CRO Oversight Plan

Vitalis Therapeutics Inc. — Oversight of Meridian Clinical Research, which executes Phase 2 and Phase 3 for the VitaFlow (VTX-401) program under a $93,900,000 contract: the transfer of obligations under 21 CFR 312.52, governance forums, contracted KPIs, escalation, and what the sponsor must be able to demonstrate at inspection.

$93.9M

Contract value

Obligations retained

5/8

KPIs meeting

KPI misses

Contents

The Provision That Governs Everything Else
What Was Transferred
Why a Sponsor Still Has to Do Work
Governance Forums
Performance Against Contracted KPIs
Contract Structure
Escalation
Inspection Readiness

1. The Provision That Governs Everything Else

Under 21 CFR 312.52 a sponsor may transfer responsibility for any or all of its obligations to a contract research organization. The transfer must be described in writing. If not all obligations are transferred, the writing must describe each obligation being assumed.

“Any obligation not covered by the written description shall be deemed not to have been transferred.”

That single sentence inverts ordinary commercial contracting intuition. In most outsourcing, an ambiguity about scope is a negotiation — both parties argue, and the answer depends on the contract's construction. Here the answer is fixed in advance and it is always the same: silence means the sponsor kept it.

The default is retention. A sponsor that has not written an obligation down has not transferred it, however clearly both parties believed otherwise, and however competently the CRO has been performing it.

The corollary at 312.52(b) matters too: a CRO that assumes an obligation becomes subject to the same regulatory action as a sponsor for failing it. Transfer is real. It is simply not implicit, and it is not a way of making a duty disappear — it relocates the duty to a named party who is then answerable for it.

2. What Was Transferred

Meridian Clinical Research executes Phase 2 and Phase 3 under Decision D-04. The written transfer describes each obligation individually rather than relying on a general statement.

Obligation	Ref	Status	Detail
Selecting qualified investigators	`312.53`	Transferred	Meridian identifies and qualifies; Vitalis approves the final site list.
Shipping investigational product to sites	`312.59`	Transferred	Including accountability records and return of unused supply.
Monitoring the investigation	`312.56`	Transferred	Under the risk-based model agreed with Vitalis.
Maintaining trial records	`312.57`	Transferred	With Vitalis retaining right of access at any time, without notice.
Ensuring the investigation is conducted per the protocol	`312.56`	Shared	Meridian executes; Vitalis retains protocol interpretation.
IND maintenance and submissions	`312.31 / 312.33`	Retained	Vitalis is the IND holder. Not transferable in practice.
Safety reporting to FDA and investigators	`312.32`	Retained	Meridian collects and processes; the reporting obligation stays with Vitalis.
Informing investigators of new safety risks	`312.55`	Retained	Content approved by the sponsor medical monitor.
Selecting the general investigational plan	`312.23`	Retained	Sponsor duty.
Protocol interpretation and deviation decisions	`—`	Retained	Medical judgment. Escalated by Meridian, decided by Vitalis.

The retained column is the interesting one. Every item in it is either a duty attaching to the IND holder, or a matter requiring medical judgment. IND maintenance, safety reporting, informing investigators of new risks, the investigational plan, and protocol interpretation.

Those were not retained because Vitalis wanted more control. They were retained because delegating them would have created a structure in which the party making the judgment is not the party the agency holds answerable for the IND — and that gap is where programs get into trouble at inspection.

3. Why a Sponsor Still Has to Do Work

A recurring misconception, and the reason this plan exists: outsourcing execution does not outsource accountability for the investigation. 312.50 makes the sponsor responsible for selecting qualified investigators, ensuring proper monitoring, ensuring the investigation is conducted according to the plan and protocols, maintaining an effective IND, and ensuring FDA and all investigators are promptly informed of significant new risks.

A sponsor that has transferred monitoring still has to be able to demonstrate that monitoring happened and was adequate. That is not the same activity as monitoring, and it is the activity this plan governs.

The failure mode has a name and it is common. A sponsor signs a comprehensive contract, stands down its own capability, and treats the CRO's status reports as the ground truth. Nobody is doing anything wrong. The reports are accurate. But no one on the sponsor side is independently positioned to notice when they stop being complete.

Oversight is not distrust of the vendor. It is the recognition that the sponsor will be asked, at inspection, to show what it knew and when — and “our CRO told us it was fine” is not an answer, because under 312.50 that was the sponsor's obligation to verify.

4. Governance Forums

Forum	Cadence	Participants	Content
Operational call	Weekly	Clinical operations both sides	Enrolment, site issues, monitoring findings, action items.
Functional review	Monthly	Function leads	Data management, biostatistics, safety, regulatory — each reviewed against its own KPIs.
Joint program review	Quarterly	Program Director and Meridian account lead	KPI scorecard, change orders, risk register, escalations.
Executive governance	Twice yearly	Sponsor VP and Meridian executive sponsor	Relationship health, systemic issues, contract performance.
For-cause audit	As required	Vitalis Quality Assurance	Independent of clinical operations. Right of access is unconditional and requires no notice period.

