Contract Research Organization (CRO)

A Contract Research Organization (CRO) is a company — for-profit or nonprofit — that a clinical trial sponsor contracts to perform one or more trial-related duties and functions on the sponsor’s behalf: site selection and management, clinical monitoring, data management, biostatistics, pharmacovigilance, regulatory submissions, and/or overall trial management. A CRO is defined by that contractual relationship, not by size or specialty — a company only counts as “the CRO” for a given trial with respect to the specific duties a written agreement actually transfers to it; any duty not explicitly transferred stays with the sponsor.

What Makes an Organization a CRO (Operational Definition)

Under ICH E6(R2) Good Clinical Practice, Section 5.2 (“Contract Research Organization”), a sponsor may transfer any or all of its trial-related duties and functions to a CRO, but the ultimate responsibility for the quality and integrity of the trial data always remains with the sponsor — delegation of tasks is not delegation of accountability. Any duty transferred to a CRO must be specified in writing, and the sponsor is required to maintain oversight of everything carried out on its behalf, including work the CRO itself subcontracts to a further party. Anything not explicitly transferred in writing is retained by the sponsor by default.

For US FDA-regulated drug and biologic trials, 21 CFR 312.52 (“Transfer of obligations to a contract research organization”) establishes the same structure in binding regulatory text: “A sponsor may transfer responsibility for any or all of the obligations set forth in this part to a contract research organization.” The transfer must be described in writing — a general statement is acceptable only if all obligations are transferred; a partial transfer must itemize exactly which obligations move. A CRO that assumes a sponsor obligation “shall comply with the specific regulations in this chapter applicable to this obligation” and is subject to the same FDA regulatory action as a sponsor for failing to meet it.

Practically, this means an organization is acting as a CRO for a given trial when: (1) it is a legally distinct entity from the sponsor, (2) it is performing sponsor-side trial functions under a written contract (a Clinical Trial Agreement, master services agreement, and/or work order), and (3) the specific functions it has assumed — and, by exclusion, the ones it hasn’t — are documented rather than assumed informally. A company that merely supplies staff to work under the sponsor’s own procedures and management (see the FSP model below) is still a CRO in the contractual sense, even though day-to-day control looks different from a full-service engagement.

The Sponsor-CRO Relationship and the ICH E6(R2) Delegation Framework

Because ICH E6(R2) §5.2.4 states that references to “sponsor” throughout the guideline apply equally to a CRO to the extent it has assumed sponsor duties, a CRO operating under a properly documented transfer effectively steps into the sponsor’s regulatory shoes for those specific functions — while the sponsor never actually steps out of ultimate accountability. This produces the delegation-of-duties framework research administrators and sponsor oversight staff work within day to day:

• Written transfer. The Clinical Trial Agreement and any associated task orders/work orders enumerate exactly which duties move to the CRO (e.g., monitoring, safety reporting, data management) versus which the sponsor retains (e.g., final medical/safety decisions, regulatory strategy).
• Sponsor oversight of the CRO. ICH E6(R2) requires the sponsor to actively oversee CRO-performed functions — not simply contract them out and disengage. In practice this is documented through vendor oversight plans, periodic CRO performance/quality reviews, co-monitoring or audit visits, and review of CRO-generated monitoring reports and metrics.
• Oversight extends to CRO subcontractors. If the CRO further subcontracts a function (e.g., to a central lab or an imaging vendor), the sponsor’s oversight obligation follows the work, not just the direct contractual counterparty.
• Site-level delegation is separate but related. At the investigational site, the Principal Investigator maintains a delegation-of-authority log assigning specific trial tasks to qualified site staff. CRO-employed Clinical Research Associates (CRAs) perform the ICH E6(R2) §1.38 “monitor” function — verifying that a site is conducting, recording, and reporting the trial per protocol, sponsor SOPs, GCP, and applicable regulations — but they monitor the site; they do not sit on the site’s own delegation log the way site-employed staff do.

Full-Service vs. Functional Service Provider (FSP) CRO Models

Sponsors typically engage CROs under one of two broad commercial models, or a hybrid of the two:

• Full-service CRO. The CRO takes end-to-end operational responsibility for some or all of a trial — site selection and start-up, monitoring, data management, biostatistics, medical writing, pharmacovigilance, and regulatory submissions — typically under the CRO’s own systems, SOPs, and project-management structure, with a single point of operational accountability back to the sponsor. This is the traditional CRO engagement model and remains standard for sponsors without large internal clinical operations infrastructure. Large full-service CROs operating at global scale include organizations such as IQVIA, ICON, Parexel, and Labcorp Drug Development — named here only as illustrative examples of the model, not as a recommendation or exhaustive list.
• Functional Service Provider (FSP). The sponsor contracts a CRO for one or more discrete functions only — commonly clinical monitoring, data management, biostatistics, medical writing, or pharmacovigilance — while retaining direct day-to-day control of cross-functional integration and priorities in-house. FSP staff (e.g., CRAs) typically work as an extension of the sponsor’s own team, embedded in the sponsor’s systems and processes, often across multiple studies or the sponsor’s full portfolio rather than a single trial. FSP arrangements can be single-function, multi-function, or blended with a full-service engagement for other parts of the same program.

