📚 Part of the TILA-278 Regulatory Dossier — Reader's Guide. This article shows the live document; edits to the source appear here automatically.

---

Clinical Monitoring Plan (TILA278-201)

Field	Value
Document ID	TMF-003
Version	1.0
Compound	TILA-278 (anti-TL1A antagonist / IL-22R agonist bispecific)
Standard	ICH E6(R3) / RBM
Confidentiality	Confidential

Trial Master File operational document for Study TILA278-201.

Change History

Version	Date	Author	Summary
1.0	2026-07-08	Clinical Operations	Initial issue

Abbreviations

Term	Definition	Term	Definition
ADA	anti-drug antibody	KRI	Key Risk Indicator
AE	adverse event	MoA	mechanism of action
AESI	adverse event of special interest	MVR	Monitoring Visit Report
CAPA	corrective and preventive action	PK	pharmacokinetic(s)
CMP	Clinical Monitoring Plan	QA	Quality Assurance
COV	Close-Out Visit	QTL	Quality Tolerance Limit
CRA	Clinical Research Associate	RACT	Risk Assessment and Categorization Tool
CRO	Contract Research Organization	RBM	risk-based monitoring
CSR	Clinical Study Report	RBQM	risk-based quality management
CtQ	critical-to-quality	SAE	serious adverse event
DMP	Data Management Plan	SAP	Statistical Analysis Plan
DSMB	Data Safety Monitoring Board	SC	subcutaneous
EC	Ethics Committee	SDR	source data review
eCRF	electronic Case Report Form	SDV	source data verification
EOT	End of Treatment	SIV	Site Initiation Visit
GCP	Good Clinical Practice	SQV	Site Qualification Visit
ICH	International Council for Harmonisation	TL1A	TNF-like ligand 1A (TNFSF15)
IMV	Interim Monitoring Visit	TMDD	target-mediated drug disposition
IP	investigational product	TMF	Trial Master File
IRB	Institutional Review Board	UC	ulcerative colitis
IRT	interactive response technology	ISF	Investigator Site File

1. Introduction and Purpose

This Clinical Monitoring Plan (CMP) defines the risk-based monitoring (RBM) strategy for Protocol TILA278-201, a Phase 2b, randomized, double-blind, placebo-controlled, parallel-group 12-week induction study of TILA-278 in adults with moderately to severely active ulcerative colitis (UC). TILA-278 (Virtual Biopharma Inc.) is a humanized IgG1 bispecific monoclonal antibody combining anti-TL1A (TNFSF15) antagonism with IL-22 receptor agonism, administered subcutaneously (SC).

The CMP operationalizes the sponsor's quality-by-design and risk-based quality management (RBQM) framework in accordance with ICH E6(R3). It describes:

• the integrated monitoring model (central, remote, and on-site);
• the critical data and critical processes that are the focus of monitoring;
• the source data review (SDR) and source data verification (SDV) approach;
• the types and frequency of site visits and remote contacts;
• the Key Risk Indicators (KRIs), Quality Tolerance Limits (QTLs), and the issue-escalation pathway.

This CMP is a controlled Trial Master File (TMF) document. It is intended to be read together with the protocol, the Monitoring Manual/Visit Report templates, the Data Management Plan (DMP), the Safety Management Plan / Pharmacovigilance Agreement, the Statistical Analysis Plan (SAP), the Data Safety Monitoring Board (DSMB) Charter, and the study-level Risk Assessment and Categorization Tool (RACT). Where this CMP and the protocol differ on a clinical requirement, the protocol prevails; this CMP governs monitoring conduct.

2. Scope and Regulatory Basis

2.1 Scope

This CMP applies to all investigational sites participating in TILA278-201 and to all monitoring activities performed by the sponsor and its delegated Contract Research Organization (CRO) from site activation through site close-out. It covers monitoring of subject rights and safety, data integrity and credibility, investigational product (IP) management, and compliance with the protocol, ICH GCP, and applicable regulatory requirements.

