Request a demo specialized to your need.
In 2024, an FDA Bioresearch Monitoring inspection into Applied Therapeutics found that more than 19 patients had received doses roughly 80% lower than the protocol specified, that the company had reported protocol doses as though they were the doses actually administered, and that a third-party vendor deleted electronic records and audit trails for all 47 trial participants just two days after FDA announced its inspection.
The sponsor hadn't necessarily administered a single dose incorrectly by hand. What failed was oversight of a vendor, of what that vendor was actually doing, and of whether the data coming back matched reality.
That case landed against a backdrop FDA had already been building toward. In April 2023, the agency finalized guidance on risk-based monitoring that reinforced a specific principle: sponsors may delegate trial tasks to CROs and vendors, but under ICH E6, the ultimate responsibility for data quality and integrity stays with the sponsor regardless of who's actually performing the work.
FDA's updated Sponsor and CRO Compliance Program Manual translated that principle into specific inspection focus areas and Trial Management deficiencies are already the single most common finding category for sponsor and CRO inspections, cited in FDA and EMA data with close to 90% agreement between the two agencies on how often it shows up.
Here are five specific gaps inspectors are now trained to look for, drawn from the updated BIMO manual's stated focus areas.
1. Agreements That Actually Clarify Delegated Responsibility
It's not enough that a CRO is contracted to run a trial. Inspectors look for documentation that specifically defines which responsibilities were delegated, to whom, and under what terms because a vague or generic services agreement doesn't establish that the sponsor understood, and actively managed, what it handed off.
2. Oversight Logs of Vendor and CRO Activity
A sponsor that can't produce a record of its own oversight activity check-ins, deliverable reviews, performance monitoring of the CRO itself — has no evidence that oversight happened at all, regardless of whether it actually did. Inspectors have specifically cited sponsors for missing oversight logs, not just for problems the logs would have revealed.
3. CAPA Enforcement With Vendors, Not Just Internally
A corrective and preventive action raised against a vendor is only meaningful if it's tracked to closure. Inspectors have cited sponsors for identifying an issue with a CRO's performance and then failing to confirm the corrective action was actually completed a gap between raising a concern and verifying it was resolved.
4. Current, Archived Versions of Monitoring Plans and Site Agreements
The updated BIMO manual specifically calls out that inspectors will request monitoring protocols and agreements directly. That means every version of a monitoring plan, SOP, and site agreement needs to be archived and retrievable not just the current one, but the history of how it changed.
5. Sponsor-Level TMF Completeness, Not Just Site-Level
A site's Trial Master File being in order doesn't satisfy this expectation on its own. The sponsor-level TMF the documents and records the sponsor itself is responsible for maintaining is expected to be fully current, with unfiled documents or outstanding vendor deliverables resolved or explained before an inspection, not discovered during one.
Before This Guidance vs. What's Now Specifically Checked
| Before the 2023 Update | Current BIMO Focus | |
|---|---|---|
| CRO agreements | Existence of a contract | Documentation of specifically delegated responsibilities |
| Vendor oversight | Assumed if a CRO was qualified initially | Ongoing oversight logs expected as evidence |
| CAPAs with vendors | Raised as needed | Expected to be tracked to verified closure |
| Monitoring plan versions | Current version on file | Full version history archived and retrievable |
| TMF scope | Site-level completeness | Sponsor-level completeness examined directly |
Why This Matters Beyond the Inspection Itself
The Applied Therapeutics case is extreme, but the underlying failure pattern is ordinary: a sponsor trusted a vendor's data without an independent way to verify it, and by the time the gap surfaced, records had already been altered.
Most sponsor oversight gaps never reach that level of severity but the five items above are exactly the kind of ordinary, unglamorous documentation gaps that make it hard to prove oversight happened, even in trials where nothing has actually gone wrong. Under current guidance, "we trusted our CRO" isn't a position FDA accepts as sufficient on its own.
Platforms that connect sponsor-level oversight activity to the same record as CTMS and eTMF Cloudbyz among them are generally built to keep this kind of evidence current rather than reconstructed after the fact: monitoring plan versions retained automatically, CAPA status tracked to closure rather than logged and forgotten, and TMF completeness visible at the sponsor level continuously.
Whether that fully closes the gap for a given organization depends on how consistently the workflow is used but having oversight evidence live in the system, rather than assembled before an inspection, is the practical difference between the two columns above.
See Where Your Own Oversight Evidence Currently Lives
If your sponsor-level oversight evidence CAPA status, monitoring plan history, vendor oversight logs currently lives across several disconnected files rather than one system, it's worth seeing what continuous visibility into it looks like.
Subscribe to our Newsletter
