Last Updated: October 2026
Throughout the clinical trial, the majority of sponsors delegate responsibility for management of their most valuable asset to their CRO. That most valuable asset is the Trial Master File (TMF), defined by the EMA as the collection of essential documents and data records which “enable the operational staff as well as monitors, auditors and inspectors to evaluate compliance with the protocol, the trial’s safe conduct and the quality of the data obtained.”
What should you ask your CRO about your TMF? Ask seven things: what it costs to keep your study stored, how the data is secured and checked, how long the CRO holds it after study close, which system holds it and whether it is validated, how they support an inspection, how you and inspectors get access, and how the TMF is handed back to you. Regulators hold the sponsor responsible for the TMF even when a CRO runs it, so you need these answers in writing.
In this article
- 1. Cost
- 2. Securing the data
- 3. Retention after study close
- 4. The system that stores the TMF
- 5. Inspection support
- 6. Access
- 7. Transfer back to you
- What your CRO contract should say about the TMF
- What a good answer looks like
- How the main eTMF options handle sponsor-CRO collaboration and transfer
- How Kivo supports sponsors who want to own their TMF
- Frequently asked questions
As with any outsourced activity, there are risks associated with relinquishing control over your TMF. But despite the downsides, most sponsors still hand day-to-day TMF work to a CRO: one industry estimate puts roughly 72% of clinical trials in the hands of a CRO partner. Thus it is important to learn how to select a CRO, how to structure your agreement to ensure your data will be protected, and to review contracts that are already in place.
If you have recently joined a sponsor organization with a CRO in place, or are simply looking to understand more about how your CRO will be handling this sensitive data, it is wise to review the details of your contract. Below, we outline 7 key questions to ask your CRO, assuming you already have a contract. Asking these questions can help uncover any gaps in their data management processes, and thus reduce your risk of data loss or inspection issues down the line.
7 Questions to Ask your CRO about your TMF
1. What is the all-in cost to continue to maintain our study?
What is included in the cost?
How is the cost calculated? Per GB, per study, etc?
Does the cost scale over time?
What services are included as part of long-term storage?
2. What is your process for securing the data and documents?
What is your quality control process to ensure the quality of the data?
Can you walk me through the process followed in your eTMF for QC? Do you use a risk-based approach?
What kind of checks are done on the stored data to ensure it is maintained and no loss of data has occurred?
- What kind of backups exist, should my TMF data become corrupted?
3. How long will you hold our data after study close?
What period of time is in the contract?
What happens when that time period ends? Do I have the option to renew?
- If I have the option to renew, does the cost structure change?
4. What system is being used to store the TMF?
Are the systems which will be used in our study validated or are they qualified?
Is there validation documentation?
Is each instance of a database validated?
Do you store any data on any non-controlled systems?
- If you have system changes or updates, how am I notified?
5. How do you support us through a TMF inspection?
- Who provides TMF expertise during an inspection?
- What kind of IT support will be available during an inspection for your systems?
6. How do I get access to the TMF when I need to?
- How do inspectors / regulatory bodies get access?
- What is the timing for granting system access?
7. If and when we want to reclaim stewardship of the TMF, how will it be transferred to us?
- Is there an existing transfer plan?
- What support do you provide during a transfer?
- If I sell the study, can I transfer the long-term storage arrangement to the buyer?
What Your CRO Contract Should Say About the TMF
The EMA guideline on the TMF says the sponsor “remains responsible for the trial and will need to maintain oversight” when it outsources work to a CRO. It lists what the clinical trial contract should cover:
- Which party holds the TMF, or which party holds which parts of it when it is divided.
- The access arrangements for the parties involved.
- How the TMF will be made available to the competent authorities.
- Arrangements for when the trial is completed, including where the CRO archives the TMF on the sponsor's behalf.
- Procedures in case a party closes down its business for any reason.
Where a CRO manages the eTMF, the guideline also expects pre-qualification checks before you contract the CRO, and says eTMF systems should be validated.
ICH E6(R3), adopted in January 2025, takes the same line: where activities are transferred to service providers, responsibility for the conduct of the trial, including the quality and integrity of the trial data, resides with the sponsor, who should maintain appropriate oversight (ICH E6(R3), Principle 10). FDA posted the final guideline on September 9, 2025, and the EMA made it effective on July 23, 2025. Check FDA's current status for a U.S. compliance date.
