SOP-M1
Service Providers and Vendors
- Number
- SOP-M1
- Category
- Module
- Edition
- Lean Edition 2.0
- Approx. pages
- 6
- Reference Edition source
- 105
[YELLOW] the site fills in. [DEFAULT: green] a value the site may keep or change.
On this page
1. Purpose
This module describes how [SITE NAME] qualifies, contracts with and oversees service providers that perform trial-related activities for the investigator, and how it handles providers the sponsor selects. The investigator may delegate activities to service providers but keeps responsibility for them (ICH E6(R3) Annex 1, 2.3).
2. Scope
Adopt this module only if [SITE NAME] uses outside persons or organizations to perform trial-related activities, for example local or hospital laboratories, imaging centers, couriers, home health or mobile phlebotomy, pharmacies, recruitment vendors, electronic system vendors (eISF, eSource, eConsent, CTMS), archive or shredding companies, staffing agencies, interpreters or calibration vendors. Most independent sites meet this trigger, because almost every site uses an outside laboratory, courier or electronic system vendor.
General business vendors with no trial-related activity and no access to trial data (for example office supplies or cleaning) are out of scope. Follow the protocol, sponsor or IRB requirement where it is stricter than this module. The clinical trial agreement (CTA) may require sponsor approval before the site subcontracts a study activity.
3. Responsibilities
| Role | Responsibilities |
|---|---|
| Principal Investigator (PI) | Approves each provider that performs investigator activities, including sponsor-identified providers. Reviews provider output that affects safety, eligibility or endpoints. Decides on action when a provider problem affects participants or data. |
| Site Director | Approves the business relationship and written agreements. Names a Provider Owner for each provider. Decides to end a provider relationship. |
| Quality Lead | Keeps the provider list and F-105-01 records. Assigns category and risk level with the PI. Leads qualification and the annual review. Opens CAPAs for provider problems under SOP-08. |
| Finance / Contracts Lead | Executes agreements and business associate agreements. Checks that the CTA permits the subcontract. Runs debarment and exclusion screening of provider companies. |
| Regulatory Coordinator | Lists providers on the Form FDA 1572 or device records where required. Notifies the sponsor and IRB of providers where required. Files study-specific provider records in the ISF. |
| Provider Owner (named on F-105-01) | Day-to-day contact for the provider. Collects certificates and performance information. Records issues and reviews on F-105-01. |
| Clinical Research Coordinator (CRC) | Uses providers as the study requires. Reports provider problems to the Provider Owner the same day they are found. |
4. Definitions
| Term | Definition |
|---|---|
| Service provider | A person or organization providing a service used by the sponsor or the investigator to fulfil trial-related activities (ICH E6(R3) Glossary). |
| Investigator-engaged provider | A provider that [SITE NAME] or the PI selects and contracts with to perform activities that are the investigator's responsibility. |
| Standard-terms provider | A CLIA-certified or accredited laboratory, an accredited imaging center, or a courier that performs investigator activities under its own standard or published terms, or terms the sponsor has accepted, which the site cannot negotiate. |
| Sponsor-identified provider | A provider the sponsor selects and contracts to perform activities that are the investigator's responsibility (for example sponsor-arranged home nursing). Responsibility for those activities stays with the investigator. |
| Sponsor service provider | A provider the sponsor contracts for the sponsor's own activities (for example central laboratory, IRT, EDC, central reading, CRO monitoring). The sponsor oversees it. |
| Business associate agreement (BAA) | A contract required by HIPAA (45 CFR 164.504(e)) when a person or company handles protected health information on behalf of a covered entity. |
5. Procedure
5.1 Place each provider in one category
5.1.1
Before a provider performs any trial-related activity, the Quality Lead and the PI place it in one category and record the category on F-105-01 Service Provider Qualification and Oversight Record:
- standard-terms provider: apply 5.2 only, plus the study-level steps in 5.5
- investigator-engaged provider: apply 5.3 to 5.6 and 5.9
- sponsor-identified provider: apply 5.7
- sponsor service provider: apply 5.8
5.1.2
When it is not clear whether an activity is the investigator's or the sponsor's responsibility, the Regulatory Coordinator asks the sponsor in writing and files the answer in the ISF.
