SOP-105

Oversight of Service Providers and Vendors

Number: SOP-105
Category: Governance and Quality System
Edition: Reference Edition 1.3
Approx. pages: 9

Download Word All Reference Edition documents

[YELLOW] the site fills in. [DEFAULT: green] a value the site may keep or change.

On this page

1. Purpose
2. Scope
3. Responsibilities
4. Definitions
5. Procedure
6. Related Forms and SOPs
7. References

1. Purpose

This SOP describes how [SITE NAME] selects, qualifies, contracts with and oversees service providers that perform trial-related activities on behalf of the investigator, and how the site handles service providers that the sponsor selects. The investigator may delegate activities to service providers but keeps responsibility for them, including the quality and integrity of the data they produce (ICH E6(R3) Principle 10; Annex 1, 2.3).

2. Scope

This SOP applies to any person or organization outside the [SITE NAME] workforce that performs a trial-related activity for the site. Examples:

local clinical laboratories and pathology services
imaging centers, cardiology and other diagnostic testing facilities
home health, mobile nursing and mobile phlebotomy services
pharmacies that store, prepare or dispense IP for the site
recruitment and advertising vendors, call centers and patient database vendors
eRegulatory (eISF), CTMS, eConsent, eSource and other electronic system vendors deployed by the site
off-site record storage and archiving companies, and document scanning or destruction companies
couriers used by the site for IP, specimens or records
staffing agencies that supply research staff
interpreters and translation services used for consent
equipment calibration and maintenance vendors

It covers four categories, handled differently (5.1). General business vendors with no trial-related activity or access to trial data (for example, janitorial or office supplies) are out of scope.

Follow the protocol, sponsor or IRB requirement where it is stricter than this SOP. The clinical trial agreement (CTA) may require sponsor approval before the site subcontracts any study activity.

3. Responsibilities

Role	Responsibilities
Principal Investigator (PI)	Approves each service provider used for activities under the investigator's responsibility, including providers identified by the sponsor. Sets the level of oversight. Reviews provider output that affects participant safety, eligibility or endpoints. Acts on performance problems.
Site Director	Owns the service provider program. Approves selection and written agreements. Names an owner for each provider relationship. Decides to terminate a provider.
Quality Lead	Maintains the provider list and F-105-01 records. Assigns risk level with the PI. Leads qualification reviews and periodic requalification. Opens CAPAs for provider issues.
Finance / Contracts Lead	Negotiates and executes written agreements, including business associate agreements. Checks that CTAs allow the subcontract or that sponsor approval is obtained. Runs debarment and exclusion screening of providers (5.3.2).
Regulatory Coordinator	Lists providers on the 1572 or in device records where required. Notifies the sponsor and IRB of providers as required. Files study-specific provider records (certifications, normal ranges, agreements) in the ISF.
Lead CRC / CRC	Uses providers as the study requires. Records and reports provider problems (for example, late results, specimen handling errors, missed home visits) to the provider owner and Quality Lead.
Provider Owner (named per provider on F-105-01)	Day-to-day contact for the provider. Collects performance information and leads periodic oversight.

4. Definitions

Term	Definition
Service Provider	A person or organization (commercial, academic or other) providing a service used by either the sponsor or the investigator to fulfil trial-related activities (ICH E6(R3) Glossary).
Investigator-Engaged Service Provider	A service provider that [SITE NAME] or the PI selects and contracts with to perform activities that are the investigator's responsibility.
Sponsor-Identified Service Provider	A service provider selected and contracted by the sponsor to perform activities that are the investigator's responsibility (for example, sponsor-arranged home nursing for study visits). The responsibility for those activities stays with the investigator (ICH E6(R3) Annex 1, 3.6.5).
Sponsor Service Provider	A service provider contracted by the sponsor to perform the sponsor's own activities (for example, central laboratory, IRT, EDC, eCOA, central imaging reading, CRO monitoring). The sponsor oversees these providers.
Agreement	A document or set of documents describing the details of any arrangements on delegation or transfer, distribution and/or sharing of activities and, if appropriate, financial matters between two or more parties (ICH E6(R3) Glossary).
Business Associate Agreement (BAA)	A contract required by HIPAA (45 CFR 164.504(e)) when a person or company creates, receives, maintains or transmits protected health information on behalf of a covered entity. Applies only when [SITE NAME] is a covered entity (SOP-400).
Standard-Terms Provider	A CLIA-certified or accredited laboratory, an accredited imaging center, or a courier that performs investigator activities under its own standard or published terms, or under terms the sponsor has accepted, which the site cannot negotiate (5.1.3).
Risk Level	High, medium or low rating set under 5.2 that decides the depth of qualification and oversight.
CLIA Certificate	The certificate issued under 42 CFR 493 that permits a laboratory to perform testing on human specimens at the stated complexity level.

