How to select and audit a CRO in Russia and the EAEU under the GCP Rules in force since 10 March 2026.
The sponsor of a clinical trial (the organization or person responsible for initiating, organizing and financing it) is also responsible for the subcontractors of its contract research organization (CRO). Under the Rules of Good Clinical Practice (GCP) of the Eurasian Economic Union (EAEU), approved by Decision of the Council of the Eurasian Economic Commission (EEC) No. 79 of 3 November 2016 (the GCP Rules), the sponsor controls all functions performed on its behalf, including those that a CRO has passed to third parties under a subcontract. Since 10 March 2026 the GCP Rules have applied in the edition of EEC Council Decision No. 63 of 1 August 2025 (Decision No. 63). Decision No. 63 restated the GCP Rules in a new edition in full and entered into force 180 calendar days after its official publication. It was published on 11 September 2025, so the period ended on 10 March 2026. Decision No. 63 has no transitional provisions.
Under the GCP Rules, a CRO performs one or more of the sponsor’s duties and functions related to the conduct of a trial under a contract with the sponsor. Responsibility for the quality and completeness of the data stays with the sponsor. In Russia, Federal Law No. 61-FZ of 12 April 2010 «On the Circulation of Medicines» (61-FZ) allows legal entities of any organizational and legal form to be engaged in organizing clinical trials, if the trials comply with the requirements of that law. Clinical trials are conducted under the rules of good clinical practice approved by the EEC. If these rules are violated in a way that affects the completeness or reliability of the trial, the trial is suspended under 61-FZ.
What the GCP Rules said about CROs before 10 March 2026
Under the 2016 edition, the sponsor could pass duties and functions to a CRO, but responsibility for the quality and completeness of the data stayed with the sponsor. The transfer was documented, and everything not transferred remained with the sponsor.
Quality was assured and controlled through systems with standard operating procedures (SOPs, detailed written instructions for performing an activity in a uniform way). As a general rule, monitoring meant visiting trial sites before the trial, during it and after it; monitoring without visits was allowed in exceptional cases. If an investigator or a sponsor employee failed to comply with the requirements, the sponsor acted without delay.
What changed on 10 March 2026
Table 1. GCP Rules before and after 10 March 2026
| Parameter | 2016 edition | Edition of Decision No. 63 (from 10 March 2026) |
|---|---|---|
| Quality system | Quality assurance and quality control systems with SOPs | Risk-based quality management system: critical processes and data, risk identification, assessment and control, documentation of measures, periodic review |
| Transfer of functions to a CRO | Documented transfer | Documented transfer and sponsor control over all functions, including those the CRO passed to subcontractors |
| Monitoring | Site visits as a general rule, exceptions in special cases | Approach based on priorities and risks: on-site, combined or, if justified, centralized-only monitoring; monitoring plan that takes risks into account |
| Electronic systems | Validation, SOPs, audit trail, protection against unauthorized access | The same requirements plus risk-based validation, SOPs covering the whole life cycle of the system, user training, data integrity during upgrades and migration |
| Non-compliance | Prompt action by the sponsor | In addition, root cause analysis and corrective and preventive actions where non-compliance significantly affects the protection of subjects or the reliability of results |
| Clinical study report | Description of the systems for assuring and controlling data quality | Description of the quality management approach and of important deviations from tolerance limits |
The sponsor keeps a quality management system running at all stages of the trial, and the methods of quality assurance and control must be proportionate to the risk and to the importance of the information collected. When developing the protocol, the sponsor identifies the processes and data that are critical for the protection of subjects and the reliability of results. It considers risks at the level of the system, that is, SOPs, computerized systems and personnel, and at the level of the individual trial. The sponsor then assesses the risks by the likelihood of an error, the ability to detect it and its effect on the protection of subjects and the reliability of results, and decides which risks to reduce and which to accept. Measures to reduce risks can be included in the protocol, monitoring plans, agreements between the parties on the allocation of duties, system mechanisms for compliance with SOPs, and training. The sponsor documents the measures, communicates them to the persons involved and periodically checks how effective they are.