5.2 Standard-terms providers: certificate check only
5.2.1
Examples are a national reference laboratory, a hospital laboratory, an accredited imaging center and a commercial parcel carrier. No custom agreement, questionnaire, site visit, performance review or screening of personnel is required.
5.2.2
Before first use, the Provider Owner files on F-105-01:
- the current CLIA certificate (at the complexity level for the tests used) or accreditation certificate
- for a laboratory, the reference ranges with their effective dates
- a statement that the provider's standard or published terms, or the terms the sponsor accepted for the study, are accepted
5.2.3
A BAA is put in place only where the Privacy Officer determines one is needed (SOP-12).
5.2.4
At least annually, the Provider Owner checks that the certificate or accreditation is current and records the check on F-105-01. This is the only recurring check for this category.
5.2.5
Oversight is limited to logging issues (for example lost or rejected specimens, late results, temperature excursions in courier custody) on F-105-01 and acting on them under 5.6.3. Investigator review of each result report continues under SOP-02 and is not provider oversight.
5.3 Investigator-engaged providers: risk level and qualification
5.3.1
The Quality Lead and PI assign a risk level and record it on F-105-01:
- High: contact with participants (home health, mobile phlebotomy), IP storage, preparation, dispensing or shipping, holding source or essential records (eISF, eSource, archive), or handling participant identifiable data for more than [DEFAULT: 50] participants
- Standard: all other investigator-engaged providers (for example recruitment vendors working only from IRB-approved materials, interpreters for consent, calibration vendors)
5.3.2
The Provider Owner collects qualification evidence that fits what the provider does and records it on F-105-01. Typical evidence:
- home health or mobile phlebotomy: state agency license where required, staff licenses, background check policy, emergency procedures, how visits are documented and specimens and IP handled
- pharmacy: state pharmacy license, storage and temperature monitoring capability, applicable compounding standard (for example USP 797), DEA registration if controlled substances are involved
- electronic system vendor: intended use, validation summary, audit trail, access control and electronic signature controls relevant to 21 CFR 11, backup and hosting location, data export at contract end, read-only access for monitors and inspectors (SOP-12)
- archive or storage company: access-controlled and environmentally protected storage, retrieval times, chain of custody, no destruction without the site's written authorization (SOP-12)
- recruitment vendor: methods, agreement to use only IRB-approved materials, data security, how referrals reach the site (SOP-M3)
- staffing agency: how it verifies licenses, background checks and training, and notice when staff change
- interpreter or translation service: language and medical terminology qualifications, confidentiality commitment
5.3.3
For a high-risk provider, the Quality Lead also obtains at least one of the following. The method is [DEFAULT: a completed questionnaire for every high-risk provider, plus a site visit or remote assessment for home health and mobile phlebotomy providers]:
- a completed questionnaire on the provider's quality system, training and incident handling
- a site visit or remote assessment by the Quality Lead or a delegate
- a recent audit report or certification the Quality Lead accepts (for example a sponsor audit summary, ISO certification or SOC 2 report)
5.3.4
A provider's existing quality processes may be accepted if they are fit for purpose for the activity, even if not designed for GCP (ICH E6(R3) Annex 1, 3.6.10). The Quality Lead records the reason on F-105-01.
5.3.5
Before engagement and at each annual review (5.6.2), the Finance / Contracts Lead screens the provider company (not its individual personnel) against the FDA Debarment List, the FDA Clinical Investigators Disqualification Proceedings list and the HHS OIG List of Excluded Individuals/Entities, and records the date, lists and result on F-105-01. This is site practice, not a regulatory requirement. A possible match is handled as for staff under SOP-01, 5.8.4.
5.3.6
The Quality Lead records the result on F-105-01 as approved, approved with conditions, or not approved. The PI signs for providers that perform investigator activities, and the Site Director signs for the business relationship.
