eQMS for CROs: What does GCP require of a CRO’s quality system?
Last updated: October 2026
A CRO needs its own documented quality management system. The GCP guideline ICH E6(R3) states in section 3.6.6 that service providers taking on sponsor activities should implement appropriate quality management. In the United States, 21 CFR 312.52(b) makes a CRO subject to the same regulatory action as a sponsor for every obligation it assumes in writing. GCP does not say whether that QMS should run on paper, as a hybrid or in an eQMS. What matters is that it produces robust evidence for inspections and sponsor audits: controlled SOPs, version-linked training, deviation and CAPA processes with effectiveness checks, audits, supplier qualification and a complete TMF. Inspection data from the FDA, MHRA and EMA show that these are exactly the elements most often criticised. This guide maps each typical finding to the QMS element that prevents it.
Typical inspection findings and the responsible QMS element (as of October 2026)
| Finding | Evidence | Typical root cause | Responsible QMS element |
|---|---|---|---|
| Inadequate monitoring | Most frequent sponsor/CRO observation in the FDA’s FY2024 data; 35 major/critical findings in the EMA 2024 report | No risk-based monitoring plan, no defined escalation | Monitoring SOP, RBQM process, escalation route |
| Incomplete TMF or essential documents | 41 major/critical findings (EMA 2024), the largest sub-category | No filing timelines, no documented TMF quality control | TMF SOP and TMF plan, TMF QC, document control |
| Missing or outdated SOPs | 22 major/critical findings (EMA 2024) | No periodic review, no change control | SOP and document control |
| Training not evidenced | 10 major/critical findings (EMA 2024); critical CRO finding in the MHRA 2019–2020 report | Training matrix not linked to SOP versions | Role- and study-specific training with version evidence |
| Deviations reported late or not at all | Recurring theme in FDA inspection trends | No criteria for important deviations, unclear reporting lines | Deviation process with escalation to the sponsor |
| Repeat findings | All 4 critical findings at commercial sponsors (MHRA 2019–2020) stemmed from earlier findings that had not been effectively resolved | CAPA without an effectiveness check | CAPA process with effectiveness check |
| Vendors not qualified or overseen | Named explicitly in the EMA 2024 report; FDA warning letter, 2024 | No qualification, no quality agreement, no audits | Supplier and subcontractor qualification, audit programme |
| Data integrity and system validation | 2 of 4 critical CRO findings (MHRA 2019–2020); inadequate validation of electronic systems in the FDA trends | Systems not validated, audit trails not reviewed | System inventory, risk-based validation, audit trail review |
What does ICH E6(R3) require of a CRO’s quality system?
ICH E6(R3) allows a sponsor to transfer activities to a CRO, but overall responsibility stays with the sponsor. For the activities it takes on, the CRO must run its own appropriate quality management and report relevant incidents to the sponsor. Quality processes should be risk-based and proportionate, in other words fit for purpose.
ICH E6(R3) reached ICH Step 4 on 6 January 2025. In the EU it has applied since 23 July 2025 (EMA); Annex 2 applies in the EU from 15 January 2027. The FDA published E6(R3) as final, non-binding guidance in September 2025.
The sections most relevant to a CRO’s quality system are:
- Principle 10 and section 3.6.4: activities are allocated in written agreements. Anything not explicitly transferred remains with the sponsor.
- Section 3.6.6: the CRO implements its own quality management and reports relevant incidents to the sponsor.
- Sections 3.6.7 to 3.6.9: the sponsor assesses the CRO’s suitability, should have access to its SOPs and performance metrics, and extends oversight to subcontractors.
- Section 3.6.10: quality processes must be fit for purpose. A small CRO does not need corporate bureaucracy, but it does need complete evidence.
- Section 3.10 (quality by design and RBQM): critical to quality factors are identified early, and risks are assessed, controlled, reviewed and reported. Section 3.10.1.3 describes quality tolerance limits (QTLs).
- Section 3.9: criteria for important deviations and their timely escalation.
- Section 3.11.2: independent, risk-proportionate audits.
- Section 3.12.2: root cause analysis, CAPA and confirmation that the actions are adequate.
- Principle 9 and section 4: computerised systems are validated on a risk basis, with user and access management.
In practice, RBQM means a CRO’s QMS must record study-level risk assessments, detect and report QTL breaches to the sponsor, and justify monitoring intensity. A generic SOP set without study-specific risk documentation will not suffice.
Which obligations does a CRO assume under 21 CFR 312.52?