The study is conducted at approximately 130 sites across approximately 15 countries, enrolling from a screened population of 1700 subjects, with 900 randomized 1:1:1 to TILA-278 High (299), TILA-278 Low (300), and placebo (301).

2.2 Regulatory and guidance basis

• ICH E6(R3) Good Clinical Practice, including Annex 1 and the principles of a proportionate, risk-based approach to trial conduct and monitoring.
• ICH E8(R1) General Considerations for Clinical Studies (critical-to-quality [CtQ] factors).
• ICH E2A / E2B(R3) and applicable expedited safety-reporting requirements.
• Regional GCP inspection expectations (e.g., FDA guidance on a risk-based approach to monitoring; EMA reflection paper on risk-based quality management in clinical trials).
• Sponsor SOPs for clinical monitoring, RBQM, protocol-deviation management, TMF, and issue escalation.

2.3 Guiding principles

Monitoring is proportionate to the risks to the reliability of study results and to subject rights, safety, and well-being. The sponsor prioritizes the prevention of important errors over their retrospective detection, concentrates effort on critical data and critical processes, and uses centralized analytics to direct on-site effort to where it adds most value. Monitoring intensity is not uniform across sites or over time; it is adjusted dynamically in response to accumulating risk signals.

3. Study Overview (Monitoring-Relevant Summary)

Attribute	Detail
Protocol	TILA278-201
Phase / design	Phase 2b, randomized, double-blind, placebo-controlled, parallel-group
Population	Adults 18–75 years with moderately to severely active UC (baseline modified Mayo score 4–9)
Treatment period	12-week induction
Randomization	1:1:1 — TILA-278 High / TILA-278 Low / Placebo (299/300/301), central via IRT
Stratification	Baseline modified Mayo severity (4–6 vs 7–9); prior biologic exposure (yes vs no)
Administration	Subcutaneous injection (prefilled syringe/autoinjector); study drug administered at Weeks 0, 2, 4, and 8
Visit schedule	Weeks 0, 2, 4, 8, 12 (Week 12 = End-of-Treatment assessment)
Primary endpoint	Clinical remission (modified Mayo ≤ 2, no individual subscore > 1) at Week 12
Screened / randomized	1700 / 900

The stratification factors (baseline severity; prior biologic exposure) and the composite, endoscopy-dependent primary endpoint are the principal drivers of the risk profile and therefore of the monitoring focus (Sections 6–7). The modified Mayo score is the sum of three subscores — stool frequency, rectal bleeding, and the centrally read endoscopy subscore (each 0–3; total 0–9).

4. Roles, Responsibilities, and Oversight

The sponsor retains overall accountability for the quality and integrity of the trial data and for oversight of delegated activities. Delegation to the CRO is documented in the sponsor–CRO agreement and delegation log.

Role	Core monitoring responsibilities
Sponsor Clinical Lead / Study Responsible Physician	Overall oversight; approval of QTL/KRI framework; decisions on QTL breaches, site suspension, and serious-breach determinations.
Sponsor Medical Monitor	Ongoing benefit–risk review; eligibility and SAE adjudication support; medical review of safety and endpoint data; clinical escalation point.
Central Monitoring / RBQM Analyst	Ongoing statistical and KRI surveillance; QTL tracking; generation of central-monitoring signals and triggers for on-site action.
Clinical Trial / Country Lead	Line management of CRAs; review of Monitoring Visit Reports (MVRs) and action-item closure; regional risk oversight.
Clinical Research Associate (CRA / on-site & remote monitor)	Site management; SIV/IMV/COV conduct; SDR/SDV; protocol-deviation and IP-accountability review; issue identification and first-level escalation.
Data Management	eCRF/edit-check design; query management; data-cleaning and reconciliation metrics feeding central monitoring.
Pharmacovigilance / Safety	SAE intake, expedited reporting, SAE reconciliation with the clinical database.
Quality Assurance (QA)	Risk-based audits; oversight of CAPA; independent of operational delivery.

