Your CRO Has QA. That's Not Enough.

"Our CRO has QA — we're covered." It's one of the most common phrases in biotech, and one of the most dangerous assumptions in nonclinical development. In this episode, we break down the critical difference between CRO QA and sponsor-side oversight, why GLP compliance and regulatory strategy are two completely different things, and what happens when nobody is doing the sponsor's job.

Key takeaways:

• CRO QA ensures the CRO complies with GLP — that's it. It does not ensure your study design supports your regulatory strategy
• When a protocol deviation occurs, CRO QA documents it perfectly — but nobody assesses whether it invalidates your NOAEL or affects your IND
• Big Pharma has five layers of oversight. Most biotechs have two and hope that's enough — the missing layer is sponsor-side QA
• Real-time study monitoring with a regulatory lens is what catches problems when you can still fix them, not six months later in the final report
• Most biotechs choose to do nothing by default — not because they've evaluated the risk, but because they don't know the gap exists

Links:

• Data Is Not Strategy on Amazon: https://a.co/d/02xUsV6K
• Work with Dessi: www.toxistrategy.com 

The Nonclinical is hosted by Dessi McEntee, MS, DABT — board-certified toxicologist and Fractional Head of Toxicology. Subscribe to the newsletter on LinkedIn, take the course at nonclinical.academy, or work with Dessi at toxistrategy.com.

Transcript

SPEAKER_00 0:00

So, um if you are a biotech leader, right? Yeah. And you're managing early stage drug development programs, there is this one specific phrase that probably brings you a ton of comfort.

SPEAKER_01 0:13

Oh, absolutely. It's like the ultimate safety blanket phrase in the industry.

SPEAKER_00 0:17

Right. It's something you've probably heard in a board meeting, or you know, maybe you've even leaned on it yourself when you're trying to reassure a nervous investor. And it basically goes, our CRO has QA. We're covered.

SPEAKER_01 0:28

Yeah, exactly. You've outsourced the work to this top-tier contract research organization, right? And they have a dedicated quality assurance unit. So um you figure you can finally just sleep at night. Aaron Powell Right.

SPEAKER_00 0:39

It feels definitive. It gives you this sense that a, I don't know, a safety net has been securely fastened under your entire non-clinical program.

SPEAKER_01 0:47

Aaron Powell Which is so crucial when you're navigating just the sheer chaos of early stage development. But I mean that sense of security, it's fundamentally flawed.

SPEAKER_00 0:55

Aaron Powell Yeah, and that's exactly what we're going to get into today. Because, you know, knowledge is really only valuable when it's applied correctly. And right now, a staggering number of lean, fast-moving biotechs are applying, well, the completely wrong kind of oversight to their most critical studies.

SPEAKER_01 1:12

Aaron Powell They really are.

SPEAKER_00 1:13

So for this deep dive, we are pulling from some really fascinating notes and excerpts from a piece by Desi McIntyre. She's a board-certified toxicologist and a fractional head of toxicology.

SPEAKER_01 1:23

Aaron Powell And she makes this brilliant argument that confusing study execution with regulatory strategy is like one of the absolute most dangerous blind spots in the entire industry.

SPEAKER_00 1:34

Aaron Powell So our mission right now is to unpack why that is. We're going to explore why relying solely on your CRO's quality assurance can lead to, you know, massive delays, clinical holds, and literally millions of dollars evaporating into thin air.

SPEAKER_01 1:49

It's painful to watch.

SPEAKER_00 1:50

Aaron Powell We are your guides through this material. And uh by the end of this, we really want you to look at your own programs and figure out if they're actually as covered as you think they are.

SPEAKER_01 1:59

Because to really understand this blind spot, we first have to look at what that CRO's quality assurance team is actually mandated to do. Aaron Powell Right.

SPEAKER_00 2:06

Like what are you actually paying them for?

SPEAKER_01 2:08

Exactly. The assumption from the sponsor side, so from you, the biotech leader, is often that the CRO is looking out for your overarching business and regulatory strategy.

SPEAKER_00 2:19

Aaron Powell, which makes sense on paper, right? You're paying them millions.