The two models trade off differently: full-service favors operational simplicity and a single accountable party for interdependent work; FSP favors sponsor control, process consistency across a portfolio, and cost flexibility, at the price of the sponsor itself owning more cross-vendor integration. Neither model changes the underlying ICH E6(R2)/21 CFR 312.52 delegation-of-duties and sponsor-oversight requirements described above — both still require a written transfer of duties and active sponsor oversight of whatever the CRO (or FSP staff) actually performs.

CRO vs. an Academic Institution’s Own Clinical Trials Office

A university, academic medical center, or hospital’s internal clinical trials office (sometimes called an Office of Clinical Research or Office of Research Administration) is not a CRO in the ICH E6(R2)/21 CFR 312.52 sense, even though it performs some overlapping functions. The key distinction is contractual and organizational, not functional:

• A clinical trials office is an internal institutional unit that supports its own faculty’s investigator-initiated trials — budgeting, contract negotiation, IRB liaison, regulatory document management, coverage-analysis support — as an extension of the institution itself, not as a separate legal entity contracted by an external sponsor.
• A CRO is a separate legal entity engaged under a written contract by a sponsor (commercial or academic) to assume specific sponsor-side trial duties, with the accountability structure described in §5.2 above.

The line blurs in one well-documented arrangement: some academic medical centers operate what the clinical-trials literature calls an Academic Research Organization (ARO) — a university-affiliated, typically nonprofit unit that contracts with external, often industry, sponsors to provide CRO-like services (independent academic leadership, endpoint adjudication, statistical analysis, safety monitoring, site coordination) for large multicenter trials, frequently in partnership with a commercial CRO. This “ARO-CRO model” is intended to combine independent academic oversight with a commercial CRO’s operational scale, and is distinct from an institution’s routine clinical trials office, which does not contract its services out to external sponsors in the same way.

Worked Examples

• Full-service engagement: A biotechnology sponsor running a multi-region Phase III trial contracts a full-service CRO under a Clinical Trial Agreement covering site selection, monitoring, data management, safety reporting, and regulatory submission support. The CRO operates under its own SOPs and assigns CRAs to monitor sites; the sponsor retains ultimate responsibility for data quality/integrity and reviews the CRO’s monitoring reports and quality metrics on an ongoing basis, per ICH E6(R2) §5.2.2.
• FSP engagement: The same sponsor separately contracts a different CRO under an FSP arrangement to supply only biostatistics and medical-writing staff across its entire portfolio; those staff work inside the sponsor’s own systems and report through the sponsor’s internal project structure rather than the vendor’s.

Counter-Example

A university hospital’s internal clinical trials office, which processes budgets and coordinates IRB submissions for its own faculty’s investigator-initiated study, is not acting as a CRO for that study — it has no external sponsor contracting it to assume trial duties; it is the institution supporting its own research. The same institution’s separately constituted Academic Research Organization, if it has one, could act as a CRO-like entity only when a different, external sponsor formally contracts it to assume specific trial-related duties under a written agreement.

Related Terms

• Clinical Research Associate (CRA) — the ICH E6(R2) “monitor” role, typically employed by a CRO or sponsor.
• Clinical Research Assistant — the site-side operational support role, distinct from CRO/sponsor-side staff.
• Good Clinical Practice (GCP) Certification — the training framework underlying CRO and site staff qualification.
• Clinical Data Management — a function commonly delegated to a CRO under CDISC/GCDMP standards.
• Clinical Trial Supply Management — investigational product logistics, another function CROs frequently manage on a sponsor’s behalf.
• Clinical Research Administration — this term’s parent topic cluster.

Frequently Asked Questions

Is a CRO the same as a sponsor?

No. The sponsor is the party that initiates and takes overall responsibility for a clinical trial and, under FDA regulation, submits the IND/IDE. A CRO is a separate entity the sponsor contracts to perform specific duties. Under ICH E6(R2) §5.2.4, a CRO is treated as standing in the sponsor’s place only for the specific duties it has formally assumed — it does not become “the sponsor” for the whole trial.

Can a sponsor transfer all of its regulatory obligations to a CRO?

It can transfer responsibility for performing the underlying duties, and 21 CFR 312.52(a) allows a general statement that “all obligations” have been transferred in the written agreement. But ICH E6(R2) is explicit that the sponsor’s ultimate responsibility for the quality and integrity of the trial data is never transferable — oversight remains a sponsor obligation regardless of how much operational work moves to the CRO.

What is the difference between a full-service CRO and an FSP arrangement?

A full-service CRO takes end-to-end operational responsibility for the functions it’s engaged for, under its own systems and project management. An FSP arrangement supplies staff or a discrete function (e.g., monitoring, data management, biostatistics) that operates as an extension of the sponsor’s own team, inside the sponsor’s own systems, with the sponsor retaining more direct day-to-day control.

Is a university’s clinical trials office a CRO?

Not in the standard sense. It’s an internal institutional unit supporting the institution’s own investigator-initiated research, not a separate entity contracted by an external sponsor. Some academic medical centers separately operate an Academic Research Organization (ARO) that can act in a CRO-like capacity for external sponsors — but that is a distinct, formally contracted arrangement, not what a routine clinical trials office does.