📚 Part of the TILA-278 Regulatory Dossier — Reader's Guide. This article shows the live document; edits to the source appear here automatically.

---

Vendor / CRO Management (TILA-278)

Document ID: PM-006
Version: 1.0
Change History: 1.0 — Initial issue.
Standard(s): Program management

Vendor / CRO Management — TILA-278

The outsourcing and vendor-oversight approach for the TILA-278 program: the CRO and specialty-vendor scope, selection and qualification, oversight and performance metrics, and the sponsor's retained-oversight responsibilities under ICH E6(R3).

TILA-278 is a humanized IgG1 bispecific monoclonal antibody that simultaneously antagonizes TNF-like ligand 1A (TL1A) and agonizes the interleukin-22 receptor (IL-22R), administered subcutaneously for the treatment of moderate-to-severe ulcerative colitis (UC). The dual mechanism — TL1A antagonism to attenuate the inflammatory and pro-fibrotic axis, coupled with IL-22R agonism to promote epithelial regeneration and mucosal healing — is delivered from a single Chinese hamster ovary (CHO) cell-culture–derived molecule purified by a Protein A capture step followed by orthogonal polishing chromatography. Because the sponsor, Virtual Biopharma Inc., operates a virtual/outsourced development model, essentially every operational function across chemistry-manufacturing-controls (CMC), nonclinical, clinical, bioanalytical, and pharmacovigilance domains is executed by contracted service providers. This document defines how those providers are scoped, qualified, contracted, and overseen so that the sponsor retains full accountability for data integrity and subject safety consistent with ICH E6(R3), 21 CFR Parts 312, 58, and 210/211, and the biotechnology-specific expectations of ICH Q5A(R2), Q5C, Q6B, and S6(R1) that govern the eventual Biologics License Application (BLA) under 21 CFR Part 601.

The pivotal Phase 2b induction study, TILA278-201, anchors the current vendor footprint. It is a randomized, double-blind, placebo-controlled, 1:1:1 trial of a 12-week induction period in which 1700 subjects were screened and 900 randomized (299 High dose / 300 Low dose / 301 Placebo), yielding a Full Analysis Set of 840 subjects (284 / 283 / 273). The primary endpoint of clinical remission (modified Mayo score ≤ 2 with no individual subscore > 1) at Week 12 was achieved by 37.3% (106/284) of High-dose, 16.2% (46/283) of Low-dose, and 0.7% (2/273) of Placebo subjects; the key secondary modified-Mayo least-squares mean change from baseline was −3.36 (High), −2.76 (Low), and −1.00 (Placebo), corresponding to placebo-adjusted differences of −2.36 and −1.77, with centrally read endoscopic improvement of 48.9%, 27.9%, and 6.2%, respectively. The credibility of these outcomes depends directly on the qualification and oversight of the vendors that generated, adjudicated, and analyzed the underlying data; the sections below describe those controls.

Outsourcing strategy and governance model

The sponsor maintains a lean internal core of accountable function owners — clinical operations, CMC/technical operations, nonclinical/translational, biometrics, pharmacovigilance, quality assurance (QA), and regulatory affairs — each of whom retains non-delegable oversight of the corresponding outsourced activities. No oversight responsibility transfers to a vendor by virtue of the contract; only the execution of defined tasks is delegated. A single, global full-service clinical CRO holds primary responsibility for TILA278-201 conduct, with the sponsor retaining direct governance rather than a fully "handed-off" model. Specialty functions that require dedicated technical capability — central laboratory, bioanalysis, central endoscopy reading, central histopathology, interactive response technology (IRT), electronic clinical outcome assessment (eCOA), drug-substance and drug-product manufacture, and the safety database — are contracted directly by the sponsor (functional-service / directly-contracted model) so that the sponsor holds the quality and technical agreements and controls change directly.

Governance operates on three tiers: (1) an executive Joint Steering Committee meeting quarterly to manage scope, budget, and strategic risk; (2) operational governance meetings (typically weekly for the clinical CRO and central lab, biweekly to monthly for specialty vendors) that manage timelines, deliverables, and issues; and (3) a study-level risk and quality review that tracks quality tolerance limits (QTLs) and key risk indicators (KRIs). A program-level RACI matrix and a vendor-oversight plan, both maintained by the sponsor, define decision rights and escalation paths for every function listed below.

