CTMS Selection for a Biotech Running Its First Phase 2 Trial

Why the First Phase 2 Changes the Oversight Question

Most first-in-human studies run by small biotechs are small and closely managed. One or two sites, a CRO that handles monitoring and data management, and a clinical lead who knows every participant’s status from memory. The oversight record in that setting is often a set of meeting minutes and a spreadsheet the clinical lead maintains. It is not elegant, but the scale makes it workable.

Phase 2 is different in kind, not only in size. The trial now tests whether the drug does what the company says it does, so the data will support the next financing, a partnering deal, or a Phase 3 design. Site counts climb into the dozens. Countries are added. Recruitment becomes the main driver of the timeline. A second vendor often arrives for imaging, central labs, or patient-reported outcomes. And the sponsor’s clinical team, still small, is expected to direct all of it.

Emerging biopharma companies carry a growing share of this work. IQVIA reports that emerging biopharma sponsors accounted for 68 percent of all clinical trial starts in 2025, up from 56 percent in 2019.¹⁴ Many of those sponsors are running a Phase 2 for the first time with a team that was built for Phase 1.

What the Rules Say About Delegation

US regulations allow a sponsor to transfer any or all of its obligations to a contract research organization, but the transfer must be in writing. The regulation adds a sentence that every first-time sponsor should read twice: “Any obligation not covered by the written description shall be deemed not to have been transferred.”⁵ The general duties that frame the whole program also stay with the sponsor, including selecting qualified investigators and ensuring proper monitoring,⁴ and the sponsor must monitor the progress of all clinical investigations under its IND.⁶

ICH E6(R3), which FDA published as final guidance in September 2025 and which came into effect in the EU on 23 July 2025, says the same thing in GCP terms.²³ Section 3.6.6 allows a sponsor to transfer any or all of its trial-related activities to a service provider, but states that the ultimate responsibility, including participant protection and the reliability of the trial data, stays with the sponsor. Section 3.6.9 asks the sponsor to oversee important activities it has transferred, including work the service provider subcontracts. Section 3.6.8 says the sponsor “should have access to relevant information (e.g., SOPs and performance metrics) for selection and oversight of service providers.”¹

Section 3.9.5 then addresses how much oversight is enough: it should be fit for purpose and tailored to the complexity and risks of the trial, and the selection and oversight of investigators and service providers are described as fundamental features of the oversight process.¹ That flexibility matters for a small sponsor. Nobody expects a 25-person biotech to run the oversight apparatus of a top-ten pharma company. Inspectors do expect the sponsor to have decided what oversight it needs, to do it, and to be able to show it.

What Inspectors Find

The gap between what sponsors intend and what they can show is a steady theme in inspection reports. The EMA GCP Inspectors Working Group’s annual report for 2024 covers 67 inspections requested by the CHMP (the EMA committee that assesses marketing applications). Eighteen were at sponsor sites, and those 18 inspections produced 152 major or critical findings, 144 major and 8 critical.¹⁰ By our arithmetic, that is more than eight serious findings per sponsor inspection. Across all 67 inspections, monitoring was the largest subcategory under trial management, with 35 major findings. The report’s examples under contracts and agreements include inadequate documentation of third party and vendor qualification and oversight, and its examples under audit include sponsors that had not audited the partners and vendors working on their behalf.¹⁰

The UK inspectorate has described the same pattern in more detail. In a 2018 post on sponsor oversight, the MHRA described a commercial sponsor that received a major finding for CRO oversight. There was no evidence that the oversight activities set out in the CRO’s own plans had been carried out. Monitoring visit reports written by the CRO had no record of when the sponsor reviewed them, who reviewed them, or what was decided. The sponsor held some oversight records electronically, but outside the trial master file and outside its quality system, so the inspectors could not reconstruct what oversight had happened.¹¹

FDA sees the same issue from its side. At a 2022 Food and Drug Law Institute meeting, speakers reported that a lack of oversight of contract third parties is a frequent theme in FDA warning letters to sponsors.¹³ At a joint FDA, MHRA, and Health Canada GCP workshop in February 2024, one case study described a contract monitor that did not keep to the schedule of visits and covered a limited scope. Site noncompliance was not found in time to correct it, ineligible participants were enrolled and treated at multiple sites, and the final data set included data from ineligible and improperly dosed participants.¹²

When a Sponsor-Side CTMS Becomes Worth It

There is no rule that says a sponsor must own a CTMS. Many first Phase 2 trials are run well on the CRO’s system, with the sponsor reviewing reports and dashboards the CRO provides. The question is not whether a CTMS is required. It is whether the sponsor can meet its oversight duties, and show that it met them, with what it has today.

