How to Qualify a Clinical Trial Vendor with Questionnaires

Many Sponsors default to an audit-first qualification, where every Vendor gets a full auditor-led assessment, regardless of what they’re contributing to the trial. It’s the safe assumption, but it isn’t what the regulations actually require every time. 

ICH E6(R3) is explicit that Sponsor oversight should be proportionate to risk. For Vendors that aren’t supporting a primary or secondary endpoint, a well-structured questionnaire process can be all the qualification you need. Done well, it’s defensible at inspection, faster to execute, and can gather more information than a one- or two-day audit visit. 

This article makes the case for when an RFI-only approach is the right call, what it takes to do it well, and what to watch out for. The perspective draws on a conversation with our Head of Quality, Anthea Dransfield.

What qualification actually means under R3

ICH E6(R3) doesn't tell Sponsors how to qualify a Vendor. It tells them what they're accountable for: documentation of selection, assessment, and oversight of service providers conducting important trial-related activities.

As Anthea puts it: "It's not a checkbox exercise. It's a relationship building exercise. It's about learning about the Vendor, what they can do, what they maybe can't do, the resources they have available, the equipment they have available. And a questionnaire is a way of gathering information." 

Before a Sponsor can decide how to qualify a Vendor, they need to be clear on what they'll actually be using that Vendor for. Anthea described being asked recently to both collect questionnaires and conduct an audit on a Vendor. When she asked the Sponsor's team what the Vendor would be used for, no one could tell her. Operations had simply been told to qualify them.

When RFI-only is the right approach

The most useful filter is whether the Vendor supports a primary or secondary endpoint. If they do, an audit is almost always warranted. But, in Anthea's words, "if it's not something that's supporting those primary or secondary endpoints, then you have latitude." That latitude is conditional on documented due diligence: whether the Vendor has the capabilities, resources, and protocol understanding to deliver. 

R3's risk-based principle is what creates that flexibility. In practice, it lets Sponsors tier Vendors by the significance of their contribution and apply oversight accordingly. 

Anthea gave a concrete example. A production company creating an educational video for participants to help them understand the condition they're living with isn't supporting a primary or secondary endpoint. They're providing information. For this Vendor, a questionnaire, evaluated against regulatory and Sponsor expectations, can be enough. The RFI is the right instrument for assessing them.

How to do it well

The non-negotiable foundation is documentation. Anthea: "If it's not written down, it never happened." That includes the written justification for why the RFI route was chosen, the risk assessment that led to it, and the assessment of the Vendor's responses. 

Beyond documentation, three things separate a defensible RFI process from an insufficient paper exercise. 

Question design. RFI questions should be clear, free of ambiguous acronyms, and tied back to a specific regulation. When a Vendor asks why you’re asking a particular question, you should be able to point to MHRA guidance or an FDA expectation. Anthea's reason for that grounding: regulators enforce regulations, not industry best practices. A question built on best-practice expectations gives you no real basis to act on a Vendor's response. 

How responses are evaluated. Vendors’ comments matter as much as their answers. Anthea described a pattern she's seen repeatedly when assessing questionnaire output: a Vendor answers "no, we don't have that capability" and then in the comments explains a process they do have, one that meets the regulation's intent even if it doesn't match the question's literal wording. 

The right test, in Anthea's words, is whether the Sponsor can defend the Vendor's approach to an inspector, rather than whether the Vendor strictly does or doesn't do what the question asks. Anthea contrasted this with her GMP background, which she described as "very black and white." R3's risk-based approach, in her view, gives more flexibility, as long as the Sponsor can show the justification for the route they took.

What RFIs do that audits can’t (and where they fall short)

The clearest argument for an RFI-led approach isn’t that it’s lighter. It’s that, in several respects, it can give you more information than an audit. 

An audit captures a point in time. A questionnaire can be reissued, updated, or extended. If a Vendor implements a new piece of software that supports the service they’re providing, a targeted questionnaire on that specific change can give you sufficient assurance without needing a full requalification. 

Audits also depend heavily on the auditor’s experience and what they happen to ask. RFIs are person-agnostic. Every Vendor in a category gets asked the same questions, which makes responses directly comparable across your portfolio. And questionnaires often gather more information than a one or two-day audit visit. 

One limitation is self-reporting. A Vendor's RFI response is what they say about themselves. The standard mitigation is to ask for evidence (SOPs, forms, supporting documents) uploaded alongside their responses. But the same dynamic applies in audits. Auditees naturally present their work in the best light, and an auditor, working in a one or two-day window, may not always surface what isn't volunteered. 

In both cases, ongoing performance monitoring is what really tells you whether a Vendor is delivering. The qualification step lets you make an informed decision about a new trial partner. The performance data is what tells you over time whether the Vendor is meeting expectations.

What best practice looks like

Qualification is the start of the relationship, not the end. Sponsors who get the most from a questionnaire-led approach treat it as the beginning of a longer process and share a few habits: 

They add custom questions. The standard regulatory coverage can't anticipate every trial-specific need. An oncology trial, for example, generates significantly more data and assessments than other therapeutic areas. A Vendor can be fully regulation-compliant and still unable to meet a specific trial's unique requirements. Custom questions, written against what your specific trial needs, are how you can catch that. 

They score the responses against risk. A complete questionnaire produces a lot of information, but it doesn't on its own tell the Sponsor where to focus. Scoring each response turns the questionnaire into a decision tool. The Sponsor can see where a Vendor's responses fall short of expectations and target follow-up at those specific areas—including a focused audit on the gaps the score surfaces, rather than defaulting to a full audit. With Diligent, our SMEs work with Sponsors to define trial-specific risk criteria and build a scoring model weighted against those needs (rather than generic frameworks). 

They track the metrics they set. KPIs and KRIs only matter if someone is reviewing them on a regular cadence and acting when the trends shift. 

They communicate. The relationships that hold up through a trial are the ones with established escalation pathways and an honest two-way exchange. Where things tend to break down is at the points where the Sponsor changes a requirement mid-trial without discussing it with the Vendor. 

They track the delta both ways. Vendor SOPs change. Vendor resources change. Sponsor requirements change. Staying on top of both sides is what keeps qualification an ongoing process.

Putting this into practice

The 20 critical questions guide covers the main categories Sponsors should assess, with questions drawn from current regulations. Every trial has its own risk profile, and most Sponsors will need to add custom questions to address what's specific to their study. 

For Sponsors building or reassessing their qualification process, Diligent's team can meet with you to assess your current approach, identify regulatory needs, and offer consultative support to help you bridge gaps. Diligent360 is the platform Sponsors use to perform compliant vendor lifecycle management, end to end.