5. Procedure

5.1 Identify the provider category

5.1.1

Before a provider performs any trial-related activity, the Quality Lead and the PI place it in one category and record the category on F-105-01 Service Provider Qualification and Oversight Record:

Investigator-engaged: apply all of this SOP
Sponsor-identified, for investigator activities: apply 5.7
Sponsor service provider, for sponsor activities: apply 5.8
Standard-terms provider, for investigator activities: apply 5.1.3 only

5.1.2

When it is not clear whose responsibility an activity is, the Regulatory Coordinator asks the sponsor in writing and files the answer in the ISF.

5.1.3

A standard-terms provider is a CLIA-certified or accredited laboratory, an accredited imaging center, or a courier whose terms the site cannot negotiate (for example, a national reference laboratory, a hospital laboratory or a commercial parcel carrier). For this category, 5.2 to 5.6 and 5.9 do not apply. Instead:

5.1.3.1

Qualification: the Provider Owner files the current CLIA certificate or accreditation certificate (and, for a laboratory, the reference ranges) on F-105-01, and records that the provider's standard or published terms, or the terms the sponsor has accepted for the study, are accepted. No custom agreement is required. A BAA is put in place only where the Privacy Officer determines one is needed (SOP-400 Participant Privacy and HIPAA in Research).

5.1.3.2

Annual check: the Provider Owner checks at least annually that the certificate or accreditation is current and records the check on F-105-01.

5.1.3.3

Oversight: risk-based oversight is limited to tracking issues (for example, lost or rejected specimens, late results, temperature excursions in courier custody) on F-105-01, and acting on them under 5.6.4. Investigator review of results under SOP-101 5.4.4 continues and is not provider oversight.

5.1.3.4

The study-level steps in 5.5.1 (1572 listing and ISF filing) still apply.

Network note: In Model N, Network Office central services that perform investigator activities for a member site (for example, central regulatory submissions, a central eRegulatory system or CTMS, a central recruitment call center or pre-screening team, central IP storage, or shared staff) are investigator-engaged service providers to that site, and the site PI approves and oversees them under this SOP (Appendix B, SOP-105 rows). The central services and their scope are listed under SOP-904 Shared Staff, Cross-Site Coverage and Central Services. N-Affiliated: the Network Office is a separate entity. The network or affiliation agreement, or a services schedule under it, must cover the items in 5.4.1, and a business associate agreement is needed where the Network Office creates, receives, maintains or transmits the site's protected health information. N-Integrated: where the Network Office is part of the same legal entity as the member site, no contract or BAA is needed, but the PI approval, risk level and oversight in this SOP still apply. N-Integrated defaults apply only where the member site and the network entity are the same legal entity. A separate subsidiary, or a professional corporation under a management services arrangement, follows the N-Affiliated rows for PHI, direction of staff, contract signature, records custody and payments unless counsel confirms otherwise (SOP-900, 5.2.1). In both variants the site records each central service on F-105-01 or keeps a pointer to the central services record under SOP-904. Central staff who perform a protocol-specific task for a study (for example, pre-screening against that study's criteria) are also on the site's delegation log for that study (F-302-01); the service record under this SOP alone covers only tasks that are not protocol-specific.

5.2 Assign a risk level

5.2.1

The Quality Lead and PI assign a risk level to each investigator-engaged provider, based on what the provider does:

High: contact with participants (home health, mobile phlebotomy), IP storage, preparation, dispensing or shipping, testing that produces safety, eligibility or endpoint data, holding source or essential records (eISF, eSource, archive), or handling participant identifiable data at scale
Medium: recruitment vendors working only from IRB-approved materials, couriers for specimens or records, interpreters for consent, equipment calibration vendors
Low: services with limited effect on participants or data (for example, translation of non-participant-facing documents)

5.2.2

The risk level sets the minimum qualification in 5.3 and oversight in 5.6. The PI may raise the level for a study.