Signals You Have Outgrown the CRO’s Reports and Your Spreadsheets

In our experience, these signals show up before anyone says the word “CTMS” in a meeting:

One or two of these signals can be handled with process changes. Four or more usually means the sponsor needs its own system of record for oversight, whether that is a CTMS it licenses or a formally governed view into the CRO’s CTMS.

When the CRO’s System Is Enough

Staying on the CRO’s CTMS is a reasonable choice when the trial uses one full-service CRO, the sponsor has direct read access to the CRO’s CTMS (not only exported reports), the contract settles data ownership and exit terms, and the sponsor has a written oversight plan that names what it reviews, how often, and where the evidence of that review is filed. In that setup, the sponsor’s oversight record can live in the trial master file and a simple, controlled issue log, and a sponsor-side CTMS would add effort without adding much.

It is a weaker choice when the CRO’s system only shows the sponsor what the CRO chooses to publish, when access ends at contract close, or when the sponsor’s team spends hours each week rebuilding the CRO’s numbers in spreadsheets to check them.

A Simple Decision Test

Ask the clinical operations lead to answer three questions, in writing, for a site chosen at random:

1. How many participants has this site screened, enrolled, and discontinued, and where does that number come from?
2. What did the last monitoring visit find at this site, when did the sponsor review the report, and what happened to each finding?
3. Which important protocol deviations has this site had, and has the sponsor decided whether any of them affect the analysis?

If the answers take more than an hour to put together, or depend on asking the CRO, the sponsor’s oversight record is not under its own control. That is the problem a sponsor-side CTMS solves.

What to Require From a Sponsor-Side CTMS

Vendor feature lists are long. For a first Phase 2 sponsor, a short list of requirements decides the outcome. The rest can wait for Phase 3.

Oversight of CRO Performance

The CTMS should let the sponsor define the measures it uses to judge its CRO and record what it did when a measure was off. The EMA guideline on computerised systems and electronic data in clinical trials gives a plain example of how oversight can be done: by reviewing defined key performance indicators (KPIs) or reconciliations.⁹ Useful measures for a first Phase 2 tend to be few and concrete:

• Time from site selection to site activation, by country
• Screening and enrollment against plan, by site
• Monitoring visits completed against the monitoring plan’s schedule
• Time from monitoring visit to report finalization, and from report to sponsor review
• Open action items by age, and the share closed within the agreed time
• Important protocol deviations by site and category

Requirement: the system records each review of a measure, the reviewer, the date, and any action raised, in a form that can be filed or exported to the trial master file.

Site and Enrollment Tracking

Site lifecycle tracking is the core of any CTMS: feasibility, selection, regulatory and ethics approvals, contract and budget status, initiation, activation, and close-out. Enrollment tracking should record screening, screen failures with reasons, enrollment, discontinuations, and completions by site. ICH E6(R3) lists reviewing and reporting participant recruitment and retention rates among the monitoring activities for investigator sites.¹

The key requirement here is the source of each number. Enrollment counts that are typed in by hand will drift from the EDC. Ask how the system gets enrollment status: by manual entry, by a file import, or by an integration with the EDC or the interactive response technology (IRT) system that randomizes participants. Each answer is acceptable for a small trial, but the sponsor needs to know which one it is and how differences are reconciled.

Monitoring Visit Reports and Issue Follow-Up

ICH E6(R3) sets out what a monitoring report should contain: a summary of what was reviewed, significant findings, conclusions, the actions needed to resolve them, and follow-up on earlier issues. Reports should reach the appropriate sponsor staff in a timely manner, and when findings need escalation, the sponsor should decide on the action and record both the decision and the resolution.¹ FDA’s 2023 questions and answers on risk-based monitoring ask for similar documentation, including the date of the activity, who took part, what was reviewed, what deficiencies were found, and what actions were taken or recommended, and say reports should go to sponsor staff responsible for oversight in a timely manner.⁸

That gives a clear requirement. The CTMS should hold monitoring visit reports (or receive them from the CRO’s system), route them to a named sponsor reviewer, capture the review date and outcome, and link each finding to an action item that can be tracked to closure. If the CRO writes reports in its own system, the sponsor-side CTMS should at least record the sponsor’s review and decisions against each report.