Four scheduled tiers plus audit. The pattern is deliberate: operational contact is frequent and narrow, executive contact is infrequent and broad. A relationship that escalates everything to the quarterly review has no operating rhythm; one that never escalates has no visibility.

Note what the audit line says about notice. Quality Assurance right of access is unconditional and requires no notice period, and it sits outside clinical operations entirely. An audit that has to be scheduled with the party being audited, through the people who work with them daily, is not an audit.

5. Performance Against Contracted KPIs

KPI	Target	Actual	Status	Note
Site activation cycle time	≤18 weeks	22 weeks	miss	The program's central operational problem. Change order under negotiation.
Monitoring visit completion to schedule	≥95%	97%	meet
Monitoring report turnaround	≤10 business days	8 days	meet
Query resolution cycle time	≤15 days median	12 days	meet
SAE reconciliation completeness	100%	100%	meet	Safety database against clinical database. No tolerance band.
Protocol deviation reporting to sponsor	≤5 business days	4 days	meet
Data entry to database lock readiness	≤20 days from last visit	not yet measurable	pending	Measured from first site reaching last-patient-out.
Staff turnover on the program team	≤15% annualized	23%	miss	Escalated. Turnover on a study team costs continuity that no KPI fully captures.

Two misses, and they are related in a way the scorecard does not show.

Site activation at 22 weeks against an 18-week target is the program's central operational problem — it is the origin of the 76-participant enrolment shortfall traced in the Enrolment Dashboard and diagnosed in the Site Management Plan.

Staff turnover at 23% against a 15% target looks like a softer, more administrative miss. It is very likely the cause of the first. Site activation is relationship work — contract negotiation, ethics submissions, chasing documents through institutions that have no deadline of their own. A study start-up team losing a quarter of its people annually loses precisely the accumulated relationships that make that work move.

Everything else is meeting target, and two KPIs are worth noticing for their absence of a tolerance band: SAE reconciliation completeness is 100% or it is a finding, and protocol deviation reporting is a compliance obligation rather than a service level.

6. Contract Structure

Element	Position
Model	Fixed price by work package with a stated rate card for change orders
Work packages	3 — one per stage, released by notice at each gate
Contracted value	$93,900,000
Change orders approved	4, totaling $3,100,000
Change orders in dispute	1

Work is staged to tranches, as set out in the Program Budget §6. A program cannot contract scope whose funding a future gate may decline to release — committing the full Phase 3 CRO scope at Gate 3 would have created a liability the program had no authority to fund, and would have made a RECYCLE or KILL outcome at Gate 4 expensive in a way that quietly discourages a committee from choosing it.

The disputed change order concerns site activation. Meridian's position is that the 22-week cycle time reflects institutional contracting and IRB timelines outside its control. Vitalis's position is that the 18-week target was set on Meridian's own historical performance data, submitted during vendor selection.

Both positions have merit, which is what makes it a dispute rather than a breach. It sits at Level 3 escalation and will resolve either as a change order or as an accepted service-level adjustment with a revised target — not as a demand that a partner absorb a cost the program's own timeline assumption helped create.

7. Escalation

Level	Route	Trigger
Level 1	Study manager to Meridian project manager	Operational, resolved in-week.
Level 2	Vitalis clinical operations lead to Meridian director	Repeated operational failure or a KPI miss in two consecutive periods.
Level 3	Program Director to Meridian account lead	Systemic issue, contract interpretation, or a change order in dispute.
Level 4	Development Committee to Meridian executive sponsor	Material breach, or performance threatening a gate deliverable.

Escalation is routine, not adversarial. A relationship in which raising an issue is treated as an accusation will surface issues late, which is the only outcome that actually damages a program.

One route bypasses this table entirely. Anything touching participant safety does not escalate through commercial governance. It goes to the sponsor medical monitor and, where relevant, to the Data Monitoring Committee — immediately, without passing through the account relationship.

A safety concern routed through Level 1 would be discussed by two project managers whose shared objective is delivering a study on time. That is the wrong forum, staffed by the wrong people, optimizing for the wrong thing.

8. Inspection Readiness

At a sponsor inspection, the agency will ask what the sponsor knew, when it knew it, and what it did. Oversight documentation is the answer to all three, which is why it is maintained as evidence rather than as project administration.

Evidence	Demonstrates
Written transfer of obligations	Which duties moved and which did not, per 312.52
Minuted governance meetings with actions and closure	Active oversight, not passive receipt
KPI scorecards over time	That performance was measured, not assumed
Escalation records with outcomes	That issues were raised and resolved
QA audit reports and CAPA closure	Independent verification
Monitoring visit reports reviewed by the sponsor	That the sponsor read them — review, not filing
Records of sponsor decisions on escalated matters	That retained judgment was actually exercised

Programs do not fail on the first four. They fail on the fifth. A sponsor that retained protocol interpretation but has no record of ever interpreting anything has a documentation problem that looks exactly like a delegation problem. Retaining an obligation on paper and never exercising it is, in practice, indistinguishable from having transferred it without saying so — and under 312.52 an untransferred obligation is still the sponsor's.