Under 21 CFR 312.52(a), a sponsor may transfer some or all of its obligations to a CRO, but the transfer must be described in writing. Any obligation not covered by that written description is deemed not to have been transferred. For every obligation it does assume, the CRO is subject under 312.52(b) to the same regulatory action as a sponsor.
The consequence for the QMS is clear: for each sponsor and study, the CRO must be able to show which obligations it has assumed (for example monitoring, safety reporting, data management or investigator selection) and which SOPs it uses to meet them. A register of transfer-of-obligations documents is therefore part of the basic set-up. The FDA inspects CROs under compliance programme 7348.810 (version of 15 September 2021) against the same standards as sponsors.
Which findings do the FDA, MHRA and EMA raise most often at CROs?
The most frequent findings at sponsors and CROs concern monitoring, the TMF, SOPs, training records, vendor oversight and data integrity. Notably, serious findings often trace back to earlier deficiencies that were never effectively resolved. CRO-specific case numbers are small in every report and should not be over-interpreted.
FDA BIMO
In the BIMO report for fiscal year 2024, 99 sponsor/CRO inspections received a final classification: 83 no action indicated (NAI), 15 voluntary action indicated (VAI) and 1 official action indicated (OAI). The most frequent observations concerned inadequate monitoring, protocol deviations and missing IND or safety reports. A separate FDA analysis of inspection trends counts 125 sponsor inspections, 31 of which resulted in a Form FDA 483, and cites monitoring plans not being followed, late safety reporting, inadequate validation of electronic systems and protocol deviations reported late or incompletely.
A warning letter issued in November 2024 shows how seriously vendor failures are treated: after the inspection had been announced, a contracted vendor deleted eCOA data, including the audit trails, for all 47 trial participants. The letter was addressed to the sponsor.
MHRA
The MHRA’s most recent GCP inspection metrics report covers 2019–2020 (published in 2023). Of 36 inspections, 5 were of CROs; the CRO category explicitly includes providers of electronic systems. All 5 CRO inspections had at least one major finding and one had critical findings. In total, CROs received 4 critical, 25 major and 41 other findings. The critical findings concerned data integrity (including an eCRF audit trail that could not be reviewed), investigational product management and protocol compliance, partly because training on the medical monitoring plan had not been documented. At commercial sponsors, all 4 critical findings traced back to earlier findings whose CAPA had not been effective.
EMA and EU inspections
The annual reports of the EMA’s GCP Inspectors Working Group paint a consistent picture:
Findings from EU GCP inspections requested by the EMA (as of October 2026)
| Metric | 2023 | 2024 |
|---|---|---|
| Total inspections | 67 | 67 |
| of which at CROs | 1 | 5 |
| Findings reported | 720 (all grades) | 335 (major and critical only) |
| of which critical | 36 | 11 |
| Findings at CRO sites | 14 | 17 (2 critical) |
| Essential documents (TMF) | 74 | 41 |
| Monitoring | 40 | 35 |
| SOPs | 29 | 22 |
| Qualification and training | 45 | 10 |
The two years are only partly comparable because the 2024 report no longer includes minor findings. The 2024 report explicitly cites poorly documented vendor qualification and oversight, no audits of partners and vendors, and the absence of a formally documented TMF quality control process.
What are the core elements of a CRO quality system?
A GCP-compliant CRO quality system rests on six core processes: document control, training, deviation management, CAPA, audit management and supplier qualification, supported by an inventory of validated systems. Each process must not only be written down but also generate evidence in day-to-day operation. Inspectors and sponsors examine the evidence, not the intention.
SOP and document control
SOPs need a unique version, an effective date, documented approval, periodic review and change control. An SOP index showing version and review date is the minimum evidence. For every study it must be clear whether CRO or sponsor SOPs apply.
Role- and study-specific training with version evidence
A training matrix links each role to its relevant SOPs and each study to its study-specific plans. The evidence must take the form: person X was trained on SOP Y, version Z, before starting the task. Every new SOP version must automatically trigger and track retraining; this link is precisely where many paper systems fail.
Protocol deviations and escalation to the sponsor
The CRO needs criteria, agreed with the sponsor, for what counts as an important deviation (E6(R3) section 3.9), fixed reporting timelines and a deviation log for each study. Important deviations are escalated to the sponsor and analysed for patterns so that recurring causes feed into the CAPA process.
CAPA with effectiveness checks
Every CAPA needs a documented root cause analysis, named owners, deadlines and effectiveness criteria set in advance. The effectiveness check takes place after implementation and is recorded. The MHRA data show that missing effectiveness checks can turn major findings into critical ones.