To spot systemic problems, the sponsor sets tolerance limits for the quality of trial parameters in advance. When a parameter goes beyond its limit, the sponsor assesses whether measures are needed. The quality management approach and important deviations from tolerance limits are described in the clinical study report, in accordance with the GCP Rules requirements for its structure and content.
If the CRO passed the analysis of samples to a central laboratory and the storage of trial data to an electronic data capture (EDC) system vendor, the sponsor controls these functions too, although the CRO signed the contracts with the laboratory and the vendor.
The sponsor chooses the monitoring strategy and documents its justification, for example in the monitoring plan. Centralized monitoring means a remote assessment of the collected data by qualified persons, for example data management specialists and biostatisticians. It helps to identify missing and inconsistent data, outliers, trends within and between sites and signs of data manipulation, and to choose sites for targeted visits. The monitoring plan describes the strategy, the allocation of monitoring duties among all parties, the methods and the reasons for using them, and the monitoring of critical data and processes. After each site visit or trial-related contact, the monitor gives the sponsor a written report, and the sponsor documents its review of the report and the follow-up actions. Reporting on centralized monitoring must be regular and may not depend on visits.
Recommendation of the Board of the EEC No. 25 of 19 September 2023 «On the Guideline on Data Integrity and Validation of Computerized Systems» (Recommendation No. 25) is addressed to member states, which are recommended to take the Guideline into account. The Guideline was written for the rules of good manufacturing practice (GMP), and for clinical practice it allows voluntary use. The section on outsourcing contains two provisions that can be used when working with a CRO: initial qualification and periodic requalification of suppliers with data integrity risks in mind, and regular reviews of supplier-related risks. Quality agreements are covered below. Mandatory requirements for electronic systems in clinical trials are in the GCP Rules themselves.
How to select a CRO and what to request before an audit
The GCP Rules do not set a procedure for selecting a CRO. The sponsor decides to whom to pass functions and is responsible for the result. A request for information (RFI) can be used for selection and, in a competitive procedure, a request for proposal (RFP). The GCP Rules do not name these procedures. The requests below confirm compliance with specific requirements of the GCP Rules.
All persons conducting the trial must have the education, training and experience for their tasks, and the qualifications of monitors are documented. The RFI can therefore ask for the structure of the clinical operations, quality, pharmacovigilance and data management units, the CVs of project managers, records of GCP training and the number of trial sites per monitor.
For data capture, randomization and document storage systems, the sponsor needs documented confirmation of validation and SOPs for use, so the RFI can ask for a list of systems, validation reports and SOPs. A CRO’s experience can be assessed by the disease concerned, by the number of sites it has worked with in EAEU member states, and by its history of inspections by authorized bodies, with the findings and the time taken to close them. The RFI can also ask for a list of subcontractors, the contracts with them and confirmation of the sponsor’s right to audit a subcontractor.
The requests relate to the systemic risks named in the GCP Rules: SOPs, computerized systems and personnel. RFI answers can be compared in a scoring table whose criteria and weights were approved before the answers were received. After the RFI, a shortlist of CROs is drawn up for a qualification audit (an audit carried out before a CRO is chosen, to assess its ability to perform the functions).
What to check in a CRO audit
A sponsor audit (a systematic and independent examination of activities and documentation) is conducted by persons who are independent of the trial and whose qualifications are documented. An audit can include a review of documents (the CRO’s organization chart, SOP register, document templates, system validation reports), a visit to the CRO’s office or a remote check, and interviews with heads of units.
Table 2. Areas of a CRO audit
| Area | What to request and look at |
|---|---|
| Quality system | SOP hierarchy and change procedure, deviation log, procedure for corrective and preventive actions (CAPA) |
| Personnel and training | CVs and records of GCP training, qualifications of monitors, staff turnover on the project, workload per monitor |
| Electronic systems and data | Validation reports for EDC and other systems, audit trail, list of persons authorized to make changes, backup and restoration, compliance of data with the ALCOA+ criteria (attributable, legible, contemporaneous, original, accurate, complete, consistent, enduring, available, according to Recommendation No. 25) |
| Monitoring | Monitoring plan with a justified strategy, visit reports and centralized monitoring reports, procedure for escalating problems to the sponsor |
| Safety | Procedure for receiving and forwarding reports of suspected unexpected serious adverse reactions (SUSARs), compliance with deadlines, reconciliation with the sponsor’s pharmacovigilance database |
| Subcontractors and archive | List of subcontractors and contracts with them, right to audit a subcontractor, conditions for storing trial documents |
The audit can check a sample: the personnel files of several employees, monitor reports on several visits together with the sponsor’s letters and the answers to them, and entries in the trial document storage system. In an electronic system, the auditor can ask to see the audit trail, that is, documentation that allows the course of events to be reconstructed. Changes to data must be documented, and data entered earlier are not deleted. Corrections in the case report form (CRF, the document for entering the information required by the protocol for each subject) are signed, dated and, where necessary, explained, without hiding the original entry.