Protocol Deviations

Section 3.9.3 of ICH E6(R3) asks the sponsor to set trial-specific criteria for classifying protocol deviations as important, meaning those that may significantly affect data reliability or participant rights, safety, or well-being.¹ Deviations are often recorded by the CRO, by sites, and sometimes in the EDC. The CTMS should hold the sponsor’s classification of each deviation, the date it was classified, and the person who classified it, so that the list feeding the clinical study report is the sponsor’s own.

Integration With eTMF and EDC

A first Phase 2 sponsor rarely needs deep, real-time integration. It needs a small number of reliable data flows, each defined and tested. The common ones:

• CTMS to eTMF. Site and milestone metadata (site numbers, investigator names, countries, activation dates) flow to the electronic trial master file so documents are filed against the right site, and expected-document lists update when a site is activated.
• EDC or IRT to CTMS. Screening, randomization, and visit status flow into the CTMS so enrollment counts match the clinical database.
• CRO CTMS to sponsor CTMS. If both exist, a scheduled file transfer of site status, visit status, and monitoring findings avoids double entry. This is the integration most often promised and least often tested.

FDA’s 2024 questions and answers on electronic systems in clinical investigations name the clinical trial management system among the systems a sponsor should document for each investigation, along with the system requirements. FDA adds: “Documentation should include a diagram that depicts the flow of data from data creation to final storage of data.”⁷ ICH E6(R3) adds that interfaces between systems should be defined and validated.¹ A one-page data flow diagram drawn before vendor demos is the most useful selection tool a small sponsor can make.

For file-based transfers, ask whether the vendor can import and export in an open format. The CDISC Operational Data Model, now at version 2.0, is described by CDISC as a vendor-neutral, platform-independent format for exchanging and archiving clinical study data and its metadata.¹⁶ Not every CTMS supports it, and plain, documented CSV or JSON exports are often enough for operational data. What matters is that the sponsor can get its data out in a form another system can read.

Audit Trail, Access, and Records

The CTMS holds records that support GCP oversight, so it needs the controls any GCP system needs: unique user accounts, role-based access, a computer-generated audit trail of changes, controlled backups, and a way to produce complete copies of records for inspection. FDA’s 2024 guidance lists what the agency will focus on when inspecting a sponsor’s electronic systems, including the system life cycle, access controls, change control, and the contracts with IT service providers that set out their responsibilities.⁷

Data Ownership When the CRO Also Provides the CTMS

Many CROs offer their CTMS to sponsors as part of the service, often with a sponsor portal or dashboards. That can be a sensible choice for a first Phase 2. It also creates a set of questions that do not come up when the sponsor licenses its own system, because the party being overseen controls the system that holds the oversight data.

Why This Case Is Different

When the CRO runs the CTMS, three risks need to be managed. First, the sponsor sees what the CRO configures it to see, which may be a curated view rather than the underlying records. Second, access is tied to the service contract, so it can end when the contract does, even though the records must be kept for the full retention period. Third, the system’s validation evidence belongs to the CRO, but the sponsor remains answerable for it.

The regulators have addressed each point. The EMA guideline says the responsible party can delegate tasks but keeps full responsibility for data integrity, security, and confidentiality. It says there should be no difference in the availability of documentation whether the sponsor or a service provider holds it. And where a service provider will not allow access to important documentation or will not support audits or inspections, it says “systems from such a service provider should not be used in clinical trials.”⁹ FDA’s 2024 guidance recommends a written agreement with IT service providers and lists, among the items it should include, “A plan that ensures the sponsor will have access to data throughout the regulatory retention period.”⁷

Questions to Ask Before You Sign

The last question is the one most often missed. The sponsor’s review of the CRO’s work is the sponsor’s record. If it is kept in a system the CRO administers, the sponsor should be able to show that the CRO cannot edit or delete it, or the sponsor should keep that record in its own controlled location, such as the trial master file or a sponsor-owned system.