Vendor and CRO scope

The functional scope of the principal service providers is summarized below. Each entry is governed by an executed master services agreement (MSA), a study/work-order scope, and — where the activity generates GxP data or product — a quality or technical agreement.

Function	Scope for TILA-278	Governing standards
Full-service clinical CRO	TILA278-201 site management, monitoring (risk-based), project management, medical monitoring support, regulatory/site start-up	ICH E6(R3), 21 CFR 312
Central laboratory	Safety chemistry/hematology, biomarkers, sample logistics and chain-of-custody across the screened-through-Week-12 window	ICH E6(R3), CLIA/CAP as applicable
Bioanalytical laboratory (PK)	Validated immunoassay for serum TILA-278 concentrations supporting target-mediated drug disposition (TMDD) characterization	ICH M10, 21 CFR 58 (as applicable)
Bioanalytical laboratory (immunogenicity)	Tiered anti-drug antibody (ADA) screening, confirmatory, and titer assays plus neutralizing-antibody (NAb) assessment against both the anti-TL1A and IL-22R binding arms	ICH M10, USP <1106>, EMA/FDA immunogenicity guidance
Central endoscopy reader	Blinded central reading of the Mayo endoscopic subscore supporting the endoscopic-improvement endpoint (48.9% / 27.9% / 6.2%)	Blinded independent central read charter
Central histopathology	Blinded reading of mucosal biopsies for histologic activity indices	Central reading charter
IRT / RTSM	1:1:1 randomization and double-blind drug supply management for the 900 randomized subjects	ICH E6(R3), 21 CFR 11
eCOA / ePRO	Electronic capture of the modified Mayo patient-reported subscores (stool frequency, rectal bleeding)	21 CFR 11, PRO validation
Data management & biostatistics	EDC build, database lock, statistical analysis of primary/secondary endpoints, SAP execution	ICH E6(R3), ICH E9, 21 CFR 11
Drug-substance CDMO	CHO cell-culture expression; Protein A capture plus polishing chromatography; in-process and release testing	ICH Q7, Q5A(R2), Q5D, Q6B, 21 CFR 210/211
Drug-product CDMO	Sterile fill-finish of the subcutaneous presentation, labeling, and release	ICH Q7, Q5C, Q6B, 21 CFR 210/211
Nonclinical (GLP) CRO	GLP toxicology in the cynomolgus monkey as the sole pharmacologically relevant species	21 CFR 58, ICH S6(R1)
Pharmacovigilance vendor	Global safety database, case processing, expedited/periodic reporting, signal management	ICH E2A/E2B(R3)/E2D, 21 CFR 312.32
Regulatory publishing / medical writing	eCTD compilation and submission-ready document production	21 CFR 601 (BLA), eCTD

Selection and qualification

Vendor selection follows a documented request-for-proposal and capability-assessment process weighted toward demonstrated experience with biologics and, specifically, with bispecific antibody programs and inflammatory bowel disease (IBD) endpoints. For GxP-generating vendors, qualification requires a pre-award assessment (capability, capacity, financial stability, information-security posture) followed by a for-cause or routine QA audit before the vendor is placed on the approved-supplier list. GMP manufacturers (drug-substance and drug-product CDMOs), the GLP nonclinical CRO, and the bioanalytical laboratories are audited on-site (or by validated remote audit) prior to first use and are re-qualified on a risk-based periodic cycle. Central reading vendors and eClinical system providers undergo process and computerized-system validation review as part of qualification.

Qualification of the bioanalytical laboratories carries program-specific weight because TILA-278 exhibits TMDD, which produces nonlinear, target-engagement–dependent pharmacokinetics; the PK assay must therefore be qualified across the full concentration range with attention to soluble-target interference. The immunogenicity vendor must demonstrate a validated tiered strategy capable of characterizing ADA against each arm of the bispecific independently, because a neutralizing response against either the anti-TL1A or the IL-22R paratope could differentially affect efficacy and safety, and the assay format must control for drug and target interference at expected circulating concentrations.