SPEAKER_01 2:22

It does make sense, but they are not. The sole purpose of a CRO's quality assurance unit is to ensure that their own execution of your study complies with GLP or good laboratory practice.

SPEAKER_00 2:33

And um GLP compliance is incredibly specific. I mean, it's not about the scientific merit of the study at all.

SPEAKER_01 2:40

No, not even a little bit. It's entirely about operational rigor.

SPEAKER_00 2:43

Aaron Powell Right. So the CRO, QA, is conducting, you know, phase inspections during the study. They are verifying that the technicians are following the standard operating procedures to the exact letter.

SPEAKER_01 2:53

Aaron Powell Yeah, they're out there making sure the pipettes are calibrated.

SPEAKER_00 2:57

Yes. And that the timestamps on the data logs actually match up. They're checking if the temperature in the animal room fluctuated and verifying that the final report accurately reflects the raw data.

SPEAKER_01 3:08

Aaron Powell All of which, I want to be clear, is absolutely essential. I mean, you literally cannot submit a valid non-clinical study to the FDA without that rigorous GLP compliance.

SPEAKER_00 3:18

Right, it's table stakes.

SPEAKER_01 3:20

Exactly. But what is completely absent from that mandate is any evaluation of the actual study design itself.

SPEAKER_00 3:27

Ah, right. So they aren't checking the strategy.

SPEAKER_01 3:30

No. CRO QA is not verifying if your protocol answers the specific questions the FDA wants answered for your IND application. They just ensure the data is collected correctly.

SPEAKER_00 3:42

Aaron Ross Powell But they don't ensure the data is actually useful for your clinical goals.

SPEAKER_01 3:45

Precisely.

SPEAKER_00 3:46

Okay, so um I was thinking about this, and it's kind of like the difference between having a brilliant copy editor versus a developmental editor for a novel.

SPEAKER_01 3:55

Oh, that's a really good way to look at it.

SPEAKER_00 3:56

Right. So the copy editor who is the CRO QA in this scenario, they go through your manuscript and ensure every single word is spelled right.

SPEAKER_01 4:03

They make sure the grammar is perfect.

SPEAKER_00 4:05

Exactly. The punctuation is flawless, the formatting meets publishing standards, but and this is the kicker, they are entirely indifferent to whether the actual plot makes any sense.

SPEAKER_01 4:15

Yeah, they don't care if the readers will absolutely hate the ending.

SPEAKER_00 4:18

Right. And if the ending of the book ruins the entire story, well, you can't blame the copy editor. They did exactly what you hired them to do.

SPEAKER_01 4:26

Exactly. The problem isn't the CRO failing at their job. The problem is the biotech sponsor expecting the CRO to provide this like strategic narrative oversight that was literally never part of the contract.

SPEAKER_00 4:41

Okay, but let me challenge this premise just a little bit because I think a lot of people listening are probably thinking this. Sure.

SPEAKER_01 4:46

Go ahead.

SPEAKER_00 4:46

If I'm an early stage biotech, yeah. Right. And I am writing a two or three million dollar check to a premier global CRO. And these people have seen hundreds, maybe thousands of IND enabling studies.

SPEAKER_01 5:00

Oh, absolutely they have.

SPEAKER_00 5:01

Right. So if I hand them a protocol that is missing a critical endpoint or, you know, has a glaring strategic flaw, surely they are going to speak up and tap me on the shoulder.

SPEAKER_01 5:12

You know, it is entirely logical to assume that. And honestly, that's exactly why so many founders fall right into this trap.

SPEAKER_00 5:19

But they don't tap you on the shoulder.

SPEAKER_01 5:20

Well, you have to look at it from the CRO's perspective, especially regarding liability and their operational mandate. Now, a truly exceptional study director at a CRO might flag a blatant scientific impossibility.

SPEAKER_00 5:34

Like if you ask them to dose an animal with something completely unfeasible.

SPEAKER_01 5:37

Right. But it fundamentally is not their responsibility to understand your corporate regulatory alignment. I mean, they aren't sitting in your board meetings.

SPEAKER_00 5:47

That's true.

