{
"slug": "cross-boundary-oversight-chain",
"topic_id": "TOPIC-124",
"cluster": "Pharma, Biotech & Clinical Trial GxP Identity",
"tier": "Tier B",
"title": "Sponsor oversight across the CRO and CDMO boundary: delegation an inspector can verify",
"summary": "Regulators hold sponsors accountable for delegated GxP activities. The partner's audit trail names the partner's employees, is written by the partner's software, and cannot be verified by the sponsor without an audit visit.",
"lede": "Outsourcing moves the work. It does not move the liability. A sponsor remains answerable for decisions taken inside a partner's quality system, and the evidence supporting that answer currently consists of a quality agreement, an annual audit report and a set of monthly meeting minutes.",
"date": "2024-02-20",
"category": "Compliance",
"author_id": "tobias-lindqvist-rao",
"tags": [
"CRO",
"CDMO",
"sponsor oversight",
"quality agreement",
"outsourcing",
"ICH Q10"
],
"image": "https://cdn.twc.sh/images/igcache/Cross%20Boundary%20Oversight%20Chain/1500_900/blog.jpg",
"schema": "Article",
"key_takeaways": [
"Quality agreements allocate responsibility contractually. No system enforces that allocation, so oversight is evidenced by periodic sampling rather than per-decision proof.",
"A cross-boundary delegation names a sponsor human, a partner human, a decision class and an expiry — and verifies without either party accessing the other's systems.",
"The commercial objection from partners is real and should be addressed directly rather than assumed away."
],
"body": [
{
"type": "h2",
"text": "The protocol problem, stated in engineering terms"
},
{
"type": "diagram",
"kind": "flow",
"alt": "Accountability stays with the sponsor; evidence stays with the partner",
"caption": "The delegation is contractual. The evidence is not portable.",
"nodes": [
{
"label": "Sponsor delegates an activity",
"note": "contract"
},
{
"label": "Partner performs it",
"note": "their systems, their staff"
},
{
"label": "Audit trail written by the partner",
"note": "about themselves",
"bad": true
},
{
"label": "Inspector asks the sponsor",
"note": "accountability did not transfer",
"bad": true
}
]
},
{
"type": "p",
"html": "Two organisations need to establish that a decision taken by a human in organisation B was authorised by a human in organisation A, and that a third party — a regulator — can verify this without access to either organisation's infrastructure."
},
{
"type": "p",
"html": "Stated that way it is a familiar distributed-systems problem with a familiar solution: a signed capability, issued by A, presented by B, verifiable by anyone holding A's public key. What makes it unusual is that the industry has solved it with paper instead."
},
{
"type": "h2",
"text": "What exists today"
},
{
"type": "table",
"head": [
"Artefact",
"What it establishes",
"What it cannot establish"
],
"rows": [
[
"Quality agreement",
"Which party is responsible for which activity",
"That a specific decision was taken within that allocation"
],
[
"Annual audit report",
"That the partner's system met expectations on the audit dates",
"Anything about the 360 days not sampled"
],
[
"Person in plant",
"Continuous presence of a sponsor representative",
"Only available for the largest relationships; does not scale"
],
[
"Monthly quality review",
"That issues were discussed",
"No binding to individual decisions"
]
]
},
{
"type": "p",
"html": "Each of these is useful. None of them is per-decision, and per-decision is what a regulator asks about when a specific batch or a specific deviation is in question."
},
{
"type": "h2",
"text": "The Cross-Boundary Oversight Chain"
},
{
"type": "p",
"html": "Three objects, each signed, each verifiable independently."
},
{
"type": "ol",
"items": [
"The authority grant. A named sponsor quality officer signs a delegation: decision class (for example, minor deviation closure for product X), value or severity ceiling, validity period, and the named partner individuals it applies to.",
"The decision. The partner's named individual signs a canonical statement of the decision, referencing the delegation.",
"The escalation. Decisions outside the delegated scope produce no valid signature. The partner must obtain a fresh, narrower grant — which is the escalation the quality agreement already requires and which is currently enforced by memory."