Oversight cadence: a cross-functional Risk Review Team meets at a defined interval (every 4 weeks during active enrollment, or ad hoc when a signal requires) to review KRIs, QTL status, aggregate deviations, and escalated issues, and to re-baseline site-level monitoring intensity.

Independent safety oversight is additionally provided by a Data Safety Monitoring Board (DSMB) operating under its own charter, which reviews unblinded safety data (including deaths, SAEs, adverse events leading to discontinuation, injection-site reactions, and laboratory safety parameters) at pre-specified intervals. Unblinded safety reports are prepared by an independent statistical group that is functionally separate from the blinded sponsor study team. Clinical monitoring under this CMP is performed by blinded personnel and does not access unblinded treatment assignments or DSMB deliberations; the DSMB's independent review complements, and does not substitute for, the sponsor's monitoring obligations.

5. Risk Assessment and Critical-to-Quality Factors

A documented RACT was completed at study start-up and is maintained as a living document. Risks are scored on likelihood, impact (on subject safety and/or data reliability), and detectability, and are mapped to mitigation and to specific monitoring activities. The CtQ factors below anchor the monitoring focus.

CtQ factor	Why critical for TILA278-201	Primary monitoring control
Valid informed consent	Ethical/regulatory foundation; re-consent on amendments	100% on-site verification of consent presence, version, dating, and process
Eligibility integrity	Composite modified Mayo entry criteria (baseline 4–9), baseline infection screening, and stratification (severity, prior biologic) drive interpretability	100% SDV of key eligibility and stratification data; central check of randomization strata vs. source
Randomization / blinding integrity	Double-blind, managed via interactive response technology (IRT); unblinding threatens the primary comparison	IRT reconciliation; monitoring of unblinding events, kit assignment, matched injection volumes, and blind maintenance
Primary endpoint capture	Modified Mayo at Week 12 (stool frequency, rectal bleeding, centrally read endoscopy subscore)	100% SDV of endpoint components; central-read tracking; window/missingness surveillance
IP management (SC biologic)	Cold-chain-dependent prefilled syringe/autoinjector; correct kit, dose, and administration at Weeks 0/2/4/8	Temperature-excursion review; accountability reconciliation; administration-record SDV
Safety data completeness	Immunomodulatory MoA (infection risk from TH1/TH17 dampening); injection-site reactions the main drug-attributable finding	SAE 100% review + reconciliation; AESI surveillance; central AE-rate analytics
PK / immunogenicity sampling	Anti-drug antibody (ADA) impact on PK/efficacy/safety; target-mediated drug disposition (TMDD)-driven PK	Sample-collection compliance KRI; SDV of collection date/time and processing
Data timeliness & credibility	Feeds central statistical monitoring and QTL tracking	eCRF entry-lag and query-aging KRIs; cross-site distributional checks

6. Monitoring Strategy

TILA278-201 uses an integrated, risk-based monitoring model combining continuous centralized analytics, scheduled and triggered remote monitoring, and targeted on-site monitoring. The three components are complementary: central monitoring identifies where risk is concentrated, and remote/on-site monitoring resolves and prevents it.

6.1 Central (statistical) monitoring — continuous

Central monitoring is performed continuously on accumulating data by the RBQM analyst and Data Management, independent of site visits. It includes:

• KRI dashboards with site-level and study-level thresholds (Section 9), refreshed on a defined cycle (weekly during active enrollment);
• cross-site distributional and outlier checks (e.g., variability and digit-preference in modified Mayo components; improbable data patterns; duplicate or unusually uniform data);
• data-quality metrics (query rate/aging, eCRF entry lag, missingness of endpoint components, visit-window compliance);
• safety-signal surveillance at aggregate level (blinded-pool AE/SAE rates by arm, adverse event of special interest [AESI] clustering);
• QTL monitoring against study-level parameters (Section 9.2).

Central-monitoring output directly informs the site risk score and the triggering of remote or on-site actions.