Audit management
A risk-based audit plan covers internal audits of the CRO’s own processes, investigator site audits (where transferred), audits of vendors and subcontractors, and the preparation and follow-up of sponsor audits and inspections. The audit function must be independent of the activities audited (E6(R3) section 3.11.2). Small CROs often achieve this with external auditors.
Supplier and subcontractor qualification
Every GCP-relevant vendor (laboratories, eCOA, EDC and IRT providers, freelance monitors, translators) is qualified before engagement, bound by a quality agreement and periodically re-assessed. For subcontractors, the CRO also needs the sponsor’s agreement, because E6(R3) section 3.6.9 extends sponsor oversight across the whole chain.
System inventory and validation
An inventory of all GCP-relevant computerised systems, with validation status, owners and access concept, is mandatory. The EMA’s guideline on computerised systems and electronic data in clinical trials sets out the detailed expectations. A detailed vendor comparison is available in our eQMS software comparison.
Why is the TMF part of a CRO’s quality system?
The TMF is the evidence that a trial was conducted in line with GCP, which makes it inseparable from the QMS. The EMA TMF guideline requires the QMS of the sponsor and of any CRO to include procedures covering every aspect of the TMF. Centrally held systems such as SOP management, training records and validation documentation are themselves considered part of the TMF.
The guideline (EMA/INS/GCP/856758/2018) makes this concrete in several places:
- Section 3.2: the contract between sponsor and CRO should specify which procedures apply and what training is required.
- Section 3.4: central systems such as SOP management, central training records, delegation logs and software validation records form part of the TMF, and their number should be kept to a minimum.
- Section 4.1.2: the controls expected of an eTMF also apply to SOP management systems.
- Section 6.3: SOPs and training records are retained for as long as the trial documents they relate to.
EU Regulation 536/2014 requires in Article 57 that the TMF contains the essential documents at all times, and in Article 58 that it is archived for at least 25 years with every change remaining traceable.
What inspectors therefore follow is the chain: which SOP version applied when an activity took place, was the person carrying it out trained on it, and is the resulting document filed in the TMF completely and on time? Where the SOP system, training records and TMF are kept separately, this chain has to be rebuilt by hand, often during the inspection itself.
Integrated platform or best-of-breed?
Both architectures can be GCP-compliant. An integrated, pre-validated platform reduces the number of TMF-relevant systems, as the EMA guideline recommends, and links SOP versions, training and TMF documents within a single audit trail. Best-of-breed tools often offer more functional depth in each area and combine more easily with an eTMF mandated by the sponsor, but they require validated interfaces and documented reconciliation between systems.
Conclusion by segment: a small CRO that maintains the TMF itself usually benefits from integration, because the effort of producing evidence falls. Where a CRO mainly works in the sponsor’s eTMF, a lean eQMS with a clearly documented interface is often the better choice. An overview of eTMF systems is available in the eTMF software comparison; the distinction from document management systems is explained on the eDMS page.
What does a sponsor check in a CRO qualification audit?
A sponsor checks whether the CRO can deliver the activities to be transferred with a working QMS, qualified staff and validated systems. The basis is the oversight duties in ICH E6(R3) sections 3.6.7 to 3.6.9 and, for US studies, the criteria of FDA compliance programme 7348.810. A CRO should be able to produce the necessary evidence at any time, not only once the audit has been announced.
A typical audit scope covers:
- organisation, responsibilities and independence of the QA function
- SOP index, current versions and review history
- CVs, job descriptions and training records of the staff to be assigned
- deviation and CAPA process, with examples and effectiveness checks
- internal audit programme and results
- list of qualified vendors and subcontractors with quality agreements
- system inventory, validation documentation and the concept for segregating data between sponsors
- inspection history and handling of findings
- data protection, business continuity and archiving for at least 25 years
- performance metrics, for example on reporting timelines, TMF completeness and CAPA cycle times
An “audit-ready pack” has proved its worth: a permanently up-to-date folder containing the quality manual, SOP index, organisation chart, training overview, vendor list, system inventory and metrics.
Paper, hybrid or eQMS: what suits a small CRO?
GCP does not require an eQMS. A paper-based or hybrid QMS is acceptable as long as it produces the same evidence. As the number of sponsors, parallel studies and SOP versions grows, however, so does the manual effort needed to keep the chain from SOP to training to TMF intact. This threshold is a practical judgement, not a regulatory requirement.