SPEAKER_01 5:47

They haven't read the minutes from your pre-IND meeting with the FDA. They don't know the specific claims you are trying to make in your investigator's brochure.

SPEAKER_00 5:55

So basically, if you ask them to build a bridge to nowhere, they will build you a perfectly compliant, beautifully documented bridge to nowhere.

SPEAKER_01 6:03

Exactly. They are reviewing your protocol for operational feasibility. Like can their facility execute this safely and within GLP guidelines. Right. They are not reviewing it for strategic viability. And you know, this lack of strategic context becomes incredibly dangerous when the inevitable happens.

SPEAKER_00 6:20

When things go wrong during the study itself. Exactly. Because I mean, let's be real. No study survives contact with reality perfectly. You always get protocol deviations.

SPEAKER_01 6:29

Oh, always. The power blanks or a technician misreads a label or you know, a machine calibration drifts for an hour.

SPEAKER_00 6:37

Right. And when those deviations happen, CRO, QA, does their job. They document the what, the when, and the corrective action.

SPEAKER_01 6:46

They file the paperwork seamlessly. The GLP compliance is totally maintained.

SPEAKER_00 6:50

Aaron Powell But documenting that a deviation occurred is like very different from assessing what that deviation actually means for your broader strategy.

SPEAKER_01 6:58

Aaron Powell Yes. When a protocol deviation happens, someone has to ask does this invalidate our NOA ill? You know, our no observed adverse effect level.

SPEAKER_00 7:06

Right. Does this throw off the calculations for our human starting dose?

SPEAKER_01 7:10

Aaron Ross Powell Exactly. And CROQA does not run those strategic calculations. They simply document that the event happened and was corrected operationally.

SPEAKER_00 7:17

Aaron Powell It kind of makes me think of um a navigation analogy. It's like a cargo ship leaving the harbor and making a one-degree navigation error on day one.

SPEAKER_01 7:25

Okay, yeah.

SPEAKER_00 7:26

The CRO QA documents that the steering wheel shifted one degree, they log the time, and they note that the captain corrected his posture. Perfect compliance.

SPEAKER_01 7:35

Perfect compliance, right?

SPEAKER_00 7:36

Trevor Burrus, Jr. But they don't look at the map to realize that a one-degree shift means you are now going to miss the entire continent of Europe by week thirteen.

SPEAKER_01 7:45

Which is exactly why you need sponsor oversight. You need someone reviewing that interim data with a regulatory lens in real time.

SPEAKER_00 7:53

Someone looking at the map.

SPEAKER_01 7:54

Exactly. Someone looking at the map rather than just reading the navigation logs six months later when you've already run out of fuel in the middle of the ocean.

SPEAKER_00 8:02

Wow, yeah. So let's look at what that actually looks like in practice. Because Desi McInty's source material details a real-world disaster that perfectly illustrates this.

SPEAKER_01 8:12

Yeah, this story is a classic example.

SPEAKER_00 8:14

Right. So imagine a biotech team running a pivotal 13-week talk study, and this is the big one.

SPEAKER_01 8:20

It's the critical path.

SPEAKER_00 8:21

Yeah.

SPEAKER_01 8:22

The final major hurdle before they submit their IND to the FDA. The stakes literally couldn't be higher.

SPEAKER_00 8:28

Exactly. So they run the 13 weeks of dosing, the in-life portion finishes, and then while they wait.

SPEAKER_01 8:34

Right, because it takes time to process the pathology, run the data, and compile that massive final report.

SPEAKER_00 8:40

So they wait three months after dosing ends just to receive the final document from the CRO. Which means they are already, what, half a year into the single study?

SPEAKER_01 8:48

Yeah, easily.

SPEAKER_00 8:49

So they open the final report, and buried deep in the narrative is a protocol deviation. On day one of the study, there was a dosing error.

SPEAKER_01 8:58

Day one?

SPEAKER_00 8:59

Day one. And this error compromised four animals in the high dose group. Now, CRO QA handled this flawlessly from a compliance standpoint.

SPEAKER_01 9:08

Right. The deviation was reported, corrective action was taken immediately, QA signed off on it, and it went straight into the GLP file.