6.2 Remote monitoring — scheduled and triggered

Remote monitoring comprises off-site review of data and, where permitted by local regulation and site agreements, remote access to redacted/certified source documents. It is used to:

• perform remote SDR and, where authorized, remote SDV of critical data between on-site visits;
• follow up open action items and confirm CAPA effectiveness;
• conduct interim contacts with sites showing acceptable risk profiles, reducing on-site burden;
• respond rapidly to central-monitoring triggers without waiting for the next scheduled visit.

Remote monitoring does not replace on-site verification of activities that require physical presence (e.g., IP storage/temperature logs and drug accountability, Investigator Site File [ISF] completeness, facility/equipment checks).

6.3 On-site monitoring — targeted

On-site monitoring is deployed on a risk-adjusted schedule and for-cause. It focuses on the CtQ factors of Section 5: consent, eligibility/stratification, primary endpoint source, IP management, and safety. Sites with higher risk scores (e.g., high enrollment, new/inexperienced sites, KRI signals, or unresolved issues) receive more frequent and more intensive on-site attention; low-risk, low-enrollment, well-performing sites may be managed predominantly remotely with a defined minimum on-site presence.

6.4 Dynamic adjustment

Each site carries a risk score derived from baseline attributes (experience, enrollment volume, complexity) and dynamic signals (KRIs, deviation trends, issue history). Monitoring intensity — visit frequency, SDV extent, remote vs. on-site mix — is reviewed at each Risk Review Team meeting and adjusted accordingly. All adjustments are documented with rationale.

7. Critical Data and Critical Processes

7.1 Critical data (subject to the highest monitoring intensity)

• Informed consent (presence, correct version, dating, process).
• Key inclusion/exclusion criteria — including baseline infection screening (tuberculosis; hepatitis B and C; HIV; stool assessment for enteric pathogens, including Clostridioides difficile) — and both stratification variables (baseline modified Mayo severity; prior biologic exposure).
• Randomization record and IP/kit assignment (IRT).
• Primary endpoint components: subject-reported stool frequency and rectal bleeding subscores and the centrally read endoscopy subscore contributing to the modified Mayo score at Week 12.
• All SAEs, deaths, and AESIs.
• IP administration records, accountability, and temperature/cold-chain data.
• PK and ADA (immunogenicity) sample collection records.

7.2 Critical processes

• Consent and re-consent management.
• Eligibility confirmation and randomization/stratification via IRT.
• Blinding maintenance (including matched injection number/volume) and controlled unblinding.
• Endoscopy acquisition and transfer to the central reader; reconciliation of central-read results.
• IP receipt, storage, dispensing, administration, return/destruction, and excursion handling.
• Safety data capture, expedited reporting, and SAE reconciliation.
• eCRF completion, query resolution, and data cleaning ahead of database lock.

8. Source Data Review and Source Data Verification

The study uses a risk-based, targeted SDV model rather than 100% SDV of all data. Source Data Review (SDR) — the qualitative review of source for evidence of GCP-compliant conduct, protocol adherence, and safety reporting — is performed at every monitoring contact and is not limited to the fields subject to SDV.

8.1 SDV framework

Data category	SDV extent	Rationale
Consent, key eligibility, stratification variables	100%	Foundational to subject rights and to the interpretability of the primary comparison
Primary endpoint components (incl. endoscopy central-read linkage)	100%	Directly determines the primary result
SAEs, deaths, AESIs (incl. serious infections, injection-site reactions)	100%	Subject safety and regulatory reporting
IP administration, accountability, temperature	100% of critical fields	Cold-chain-dependent SC biologic; dosing integrity
Key secondary endpoints and safety labs	Targeted (~50%, risk-adjusted)	Important but not primary; central checks supplement
Non-critical / supportive data	Sampled (~10–20%) or central-monitoring only	Low impact on results; error detectable centrally

SDV percentages for non-critical categories are increased for a given site when central monitoring, KRIs, or deviation trends indicate elevated risk, and may be reduced for consistently high-performing, low-risk sites. Any change from the default is documented.

