Vendor qualification is a point-in-time judgment, made before award, that a vendor is capable of the work. Vendor oversight is the continuous verification, throughout the study, that the vendor is actually performing that work to the required standard. Many sponsors do one thoroughly and assume it covers the other. It doesn't.
An inspector who asks how you knew your CRO was performing is not asking to see the qualification audit from two years ago.
What does vendor qualification involve?
Qualification typically covers the vendor's quality system and SOPs, relevant experience, regulatory inspection history, validation of computerized systems, data privacy and security controls, financial stability and references. Depending on risk, it may include an audit. It ends with a documented decision to qualify, conditionally qualify or reject, and a schedule for requalification.
What does vendor oversight involve?
Oversight starts with a plan that defines what the sponsor will review, how often and against which standards. It includes governance meetings, key performance and risk indicators, review of deliverables such as monitoring reports and data listings, targeted sampling, issue and escalation management and, where warranted, audits for cause. Most importantly, it produces evidence: decisions made, issues followed up and actions closed.
Why do sponsors confuse the two?
A thick qualification file looks like evidence of control. Small teams have limited time and naturally invest it up front. And once a study is running, oversight competes with every other urgent task. The result is a sponsor that chose its vendor carefully but cannot show how it supervised the work.
What about subcontractors?
CROs routinely subcontract work to laboratories, technology providers, translators and other specialists. Ask for a list of subcontractors involved in your study and how the CRO qualifies and oversees them. The contract should require notification of, and ideally sponsor consent to, material subcontracting. Delegation chains that nobody can describe are a common source of inspection questions.
How do you keep both inspection-ready?
A vendor master list showing each vendor, its services and its qualification status.
A qualification file per vendor with the date, scope, decision and requalification schedule.
A study-level oversight plan for each critical vendor.
Evidence of oversight filed as you go: minutes, review records, issue logs and decisions.
How much is enough?
Proportionality applies. A vendor whose work directly affects participant safety or primary endpoint data deserves deeper qualification and closer oversight than one translating site newsletters. ICH E6(R3) supports exactly this kind of risk-based allocation of effort, as long as the reasoning is documented.
What is the simplest test?
For each critical vendor, ask two questions. How did we decide this vendor could do the work? And how do we know, today, that it is doing the work well? If the second answer depends on the first, there is an oversight gap.
Keep reading: Transferring Regulatory Obligations to a CRO: What Moves and What Stays