SPEAKER_00 9:14

Aaron Powell But here's the mechanism of the disaster. Like why do four animals matter so much?

SPEAKER_01 9:19

Well, your NOAL, the highest dose at which there are no significant adverse effects, it relies entirely on statistical power. Okay. So if your high dose group was designed with 10 animals and four of them are compromised by a day one dosing error, your group size is now six.

SPEAKER_00 9:34

Oh wow. So your statistical power just vanished.

SPEAKER_01 9:36

Completely vanished. The FDA is going to look at a group of six animals and say, um, this isn't a robust enough sample size to prove safety.

SPEAKER_00 9:45

So they won't accept the safety margin calculations you need to justify putting this drug into humans.

SPEAKER_01 9:52

Exactly. And because no one on the sponsor side was monitoring the study in real time with a regulatory lens, no one realized the statistical power was ruined on day one.

SPEAKER_00 10:02

That is wild. So the sponsor discovers this day one dosing error six months later, while they are like 90% done writing their IND submission.

SPEAKER_01 10:11

Yeah. Everything was perfectly documented as failing their strategy. The CRO did their job perfectly, but the sponsor completely neglected theirs.

SPEAKER_00 10:19

And the fallout from that has got to be catastrophic for a lean biotech. I mean, you can't just ignore it.

SPEAKER_01 10:24

Oh no, you definitely can't. The team now has to completely reanalyze their data, formally excluding those affected animals. Right. But because the statistical power is gone, they can't just, you know, wave their hands and justify the NOAL. They almost certainly have to run a bridging study.

SPEAKER_00 10:37

A bridging study, meaning they have to spin up an entirely new, smaller animal study just to replace the data gap they created in the high dose group.

SPEAKER_01 10:46

Yep. They have to secure lab space, buy the animals, run the dosing, do the pathology, and wait for another report.

SPEAKER_00 10:52

Aaron Powell Which delays the IND submission by what three to six months?

SPEAKER_01 10:57

Easily three to six months. And for an early stage biotech, time is quite literally survival.

SPEAKER_00 11:03

Yeah, I mean a three to six month delay isn't just a scheduling hiccup. If your burn rate is a million dollars a month, that is three to six million dollated because nobody was looking at the map.

SPEAKER_01 11:14

Exactly. You have investors asking why the critical milestone is delayed. You risk running out of runway before you ever even get to clinical trials.

SPEAKER_00 11:21

And the most frustrating part is that it was entirely preventable.

SPEAKER_01 11:24

100% preventable. If someone from the sponsor side had caught that deviation on day two, they could have immediately added replacement animals.

SPEAKER_00 11:32

Right.

SPEAKER_01 11:32

They could have extended the study parameters or adjusted the strategy right then and there, but nobody was watching.

SPEAKER_00 11:37

Wow. So this is exactly why you rarely hear about massive multinational pharmaceutical companies making these kinds of structural mistakes, right?

SPEAKER_01 11:47

Exactly. Big pharma has been burned by these exact scenarios in the past. So they built a structural ecosystem to ensure it never happens again.

SPEAKER_00 11:54

They operate on a model that clearly separates execution from strategy.

SPEAKER_01 11:58

Yes. If we look at how big pharma structures this, it's essentially five distinct functional layers.

SPEAKER_00 12:04

Aaron Powell Okay, let's break that down. The first layer is the actual study execution, right? So the technicians and the study director on the floor at the CRO pouring the concrete.

SPEAKER_01 12:12

Right. And layer two is the CRO QA, verifying that GLP compliance we talked about.

SPEAKER_00 12:17

But then you have layer three, which is the internal sponsor QA.

SPEAKER_01 12:21

And this is the crucial buffer zone. Their entire job is to ensure the execution happening in layers one and two actually aligns with the overarching regulatory strategy.

SPEAKER_00 12:30

So they're the ones constantly asking, does this data support the IND?

SPEAKER_01 12:34

Exactly. And it doesn't stop there. Layer four is the regulatory team taking that aligned data and formatting the actual submission.

SPEAKER_00 12:42

And then layer five is the medical and SACI team, reviewing the clinical implications before anything goes to the FDA.