5.3 Qualify the provider before use

5.3.1

The Provider Owner collects qualification evidence and records it on F-105-01. Minimum evidence by provider type:

clinical laboratory: current CLIA certificate at the right complexity level for the tests; accreditation (for example, CAP) if held; laboratory director's name, CV and license if the sponsor requests; reference (normal) ranges with effective dates; turnaround times; specimen requirements
imaging or diagnostic testing facility: state license or registration; accreditation for the modality where it exists (for example, ACR or IAC); evidence of equipment maintenance and calibration where the protocol depends on measurement; qualifications of technologists and readers
home health, mobile nursing or phlebotomy: state agency license where required; staff licenses or certifications; background check policy; ability to follow protocol procedures, document visits and manage specimens and IP; emergency procedures; HIPAA safeguards
pharmacy: state pharmacy license; ability to meet IP storage and temperature monitoring requirements; compounding standards that apply (for example, USP 797 for sterile preparations); DEA registration if controlled substances are involved
recruitment vendor: written description of methods; agreement to use only IRB-approved materials and scripts; data privacy and security controls; how referrals and pre-screening data are sent to the site
electronic system vendor: description of the system's intended use; validation documentation or summary; audit trail, access control and electronic signature controls relevant to 21 CFR 11; data backup, hosting location and disaster recovery; how data are exported at end of contract; how monitors, auditors and inspectors get read-only access (SOP-401 Computerized Systems and Electronic Records)
record storage or archiving company: secure, access-controlled, environmentally protected storage; fire and water protection; retrieval times; chain of custody; no destruction without the site's written authorization (SOP-402 Record Retention, Archiving and Destruction)
courier: temperature-controlled options and qualified packaging where needed; tracking and chain-of-custody records; dangerous goods capability for UN3373 and dry ice shipments (SOP-311 Biological Specimen Collection, Processing and Shipping)
staffing agency: how the agency verifies licenses, background checks and training; notice when staff change (SOP-102 Site Organization, Roles and Staff Responsibilities)
interpreter or translation service: qualifications in the language and in medical terminology; confidentiality commitment

5.3.2

For every investigator-engaged provider, the Finance / Contracts Lead screens the company and its key personnel against the debarment, disqualification and exclusion lists before engagement and at least [DEFAULT: annually], as set out in SOP-704 Research Misconduct and Fraud Reporting, section 5.7, and records the result on F-105-01. This screening is site practice, not a regulatory requirement.

5.3.3

For high-risk providers, the Quality Lead also obtains one of:

a completed site questionnaire on the provider's quality system, SOPs, staff training and incident handling
a site visit or remote assessment by the Quality Lead or a delegate
a recent audit report or certification the Quality Lead accepts (for example, a sponsor audit summary shared by the provider, ISO certification, SOC 2 report for a system vendor)

5.3.4

The Quality Lead summarizes the result on F-105-01 as approved, approved with conditions, or not approved. The PI signs approval for providers that perform investigator activities. The Site Director signs approval for the business relationship.

5.3.5

A provider's existing quality processes may be acceptable even if not designed specifically for GCP, provided they are fit for purpose for the activity (ICH E6(R3) Annex 1, 3.6.10). The Quality Lead records the reason on F-105-01 when accepting such processes.

5.4 Put a written agreement in place

5.4.1

The Finance / Contracts Lead executes a written agreement with each investigator-engaged provider before the provider performs trial-related activities (ICH E6(R3) Annex 1, 2.3.4). The agreement or attached scope of work states:

the activities the provider performs and for which studies or study types
qualification and training of the provider's personnel
compliance with the protocol and study instructions provided, GCP as applicable, and applicable law
confidentiality of participant and sponsor information
a BAA, or BAA terms, when [SITE NAME] is a covered entity and the provider creates, receives, maintains or transmits protected health information on its behalf; where the site is not a covered entity, equivalent confidentiality and security terms (SOP-400 Participant Privacy and HIPAA in Research)
data security requirements and notice of security incidents within [DEFAULT: 24 hours] of discovery
ownership of records, the site's access to them, retention for the required period and return or transfer at the end of the agreement (ICH E6(R3) Appendix C, C.2.2)
access for sponsor monitors and auditors, the IRB and regulatory inspectors to the provider's records and facilities related to the study
notice to the site of problems that could affect participant safety or data reliability within [DEFAULT: 1 business day], and of changes to key staff, location, methods or certification
no further subcontracting without the site's written approval
insurance where appropriate to the risk
termination terms

5.4.2

The Finance / Contracts Lead checks the CTA for each study before the provider is used for that study. Where the CTA requires sponsor consent to subcontract, the Regulatory Coordinator obtains it in writing and files it in the ISF.

5.4.3

A master agreement may cover several studies. The Provider Owner adds a study-specific work order or instruction when a study needs different tasks, timelines or documents.