What a Good Answer Looks Like
| Question | A good answer | A red flag |
|---|---|---|
| 1. Cost | A written fee schedule showing what is included, how it is calculated, and how it changes over time | Per-GB or per-study fees that grow with no cap, or "we'll quote it later" |
| 2. Security and QC | A documented risk-based QC process, tested backups, and regular integrity checks on stored files | No documented checks on stored data; backups described only verbally |
| 3. Retention | A contracted retention period, with renewal terms and pricing stated up front | Retention ends at study close with no renewal option |
| 4. System | A validated eTMF with documentation you can inspect, and notice of system changes | Documents also kept on uncontrolled drives or in email |
| 5. Inspection support | A named TMF expert and IT support available during inspections | No named contact; support "as available" |
| 6. Access | Defined timelines for granting sponsor and inspector access, ideally direct | Access only on request through the CRO, with days of delay |
| 7. Transfer | A documented transfer plan covering format, audit trail, and reconciliation | No plan; transfer scoped and priced only at the end |
Overall, you want to ensure that your CRO is handling your data with as much care as you would, and that all practices are following the appropriate compliance requirements. Should you be interested in exploring how to reduce your TMF costs and/or how to take ownership of your TMF, the Kivo team is here to help.
How the Main eTMF Options Handle Sponsor-CRO Collaboration and Transfer
This is a neutral overview, not a ranking. It does not assess implementation quality, market share, or fit for your organization. Capabilities change, so confirm details with each vendor. Kivo is our product, so read this section with that in mind.
| Option | What it is | What the vendor documents on sponsor-CRO exchange and transfer | Source of claim |
|---|---|---|---|
| Kivo eTMF | Cloud eTMF on the same document core as DMS, RIM, and QMS | Validated migration ingests documents, metadata, and audit trails from most TMF platforms and CROs via secure FTP and recompiles one unified audit trail. Elevar Therapeutics moved 19 TMF studies (73,794 documents) in 72 days. Long-term storage has no per-GB or per-study charges. | kivo.io |
| Veeva eTMF | Cloud eTMF from Veeva | Product page lists a TMF Transfer feature for sending completed TMFs between sponsors and CROs at study close, and a real-time view of TMF completeness for sponsors, CROs, and sites. | veeva.com (checked October 2026) |
| Montrium eTMF | Cloud eTMF with eTMF Connect from Montrium | Homepage describes a centralized study record hub for inspectors. Transfer and CRO hosting details are not published on the homepage; confirm with Montrium. | montrium.com (checked October 2026) |
| Florence eTMF | eTMF integrated with Florence's site-facing eBinders | Product page describes permissions for internal and external teams and document sharing with site eISFs. TMF transfer is not described on the product pages; confirm with Florence. | florencehc.com (checked October 2026) |
Whichever you evaluate, ask the same seven questions, plus one more: can I receive a full TMF, audit trail included, from my CRO's system? For a wider checklist, see how to select an eTMF system.
How Kivo Supports Sponsors Who Want to Own Their TMF
Kivo's validated TMF migration ingests documents, metadata, and audit trails from most TMF platforms and CROs through secure FTP, and recompiles a single unified audit trail. Elevar Therapeutics used it to migrate 19 TMF studies in 72 days. Long-term storage carries no per-GB or per-study charges, which speaks directly to question 1. Kivo holds SOC 2 Type 2 and ISO 9001 certifications, is rated 4.9/5 on G2, and supports 200+ teams. Learn more about Kivo eTMF and TMF transfer.
Frequently Asked Questions
Who is responsible for the TMF when a CRO manages it?
The sponsor. The EMA TMF guideline says the sponsor remains responsible for the trial and must maintain oversight when it outsources to a CRO, and ICH E6(R3) says responsibility for trial conduct and data quality resides with the sponsor.
What should a CRO contract say about the TMF?
Which party holds the TMF, who has access, how competent authorities get access, what happens at trial completion including archiving, and what happens if a party closes down, per the EMA guideline. Add transfer format, audit trail, and cost terms.
How long must a TMF be kept?
In the EU, clinical trial records must be kept at least 25 years after the trial ends. The sponsor stays ultimately responsible even when a CRO archives on its behalf. Confirm requirements for your regions with your regulatory team.
Can a sponsor take its TMF back from a CRO?
Yes, and the contract should say how. Plan the transfer early: agree format, audit trail handling, QC, and reconciliation, and confirm the sponsor retains the full set of documents and can make them readily available for inspections.
Related reading: Why sponsors shouldn't leave the TMF with their CRO | What an eTMF system needs for real sponsor oversight | Considerations for migrating your eTMF | What to look for when choosing a compliant eTMF vendor