SPEAKER_01 12:48

Exactly. Five separate functions, keeping execution, compliance, strategy, and clinical safety completely distinct.

SPEAKER_00 12:56

Now contrast that with the biotech reality. A lean early stage biotech typically collapses this entire ecosystem down to just two layers.

SPEAKER_01 13:05

Yeah, it's true. They hire the CRO to execute, they rely on the CRO QA for compliance, and they just, well, cross their fingers and hope that's enough to propel them all the way to a successful IND.

SPEAKER_00 13:17

They are completely missing that third layer, the sponsor oversight function.

SPEAKER_01 13:21

And that function doesn't just show up at the end either. That sponsor oversight has to be active across the entire timeline of the study.

SPEAKER_00 13:27

Right. So before the study even starts, they are the ones reviewing the protocols to ensure the study objectives actually answer the FDA's questions.

SPEAKER_01 13:34

Yeah. And during the study, they are monitoring the interim data. They are assessing those deviations in real time.

SPEAKER_00 13:40

They're also the ones looking closely at the toxicokinetics or the TK data.

SPEAKER_01 13:44

Yes, the TK data is so crucial. Right.

SPEAKER_00 13:46

Let's actually define that because TK data is really the lifeblood of human dose justification, isn't it?

SPEAKER_01 13:52

It absolutely is. Toxicokinetics measures exactly how the animal's body absorbs, distributes, metabolizes, and clears the drug over time.

SPEAKER_00 14:01

Aaron Powell So if your drug clears the system way faster than anticipated, your exposure levels drop.

SPEAKER_01 14:06

Right. And then the FDA will reject your proposed human starting dose because you haven't proven safety at sustained exposure levels. Wow.

SPEAKER_00 14:13

And CRO QA just ensures the blood was drawn at the correct minute.

SPEAKER_01 14:17

Exactly. But Sponsor QA looks at that TK data mid-study and realizes, uh-oh, our exposure levels are too low. We need to adjust the dosing strategy immediately.

SPEAKER_00 14:26

Aaron Powell And then after the study concludes, Sponsor QA reviews the final data, specifically anticipating the FDA's objections.

SPEAKER_01 14:33

Right. Identifying any narrative gaps before the IND is submitted.

SPEAKER_00 14:37

Now, if you are a biotech founder listening to this, you know, maybe you're driving to the lab or looking at your rapidly dwindling cash reserves, this concept of a five-layer big pharma ecosystem probably sounds incredibly overwhelming.

SPEAKER_01 14:50

I'm sure it does.

SPEAKER_00 14:50

Because you don't have the budget to hire a massive internal QA department. You don't have the headcount.

SPEAKER_01 14:56

Aaron Powell It is a daunting comparison. But the critical insight from McInty's piece is that early stage biotechs do not need to replicate Big Pharma's headcount.

SPEAKER_00 15:06

Oh, really?

SPEAKER_01 15:07

No, you just have to replicate the function. The gap isn't a lack of 70 people, it's a lack of targeted sponsor-side strategic oversight.

SPEAKER_00 15:16

Aaron Powell So someone just needs to be wearing that specific hat.

SPEAKER_01 15:19

Exactly.

SPEAKER_00 15:19

So how does a lean biotech actually fill that gap? The source material breaks down how companies scale this function based on their maturity and bandwidth. And it gives four options.

SPEAKER_01 15:29

Right. So option one, if you are a well-funded team with, say, five or more studies running simultaneously and multiple assets in the pipeline, you likely have the infrastructure to just hire a full-time head of quality.

SPEAKER_00 15:40

Aaron Powell Okay, so you pay the $200,000 to $300,000 salary plus equity and you have dedicated internal oversight.

SPEAKER_01 15:47

Aaron Powell Yes. But for most early stage teams with maybe one or two assets, a massive full-time salary is totally overkill.

SPEAKER_00 15:55

Aaron Powell Right. Which brings us to option two. That's where fractional or consulting support becomes the most viable bridge.

SPEAKER_01 16:01

Aaron Powell Exactly. You bring in a seasoned expert for a few thousand dollars a month. You are essentially renting the brain of a layer three strategic thinker for exactly the hours you need them.

