This is a ready-to-use SOP for qualifying and selecting clinical CROs and service providers before award. Oversight starts before a contract is signed; you cannot oversee your way out of choosing the wrong provider. Replace every <<FILL: ...>> placeholder with your own specifics, set your document numbers and dates, and route it through your normal document control, review, and approval. A worked filled specimen follows. Confirm each cited regulation against the current source before you rely on it. This content is general educational reference, not legal or regulatory advice.
Document control header
| Field | Entry |
|---|---|
| Document title | CRO and Service Provider Qualification and Selection |
| Document number | <<FILL: e.g. SOP-CQA-021>> |
| Version | <<FILL: e.g. 1.0>> |
| Effective date | <<FILL: date>> |
| Supersedes | <<FILL: prior version or "New">> |
| Document owner | <<FILL: role, e.g. Head of Clinical QA>> |
| Applies to | <<FILL: clinical programs / functions in scope>> |
1. Purpose
Define how <<FILL: COMPANY NAME>> qualifies clinical CROs and service providers (a documented decision that a provider is capable of doing the work to GxP standards) and selects among qualified providers for a specific scope, so that delegated trial duties go to competent parties and the decision is defensible in an inspection.
2. Scope
Applies to any third party proposed to carry a trial-related activity: full-service CROs, functional-service providers, central labs, EDC/IRT/eTMF vendors, PV vendors, imaging, couriers, and their subcontractors where the sponsor requires direct qualification. Depth scales with risk (section 5). It does not replace ongoing oversight, which is governed by the sponsor oversight plan and <<FILL: oversight SOP ref>>.
3. Responsibilities
| Role | Responsibility |
|---|---|
| Clinical QA | Owns the qualification program; performs or commissions assessments and audits; approves the qualification decision. |
| Clinical operations / program lead | Defines the scope and requirements; participates in selection; owns the relationship after award. |
| Data management / DI | Assesses data-holding providers (validation, access, audit trail, data residency). |
| Procurement / contracts | Runs the commercial process; ensures the contract reflects the qualification conditions. |
| Provider | Supplies the requested evidence honestly and completely. |
4. Definitions
- Qualification: the documented determination that a provider is capable of performing defined GxP activities to standard, before award.
- Selection: choosing among qualified providers for a specific study or scope.
- Requalification: periodic or triggered re-confirmation that a provider remains qualified.
- Service provider: any third party performing trial-related activities, per ICH E6(R3).
5. Procedure
5.1 Determine the risk tier
Set the assessment depth from what the provider will do and how much it could hurt the trial.
| Risk tier | Typical scope | Minimum qualification depth |
|---|---|---|
| High | PV/safety reporting, EDC holding the primary endpoint, full-service conduct, GxP data hosting | On-site or detailed remote audit before award, plus full assessment |
| Medium | Central lab, IRT, eTMF, specialty monitoring | Detailed questionnaire + evidence review; audit risk-based |
| Low | Translation, kit supply, non-GxP services | Questionnaire + references |
5.2 Run the assessment (domains)
Assess, proportionate to tier:
- Quality system: current, controlled, followed SOPs; CAPA; deviation and change control; internal audit; management review. Request the SOP index and redacted recent CAPAs.
- Regulatory and inspection history: prior FDA/EMA/MHRA inspections, Form 483s, warning letters, and how they were closed.
- Experience and capacity: therapeutic area, phase, and modality experience; headcount; the risk of overcommitment to junior staff.
- Personnel and training: qualifications and GCP training currency of the people who will actually work on the study.
- Computer systems and data integrity: system validation, role-based access, audit trails on and reviewed, backup and restore, data hosting and residency.
- Financial stability and business continuity: financial health; disaster recovery and continuity plans, so a provider failure mid-trial does not strand data.
- Subcontractor governance: whether and to whom they subcontract, and how they qualify and oversee those subcontractors.
5.3 Score and decide
- Score each domain against defined criteria (section 6) and record evidence, not assertion.
