Clinical Monitoring: Sponsor Oversight under CTR Art. 71 and ICH E6(R3)

Article 48 of Regulation (EU) No 536/2014 (Clinical Trials Regulation, CTR) requires the sponsor to "adequately monitor the conduct of a clinical trial." That is an assessment requirement, not a procedural one: the sponsor determines the extent and nature of monitoring based on an assessment that considers whether the trial is low-intervention, its objectives and methodology, and the degree of deviation of the intervention from normal clinical practice. Terms such as risk-based, monitoring plan, source data verification, on-site or remote do not appear in the wording of Art. 48. Anyone citing them "under EU 536/2014" is actually citing ICH E6(R3).

The bridge to ICH E6(R3): Art. 47 CTR, second paragraph

The regulation builds that bridge itself. Under the second paragraph of Art. 47 CTR, the sponsor and the investigator "shall also take appropriate account of the quality standards and the ICH guidelines on good clinical practice"; under the third paragraph, the Commission makes those guidelines publicly available. That makes ICH E6(R3) the benchmark against which "adequately" in Art. 48 is measured: the link between the regulation's abstract assessment duty and the concrete procedures an actual monitoring plan contains.

Sponsor oversight stays with the sponsor: Art. 71 CTR, second paragraph

The legal basis for why delegation does not change accountability sits in the second paragraph of Art. 71 CTR. Any sponsor may delegate, in a written contract, any or all of its tasks to an individual, a company, an institution or an organization, but "such delegation shall be without prejudice to the responsibility of the sponsor, in particular regarding the safety of subjects and the reliability and robustness of the data generated in the clinical trial." A CRA team, a CRO or centralized data monitoring can carry out the monitoring; the responsibility for it actually working stays with the sponsor.

ICH E6(R3) operationalizes this in Annex 1, section 3.9 ("Sponsor Oversight"): the range and extent of oversight measures should be "fit for purpose" and tailored to the complexity of and risks associated with the trial; the selection and oversight of investigators and service providers are "fundamental features" of the oversight process (3.9.5). The sponsor defines trial-specific criteria for which protocol deviations are "important" (3.9.3) and ensures "appropriate and timely escalation and follow-up of issues" (3.9.6).

What the monitoring plan under ICH E6(R3) actually requires

Annex 1, section 3.11.4, classifies monitoring as one of the principal quality control activities. The sponsor should determine the appropriate extent and nature of monitoring based on identified risks; the factors listed include the objective, purpose, design, complexity, blinding, number of trial participants, the investigational product, and current knowledge of the safety profile and endpoints. Monitoring may include site monitoring (performed on-site and/or remotely) and centralized monitoring.

Three points from this section matter most in practice:

• The monitoring plan should be tailored to the identified potential safety and data quality risks, with strategy, the activities of all parties involved, methods and tools, "and the rationale for their use" (3.11.4.3).
• Centralized monitoring can complement and reduce the extent and/or frequency of site monitoring, or be used on its own (3.11.4.2 b); the reconciliation against source data can be done on the basis of samples, supported by data analytics, with a sample size that may need adjustment based on previous monitoring results (3.11.4.5.4 b). Source data verification is therefore one method among several, not a mandatory full reconciliation.
• Remote access to source data is explicitly provided for: monitoring may include "remote and secure, direct read-only access to source records" (3.11.4.1 c), and frequency should be determined based on identified risks and "modified as appropriate using knowledge gained" (3.11.4.1 a).

Monitoring reports summarize what was reviewed, key findings, and required actions with their follow-up, "including those not resolved in previous reports" (3.11.4.6). Monitoring should be performed by persons not involved in the clinical conduct of the trial at the site being monitored.

Annex 2: what applies from 15 January 2027 and what does not

ICH E6(R3) Annex 2 on decentralized and pragmatic clinical trials and real-world data has been adopted and becomes effective on 15 January 2027. On classic sponsor monitoring itself, it says almost nothing: the term "monitor" appears only twice in the Annex 2 text, against 83 occurrences in the Annex 1 text. Its contribution lies elsewhere, in investigator oversight of activities away from the trial site, ranging "from direct supervision to less intensive oversight," in remote consent, and in remote data collection. Reading "new monitoring rules from 2027" into Annex 2 reads in something that is not there.