SPEAKER_00 16:14

Aaron Powell So they dial into the key meetings, review the critical protocols, and monitor the interim data without adding massive overhead to your burn rate.

SPEAKER_01 16:22

Yep. It's very efficient. Then there's option three. You also have the option of building the capability internally with your existing team, provided they have the right background.

SPEAKER_00 16:32

Like cross-training your CMC lead, for example.

SPEAKER_01 16:34

Trevor Burrus, Jr. Right. Your CMC lead is the person responsible for chemistry, manufacturing, and controls. They ensure your drugs, chemical recipe, and manufacturing process are perfectly consistent batch to batch.

SPEAKER_00 16:45

So they already have a really rigid quality-focused mindset.

SPEAKER_01 16:48

Exactly. Or perhaps your regulatory lead or toxicologist steps into the role. But um there is a massive caveat here. This only works if your team actually has the internal bandwidth. If your CMC lead is already working 80 hours a week trying to scale up manufacturing, throwing sponsor QA responsibilities onto their plate is a recipe for disaster.

SPEAKER_00 17:11

Right. That's just asking for catastrophic burnout and drop balls. You aren't solving the gap. You're just hiding it under an exhausted employee.

SPEAKER_01 17:18

Exactly.

SPEAKER_00 17:18

Which brings us to the final and honestly most common path biotechs take, option four. The default choice of doing absolutely nothing.

SPEAKER_01 17:27

Yep. The upfront cost is zero dollars.

SPEAKER_00 17:30

You just lean back on that comforting phrase, our CRO has QA work covered, and hope for the best. But I have to say, most biotechs who choose option four aren't doing it because they've carefully calculated the risks, right?

SPEAKER_01 17:42

No, not at all. They choose the default because they don't even know the gap exists. And the danger of doing nothing cannot be overstated.

SPEAKER_00 17:49

Because you are trading a zero dollar upfront cost for the massive downstream risks of clinical holds, bridging studies, and preventable failures.

SPEAKER_01 17:57

Exactly. You absolutely do not want your first IND submission to the FDA to be the exact moment you discover you needed sponsor-side quality oversight all along.

SPEAKER_00 18:07

Oh man, yeah. Because when the FDA spots a fatal strategic flaw in your data, they don't just ask for a polite clarification.

SPEAKER_01 18:15

No, they place a clinical hold on your program, everything stops.

SPEAKER_00 18:19

Everything.

SPEAKER_01 18:20

You have to generate new data that actually supports your strategy before you can proceed. It is the most expensive learning curve in drug development.

SPEAKER_00 18:27

Wow. So it really comes down to a fundamental truth in drug development. A perfectly executed, perfectly compliant study that answers the wrong question is still a failed study.

SPEAKER_01 18:37

Exactly. The CROQA ensures the physical execution of your study is GLP compliant. They ensure the grammar of the study is flawless.

SPEAKER_00 18:45

But someone, whether that is a full-time hire, a fractional consultant, or a highly trained internal team member, must ensure your overarching strategy is regulatory sound.

SPEAKER_01 18:55

Because execution does not equal strategy.

SPEAKER_00 18:58

It really doesn't. And if you want more insights into creating defensible, robust non-clinical programs, the author of the piece we explored today, Desi McInty, has written a book called Data Is Not Strategy.

SPEAKER_01 19:11

Oh, it's a great read. It dives deep into how these specific non-clinical decisions shape your clinical and regulatory outcomes.

SPEAKER_00 19:19

Right. And why the data you generate is only as valuable as the strategic framework you actually place it in.

SPEAKER_01 19:24

It really is an essential read for anyone trying to navigate the space between laboratory execution and FDA approval.

SPEAKER_00 19:31

Absolutely. So we've established that flawless execution of a flawed plan inevitably leads to failure. And that brings us to a final thought for you to mull over as you look at your own pipeline. Yeah. If you are relying on compliance to do the heavy lifting of strategy in your talk studies, where else in your early stage programs might you be mistaking perfect execution for a winning strategy? Take a hard look at the map and make sure you aren't just steering the ship perfectly toward the completely wrong continent.