]
},
{
"type": "p",
"html": "The chain verifies to a sponsor human. A regulator can check it holding only published keys. Neither party needs an account on the other's system, which is what makes this deployable across a supplier base of dozens."
},
{
"type": "h2",
"text": "Worked example: a CDMO batch disposition"
},
{
"type": "code",
"text": "delegation:\n issuer: [sponsor QA head, hardware credential]\n delegate: [CDMO QA manager, named]\n scope: disposition_decision, product=[X], site=[Y]\n limits: minor_deviation_only, max_batches=unbounded\n notAfter: [12 months]\n depth: 1 # may not be re-delegated\n\ndecision:\n actor: [CDMO QA manager, hardware credential]\n under: [delegation reference]\n render: [\"Batch [id] disposition: released\",\n \"Deviations: [n] minor, 0 major\",\n \"Basis: [investigation refs]\"]"
},
{
"type": "p",
"html": "Note depth: 1. Sub-delegation is the mechanism by which oversight silently evaporates in a multi-tier supply chain, and it is far easier to bound it cryptographically than to police it contractually."
},
{
"type": "h2",
"text": "The objection you will actually hear"
},
{
"type": "p",
"html": "Partners will not object on technical grounds. They will object on commercial ones: producing externally verifiable records of internal decisions creates exposure they have not priced, and sets a precedent every other client will demand."
},
{
"type": "p",
"html": "That objection deserves a straight answer rather than a workaround. Three points usually land:"
},
{
"type": "ul",
"items": [
"The record protects the partner too. In a dispute about whether a decision was within scope, the partner currently has the same evidentiary problem the sponsor does.",
"It reduces audit burden. A partner that can demonstrate per-decision authority is a partner that spends fewer days per year hosting audits.",
"It is a differentiator in competitive tenders, and the first CDMO in a therapeutic area to offer it will say so in every bid."
]
},
{
"type": "h2",
"text": "Where to start, given a supplier base of forty"
},
{
"type": "p",
"html": "Do not attempt the whole base. Rank suppliers by the product of two factors: the consequence of a decision taken badly, and the frequency with which decisions are delegated. Start with the top two. Run a year. Publish the audit-day reduction internally."
},
{
"type": "p",
"html": "If there is no audit-day reduction, the control has not paid for itself and you should say so. That is the falsification condition, and it is worth agreeing on it before the pilot rather than after."
},
{
"type": "h2",
"text": "What a sponsor can realistically ask for"
},
{
"type": "table",
"caption": "Evidence options across the boundary",
"head": [
"Option",
"Practicality"
],
"rows": [
[
"Full audit trail access",
"Rarely granted; contains other sponsors' data"
],
[
"Periodic audit",
"Point in time, expensive, not per-activity"
],
[
"Contractual attestation",
"What happens today — a statement"
],
[
"Receipts for defined decision points",
"Bounded, portable, verifiable by the sponsor"
]
]
},
{
"type": "h2",
"text": "Objections and honest limits"
},
{
"type": "p",
"html": "“The quality agreement covers this.” It allocates responsibility and specifies what the partner must do. It does not make any specific act verifiable by the sponsor."
},
{
"type": "p",
"html": "“Partners will not instrument for us.” Some will not. Ask for a bounded set — batch certification, deviation approval, critical process decisions — rather than general logging, and the conversation changes."
}
],
"faq": [
{
"q": "Does this replace auditing?",
"a": "No. Audits assess systems, culture and capability, none of which a signed decision record addresses. The claim is narrower: per-decision authority becomes verifiable between audits."
},
{
"q": "What if the partner refuses?",
"a": "Then you know something about the relationship. More constructively, most refusals soften when the reciprocal benefit and the audit-burden reduction are quantified in the next contract negotiation."