8.2 Interaction with central monitoring

Central monitoring reduces reliance on manual SDV for errors that are more efficiently detected in aggregate (e.g., outliers, missingness, inconsistent distributions). On-site SDV/SDR is reserved for verification that requires source access and for confirming/resolving central signals. The two approaches are explicitly complementary and jointly documented in the site's monitoring record.

9. Key Risk Indicators and Quality Tolerance Limits

9.1 Key Risk Indicators (site-level)

KRIs are tracked continuously; each has a defined threshold that triggers review and, where warranted, remote or on-site action. Thresholds below are the study baselines and are risk-adjusted per site.

KRI	Threshold (trigger)	Directed action
Screen-failure rate deviation	> 2 SD from study mean	Review eligibility interpretation and pre-screening practice
eCRF entry lag	> 10 business days median	Remote follow-up; data-entry remediation
Query rate / query aging	> 15% open beyond 30 days	Remote query-resolution support
Important protocol deviation rate	> 2 SD above pooled site rate	Root-cause review; targeted visit if sustained
Visit-window non-compliance	> 10% of visits out of window	Site retraining; scheduling remediation
Primary endpoint component missingness	> 5% at a completed visit	Immediate remote review; endpoint-capture remediation
SAE reporting timeliness	Any report > 24 h of site awareness	Escalation to safety; retraining; for-cause review
IP temperature excursions unresolved	> 1 unresolved excursion	On-site/for-cause review of storage and quarantine
PK/ADA sample-collection compliance	< 90% collected/processed per schedule	Remote review of sampling logistics
Discontinuation / withdrawal rate	> 2 SD above pooled rate	Medical + operational review

9.2 Quality Tolerance Limits (study-level)

QTLs are pre-specified parameters, above which a systematic issue affecting subject safety or the reliability of study results is deemed possible; a breach triggers documented evaluation and, if confirmed, corrective action recorded in the RBQM/TMF record. QTL breaches are reported in the Clinical Study Report.

QTL parameter	Tolerance limit	Basis
Subjects randomized with a major eligibility violation	≤ 2%	Protects primary-analysis population validity
Primary endpoint unevaluable at Week 12	≤ 8%	Protects primary-endpoint power/interpretability
Overall premature discontinuation (excluding lack-of-efficacy withdrawals)	≤ 15%	Protects estimand and missing-data assumptions
Important protocol deviations affecting primary endpoint	≤ 5%	Data credibility
SAEs not reported within required timelines	0 tolerance for pattern; any recurrence evaluated	Subject safety and regulatory compliance

QTLs are distinct from KRIs: KRIs manage operational, site-level risk; QTLs are secondary limits on parameters critical to the study as a whole. Approaching a QTL (a defined warning band) prompts proactive review before the limit is breached.

10. Site Visit Types and Frequency

Visit type	Timing / frequency	Purpose
Site Qualification Visit (SQV)	Pre-selection	Confirm site capability, staff, facilities, cold-chain, endoscopy access
Site Initiation Visit (SIV)	After IRB/EC approval, before first subject	Protocol/IP/GCP training; site activation; ISF review
Interim Monitoring Visit (IMV) — on-site	First within 4–6 weeks of first subject randomized; thereafter risk-based, on-site at least every 8–12 weeks during active enrollment	SDR/SDV of critical data; IP and safety review; action-item closure
Remote monitoring contact	Between on-site IMVs, and on trigger	Remote SDR/SDV, query and CAPA follow-up
Triggered / for-cause visit	Ad hoc, driven by KRI/QTL signals or issues	Investigate and resolve specific risks
Close-Out Visit (COV)	After last subject last visit and data reconciliation	Final reconciliation, IP disposition, TMF completeness, archiving

The first on-site IMV is prioritized to confirm early that consent, eligibility, stratification, randomization, and IP handling are being executed correctly, given their downstream impact on the primary result. Subsequent frequency is governed by the site risk score: higher-risk/higher-enrolling sites are visited more often on-site; lower-risk sites may be managed predominantly through remote contacts with a defined minimum on-site cadence. All visits generate a Monitoring Visit Report (MVR) and a follow-up letter within the timelines defined in the Monitoring Manual (MVR finalized within 10 business days; site follow-up letter within 5 business days).

