Interactive Response Technology Software Vendor Oversight Requirements

What sponsor responsibilities remain when IRT tasks are delegated?

Interactive response technology (IRT) systems support trial processes such as participant randomization, treatment assignment, drug dispensing, and inventory management. Because IRT can affect participant safety, treatment allocation, blinding, and trial data, sponsors should oversee its use as a trial-critical computerized system.

For an FDA-regulated drug investigation, a sponsor may transfer some or all obligations under 21 CFR Part 312 to a contract research organization (CRO), but the transfer must be described in writing. If only some obligations are transferred, the writing must identify which ones the CRO assumes. A sponsor using an IRT vendor should not assume that a general software-services contract itself transfers regulatory obligations; document who is responsible for each activity and confirm that the arrangement fits the applicable regulations. See 21 CFR 312.52 on transfers of obligations to CROs.

FDA’s current Good Clinical Practice guidance says sponsors may transfer trial-related activities to service providers, while emphasizing sponsor responsibility for oversight and for participant protection and reliable trial data. The sponsor should assess the provider’s suitability, oversee important transferred activities—including subcontracted work—and have access to relevant information such as procedures and performance metrics. These are guidance recommendations; applicable regulations remain controlling. See FDA’s September 2025 E6(R3) Good Clinical Practice guidance.

In practice, retain accountability for deciding whether the IRT is fit for the trial, approving protocol-specific design and changes, ensuring required testing is adequate, monitoring issues that could affect participants or trial results, and ensuring records remain available. Assign operational tasks to the vendor where appropriate, but keep sponsor decision-making, escalation, and oversight responsibilities explicit.

How to qualify an IRT software vendor before use

Qualify the vendor against the IRT’s intended use and the trial’s risks, rather than relying on a general claim that its platform is “validated” or “compliant.” Consider whether the vendor can support the planned countries, sites, languages, treatment arms, supply model, blinding arrangements, integrations, and expected enrollment. Assess its quality processes, technical capability, staffing, support coverage, and ability to preserve records throughout the trial.

Request IRT vendor qualification documentation appropriate to the service and risk. This may include descriptions of the quality management system, standard operating procedures, software development and maintenance processes, validation approach, release and change control, incident management, user support, security controls, backup arrangements, disaster recovery and contingency planning, and any relevant subcontractors. Review the vendor’s ability to report defects, outages, security incidents, and other events that could affect participant safety or data reliability.

FDA recommends that sponsors assess service-provider suitability and have access to information needed for selection and oversight. Its electronic-systems guidance also identifies vendor documentation that can help assess whether a system is fit for purpose, including development and validation processes, functional testing, and change-control procedures. See FDA E6(R3), section 3.6 and the FDA guidance on electronic systems in clinical investigations.

Document the qualification rationale, identified risks, evidence reviewed, open issues, and approval decision. A vendor audit or assessment can be one source of evidence, but it does not replace a trial-specific assessment of the system, configuration, interfaces, and support arrangements.

What validation and trial-specific testing should sponsors review?

Review computerized system validation evidence for the system’s intended use, including the configured IRT workflows and trial-specific requirements. FDA describes validation as establishing and documenting that system requirements can be consistently fulfilled, using a risk-based approach. Its guidance recommends that validation address relevant functionality, protocol-specific configurations, customizations, data transfers, and interfaces, and that computerized systems be validated before use in an investigation. See the FDA electronic-systems guidance.

Ask for enough evidence to evaluate the system—not just a certificate or summary statement. Depending on the system and risk, review the requirements and specifications, risk assessment, traceability between requirements and tests, test plans and results, defect disposition, release documentation, and evidence supporting interfaces and data migration. Review user acceptance testing (UAT) showing that authorized trial users can perform critical workflows correctly in the configured environment.

Trial-specific testing should exercise scenarios that could affect treatment or trial conduct, such as participant eligibility checks, randomization, allocation concealment, visit schedules, dispensing rules, resupply thresholds, inventory handling, emergency unblinding, and user permissions. Test relevant boundary cases and error handling, including duplicate requests, incorrect inputs, unavailable integrations, and recovery from interruptions. Include regression testing for critical functions when changes could affect them.

Agree on how test defects will be categorized, corrected, retested, and approved before go-live. The sponsor should document its review of the validation evidence and its conclusion that the IRT is fit for the intended trial use. The extent of validation and testing should be proportionate to the system’s functions and the potential effect on participant rights, safety, and trial-result reliability—not treated as a one-size-fits-all checklist.