The sponsor’s essential documents are kept for at least 2 years from the approval of the last registration application for the product in a member state and until no application is pending and none is planned, or for at least 2 years from the official end of the clinical phase of development. They are kept longer if applicable rules or the needs of the sponsor so require. If the CRO keeps the archive, these periods can be set in the contract.
The subject, methods and frequency of audits are determined by the sponsor’s written procedures. In planning, the sponsor takes into account the importance of the trial for applications to authorized bodies, the number of subjects, the type and complexity of the trial, the degree of risk to subjects and problems identified earlier. Audit findings and conclusions are documented. If the law of a member state requires it, the sponsor provides proof that the audit was carried out. Authorized bodies should not routinely request audit reports, but may request them where there is evidence of serious non-compliance with the GCP Rules or in court proceedings.
Responsibilities matrix and quality agreement
The sponsor allocates all duties before the trial starts, documents the transfer of functions to the CRO and keeps what it has not transferred. The GCP Rules do not name a responsibilities matrix. To meet these requirements, it can have a row for each function (monitoring, data management, biostatistics, pharmacovigilance, work with the central laboratory) stating who performs it, who controls it and under which document.
The GCP Rules name agreements between the parties that define the allocation of duties among the measures for reducing risks. Recommendation No. 25 proposes quality agreements with provisions on data integrity and on immediately informing the customer of integrity failures on the contractor’s side.
A quality agreement can include:
quality indicators for the CRO’s work and tolerance limits, beyond which the CRO notifies the sponsor;
a procedure for escalating problems and response times;
the period within which the CRO informs the sponsor of a request or inspection by an authorized body;
the CRO’s internal deadlines for forwarding SUSAR reports to the sponsor;
the sponsor’s right to audit the CRO and its subcontractors and the obligation to ensure direct access for inspections, that is, permission to examine, analyze, verify and copy the records and reports needed to evaluate the trial;
the deadline for submitting a CAPA plan after the audit report and the procedure for checking that it is carried out.
The sponsor’s deadlines for SUSARs are set by the GCP Rules in the procedure for submitting safety information. For reactions that led to death or were life-threatening, the sponsor reports immediately and no later than 7 calendar days from the date it receives the information. For other SUSARs, it reports no later than 15 calendar days from the date it receives the information. The GCP Rules do not say from which date the sponsor counts the period if the CRO received the information first. The CRO’s internal deadline in the agreement can be tied to the date the CRO received the information and made shorter than the sponsor’s deadlines.
The contract can also provide for the exit procedure: handover of trial documents and data, access to systems during inspections, and the storage period for the archive. The transfer of ownership of data is brought to the attention of authorized bodies in accordance with applicable requirements.
Audit findings and corrective actions
The GCP Rules speak about non-compliance by the investigator (the medical organization) and by a sponsor employee. Such non-compliance leads to prompt action by the sponsor. If the non-compliance significantly affects, or may affect, the protection of subjects or the reliability of results, the sponsor must analyze the causes, establish the root cause and take corrective and preventive actions (CAPA). A CRO is not mentioned in this provision. The GCP Rules provisions on the sponsor apply to the CRO to the extent that it has taken on the sponsor’s duties and functions. The CRO’s obligation to prepare and carry out a CAPA plan can be set in the quality agreement.
If monitoring or an audit reveals serious or repeated non-compliance by the investigator (the medical organization), the sponsor ends its participation in the trial and promptly notifies authorized bodies. When the CRO did the monitoring, responsibility stays with the sponsor, so the agreement can require the CRO to pass such signals to the sponsor without delay.
