractors be pre-approved by them, and they will expect to be provided with more details on the results of the qualifications performed by their CROs. They will also want evidence that the CROs are actively managing their subcontractors throughout their studies. In addition, more sponsors will likely be inserting third-party beneficiary language into agreements with their CROs, to allow the sponsors to have more direct oversight of these subcontractors.


Given the increasing prevalence of outsourcing in R&D, it is not surprising that ICH E6(R2) has addressed in more detail third-party oversight expectations of both investigators and sponsors. The addenda will result in a number of changes in contractual agreements as well as investigator, sponsor, and CRO processes that will enable effective quality risk management critical to the protection of human subjects and reliability of trial results.

Madeleine Kennedy, PhD, DBioethics, (madeleine.kennedy@incresearch.com) is senior vice president for corporate quality with INC Research/inVentiv Health.

[DOI: 10.14524/CR-17-4043]