Which responsibilities and change controls belong in vendor agreements?

Use a written agreement and responsibility matrix to identify the sponsor’s and vendor’s duties across configuration, validation support, testing, release, training, operational support, incident handling, data transfers, and record retention. Define sponsor approval points, escalation contacts, response and notification expectations, service reporting, and how the sponsor can review relevant procedures and performance information. For obligations transferred to a CRO under Part 312, clearly document the specific obligations being transferred as required by 21 CFR 312.52.

Specify how both planned and urgent changes will be assessed, approved, tested, documented, and communicated. The agreement should address software releases, patches, security updates, configuration changes, interface changes, infrastructure changes that could affect the system, and subcontractor changes. Require the vendor to provide impact information early enough for the sponsor to assess risks to trial operations, data, blinding, and participant safety.

For a protocol amendment, establish a protocol amendment change control process. The sponsor and vendor should identify which IRT functions and trial materials may be affected—for example, eligibility or visit rules, randomization strata, treatment arms, dosing or dispensing instructions, supply settings, site workflows, and data exchanges. Document approvals, testing and regression-testing decisions, training or communication needs, implementation timing, and the process for handling participants already in the system. Not every amendment requires the same testing; the scope should follow a documented risk and impact assessment.

Also agree on business continuity, backup and recovery responsibilities, disaster recovery and contingency planning, and how the parties will maintain access to trial records if the service ends or the vendor changes. FDA’s guidance recommends documented change control and evaluation of changes over the system lifecycle. See the FDA electronic-systems guidance.

How to protect IRT data integrity and restrict system access

Require controls that preserve the attribution, accuracy, completeness, and traceability of IRT records. Use unique user accounts, appropriate authentication, least-privilege permissions, and role-based access controls that separate sponsor, site, pharmacy, and vendor functions as appropriate. Keep a current record of authorized users, their roles, and permissions; establish procedures for approving access, reviewing it periodically, and promptly removing or changing access when responsibilities change.

Access should reflect documented study responsibilities and applicable site delegation arrangements. FDA’s E6(R3) guidance recommends maintaining user and permission records and ensuring investigator-site access is consistent with investigator delegations and visible to the investigator. It also recommends addressing user management, audit trails, backups, disaster recovery, and IT security in computerized-system procedures. See FDA E6(R3).

Ensure that system records can show who performed an action and when, and that changes do not obscure prior information. Where required by the applicable regulations, 21 CFR Part 11 includes controls for closed systems such as validation, access limitation, authority checks, and secure, computer-generated time-stamped audit trails. Applicability depends on the electronic records and regulatory requirements involved; do not assume that simply labeling a system “Part 11 compliant” establishes compliance for a particular use. See 21 CFR 11.10 and FDA’s Part 11 scope and application guidance.

Plan audit trail review based on trial risk and the records involved. Define which IRT actions and metadata require review, who reviews them, how often, and how findings are escalated and documented. Review may focus on critical events such as allocation changes, unblinding, dispensing changes, user-access changes, and corrections. FDA’s E6(R3) guidance recommends planned, risk-based review of trial-specific data, audit trails, and relevant metadata; it also recommends that audit trails and logs remain interpretable and that their integrity be protected. See FDA E6(R3), section 4.2.

Define reconciliation procedures for IRT data transfers and related trial records. IRT data reconciliation may compare randomization and treatment assignment records with relevant EDC records, dispensing and inventory records, or other systems, as appropriate to the trial. Investigate discrepancies, document their resolution, and preserve traceability. FDA recommends validated transfer processes or other appropriate processes such as reconciliation to help maintain the integrity and confidentiality of transferred electronic data. See FDA E6(R3). For more on data integrity, see our related resource.

How to monitor vendor performance and manage system changes

Set up ongoing, risk-based oversight rather than treating vendor qualification as a one-time event. Review agreed performance measures, unresolved defects, deviations, support requests, availability, incident reports, security events, and corrective and preventive actions. Escalate issues that may affect participant safety, treatment assignment, blinding, supply, or data reliability. FDA’s E6(R3) guidance recommends oversight of important activities transferred to service providers, including subcontracted activities, and access to relevant performance information. See FDA E6(R3), section 3.6.

