What ICH E6(R3) Really Means for CRO Selection and Vendor Oversight

Many biotech and emerging biopharma sponsors are treating ICH E6(R3) as a documentation update:  new templates, new signatures, same relationship with the CRO underneath. That reading will not survive an inspection. R3 says accountability cannot be delegated. Whatever the CRO does, the sponsor still owns trial quality and participant safety, and a CRO's failure shows up as the sponsor's finding.

That changes three things that are currently on autopilot.

Selection. If the RFP scorecard still weights price above evidence of risk-based quality management, it is scoring the wrong things. Ask CROs to show their actual system for identifying and controlling critical-to-quality factors, not describe one on a slide. Weight how they behave when a milestone slips above what they quoted to win the bid.

Governance. Calendar-based oversight — the monthly steering committee, the quarterly audit — is a relic of R2. R3 expects risk-tiered oversight: continuous, defined review for high-risk activities, periodic sampling for low-risk ones. That has to be named per activity, in writing, with an owner.

Documentation. "Noted and escalated to CRO" is not sufficient. Inspectors want evidence of oversight: what signal was seen, what decision followed, whether it worked. And essential records now reach past the TMF into the vendor's electronic data, logs, and system audit trails.  Access to those has to be built into the contract.

For most biotech and emerging biopharma companies, there is no internal QA bench standing behind the CRO. The service provider relationship is where R3 compliance actually lives or dies.

If your CRO governance needs to move from delegated tasks to documented accountability, let's talk!

E6(R3) raises more questions than one article settles. The FAQ covers sponsor accountability, vendor selection and risk-tiered oversight in more detail.