21 CFR Part 11 and EU GMP Annex 11
If an eQMS holds records required under FDA regulations, for example for studies under a US IND, 21 CFR Part 11 applies. Its requirements include system validation (11.10(a)) and secure, computer-generated, time-stamped audit trails (11.10(e)). Part 11 does not apply to EU-only studies, but E6(R3) section 4 and the EMA guideline on computerised systems expect comparable controls. EU GMP Annex 11 is a GMP requirement but is often used as a reference in practice; the 2011 version remains in force, and a 2025 revision draft has not yet been adopted. More on this on the Part 11 page.
Validation effort: CSV and CSA
Traditional computer system validation (CSV) tests comprehensively and with scripts. Computer software assurance (CSA) sets the depth of testing according to risk. The final FDA CSA guidance of September 2025 formally applies to production and quality system software of medical device manufacturers, not to GCP. Its risk-based approach does, however, align with E6(R3) principle 9. For small CROs, a pre-validated system with a supplier validation pack reduces their own effort to risk assessment, configuration verification and acceptance.
Segregating data across multiple sponsors
A CRO working for several sponsors must ensure that trial data, study-specific documents and audit reports are visible only to authorised users. This requires role- and study-based access rights, an audit trail that also covers read access to sensitive areas, and a documented access concept that can be shown to sponsors during audits.
When should a CRO introduce an eQMS?
Ideally early enough to have several months of operational evidence before the first sponsor audit: trained staff, closed CAPAs and a completed internal audit. A system introduced just before the audit demonstrates processes, but not processes that are actually lived.
Decision guide by starting point
- One sponsor, one study, a small team: a well-controlled paper or hybrid QMS can be sufficient, provided training is recorded against exact SOP versions.
- Several sponsors or parallel studies: an eQMS with data segregation and automatic retraining on new SOP versions markedly reduces the risk of gaps.
- Studies under a US IND with required electronic records: Part 11 controls are mandatory, so a validated system is effectively necessary.
- The CRO maintains the TMF itself: the link between QMS and eTMF becomes inspection-relevant; consider an integrated solution.
- The CRO works in the sponsor’s eTMF: a lean eQMS plus clearly documented interfaces and responsibilities.
- First sponsor audit on the horizon: introduce the system now and schedule an internal audit before the sponsor audit.
Frequently asked questions
Which eQMS suits small CROs?
A suitable system covers SOP control, version-linked training records, deviation management, CAPA with effectiveness checks, audit management and supplier qualification. It should be able to segregate data for several sponsors, meet Part 11 controls for US studies and be implementable with a manageable validation effort. GCP does not prescribe any particular product.
Does a CRO need its own QMS, or is the sponsor’s enough?
The CRO needs its own QMS. ICH E6(R3) section 3.6.6 requires service providers to run their own quality management, and under 21 CFR 312.52(b) the CRO is liable as a sponsor for the obligations it assumes. Sponsor SOPs may be agreed for individual studies, but they do not replace the CRO’s own QMS.
What does a sponsor check in a CRO qualification audit?
Typically the QA organisation, SOPs, training records, the deviation and CAPA process, the internal audit programme, subcontractors, system validation and data segregation, inspection history and performance metrics. The basis is the sponsor’s oversight duties under ICH E6(R3) sections 3.6.7 to 3.6.9.
Does a CRO’s eQMS have to be Part 11 compliant?
Yes, if it holds records required under FDA regulations, for example for studies under a US IND. Requirements then include validation (11.10(a)) and audit trails (11.10(e)). Part 11 does not apply to EU-only studies, but ICH E6(R3) section 4 expects comparable controls.
Does ICH E6(R3) already apply to CROs?
In the EU, ICH E6(R3) has applied since 23 July 2025, with Annex 2 following on 15 January 2027. The FDA published E6(R3) as final, non-binding guidance in September 2025. CROs should therefore align their QMS with E6(R3) now.
Do SOPs and training records belong in the TMF?
Yes, insofar as they are relevant to the trial. Under the EMA TMF guideline (section 3.4), central systems such as SOP management and training records form part of the TMF and must be kept for as long as the related trial documents.
How long must a CRO retain TMF content?
For trials under EU Regulation 536/2014, at least 25 years after the end of the trial (Article 58), unless other rules require a longer period. Every change must remain traceable throughout.
When should a small CRO introduce an eQMS?
At the latest a few months before the first sponsor audit, so that operational evidence such as completed training, closed CAPAs and an internal audit is in place. Starting early pays off especially once several sponsors or US studies are involved.
Author: Jan Krikava – A former life science consultant who founded Docuply on the back of his own consulting experience. 14 years of experience in quality management. Business Informatics B. Sc. LinkedIn: linkedin.com/in/jan-krikava