Maintain a change process that records what changed, why it changed, who approved it, what risks were assessed, and what verification or validation was performed. Before implementation, determine whether a change affects trial-specific configuration, interfaces, permissions, audit trails, data transfers, or previously validated functions. Document whether regression testing or additional user testing is needed, and confirm successful implementation before relying on the changed system.

For protocol amendments, coordinate IRT changes with approved protocol documents, site communications, supply plans, and related systems. Define cutover timing, participant-record handling, and checks to confirm that the new configuration is active only when intended. After implementation, monitor for unexpected behavior and reconcile relevant records where appropriate.

Keep contingency procedures usable and known to affected staff. They should explain how the trial can continue safely during an outage, how actions taken outside the system will be captured, and how records will be reconciled after recovery. Test recovery arrangements as appropriate to risk and document results. FDA’s electronic-systems guidance recommends evaluating and documenting system changes and addressing contingency planning and backup and recovery. See the FDA electronic-systems guidance.

What records must be retained for regulatory inspections?

Retain records sufficient to show that the IRT was suitable for its intended use and that trial activities performed through it can be reconstructed. Depending on the system and study, the inspection-ready file may include the vendor assessment and qualification decision; the responsibility matrix and agreements; system descriptions and versions; validation and trial-specific testing evidence; approvals and release records; training records; change controls; issue and incident records; access and permission records; audit trail review documentation; relevant data-transfer and reconciliation evidence; and backup, recovery, and contingency records.

Ensure that records can be retrieved in a readable and usable form, with relevant metadata and audit trails preserved. FDA’s computerized-systems guidance says study documentation should identify computerized systems used to create, modify, maintain, archive, retrieve, or transmit data, and notes that FDA may inspect records supporting submissions. It also emphasizes preserving the ability to retrieve and review older study data and relevant information needed to reconstruct how data were managed. See the FDA guidance on computerized systems used in clinical trials.

Do not assume one retention period applies to every IRT record or every type of investigation. For records and reports required under the IND regulations, 21 CFR 312.57(c) specifies sponsor retention periods tied to marketing approval or, if the drug is not approved, discontinuation of investigational shipments and notification to FDA. Other applicable requirements may set different periods. Document the applicable schedule, ensure the vendor agreement supports it, and arrange for secure transfer or continued access if the service ends. FDA’s E6(R3) guidance also recommends informing service providers in writing of essential-record retention requirements and when records are no longer needed under applicable requirements. See FDA E6(R3), section 3.16.

In summary, effective IRT vendor oversight combines documented qualification, risk-based validation and testing, clear written responsibilities, controlled access and changes, ongoing performance monitoring, and inspection-ready records retained for the applicable period.

FAQs

Who is ultimately responsible for trial compliance when IRT services are outsourced?

The sponsor remains responsible for appropriate oversight of trial-related activities and for ensuring that delegated work is suitably managed. For IND studies, certain obligations may be transferred to a CRO through a written agreement under 21 CFR 312.52; the agreement should identify which obligations are transferred. FDA’s E6(R3) guidance emphasizes sponsor oversight and responsibility for participant protection and reliable trial data. The precise regulatory requirements depend on the trial and applicable regulations.

What validation documents should an IRT vendor provide?

Request evidence that lets you assess fitness for the intended trial use, such as the system description, requirements, risk assessment, validation approach, test plans and results, traceability, relevant interface and transfer testing, UAT evidence, defect resolution, and change-control records. The appropriate scope depends on system functionality and risk. The sponsor should document its review and conclusion; a vendor certificate or general validation statement alone may not establish that a specific trial configuration is fit for use.

How should sponsors assess IRT changes after a protocol amendment?

Use documented change control to identify affected settings, workflows, integrations, user roles, and trial records. Assess risks to treatment assignment, blinding, dispensing, inventory, and data transfers; determine what testing or regression testing is warranted; and document approvals, implementation timing, training, and post-change checks. Scale the testing to the change and its potential impact rather than assuming every amendment requires identical revalidation.

What IRT records should be available during a regulatory inspection?

Be prepared to provide relevant vendor qualification and oversight records, agreements and responsibility assignments, system and version information, validation and trial-specific test evidence, access and audit trail records, change controls, incident documentation, data-transfer and reconciliation evidence, and applicable retention records. Records should be retrievable and usable for review, with relevant metadata preserved. Retention periods depend on the applicable regulatory requirements and record type.