5.4 Written agreement
5.4.1
The Finance / Contracts Lead executes a written agreement with each investigator-engaged provider before it performs trial-related activities (ICH E6(R3) Annex 1, 2.3.4). Where the provider negotiates, the agreement or scope of work states:
- the activities, studies and personnel qualifications
- compliance with the protocol, study instructions, GCP as applicable and law
- confidentiality, and a BAA where [SITE NAME] is a covered entity and the provider handles protected health information for it (otherwise equivalent confidentiality and security terms)
- notice to the site within [DEFAULT: 1 business day] of a security incident or a problem that could affect participant safety or data reliability, and notice of changes to key staff, location, methods or certification
- ownership of records, site access to them, retention for the required period and return or transfer at the end (ICH E6(R3) Appendix C)
- access for sponsor monitors and auditors, the IRB and regulatory inspectors to study-related records and facilities
- no further subcontracting without the site's written approval
- insurance proportionate to the risk, and termination terms
5.4.2
Before the provider is used on a study, the Finance / Contracts Lead checks the CTA. Where the CTA requires sponsor consent to subcontract, the Regulatory Coordinator obtains it in writing and files it in the ISF.
5.4.3
A master agreement may cover several studies. The Provider Owner adds a study-specific work order when a study needs different tasks, timelines or documents.
5.4.4
Provider's standard terms. Where a provider contracts only on its own standard terms (common for eISF, eConsent, eSource and other software vendors), the Finance / Contracts Lead compares those terms with 5.4.1 and records each missing or weaker term on F-105-01 (for example incident notice in 72 hours, or subcontracted cloud hosting). For each gap the Quality Lead and PI record whether it is acceptable for the provider's risk level and the mitigation, for example a SOC 2 Type II or ISO 27001 report that names the subcontracted hosts, the vendor's Part 11 controls (5.3.2), or a site export of study data. A provider whose terms do not give sponsor, IRB and inspector access to study records, or the return or transfer of records at the end, is not approved for High-risk activities. The annual review (5.6.2) re-reads the recorded gaps.
5.5 Study-level steps before first use (all investigator-activity providers)
5.5.1
For each study, the Regulatory Coordinator:
- lists laboratories and testing facilities that support the study in Section 4 of the 1572 and other locations where participants are seen in Section 3 (SOP-02)
- notifies the IRB where the IRB requires it (for example a home health provider visiting participants)
- files the provider's study-relevant documents in the ISF (for example CLIA certificate, reference ranges) and replaces them when they expire or change (SOP-03)
5.5.2
The PI or Lead CRC gives the provider the protocol sections and instructions it needs and trains its personnel on study-specific tasks beyond their usual work, recorded on F-103-01 Staff Training Log or the provider's record.
5.5.3
Provider personnel who perform significant trial-related tasks outside their usual role are delegated by the PI under SOP-02 on F-302-01 Delegation of Authority Log, or by a delegation to the provider organization the sponsor accepts. Routine clinical services performed as normal practice (for example a hospital laboratory running standard tests) need no individual delegation.
5.6 Oversight of investigator-engaged providers
5.6.1
The Provider Owner logs each provider issue on F-105-01 when it is found. Issue triggers include:
- a missed or late home visit or sample collection
- a specimen rejection or loss that loses a protocol time point
- a temperature excursion in the provider's custody
- any IP or participant-safety event involving the provider
- a security incident or late notice under 5.4.1
5.6.2
At least annually, the PI and Provider Owner review each active investigator-engaged provider using the issue log, current certificates, any changes and the sponsor's feedback, and record the result on F-105-01 as continue, continue with conditions, or stop. The annual review also serves as requalification. The Quality Lead requalifies earlier when the provider changes ownership, location, methods or certification status, or after a significant problem.
5.6.3
When a provider problem affects participant safety, rights or data reliability, the CRC tells the PI the same day, and the PI decides on immediate action. The CRC records any deviation and reports to the sponsor and IRB where required (SOP-08). The Quality Lead opens a CAPA on F-703-01 when an SOP-08 trigger is met; provider issues count toward the SOP-08 repeat-problem trigger.
5.6.4
A computerized system incident at a provider that may have a significant or persistent effect on trial data or system security is reported to the sponsor and, where applicable, the IRB (ICH E6(R3) Annex 1, 2.12.10).
5.6.5
The Quality Lead tracks expiry dates of provider certificates and licenses on F-105-01 and requests renewals before expiry.