Contracts, quality agreements, and technical agreements

Every GxP vendor relationship is governed by a two-layer instrument set: a commercial MSA with study/work-order scope, and a quality agreement (for GMP/GCP/GLP/PV activities) or technical agreement (for CMC transfer activities) that assigns specific quality responsibilities, defines the disposition and release decision rights retained by the sponsor, and specifies audit rights, deviation and change-control notification obligations, data-ownership, record-retention, and subcontracting controls. For the CHO drug-substance and sterile drug-product CDMOs, the technical/quality agreements additionally define responsibilities for cell-bank custody and testing (consistent with ICH Q5D), adventitious-agent and viral-clearance program ownership (ICH Q5A(R2)), specification setting and lifecycle (ICH Q6B), stability program execution (ICH Q5C), and process/analytical change notification thresholds that require sponsor pre-approval. No subcontracting of a GxP activity is permitted without prior written sponsor approval and flow-down of equivalent quality obligations.

Oversight, performance metrics, and quality tolerance limits

Ongoing oversight is risk-based and metric-driven. For each vendor the sponsor and vendor agree KRIs and, at the study level, QTLs whose breach triggers documented root-cause analysis and, where warranted, corrective and preventive action (CAPA). Representative metrics tracked for TILA278-201 include: data-entry and query-resolution cycle time and open-query aging (data management/CRO); source-data-verification and central-monitoring findings and site-issue aging (CRO); sample accountability, chain-of-custody integrity, and out-of-window collection rate (central lab); assay run acceptance rate, incurred-sample-reanalysis performance, and turnaround (bioanalytical); central-read completion rate and inter-/intra-reader agreement (endoscopy and histopathology); randomization error rate and drug-supply/temperature-excursion events (IRT and distribution); and case-processing timeliness and regulatory-reporting compliance (pharmacovigilance). Because the double-blind integrity of a 1:1:1 design directly underpins the interpretability of the 37.3% / 16.2% / 0.7% remission separation and the −2.36 / −1.77 placebo-adjusted modified-Mayo differences, unblinding-control metrics (IRT access logs, blinded-team firewalls, and any emergency unblinding events) are treated as high-priority QTLs.

GMP vendor oversight — drug substance and drug product

The CHO-derived drug substance and the sterile subcutaneous drug product are the most technically demanding elements of the vendor portfolio and receive commensurate oversight. The sponsor's technical operations and QA functions review and approve the master and working cell-bank testing and stability program, the upstream cell-culture process, and the downstream Protein A capture plus polishing purification train, including the viral-clearance strategy required under ICH Q5A(R2). Person-in-plant presence or real-time batch-record review is used for critical campaigns, and the sponsor retains final disposition/release authority for every batch used in TILA278-201 and destined for the BLA. Specifications are set and maintained per ICH Q6B for identity, purity/impurities (including product- and process-related impurities and aggregates), potency (a bioassay reflecting both TL1A-antagonist and IL-22R-agonist activities), and safety attributes; stability is governed by ICH Q5C. Change control at the CDMOs flows to the sponsor for pre-approval, with comparability assessments planned for any process change that could affect the quality-target product profile. Analytical method transfer and co-validation between the CDMOs and the sponsor-designated release/stability laboratories are executed under technical agreements.

Bioanalytical and central-laboratory oversight

The central safety laboratory is overseen for pre-analytical integrity (kit distribution, collection windows, shipment temperature, and chain-of-custody) across the screening-through-Week-12 timeline for all 900 randomized subjects. The PK bioanalytical laboratory is overseen against an ICH M10–compliant validation supporting TMDD characterization, and the immunogenicity laboratory against a validated tiered ADA/NAb strategy that resolves responses to each binding arm of the bispecific. Sponsor oversight includes review of validation and bioanalytical reports, incurred-sample-reanalysis outcomes, and any assay-interference investigations, with the pharmacokinetic and immunogenicity data ultimately integrated into the clinical pharmacology and immunogenicity assessments of the BLA.

