Under ICH E6(R3), the sponsor is the entity that takes ultimate responsibility for the initiation, management, and financing of a clinical trial. The monitor is the sponsor’s representative at the site, responsible for verifying that the trial is conducted and documented according to the protocol, GCP, and applicable regulatory requirements. Together, their obligations form the backbone of clinical trial oversight and the most common source of findings in regulatory inspections.
This practice test covers sponsor responsibilities under ICH E6(R3): quality management, CRO oversight, risk-based monitoring, SUSAR reporting, the Trial Master File, and the monitor’s specific obligations during site visits. Questions reflect the updated framework introduced in E6(R3), endorsed January 2025 and effective July 2025 under EMA and published by FDA in September 2025.
Section 1: Sponsor Responsibilities and Quality Management
Question 1 | Beginner
Under ICH E6(R3), who retains ultimate responsibility for the quality and integrity of trial data when a sponsor transfers all trial-related duties to a CRO?
- A) The CRO, as it has taken on all obligations through the transfer agreement
- B) The sponsor, regardless of the extent of delegation to the CRO
- C) The principal investigator at each site
- D) The regulatory authority overseeing the trial
ICH E6(R3) is explicit: a sponsor may transfer trial-related duties to a CRO, but ultimate responsibility for quality and integrity of trial data always remains with the sponsor. The transfer agreement specifies which duties have been transferred, but this does not transfer the sponsor’s accountability. This distinguishes the sponsor from a CRO in regulatory and legal terms.
Why the others are incorrect: A is incorrect because the transfer agreement transfers duties, not ultimate responsibility. C is incorrect because investigators are responsible for site-level conduct, not overall trial quality. D is incorrect because regulatory authorities oversee compliance but do not bear responsibility for the trial.
Question 2 | Intermediate
ICH E6(R3) introduces the concept of Quality by Design (QbD). What does this require the sponsor to do?
- A) Conduct 100% source data verification at every site visit
- B) Identify critical-to-quality factors prospectively during trial planning and design oversight procedures to protect them
- C) Eliminate all risk from the trial before enrolment begins
- D) Conduct a quality audit at the conclusion of every trial
Quality by Design requires the sponsor to identify critical-to-quality (CtQ) factors at the trial planning stage and design quality management procedures specifically around protecting those factors. This is proactive and prevention-focused, not detection-after-the-fact.
Why the others are incorrect: A describes 100% SDV which E6(R3) explicitly moves away from. C is not achievable — the goal is risk identification and mitigation, not elimination. D describes post-trial audit, which is verification, not QbD.
Question 3 | Beginner
A sponsor uses a CRO for all clinical operations. What must the sponsor put in place to fulfil E6(R3) obligations?
- A) Nothing further — the CRO assumes all GCP obligations once the contract is signed
- B) A written agreement specifying transferred duties, and ongoing oversight of the CRO to ensure compliance with the protocol and GCP
- C) A separate IRB submission for each CRO involved
- D) A regulatory notification that all activities have been outsourced
E6(R3) requires a written agreement with the CRO specifying which duties have been transferred, and ongoing sponsor oversight of the CRO’s performance. The sponsor cannot simply hand over activities and disengage — vendor oversight remains a sponsor responsibility regardless of how many activities are outsourced.
Why the others are incorrect: A is incorrect because the sponsor retains ultimate responsibility. C is incorrect because IRB submissions relate to the trial itself. D is not a standard E6(R3) requirement.
Section 2: Risk-Based Monitoring
Question 4 | Intermediate
Under ICH E6(R3)’s risk-based monitoring approach, what determines how intensively a monitor should verify a specific data point?
- A) The chronological order of site visits, with earlier visits more intensive
- B) The risk that errors in that data point could affect participant safety or trial conclusions
- C) The geographic distance of the site from the sponsor’s headquarters
- D) The site’s experience with previous trials
Risk-based monitoring calibrates oversight intensity to the risk level of each data point. Critical-to-quality factors that directly affect participant safety or the reliability of conclusions receive intensive verification. Lower-risk data receive proportionately less monitoring. This focuses resources where they matter most.
Why the others are incorrect: A describes a chronological rather than risk-based approach. C and D might informally influence planning but are not the primary determinants under E6(R3).
Question 5 | Intermediate
A monitoring plan includes remote monitoring, centralised statistical monitoring, and reduced on-site visits. What is the primary requirement for GCP compliance?
- A) All sites must receive at least one on-site monitoring visit per month
- B) The plan must be justified based on a documented risk assessment and must ensure critical data and processes are adequately overseen
- C) Remote monitoring may only be used for sites in countries where on-site visits are logistically difficult
- D) The plan requires prior regulatory authority approval
E6(R3) allows flexibility in monitoring approaches provided the plan is grounded in a documented risk assessment and demonstrably adequate for critical data and processes. There is no fixed frequency requirement for on-site visits.