5.5 Study-level steps before first use

5.5.1

For each study that uses an investigator-engaged provider, the Regulatory Coordinator:

lists clinical laboratories and testing facilities that support the study in Section 4 of the 1572, and other locations where participants are seen in Section 3 (SOP-101 Roles and Responsibilities of the Principal Investigator)
notifies the reviewing IRB where the IRB requires it, for example when a home health provider will visit participants
files in the ISF the provider's study-relevant qualification documents (for example, CLIA certificate, laboratory normal ranges, accreditation certificate) and replaces them when they expire or change

5.5.2

The PI or Lead CRC gives the provider the protocol sections, manuals and instructions the provider needs, and trains the provider's personnel on study-specific tasks that go beyond their usual work. Training is recorded on F-103-01 Staff Training Log or the provider's record, and filed in the ISF.

5.5.3

Where provider personnel perform significant trial-related activities that are not part of their usual role, the PI records them on F-302-01 Delegation of Authority Log, or records the delegation to the provider organization in a way the sponsor accepts, in proportion to the significance of the activities (ICH E6(R3) Annex 1, 2.3.3; SOP-302 Delegation of Authority). Routine clinical services performed as part of normal practice (for example, a hospital laboratory running standard tests) do not need individual delegation.

5.6 Oversight during the study

5.6.1

The PI and Provider Owner oversee each provider in proportion to its risk level. The minimum oversight is:

High: review of performance at least [DEFAULT: quarterly] while the provider is active, plus review of each issue as it occurs
Medium: review at least [DEFAULT: annually]
Low: review at requalification

5.6.2

Oversight activities include, as relevant:

investigator review, signature and date of each laboratory, imaging or other test report that the provider returns, with clinical significance noted (SOP-101)
checking visit records from home health providers for completeness and timeliness (F-313-01 Remote Visit and Home Health Visit Record; SOP-313 Decentralized Trial Elements)
checking temperature records for IP or specimens the provider stored or carried
tracking turnaround times, errors, rejected specimens, missed visits and complaints
spot-checking recruitment vendor materials and scripts against the IRB-approved versions (SOP-300 Participant Recruitment, Pre-Screening and Advertising)
reviewing system vendor release notes, incident reports and access lists (SOP-401)

5.6.3

The Provider Owner records the results of each oversight review on F-105-01.

5.6.4

When a provider problem affects participant safety, rights or data reliability, the CRC tells the PI the same day. The PI decides on immediate action. The CRC records any protocol deviation (SOP-308 Protocol Deviations and Noncompliance) and reports to the sponsor and IRB where required. The Quality Lead opens a CAPA on F-703-01 for significant or repeated problems (SOP-703 Corrective and Preventive Action (CAPA)).

5.6.5

A computerized system incident at a provider that may have a significant or persistent effect on trial data or system security is reported to the sponsor and, where applicable, the IRB (ICH E6(R3) Annex 1, 2.12.10(e)).

5.7.1

When the sponsor proposes a provider to perform activities that are the investigator's responsibility, the Regulatory Coordinator asks the sponsor for information on the provider's qualifications, scope, and how the provider will report to the site.

5.7.2

The PI reviews the information and decides whether the provider is appropriate. The PI records the decision and any conditions on F-105-01. The investigator keeps the final decision (ICH E6(R3) Annex 1, 2.3.1).

5.7.3

The PI oversees the provider's activities that affect the PI's participants under 5.6, using the records the provider and sponsor make available (for example, home visit reports, IP delivery confirmations). The site does not need its own contract with a provider the sponsor contracts, unless the CTA or the sponsor requires one.

5.7.4

The CRC reports provider problems to the sponsor and records them as in 5.6.4. If the problems continue, the PI asks the sponsor in writing to correct them or to use another provider.

5.8.1

The site does not qualify or contract with providers that the sponsor uses for its own activities. The sponsor is responsible for selecting and overseeing them.

5.8.2

The site:

uses sponsor systems and services as the protocol and study instructions specify (ICH E6(R3) Annex 1, 2.12.4)
files in the ISF the documents the sponsor provides about them (for example, central laboratory certificates and normal ranges, IRT and EDC manuals)
reports problems that affect participants or data (for example, a central laboratory losing a specimen, an IRT outage that delays dosing) to the sponsor and records any deviation under SOP-308
requests access changes and revocations for sponsor systems (SOP-102)

5.9 Requalification and changes

5.9.1

The Quality Lead requalifies each investigator-engaged provider at least every [DEFAULT: 2 years] for high-risk providers and [DEFAULT: 3 years] for medium- and low-risk providers, using current certificates, the oversight record and any issues. The result is recorded on F-105-01.

5.9.2

The Quality Lead requalifies earlier when the provider changes ownership, location, key staff, methods or certification status, or after a significant problem.