What to Put in the Agreement

US regulations treat any obligation not described in the written transfer as kept by the sponsor.⁵ ICH E6(R3) section 3.6.4 says the same for GCP activities.¹ For a CRO-provided CTMS, the agreement or a linked quality agreement should cover, at a minimum: data ownership and access rights, the format and timing of exports, transition and exit support, access after services end, sharing of validation and change documentation, audit rights including for subcontractors, incident notification, and who files which records in the trial master file. The EMA guideline also notes that agreements should make clear which party keeps which system documentation, such as validation records, vendor SOPs, training records, and issue logs, for the full retention period.⁹

Realistic Options by Company Size

The market offers more choices than a small sponsor needs. In practice, there are four workable paths, and the right one depends less on headcount than on how many trials and vendors the sponsor has to oversee at the same time. The guidance below is our judgment from working with sponsors at these stages, not a market survey.

Platform or Point Solution

Sponsors often frame the choice as a specialized product versus a platform. For a first Phase 2, the more useful question is how many interfaces the sponsor is prepared to own. Every interface between two systems is something to define, test, and recheck after each vendor release. A unified platform reduces the number of interfaces. A point solution keeps each decision smaller and easier to reverse. Neither is wrong. The mistake is choosing a platform for a future portfolio that may never arrive, or choosing a point solution and then building five custom interfaces to make it behave like a platform.

Think About Phase 3 Without Buying for It

A sponsor that reaches Phase 3 may want to change CROs, bring monitoring oversight in-house, or move to a platform. The CTMS choice made now should not block those moves. The practical test is the exit path: can the sponsor take its site master data, milestone history, and oversight records out of this system in a usable form? If so, the Phase 2 decision is reversible, and that matters more than any feature.

Configuration Versus Customization

Vendors use the words configuration and customization loosely. For validation and for long-term ownership, the difference matters a great deal, and a small sponsor should insist on knowing which one it is buying.

What Counts as Each

Configuration means setting up the vendor’s standard product through settings the vendor designed and supports: picklists, fields drawn from the vendor’s field library, workflow steps chosen from supported options, role definitions, report layouts, and milestone templates. The vendor tests the underlying functions in every release. The sponsor tests that its chosen settings do what it needs.

Customization means changing how the product works: custom code, scripts, bespoke integrations, custom objects outside the vendor’s supported model, or changes the vendor will not carry forward automatically in new releases. The sponsor, or a partner it pays, owns the specification and testing of those changes, and often has to retest them each time the vendor releases a new version.

Why It Matters for Validation

Both FDA and ICH draw the same line. ICH E6(R3) section 4.3.4 says that both standard functions and protocol-specific configurations and customizations should be validated, and that “Different degrees of validation may be needed for bespoke systems, systems designed to be configured or systems where no alterations are needed.”¹ FDA’s 2024 guidance makes the same distinction between bespoke or customized systems, systems designed to be configured, and systems where no alterations are needed, and asks that validation cover trial-specific configurations, customizations, data transfers, and interfaces.⁷ The industry GAMP 5 guide, in its 2022 second edition, encourages regulated companies to make the most of supplier involvement and to apply critical thinking when choosing the validation approach.¹⁵

The practical effect is that each customization adds testing the sponsor must design and repeat, while configuration within the vendor’s supported options keeps most of the testing burden with the vendor, where the sponsor can review it.

Rules of Thumb for a First Phase 2

• Start from the vendor’s standard study template and change only what the protocol or the oversight plan requires.
• Write down every configuration choice in a configuration specification. It becomes both the validation baseline and the record of why the system works the way it does.
• Treat any request for custom code as a decision that needs a named owner, a reason, and an estimate of retesting effort per release.
• Prefer a file-based transfer the vendor supports over a custom real-time interface, unless the trial’s risk justifies the extra work.
• Ask the vendor which configuration options are protected through upgrades and which have broken in past releases.

A Short Selection Process

A first-time sponsor does not need a six-month request for proposal. It needs a process short enough to finish before the first site activates and structured enough to defend later. The steps below are how we suggest running it.