Why the others are incorrect: A is incorrect because E6(R3) explicitly moves away from mandatory visit frequency. C is incorrect because remote monitoring may be used where appropriate and justified. D is incorrect because monitoring plans do not require prior regulatory approval.
Section 3: Monitor Obligations During Site Visits
Question 6 | Beginner
What is the monitor’s primary responsibility during a monitoring visit?
- A) To evaluate the investigator’s clinical competence and recommend replacements
- B) To verify that the trial is being conducted and documented in accordance with the approved protocol, GCP, and applicable regulations
- C) To conduct statistical analysis of the site’s data
- D) To obtain additional informed consent from enrolled participants
The monitor’s core function is verification: confirming that what the protocol requires is what is actually happening and being documented at the site. This includes source data verification, checking the ISF, reviewing the delegation log, confirming IP accountability, and reviewing AE/SAE documentation.
Why the others are incorrect: A is incorrect because monitors do not evaluate clinical competence. C is a separate sponsor function. D is an investigator/designee function, not a monitor function.
Question 7 | Intermediate
A monitor finds that three participants were enrolled without consent dates documented before the first trial procedure dates. What should the monitor do?
- A) Note the finding and wait for the next scheduled visit to follow up
- B) Immediately notify the sponsor and document the finding in the monitoring visit report with a requirement for corrective action and a defined timeline
- C) Correct the dates in the source records
- D) Withdraw the three participants without consulting the investigator
Consent obtained after trial procedures have already been performed is a critical GCP finding that requires immediate action. The monitor must document it in the visit report, notify the sponsor promptly, and require the site to assess impact and implement corrective actions within a defined timeline. This cannot wait for the next scheduled visit.
Why the others are incorrect: A is incorrect — the severity requires immediate action. C is a serious data integrity violation; altering source documents is never acceptable. D is incorrect because participant withdrawal decisions are medical decisions for the investigator, not the monitor.
Question 8 | Advanced
A monitor finds that the investigator delegated eligibility assessments to a coordinator who is not a licensed healthcare professional and not listed on the delegation log for that task. What is the correct sequence of actions?
- A) Accept the assessments since the coordinator has GCP training
- B) Document the finding, report to the sponsor, require the site to update the delegation log and have a qualified person review and confirm the eligibility of affected participants
- C) Re-screen all affected participants from the start of the study
- D) Request that the regulatory authority suspend enrolment pending investigation
This is a protocol deviation (undocumented delegation) combined with a potential eligibility assessment by someone unqualified for that task. The monitor must document it, notify the sponsor, and require the site to update the delegation log and have a qualified person retrospectively review each affected participant’s eligibility and document that review.
Why the others are incorrect: A is incorrect because GCP training does not qualify someone for medical eligibility assessments, nor does it make undocumented delegation acceptable. C is incorrect — retrospective review by a qualified person is the appropriate corrective action, not re-screening. D is premature and not a monitor action.
Section 4: SUSAR Reporting
Question 9 | Beginner
What does SUSAR stand for?
- A) Serious Unexpected Suspected Adverse Reaction
- B) Sudden Unexplained Serious Adverse Report
- C) Sponsor-Unsolicited Safety Adverse Response
- D) Systematic Unblinded Safety Analysis Report
SUSAR stands for Suspected Unexpected Serious Adverse Reaction. All three components must be present: the event must be serious (life-threatening, hospitalization, death, disability, or other significant medical event), unexpected (not described in the current Investigator’s Brochure), and suspected to be causally related to the investigational medicinal product.
Question 10 | Intermediate
A SUSAR occurs at a site. The investigator reports it to the sponsor on Day 1. What are the sponsor’s reporting timelines to the regulatory authority?
- A) 30 days for all SUSARs regardless of severity
- B) 7 calendar days for fatal or life-threatening SUSARs; 15 calendar days for all others
- C) 24 hours for all SUSARs
- D) 15 business days for fatal SUSARs; 30 calendar days for others
Fatal or life-threatening SUSARs must be reported within 7 calendar days of the sponsor first becoming aware. All other SUSARs must be reported within 15 calendar days. These timelines run from the date the sponsor received the initial information. An initial report may be incomplete; a complete follow-up is expected within the same window.
Why the others are incorrect: A uses a single 30-day timeline which does not exist. C (24 hours) applies to some internal reporting requirements, not regulatory authority reporting. D uses incorrect timelines.
Section 5: Trial Master File
Question 11 | Intermediate
Under ICH E6(R3), what is the primary purpose of the Trial Master File (TMF)?
- A) To provide marketing data for the investigational product after trial completion
- B) To contain essential documents that allow the conduct of the trial and the quality of the data produced to be evaluated
- C) To store participant medical records for long-term follow-up
- D) To serve as the contract between the sponsor and CRO
ICH E6(R3) Annex 1 defines essential documents as those that individually and collectively allow the evaluation of the conduct of a trial and the quality of the data produced. The TMF is the collection of all such documents and is the primary document set reviewed during regulatory inspections.