5.9.3

The Quality Lead tracks expiry dates of certificates and licenses that providers must hold and obtains renewals before expiry.

5.10 Ending a provider relationship

5.10.1

When a provider is no longer used, or the Site Director terminates it, the Provider Owner:

arranges a replacement before the last date of service where a study still needs the service, and tells the sponsor and IRB where required
obtains or confirms transfer of all study records the provider holds, or confirms in writing that the provider will keep them for the required retention period with site access
confirms the provider's access to site systems and data is removed (SOP-102)
confirms return or destruction of participant information as the agreement requires

5.10.2

The Quality Lead closes the provider's F-105-01 record with the end date and reason.

5.11 Records

5.11.1

The Quality Lead keeps for each investigator-engaged provider: F-105-01, qualification evidence, the signed agreement and any BAA, oversight review records, issues and CAPAs.

5.11.2

The Regulatory Coordinator files in the ISF the study-specific records that show selection, assessment and oversight of providers that perform important trial-related activities, and the signed agreements with them, or a note to file stating where they are held (ICH E6(R3) Appendix C; SOP-204 Essential Documents and the Investigator Site File).

5.11.3

Provider records are kept for at least the retention period of every study the provider supported (SOP-402).

F-105-01 Service Provider Qualification and Oversight Record
F-103-01 Staff Training Log
F-302-01 Delegation of Authority Log
F-306-01 Note to File
F-313-01 Remote Visit and Home Health Visit Record
F-703-01 CAPA Record
Appendix B Central and Site Responsibility Matrix (Model N only)
SOP-101 Roles and Responsibilities of the Principal Investigator
SOP-102 Site Organization, Roles and Staff Responsibilities
SOP-204 Essential Documents and the Investigator Site File
SOP-300 Participant Recruitment, Pre-Screening and Advertising
SOP-302 Delegation of Authority
SOP-304 Investigational Product Management
SOP-308 Protocol Deviations and Noncompliance
SOP-311 Biological Specimen Collection, Processing and Shipping
SOP-312 Equipment Calibration and Maintenance; Local Laboratory Requirements
SOP-313 Decentralized Trial Elements (Remote Visits, Home Health, Direct-to-Participant IP)
SOP-400 Participant Privacy and HIPAA in Research
SOP-401 Computerized Systems and Electronic Records
SOP-402 Record Retention, Archiving and Destruction
SOP-703 Corrective and Preventive Action (CAPA)
SOP-704 Research Misconduct and Fraud Reporting
SOP-901 Member Site Onboarding, Integration and Exit (Model N only)
SOP-903 Network Oversight of Member Sites (Metrics, Central QA, Escalation) (Model N only)
SOP-904 Shared Staff, Cross-Site Coverage and Central Services (Model N only)
SOP-905 Network Data, Systems, Privacy and Records Across Sites (Model N only)

7. References

Reference	Title
ICH E6(R3) Principle 10	Roles and responsibilities in clinical trials should be clear and documented appropriately (10.1 to 10.3)
ICH E6(R3) Annex 1, 2.3	Investigator: Responsibilities (2.3.1 delegation and oversight; 2.3.3 delegation records; 2.3.4 agreements with service providers)
ICH E6(R3) Annex 1, 2.12.4 and 2.12.10	Records: use of sponsor systems; computerized system access and incidents
ICH E6(R3) sections 3.6.5 and 3.6.10	Agreements: sponsor-identified providers for investigator activities; fit-for-purpose quality processes
ICH E6(R3) Appendix C, C.2.2	Management of Essential Records: records held by service providers
ICH E6(R3) Annex 2 (ICH Step 4, June 2026)	Decentralised elements, pragmatic trials and real-world data
21 CFR 312.53(c)	Form FDA 1572 (research facilities and clinical laboratories)
21 CFR 11	Electronic Records; Electronic Signatures
42 CFR 493	Laboratory Requirements (CLIA)
45 CFR 164.502(e) and 164.504(e)	HIPAA: disclosures to business associates; business associate contracts (including subcontractors)
FDA Guidance (Sept 2024)	Conducting Clinical Trials With Decentralized Elements
FDA Guidance (Oct 2024)	Electronic Systems, Electronic Records, and Electronic Signatures in Clinical Investigations: Questions and Answers

Independent Site SOP Library. Licensed CC BY-NC 4.0 by the American Institute for Medical Research (AIMR), with added permission for any site's internal use (license terms). Not legal advice: each adopting site confirms state law, IRB and sponsor requirements with its own counsel and owns every step it approves.