Central imaging, endoscopy, and histopathology reading

Because endoscopic improvement (48.9% / 27.9% / 6.2%) and the endoscopic component of the modified Mayo score are efficacy-determining, the central endoscopy reader operates under a blinded independent central-read charter with defined reader training, image-quality gating, and adjudication procedures; reader blinding to treatment assignment, visit sequence (where required by the charter), and site identity is enforced and monitored. The central histopathology vendor operates under an equivalent blinded charter for mucosal biopsy assessment. The sponsor reviews reader-agreement metrics and read-completion tracking as part of routine oversight, and any charter deviations are handled through the vendor's and sponsor's deviation processes.

Nonclinical (GLP) vendor oversight

The GLP nonclinical program is conducted by a toxicology CRO with the cynomolgus monkey as the sole pharmacologically relevant species, consistent with ICH S6(R1), because the bispecific's TL1A and IL-22R epitopes and functional activities are represented in the cynomolgus monkey but not in rodents. Oversight follows 21 CFR Part 58, including study-director accountability, protocol and amendment review, sponsor monitoring visits, and audited final reports. Consistent with the biotechnology-product framework of ICH S6(R1), the program is designed around repeat-dose toxicology, safety pharmacology endpoints incorporated into the general-toxicology studies, toxicokinetics, and immunogenicity assessment; genotoxicity, carcinogenicity, hERG/ion-channel, and dedicated thorough-QT evaluations are not conducted, as they are not scientifically warranted for a monoclonal antibody of this class. The nonclinical CRO's data feed the integrated nonclinical overview of the eventual BLA.

Pharmacovigilance and safety-vendor oversight

A dedicated pharmacovigilance vendor maintains the global safety database and performs case intake, processing, medical review support, expedited and periodic reporting, and signal detection under ICH E2A/E2B(R3)/E2D and 21 CFR 312.32. Safety-data exchange agreements define reconciliation between the clinical CRO's EDC and the safety database, expedited-reporting timelines, and literature-monitoring responsibilities. The sponsor's pharmacovigilance function retains the qualified-person/medical-safety accountability, the signal-management decision rights, and benefit-risk assessment; the vendor executes but does not own these judgments.

Data management, biostatistics, and eClinical systems

Data management and biostatistics are contracted to generate the locked datasets and analyses underpinning the reported outcomes. Computerized systems (EDC, IRT/RTSM, eCOA/ePRO, and the safety database) are validated under 21 CFR Part 11, with the sponsor reviewing validation summaries, access-control and audit-trail configurations, and user-management procedures. The statistical analysis plan (ICH E9) governs the analysis of the primary remission endpoint and the key secondary modified-Mayo and endoscopic endpoints, including handling of the Full Analysis Set (840 subjects) and estimand/missing-data conventions; the sponsor's biometrics function reviews and approves the SAP, the database-lock readiness, and the final analyses.

Risk-based quality management and issue escalation

The program applies a risk-based quality-management framework consistent with ICH E6(R3): critical-to-quality factors are identified up front, risks are assessed and mitigated proportionately, and oversight intensity is allocated to the vendors and processes most likely to affect subject safety and the reliability of results. Vendor deviations, protocol deviations, and QTL breaches are captured centrally, triaged for significance, and routed to root-cause analysis and CAPA where warranted, with serious breaches escalated to the Joint Steering Committee and, where reportable, to the relevant health authority. CAPA effectiveness is verified before closure, and recurring or systemic vendor issues feed back into re-qualification and, if necessary, contingency or vendor-transition planning.

Sponsor retained-oversight responsibilities under ICH E6(R3)

Under ICH E6(R3), the sponsor's transfer of trial-related duties to a CRO or specialty vendor does not transfer accountability. Virtual Biopharma Inc. retains ultimate responsibility for the quality and integrity of the trial data, the protection of subject rights and safety, oversight of all delegated activities, and the accuracy of information submitted to health authorities. This is operationalized through the documented delegation of duties (with duties not delegated in writing remaining with the sponsor), the vendor-oversight plan, the governance-committee structure, direct maintenance of the critical quality and technical agreements, retained batch-disposition and release authority for investigational product, retained signal-management and benefit-risk decision rights in pharmacovigilance, and audit rights exercised across the GxP vendor portfolio. Collectively, these retained responsibilities ensure that the outsourced execution model supporting TILA278-201 remains fully accountable to the sponsor and submission-ready for the BLA under 21 CFR Part 601.