Why the others are incorrect: A describes a commercial purpose unrelated to GCP. C is incorrect because participant medical records are maintained at the clinical site, not in the TMF. D is incorrect because the CRO contract is one document in the TMF, not its purpose.
Question 12 | Advanced
A sponsor is closing a trial. The CRO that managed data operations has gone out of business and its records cannot be fully recovered. What is the sponsor’s obligation?
- A) The loss of CRO records relieves the sponsor of its retention obligations for those documents
- B) The sponsor remains responsible for the TMF and must take all available steps to recover or reconstruct missing records, and document what cannot be recovered
- C) The sponsor should notify only the sites, as they hold duplicates of all essential documents
- D) Regulatory authorities automatically accept incomplete TMFs when a CRO closure is involved
The sponsor retains ultimate responsibility for TMF completeness regardless of what happens to its CROs. All reasonable recovery efforts must be made, what cannot be recovered must be documented, and regulators must be notified as appropriate. This is why best practice requires sponsors to maintain independent copies of critical TMF documents and address data transfer obligations contractually at the outset.
Why the others are incorrect: A, C, and D all incorrectly suggest the sponsor’s obligation is reduced by the CRO’s closure. It is not.
Section 6: Advanced Scenarios
Question 13 | Advanced
A sponsor’s central monitoring team identifies that one site has a 0% protocol deviation rate across 47 participants over 18 months, while all other sites have deviation rates between 3% and 12%. No on-site visit has been conducted in 9 months. What should the sponsor do?
- A) Take no action — a 0% deviation rate is a positive indicator
- B) Escalate to an unannounced or expedited on-site visit to investigate whether deviations are occurring but not being reported
- C) Reduce monitoring at this site since the data appears clean
- D) Report the anomaly directly to the regulatory authority as a GCP violation
A 0% deviation rate when all peer sites report 3-12% is a statistical anomaly that central monitoring should flag as a risk signal. In clinical research, a zero deviation rate can indicate that deviations are occurring but not being identified or reported. E6(R3)’s risk-based monitoring framework specifically supports using central data signals to trigger targeted on-site visits.
Why the others are incorrect: A is incorrect because a suspiciously clean record is itself a risk signal. C is the opposite of the appropriate response. D is premature — the sponsor should investigate first.
Question 14 | Advanced
A sponsor running a decentralised trial uses a digital platform to collect participant-reported outcomes from smartphones. Which data governance obligation applies?
- A) Digitally collected data is exempt from GCP requirements as it is not collected by a healthcare professional
- B) The sponsor must ensure the digital platform meets GCP requirements for data accuracy, completeness, legibility, timeliness, and attribution, with audit trails maintained
- C) Participant-reported outcome data collected digitally cannot be used as primary endpoints
- D) The IRB/IEC does not need to review digital data collection processes
ICH E6(R3) Section 4 introduces explicit data governance requirements that apply to all clinical trial data including digitally collected patient-reported outcomes. The sponsor must validate the platform, ensure ALCOA+ principles are met, and maintain audit trails. E6(R3) specifically addresses electronic and digital systems as a core component of modern trial conduct.
Why the others are incorrect: A is incorrect because GCP applies to all trial data regardless of who collected it. C is incorrect because digital PRO data can be primary endpoints if properly validated. D is incorrect because the IRB/IEC reviews the full protocol including data collection methods.
Question 15 | Advanced
A sponsor’s medical monitor receives an SAE report indicating a participant died. The investigator assesses death as “not related” to the investigational product. The sponsor’s medical monitor assesses it as “possibly related.” How should this be handled?
- A) The investigator’s assessment takes precedence and the sponsor’s disagreement need not be documented
- B) The sponsor must report the event based on its own causality assessment, and both assessments must be documented and submitted to the regulatory authority
- C) The sponsor must defer to the investigator since they treated the participant directly
- D) The event need not be reported to regulators since the investigator found it unrelated
When the sponsor’s causality assessment differs from the investigator’s, both must be documented, and the sponsor must report based on its own assessment. If the sponsor assesses the event as possibly related and it meets the serious and unexpected criteria, it must be reported as a SUSAR regardless of the investigator’s contrary view. The sponsor has an independent safety evaluation responsibility under GCP.
Why the others are incorrect: A, C, and D all incorrectly suggest the investigator’s assessment is determinative for the sponsor’s reporting obligations. It is not — the sponsor exercises independent medical judgment and reports accordingly.
Quick Reference
Sources
- ICH E6(R3) Guideline for Good Clinical Practice, Step 4 (January 2025)
- FDA, “E6(R3) Good Clinical Practice Guidance for Industry” (September 2025)
- Sidley Austin, “U.S. FDA’s Adoption of ICH E6(R3): Key Takeaways” (2025)
- IntuitionLabs, “ICH E6(R3) Explained: A Guide to the 2025 GCP Update”
- ACRP, “FDA Publishes ICH E6(R3): What it Means for U.S. Clinical Trials” (September 2025)
- GCP Blog, “ICH E6(R3) GCP Guidelines for Clinical Trials”