},
{
"q": "Does this require systems integration?",
"a": "No, and that is the design goal. Verification uses published keys; neither party grants the other access to its quality system."
},
{
"q": "How does it interact with ICH Q10?",
"a": "Q10 expects the pharmaceutical quality system to extend across outsourced activities. This provides an evidence mechanism for that extension; it does not alter the obligation."
},
{
"q": "Does a quality agreement solve this?",
"a": "It allocates responsibility. It does not make any specific act verifiable by the sponsor."
},
{
"q": "Why won't partners share audit trails?",
"a": "They contain other sponsors' data, reveal their systems, and extraction is unfunded work. The refusal is usually reasonable."
},
{
"q": "What is a realistic ask?",
"a": "Receipts at a defined set of decision points — batch certification, deviation approval, critical process decisions — rather than general logging."
}
],
"sources": [
{
"t": "ICH Q10 — Pharmaceutical Quality System",
"u": "https://www.ich.org/page/quality-guidelines"
},
{
"t": "EudraLex Volume 4 — EU GMP guidelines",
"u": "https://health.ec.europa.eu/medicinal-products/eudralex/eudralex-volume-4_en"
},
{
"t": "ICH E6(R3) Good Clinical Practice",
"u": "https://www.ich.org/page/efficacy-guidelines"
},
{
"t": "21 CFR 211.22 — Responsibilities of the quality control unit",
"u": "https://www.ecfr.gov/current/title-21/chapter-I/subchapter-C/part-211/subpart-B/section-211.22"
}
],
"related": [
{
"slug": "dual-principal-econsent",
"title": "Remote eConsent under ICH E6(R3)",
"category": "Developer"
},
{
"slug": "qp-certification-receipt",
"title": "The QP certification nobody can verify",
"category": "Compliance"
},
{
"slug": "cross-boundary-cui-access",
"title": "Who touched the CUI?",
"category": "Compliance"
}
],
"wordcount": 961,
"url": "/blog/cross-boundary-oversight-chain.html",
"reading_time": "4 min read",
"image_title": "Cross Boundary Oversight Chain",
"seo_title": "Sponsor oversight across CRO and CDMO boundaries",
"meta_description": "Regulators hold sponsors accountable for delegated GxP work. The partner's audit trail names the partner's staff in the partner's systems.",
"hub": {
"slug": "topics/gxp-identity",
"title": "Pharma and GxP identity"
},
"answer": "It cannot, from the partner's records alone. Regulators hold sponsors accountable for delegated GxP activities, and the partner's audit trail names the partner's employees, is written by the partner's systems and is produced by the party whose performance is in question.",
"answer_q": "How does a sponsor evidence oversight across a CRO or CDMO boundary?",
"glossary": [
{
"term": "CRO / CDMO",
"def": "Contract research and contract development and manufacturing organisations performing delegated GxP activities."
},
{
"term": "Quality agreement",
"def": "The document allocating GxP responsibilities between sponsor and partner."
},
{
"term": "Delegated activity",
"def": "Work performed by a partner for which the sponsor remains accountable to the regulator."
}
],
"checklist": {
"title": "Negotiating cross-boundary oversight",
"id": "boundary",
"desc": "Four steps.",
"steps": [
{
"name": "Define the decision points you need evidence for.",
"text": "A short list, not general logging."
},
{
"name": "Ask for receipts at those points only.",
"text": "Bounded asks get agreed."
},
{
"name": "Require verification without contacting the partner.",
"text": "So evidence survives the relationship."
},
{
"name": "Put retention in the quality agreement.",
"text": "Matching your regulatory period, not their policy."
}
]
},
"cta": {
"title": "Where this fits in Manav",
"html": "Manav binds the signer to the exact record being certified, on a credential under their sole control, and produces a receipt an inspector or a partner can verify without access to the originating system.",
"href": "../docs.html",
"label": "See signature binding"
}
}