11. Program-Specific Monitoring Considerations

• Injection-site reactions. Injection-site reactions are the principal drug-attributable finding on active SC drug; monitoring confirms consistent solicitation, grading, and reporting of local reactions and their reconciliation with the safety database.
• Infection surveillance. Because TL1A antagonism dampens TH1/TH17 inflammation, serious and opportunistic infections are treated as AESIs; monitoring confirms complete capture, timely reporting, and follow-up to resolution, and verifies that protocol-required baseline infection screening (tuberculosis, hepatitis B and C, HIV, and stool assessment for enteric pathogens including Clostridioides difficile) was completed and appropriately actioned before randomization.
• Cold chain and device. The prefilled syringe/autoinjector is temperature-sensitive and administered SC at Weeks 0, 2, 4, and 8; monitoring verifies storage logs, excursion management/quarantine, device accountability, and administration records.
• Endpoint objectivity. The endoscopy subscore is centrally read; monitoring verifies acquisition quality, timely transfer, and reconciliation of central-read results against the eCRF, and tracks the unevaluable-endoscopy rate against the corresponding QTL.
• Blinding integrity. Double-blind conduct is protected through IRT reconciliation, maintenance of identical injection number and volume across arms, monitoring of any unblinding events, and separation of blinded monitoring from the unblinded statistical group supporting the DSMB.
• Immunogenicity. ADA sampling compliance is monitored because ADA may affect PK, efficacy, and safety interpretation.

12. Issue Management and Escalation

Issues are graded by their actual or potential impact on subject safety, rights, and data reliability, and escalated on defined timelines. Central- and site-monitoring findings feed a single issue log maintained in the TMF.

Level	Trigger examples	Owner / route	Target timeline
Level 1 — Site operational	Minor deviations, isolated data lags, single overdue query	CRA → Clinical Trial Lead; site CAPA	Resolve/close within 15 business days
Level 2 — Significant	KRI breach, recurrent deviations, IP excursion, endpoint-capture gaps	Clinical Trial Lead + Medical Monitor + RBQM	Action plan within 5 business days; review at next Risk Review Team
Level 3 — Critical / systemic	QTL breach, safety-reporting failure, GCP non-compliance, potential serious breach or fraud	Sponsor Clinical Lead + QA + Pharmacovigilance	Immediate escalation (within 24 h of awareness); formal evaluation and CAPA

Level 3 outcomes may include intensified/for-cause monitoring, a directed QA audit, site suspension or termination, notification to IRBs/ECs and regulatory authorities where required, and serious-breach reporting per applicable regional obligations. Confirmed QTL breaches and their evaluations are documented in the RBQM record and reported in the Clinical Study Report. All escalations, decisions, and CAPA (including effectiveness checks) are documented with rationale in the TMF.

13. Documentation, Quality Management, and Version Control

• TMF. All monitoring outputs — MVRs, follow-up letters, the issue/CAPA log, KRI/QTL records, risk-review minutes, and RACT versions — are filed in the TMF contemporaneously and are inspection-ready.
• Quality management. This CMP is part of the study RBQM system. QA conducts risk-based, independent audits; findings are managed through CAPA distinct from routine monitoring.
• Metrics and reporting. Monitoring performance (visit completion, SDV completion, issue closure, KRI/QTL status) is reported to study governance at the Risk Review Team cadence.
• Amendments. This CMP is version-controlled. It is reviewed when the protocol is amended, when the risk profile changes materially, or when accumulating data warrant a change in monitoring intensity. Substantive changes are documented with rationale, approved by the Sponsor Clinical Lead, and version-controlled in the TMF.

14. Approval

This Clinical Monitoring Plan is approved by the Sponsor Clinical Lead, the Sponsor Medical Monitor, the RBQM/Central Monitoring lead, and Quality Assurance for Virtual Biopharma Inc. and the delegated CRO. Signatures and dates are maintained in the controlled-signature version filed in the TMF.