What GCP inspections found in monitoring from 2022 to 2024

The only official figures on GCP inspection findings come from the EMA's GCP Inspectors' Working Group annual reports. They count only the inspections requested by the CHMP under the centralized procedure, not national inspections.

For 2024, the report records 67 inspections with 335 major and critical findings (324 major, 11 critical). Monitoring accounts for 35 findings (35 major, 0 critical), the third-largest subcategory, behind essential documents (41) and source documentation (38), ahead of data management (27) and SOPs (22); that is 10.4% of all major and critical findings for the year. Four finding patterns recur:

• Inadequate or delayed monitoring visits and documentation.
• Monitoring not based on an appropriate monitoring plan.
• Inadequate detection and escalation of issues: delayed SAE reporting, missing ISF documents, undetected protocol deviations and missed laboratory values.
• Insufficient access to source data for monitors: CRAs did not have direct access to electronic health or medical records (EHR/EMR).

The fourth point lands exactly where Annex 1, section 3.11.4.1 c, explicitly provides for remote monitoring through direct read-only access to source records: without that access actually established, the remote review of source data the plan provides for cannot be carried out, no matter how well-documented the monitoring plan otherwise is.

On accountability, the 2024 report is unambiguous: 9 of 11 critical findings (81.8%) and 168 of 324 major findings (51.9%) sit with the sponsor, with not a single critical finding at the investigator. By inspection location, of the 335 findings, 152 were at sponsor sites (144 major, 8 critical), 165 at investigator sites (164 major, 1 critical) and 17 at CROs (15 major, 2 critical).

For 2023, the report records 67 inspections with 720 findings (36 critical, 336 major, 348 minor); monitoring accounts for 40 findings (15 minor, 21 major, 4 critical), fifth by total count, third by major and critical findings among the itemized subcategories (25 of 372, 6.7%). Typical examples: monitoring procedures that failed to detect protocol deviations, reconcile IMP accountability, or manage issues detected in SDV and informed-consent processes; assessments "not detected by the trial monitor." 23 of 36 critical findings (63.9%) sat with the sponsor.

For 2022, the report records 36 inspections with 470 findings (17 critical, 260 major, 193 minor); monitoring accounts for 17 findings (5 minor, 11 major, 1 critical), eighth by total count, fifth by major and critical findings (12 of 277, 4.3%). Examples: a remote monitoring process without adequate protection of privacy, a lack of a monitoring plan, no evidence of timely escalation, and no evidence of "continuous and effective medical monitoring." 11 of 17 critical findings (64.7%) sat with the sponsor.

The counting method changed in 2024. Following a decision at the March 2025 GCP IWG plenary meeting, the 2024 report no longer counts minor findings, to align with the reporting requirements of the Clinical Trials Information System (CTIS). Percentages from 2024 are therefore comparable only with the major and critical figures of prior years, not their totals. On that consistent basis, monitoring is the third-largest subcategory in both 2024 and 2023, and the fifth-largest in 2022. The claim that "monitoring is among the most common causes of findings" holds for 2024 and 2023, and for 2022 only in the sense of "among the five largest subcategories."

What this means for monitoring in practice

Two threads converge here. Legally, Art. 71 CTR never shifts accountability for effective monitoring away from the sponsor, even when CRA and CRO teams carry out the work. On the inspection record, in all three years of GCP IWG reports the majority of critical findings, counted across all categories, sat with the sponsor: 64.7% (2022), 63.9% (2023) and 81.8% (2024). The fourth finding named in 2024, CRAs lacking direct access to electronic health or medical records, makes that concrete: a path of monitoring explicitly provided for under ICH E6(R3), remote access to source data, only holds up in practice if the sponsor actually establishes it technically and contractually before the monitoring plan is built on it.

Entourage provides CRAs for on-site, remote and risk-based monitoring under ICH E6(R3) and keeps sponsor oversight of delegated monitoring services documented, from the risk assessment in Clinical Monitoring to the steering of delegated services in CRO Support.