5.7 Sponsor-identified providers
5.7.1
When the sponsor proposes a provider for investigator activities, the Regulatory Coordinator asks the sponsor for the provider's qualifications, scope and how it reports to the site.
5.7.2
The PI decides whether the provider is appropriate and records the decision and any conditions on F-105-01. The investigator keeps the final decision.
5.7.3
The site does not need its own contract with a provider the sponsor contracts, unless the CTA or the sponsor requires one. The PI oversees the provider's work through the records it and the sponsor supply (for example home visit reports, delivery confirmations) and logs issues under 5.6.1.
5.7.4
The CRC reports provider problems to the sponsor and records them as in 5.6.3. If problems continue, the PI asks the sponsor in writing to correct them or to use another provider.
5.8 Sponsor service providers
5.8.1
The site does not qualify or contract with providers the sponsor uses for its own activities. The site:
- uses sponsor systems and services as the protocol and study instructions specify (ICH E6(R3) Annex 1, 2.12.4)
- files in the ISF the documents the sponsor provides about them (for example central laboratory certificates and ranges, IRT and EDC manuals)
- reports problems that affect participants or data to the sponsor and records any deviation under SOP-08
- requests access changes and removals for sponsor systems (SOP-12)
5.9 Ending a provider relationship
5.9.1
When a provider is no longer used or the Site Director ends the relationship, the Provider Owner:
- arranges a replacement before the last date of service where a study still needs the service, and tells the sponsor and IRB where required
- obtains the study records the provider holds, or written confirmation that the provider keeps them for the retention period with site access
- confirms the provider's access to site systems is removed (SOP-12)
- confirms return or destruction of participant information as the agreement requires
5.9.2
The Quality Lead closes the F-105-01 record with the end date and reason.
5.10 Records
5.10.1
The Quality Lead keeps for each provider F-105-01, qualification evidence, agreements and BAAs, issue logs, annual reviews and CAPAs.
5.10.2
The Regulatory Coordinator files in the ISF the study-specific records of provider selection, qualification and oversight and the agreements for providers that perform important trial-related activities, or a note to file stating where they are held (ICH E6(R3) Appendix C; SOP-03).
5.10.3
Provider records are kept for at least the retention period of every study the provider supported (SOP-12).
6. Related Forms and SOPs
- F-105-01 Service Provider Qualification and Oversight Record
- F-103-01 Staff Training Log
- F-302-01 Delegation of Authority Log
- F-703-01 CAPA Record
- SOP-01 SOP Control, Training and Qualification
- SOP-02 Roles, PI Oversight, Delegation and Conflicts of Interest
- SOP-03 IRB Oversight, Essential Records and Study Activation
- SOP-08 Protocol Deviations and CAPA
- SOP-12 Privacy, Electronic Systems and Record Retention
- SOP-M3 Recruitment and Advertising
- SOP-M4 Decentralized Trial Elements
7. References
| Reference | Title |
|---|---|
| ICH E6(R3) Annex 1, 2.3 | Investigator responsibilities (delegation, oversight, agreements with service providers) |
| ICH E6(R3) Annex 1, 2.12.4 and 2.12.10 | Records: use of sponsor systems; computerized system incidents |
| ICH E6(R3) Annex 1, 3.6.10 | Agreements: fit-for-purpose quality processes of service providers |
| ICH E6(R3) Appendix C | Essential records, including records held by service providers |
| 21 CFR 312.53(c) | Form FDA 1572 (research facilities and clinical laboratories) |
| 21 CFR 11 | Electronic Records; Electronic Signatures |
| 42 CFR 493 | Laboratory Requirements (CLIA) |
| 45 CFR 164.502(e) and 164.504(e) | HIPAA business associates and business associate contracts |
| FD&C Act section 306; 42 U.S.C. 1320a-7 | Debarment; exclusion from federal health care programs |
Independent Site SOP Library. Licensed CC BY-NC 4.0 by the American Institute for Medical Research (AIMR), with added permission for any site's internal use (license terms). Not legal advice: each adopting site confirms state law, IRB and sponsor requirements with its own counsel and owns every step it approves.