Who Should Take Part

Keep the group small: the clinical operations lead who will own the system, a clinical trial manager who will use it daily, someone from quality assurance, and whoever owns IT or systems for the company, even if that is a fractional role. Finance should join only if the CTMS will handle site payments. Ask the CRO to join one session if the sponsor CTMS will receive CRO data, so the integration is discussed with the people who will build it.

A Scorecard Built on the Requirements

The weights are a starting point. A sponsor staying on the CRO’s system should move weight toward data ownership and exit. A sponsor planning a platform should move weight toward integration and multi-study support.

Validation Effort, Sized to the Risk

The fear of validation keeps some small sponsors on spreadsheets longer than they should be. A spreadsheet holding oversight decisions is still a record that matters, and it has its own control problems. A commercial CTMS used largely as designed is one of the more manageable systems to validate, provided the sponsor sizes the effort to the risk and uses the vendor’s work.

What the Rules Ask

ICH E6(R3) section 4.3.4 says the responsible party is responsible for the validation status of the system throughout its life cycle, and that the approach should rest on a risk assessment that considers the intended use, the importance of the data, and the potential to affect participants and the reliability of results. It adds that the responsible party should ensure systems are validated as fit for purpose, including systems developed by other parties.¹ FDA’s 2024 guidance recommends a risk-based approach and says that, where an IT service provider performs validation, the sponsor may review the provider’s development processes, validation processes, functional testing, and change control records to judge whether the system is fit for purpose. FDA also says it is the regulated entity’s responsibility to make that documentation available on request during an inspection, including documentation the IT service provider created and maintains.⁷

The EMA guideline lists clinical trial management systems among the systems in its scope.⁹ It says that if the sponsor relies on the vendor’s validation documentation, inspectors should be given access to the full documentation of the sponsor’s examination of the vendor, and that contracts should ensure continued access to validation documentation for the retention period, even if the sponsor stops using the system or the vendor stops supporting it.⁹

What the Vendor Provides and What the Sponsor Still Owns

A Proportionate Package for a First Phase 2

For a commercial CTMS used mostly as designed, with no custom code, a small sponsor’s validation package can stay short:

• A system risk assessment and validation plan, a few pages each, stating intended use and which records support oversight
• A documented assessment of the vendor, drawing on the questionnaire, the vendor’s validation summary, and any audit
• A configuration specification
• User acceptance tests built from the same scenarios used in the scripted demos, focused on the oversight records and any data transfers
• A short validation summary report, with any open issues justified and mitigated
• Procedures for system use, access management, and change control, plus training records

The effort grows with each customization and each interface. A sponsor that wants to keep validation light has a simple option: configure, do not customize, and keep integrations few and file-based until the trial’s risk justifies more.

Keeping It Validated Through Vendor Releases

SaaS vendors release new versions on their own schedule, often several times a year. The EMA guideline notes that some service providers release updates at short notice, and says new functions should not be used until the sponsor has validated them or reviewed and assessed the vendor’s documentation.⁹ In practice, the sponsor needs a light release process: read the release notes, decide whether anything affects configured workflows or interfaces, rerun a small set of regression tests where it does, and record the assessment. At the 2024 joint regulators’ workshop, the MHRA presenter noted that an initial risk assessment is common but ongoing risk review often is not, and listed changes to vendors or systems among the changes that should prompt one.¹² A vendor release is exactly that kind of change.

Conclusion

The first Phase 2 trial is often the point where a biotech’s oversight stops being a matter of knowing everything and starts being a matter of showing it. The rules have not changed for small sponsors: tasks can move to a CRO, responsibility does not, and inspectors look for the sponsor’s own record of what it reviewed and decided. A CTMS is worth buying when it makes that record a normal part of the work instead of a project before each audit. Sometimes the right answer is governed access to the CRO’s system with strong contract terms. Sometimes it is a lightweight sponsor-side CTMS. Rarely, at this stage, is it a large platform bought for a portfolio that does not exist yet. In every case, the oversight plan and the data flow should come before the vendor demos, the contract should settle data ownership and exit, and the system should be configured rather than customized so validation stays in proportion.

Sakara Digital works with pharma and biotech organizations setting up clinical systems and the oversight models behind them. If you are planning a first Phase 2 and want an independent view on whether you need a sponsor-side CTMS, and how to choose one without overbuying, we are happy to have that conversation.

For Further Reading