The GCP Rules set neither a deadline for a CAPA plan nor a procedure for working with it. The sponsor can set them in its procedures: checking the root cause found, approving the plan, tracking its implementation, and a repeat audit where findings are significant. The grounds for unscheduled audits can be written into SOPs, for example problems identified earlier.
What the inspector checks and what the sponsor risks
An inspection (an official examination by an authorized body) covers documents, infrastructure, records, quality assurance agreements and other sources that may be at the trial site, at the sponsor’s facilities, at the CRO or at other organizations. The sponsor is responsible for the agreement of all parties involved to direct access to sites, source data (information from original medical records and their certified copies that allows the course of the trial to be reconstructed) and reports, for monitoring, audit and inspections by authorized bodies of member states and third countries. The agreement can be set out in the contracts with the CRO and its subcontractors.
In Russia, the consequences of violations are set out in 61-FZ. If the federal authority exercising control and supervision in healthcare finds violations of the rules of good clinical practice that affect the completeness or reliability of the trial, it suspends the trial and issues the medical organization an order to remedy the violations. If the organization does not remedy them in time, the authority decides to terminate the trial and sends its conclusion to the federal authority responsible for regulatory policy in healthcare, so that the trial authorization is cancelled from the date of suspension. Violating the rules of good clinical practice and falsifying results entail liability under the laws of the Russian Federation.
The data of trial participants are governed by Federal Law No. 152-FZ of 27 July 2006 «On Personal Data» (152-FZ). When personal data are collected, the recording, systematization, accumulation, storage, updating and retrieval of the personal data of Russian citizens in databases outside Russia are not allowed, except in the cases that 152-FZ lists. Before the contract is signed, the sponsor should therefore find out where the EDC servers and the trial document storage are physically located and obtain a legal assessment of whether the processing falls under the exceptions. The GCP Rules are the same for EAEU member states, while national rules on personal data and on trial authorizations are checked separately in each country.
What to do
Check current contracts and responsibilities matrices against the GCP Rules edition of 10 March 2026. Take the contracts for current trials and check three things: whether all functions are allocated, whether control over the CRO’s subcontractors is set out, and whether there is an obligation to ensure direct access for inspections.
Sign or update the quality agreement. Include indicators and tolerance limits, the escalation procedure, the CRO’s internal SUSAR deadlines, the right to audit the CRO and its subcontractors, the deadline for a CAPA plan and the conditions for exiting the contract.
Draw up a risk-based plan of CRO audits. Set the scope and frequency of scheduled audits by the importance of the trial for applications, the number of subjects, the complexity of the trial and the risk to subjects, and put the grounds for unscheduled audits into SOPs. Appoint auditors who are independent of the trial.
Ask the CRO for confirmation on electronic systems. You need validation reports, SOPs, the list of persons authorized to make changes, the backup scheme and the address where the servers are located. Give the address to a lawyer for assessment under 152-FZ.
Keep the documents on oversight of the CRO in one place. Include the justification for choosing the CRO, audit results, the monitoring plan with the justification of the strategy, monitoring reports, the CAPA log and the responsibilities matrix. The clinical study report must describe the quality management approach and important deviations from tolerance limits.
Regulatory framework:
1. Decision of the Council of the Eurasian Economic Commission No. 79 of 3 November 2016 «On Approval of the Rules of Good Clinical Practice of the Eurasian Economic Union» (as amended by Decision of the EEC Council No. 63 of 1 August 2025, applies from 10 March 2026)
2. Decision of the Council of the Eurasian Economic Commission No. 63 of 1 August 2025 «On Amendments to the Rules of Good Clinical Practice of the Eurasian Economic Union»
3. Recommendation of the Board of the Eurasian Economic Commission No. 25 of 19 September 2023 «On the Guideline on Data Integrity and Validation of Computerized Systems»
4. Federal Law No. 61-FZ of 12 April 2010 «On the Circulation of Medicines» (as amended on 4 August 2026)
5. Federal Law No. 152-FZ of 27 July 2006 «On Personal Data» (as amended on 26 July 2026)