From Risk to Reward: A Next-Gen Approach to Vendor Risk Management
– A webinar for Clinical Trial Sponsors –
Open PDF of slides
Questions and Answers:
INNOVATION
Beyond the 5 areas of innovation and adoption you shared (ie. RBM, eConsent, Dig Health Outcomes, AI, and eSource), what are some emerging areas we need to anticipate moving forward?
The complexity, evolution, and innovation in this field will only continue to grow. If I had to highlight a key trend—especially with the accelerated adoption of decentralized or patient-centric clinical trials—I would start with mobile healthcare providers and home health services. The goal is to bring healthcare directly to patients, whether through mobile research units or home-based care, to perform procedures such as phlebotomy, drug dispensing, and vital sign monitoring. Telemedicine is another major focus, enabling many procedures to be carried out remotely, similar to how we manage daily tasks in our personal lives. Additionally, leveraging electronic health records (EHR) or EMRs for tasks like patient recruitment, community-based screening, and identifying disease patterns and patient qualifications is becoming increasingly important. The fourth area, which I mentioned during my presentation, is the use of wearables and sensors. These technologies allow us to track a wide range of biomarkers and demographic data, providing valuable insights into patient health. Altogether, these four areas reflect where the industry is headed. As Chris Casazza mentioned, the Diligent Platform currently covers over 30 service categories, including these four and many more. We’re continually working to stay ahead of industry trends, embracing new and innovative capabilities as they emerge.”
RISK AND OVERSIGHT
If investigators are responsible for identifying and qualifying vendors how can I, as a Sponsor, maintain oversight? How much oversight and/or documentation is required around 3rd party vendors/subcontractors?
There are multiple, different ways that you can actually make sure that you’re gathering documentation and have got the right oversight models in place. The initial piece of it is in terms of how much do I need? This depends. Obviously your primary endpoints. You’re going to want to have a much clearer and deeper focus on any provider that is going to be generating data and information to that provides critical data. But for some of your tertiary endpoints, it may be a little less important.
From a quality perspective, one of the tools used is the Quality Agreement. Obviously, you have a business contract for the specific services. But when you get down to that oversight and what data you need from them, how often you need information from them, and the style of presentation, and what sort of KPIs that you want to track. Then, that’s when a quality agreement becomes so much more important to enable you to collect the right information. So that you can still keep that handle on things, and that you can demonstrate that oversight, even though some of the overall responsibilities may be moving along the chain to a CRO, or to an investigator. But you, as a Sponsor, could still be able to maintain that level of oversight and control through a quality agreement.
What are some inputs into the vendor risk assessment framework that will inform the oversight plan?
The most important inputs we would recommend, include:
1. The type of capability/service being provided by the vendor
2. The risk to the clinical trial portfolio
3. The intended use of the data generated/managed by the vendor
4. Outcomes/observations from the vendor assessment/qualification
5. Past vendor performance (if applicable)
Risk is dynamic – how can characterization of vendor partnerships be updated based on real time information?
A Sponsor’s risk rubric/tolerance will be able to be updated within the Diligent platform and an updated characterization profile will be provided dynamically. For publicly available information and global situations (e.g., wars, political unrest) AI can be used to mine trusted sources and provide strategic updates to risk profiles.
RISK AND OVERSIGHT
Is the Diligent model an FDA-accepted method of qualification?
Yes. The global regulations say that Sponsors need to have a rigorous vendor qualification and oversight process in place, but they don’t say how they need to do it. So, when we sat down with the FDA and walked them through our centralized shared audit model they were very supportive of the efficiencies that we would bring to the market and of our approach. So, no issues at all from a regulatory standpoint.
Can you share any experience where Health Authorities such as FDA inspected a Sponsor and if they accepted and commented on the vendor qualification based on these reports provided by Diligent instead of a regular qualification visit?
Yes. We have solicited feedback from our current Sponsor base on this topic. We have learned from several Sponsors that our reports have been the focus of an FDA inspection. The review of our reports passed regulatory scrutiny without issue.
At your request, we are happy to provide references to our Sponsor client base to discuss this specific topic. One point of clarification. At the end of your question, you cite “based on these reports provided by Diligent instead of a regular qualification visit.” To be clear, the Diligent report is based on a traditional qualification visit. We’re simply making that report available to the broader Sponsor market so Sponsors don’t have to duplicate the exact same effort and produce redundant reports.
AVAILABLE, UP-TO-DATE, and SECURE DATA
If we were to use Diligent for risk scoring of RFIs, is there a way we can pull the data from your system into our QMS or Enterprise Risk Management Platform?
As our platform has evolved, we’ve built an API that can be leveraged to integrate and consume all data that you’ve seen today in our platform demo.
How current is the RFI data in your platform?
RFI data is real-time in our platform since the vendor needs to accept releasing the data to Sponsors when a Sponsor requests the RFI. Since the RFI data is self-reported by the vendor, when they approve releasing it to the Sponsor they are in effect saying the information is current and Up To Date. If it is not Up To Date, the vendor will then make the appropriate updates before releasing the data to the Sponsors.
How does your service work with respect to NDAs?
For Sponsors, confidentiality/non-disclosure expectations are included in a Master Service Agreement or Statement of Work, as applicable. A Provider Agreement details the respective expectations from that perspective. For a provider, any request for their data (RFI or VQA) must be approved by the provider prior to it being released to a Sponsor or CRO. This enables an opportunity for updated information or statuses to be provided.
How accurate are the results? Have the responses been verified? For example, if a vendor responds “yes” to an insurance question, has someone from Diligent confirmed by verifying a copy of the insurance policy?
Vendors are requested to provide evidence to support their responses where possible, including certificates of insurance and accreditation, procedure identifiers and process descriptions.
If a vendor responds with “N/A”, has someone verified if the “N/A” response is accurate? From experience, as a Sponsor, when we follow up with a vendor, they often time correct the answer to yes or no.
As part of the Diligent RFI request process the vendors are encouraged to reach out if any questions are unclear in relation to the services they provide and to include clarifying comments as part of their response. A review is performed by Diligent subject-matter-experts to evaluate the responses and determine if any follow up or updates are required prior to the material being published.
Once contracted, can the client download copies of reports, qualification docs for our records?
Yes, a subscribed or contracted client will have access to download qualification documents from the platform once the request has been approved by the vendor, who will verify that the most up to date information is being provided.
ASSESSMENT CONDUCT
Does your qualification assessment data have on-site audit/tour data for those vendors where you need to assess their facilities?
The Diligent model combines gathering of RFI data with onsite or remote “audits”, as necessary. One of the aspects covered is the physical facility where the services are provided from. Onsite assessments, including vendors such as laboratories, do incorporate a tour of the facility and address factors such as space configurations, environmental controls and monitoring, access and security, and protection systems. Remote assessments often include a virtual tour, where applicable.