- Reach a decision: Qualified, Qualified with conditions, or Not qualified.
- Record any conditions, risks accepted, and their owner and due date.
- Clinical QA approves the decision.
5.4 Select for a study
Among qualified providers, select for the specific scope on defined criteria (capability fit, capacity, therapeutic experience, cost, timelines, conflicts). Record the selection rationale.
5.5 Requalify
Requalify on a defined cycle (commonly every two to three years for active high-risk providers) and on any material trigger: a merger, a platform move, a cluster of quality issues, a failed audit, or a significant scope change.
6. Acceptance criteria
- The provider was assessed at the depth its risk tier requires before award.
- Each domain has an evidence-backed score, not an assertion.
- The decision, conditions, accepted risks, and owner are documented and QA-approved.
- Higher-risk providers were audited before award where the tier requires it.
- Requalification cycle and triggers are defined and tracked.
7. Records generated
- Qualification assessment report (scored, with evidence references).
- Audit report and CAPAs where an audit was performed.
- Qualification decision record with conditions and risk acceptances.
- Selection rationale.
- Requalification schedule and records.
8. References
ICH E6(R3) Good Clinical Practice, sponsor use and oversight of service providers. 21 CFR 312.50 and 312.52 (sponsor responsibilities; transfer of obligations). ICH E8(R1), General Considerations for Clinical Studies (quality by design in provider selection).
Confirm the in-force version for every region the study touches before issue.
9. Revision history
| Version | Date | Author | Summary of change |
|---|---|---|---|
<<FILL: 1.0>> | <<FILL: date>> | <<FILL: author>> | Initial issue. |
10. Approvals
| Role | Name | Signature | Date |
|---|---|---|---|
| Author | <<FILL>> | ||
| Reviewer (QA) | <<FILL>> | ||
| Approver | <<FILL>> |
Filled specimen
Illustrative qualification decision for a PV/safety-reporting vendor (High risk).
Provider: illustrative PV vendor. Scope: SAE case processing and expedited reporting support for a Phase 2 program. Risk tier: High (safety reporting). Assessment: on-site audit AUD-2026-014 plus full domain review.
| Domain | Score (1 to 5) | Evidence | Note |
|---|---|---|---|
| Quality system | 4 | SOP index current; 3 CAPAs closed on time | Adequate |
| Regulatory / inspection history | 4 | One FDA inspection, no 483; documented | Reassuring |
| Experience and capacity | 3 | Right therapeutic area; capacity tight | Condition: confirm named staff |
| Personnel and training | 4 | GCP training current for named team | Adequate |
| Computer systems / DI | 4 | Validated safety DB, access reviewed, audit trail on | Adequate |
| Financial / continuity | 3 | Stable; continuity plan reviewed | Adequate |
| Subcontractor governance | 5 | No subcontracting for this scope | Simplest case |
Decision: Qualified with conditions. Conditions: (1) confirm the named case-processing team before the first work order; (2) re-audit in 24 months or on any safety-reporting timeliness breach. QA approved. Selection followed for study XYZ-201 with the rationale recorded separately.
The value of the record is the condition, not the score: capacity was the real risk, so the qualification pins the named team and sets an early re-look trigger.
Common inspection findings this SOP prevents
- A provider used with no documented qualification, so the sponsor cannot show it chose a competent party.
- A high-risk provider (PV, EDC holding the endpoint) awarded with only a questionnaire, no audit.
- A qualification that lives in someone’s head, with no scored, evidence-backed record.
- No requalification, so a provider that degraded or changed platforms is still treated as qualified.
- Subcontracting never assessed, so a critical activity sits with an unqualified party two layers down.
How to adapt this SOP
- Set the risk-tier table to your own thresholds and the provider types you actually use.
- Define the scoring criteria for each domain so scores are repeatable across assessors.
- Require an audit before award for the tiers where risk justifies it, and record when it was waived and why.
- Track requalification dates and triggers; a merger or platform move should force a re-look. Pair this SOP with the transfer-of-obligations matrix and the sponsor oversight plan.