November 2016

1. Risk-Based Monitoring  Overview November 2016

2. TransCelerate Legal Disclaimer These materials are intended to facilitate and reduce the burden on clinical trial sponsors and others in training personnel with regarding to risk-based monitoring methodologies. Each clinical trial sponsor or other company engaging in such training activities bears full responsibility for its own training and accompanying materials to ensure both the accuracy of the training and materials and compliance with all applicable local, state, and national laws and regulations. This training is not intended to replace any in-depth training that clinical trial sponsors or others may wish or need to provide to their personnel or investigator sites to educate them on required or desirable clinical trial monitoring methodologies. By using these training materials, you signify your assent to the below terms of use. If you do not agree to them, you are not authorized to copy, distribute, reproduce, or use these materials and should not do so. • Disclaimer of Liability TransCelerate, its staff, or its Member Companies shall not be held liable for any improper or incorrect use of these training materials and assumes no responsibility for any user's use of them. In no event shall TransCelerate, its staff, or its Member Companies be liable for any direct, indirect, incidental, special, exemplary, or consequential damages (including, but not limited to: procurement or substitute goods for services; loss of use, data, or profits; or business interruption) however caused and on any theory of liability, whether in contract, strict liability, or tort (including negligence or otherwise) arising in any way out of the use of these training materials, even if advised of the possibility of such damage. This disclaimer of liability applies to any damages or injury, whether for tortious behavior, negligence, or under any other cause of action. • Disclaimer of Warranties/Accuracy and Use of Information Material in the training materials may include technical inaccuracies or typographical errors. Changes may be periodically incorporated into this material. TransCelerate may make improvements and/or changes in the products, services and/or job aids described in these materials at any time without notice. These training materials are provided 'AS IS' WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT. Some jurisdictions do not allow the exclusion of implied warranties, so the above exclusion may not apply to you. Neither TransCelerate, its staff, or its Member Companies warrants or makes any representations regarding the use or the results of the use of the materials or information in this site, or the accuracy, adequacy, completeness, legality, reliability, or usefulness of the training materials.

3. What Is Risk Based Monitoring (RBM)? An adaptive approach to clinical trial monitoring that directs monitoring focus and activities to the evolving areas of greatest need which have the most potential to impact patient safety and data quality.

4. Content 1 2 3 4

5. Section 1 Objectives At the conclusion of this section, attendees will be able to… • Explain the rationale for Risk-Based Monitoring (RBM) • Describe TransCelerate RBM and the RBM key assumptions • Describe the RBM Methodology as compared to traditional monitoring methods

6. Section 1: Objective 1 Rationale for RBM

7. Industry Drivers to Change Traditional Monitoring Approach Various Reasons for Change New Technology Adapt to Needs Regulatory Shift Risk Mitigation Complex Protocols Smarter Resource Allocation Cost- Benefit Ratio

8. Regulatory Agencies - Leading the Movement 2011EMA Draft Reflection Paper & FDA Draft Guidance on RBM (issued August 2011) 1988FDA Guidance – Monitoring of Clinical Investigations(retired 2010) 2009CTTI focuses on clinical trial monitoring efficiency and effectiveness 1998FDA Guidance provides standards for minimal on-site monitoring 2013Final FDA Guidance and EMA Paper on RBM (issued August 2013) 2011 2013 1988 1996 1998 2007 2009 2010 2014 Formation of TransCelerate 2007Janet Woodcock,FDA, introduces risk-based approach concepts in clinical research 2009-106 FDA sponsor warning letters citing “inadequate monitoring” 1996ICH E6 provides flexibility in how trials are monitored 2013FDA supports TransCelerate with review of pilot RBM plans

9. RBM Industry Movement

10. Section 1: Objective 2 Transcelerate OVERVIEW and Key RBM assumptions

11. TransCelerate and Flexible Implementation As a reminder: • TransCelerate members may choose whether to implement TransCelerate generated solutions • If they choose to implement, they are free to do so however they see fit • Best practices & change management discussions are intended merely to facilitate assessment of tools in order to improve them flex·i·ble ˈfleksəbəl/ adjective adjective: flexible 1. capable of bending easily without breaking. "flexible rubber seals" synonyms:pliable, supple, bendable, pliant, plastic; More

12. TransCelerate Today – 18+ Organizations and 14 Active Initiatives Today 17 Member Companies 12 Active Initiatives 1 Exploratory Initiative 18 Member Companies 15 Active Initiatives 2 Realized Initiatives 2014 17 Member Companies 5 Active Initiatives 1 exploratory Initiative 10 Founding Members 5 Active Initiatives 2013 2012

13. Industry Initiatives Research and CRO Community Engage with Key Stakeholders We also recognized the need to collaborate not only across participating Member Companies, but also regulatory authorities and industry groups. Investigator Sites RegulatoryAuthorities

14. TransCelerate RBM Output Delete this slide? http://www.transceleratebiopharmainc.com/assets/risk-based-monitoring/

15. TransCelerate RBM Publications Delete this slide?

16. TransCelerate Position Paper: Risk-Based Monitoring Methodology

17. TransCelerate RBM Methodology: Assumptions Central and off-site monitoring are the foundation Monitoring activities are adapted based on issues/risks Tailor methodology to available technology Timely data entry and query resolution are critical Functional oversight and documents should respond to changes/risks RBM expectations can be formalized in SOPs Methodology applies to all types and phases of trials Communication plans should be tailored for efficiency Risk assessments should take place prior to protocol/CRF finalization

18. Quality by Design (QbD) Concepts Program and Protocol Development Study Execution QbD RBM • Identify risks at the program, study, & site level to apply the appropriate level of monitoring through: • Mapping the risks to appropriate monitoring plans • Employing mechanisms to monitor important parameters (Central & Off-site monitoring activities) • Smarter use of Technologies that enable effective oversight • Targeted on-site interventions Build Quality into the scientific and operational design and conduct of clinical trials to: • Effectively & efficiently answer intended questions about benefits/risks • Identify fit for purpose data • Focus on key risks to Patient safety & data integrity • Design efficient MP to rapidly detect/correct issues

19. TransCelerate RBM Methodology Monitoring Plans Adjusting monitoring activities based on risks Critical Variables RACT Using Risk Indicators, Thresholds & Action Plans Focusing on Critical Processes and Data Conducting early and ongoing risk assessments Building QbD into design & planning of trial

20. Section 1: Objective 3 RBM Methodologyas compared to traditional monitoring methods

21. Types of Monitoring Term “Monitoring” is used in different ways in the clinical trial context • Site Monitoring • Safety Monitoring • Medical Monitoring • Quality Control monitoring by Sponsor and CRO internal processes and systems • Quality Control mechanisms at site

22. Value Proposition / Benefits When Delivered Model Approach for High-Quality, Risk-Based Monitoring Unmet Need Value Proposition • Sites have varying levels of experience and quality,but monitoring approaches are not designed to manage differences • No model approach or best practices existed for risk-based monitoring • Expectations when outsourcing are 100% SDV • Research indicates that 100% SDV is not effective at identifying material risk; however, monitoring approaches remained unchanged • Improved ability to ensure subject safety, data integrity & GCP compliance • Allocates resources more efficiently • Continuous improvement opportunities enabled by an approach that can be measured & refined over time • Increase site personnel time to focus on their core job functions • Increase inspection-readiness, audit and Inspection findings minimized with focus on what matters

23. Section 1 Summary • Rationale for RBM is driven by industry, regulatory, risk & technology changes • TransCelerate’s founding principles & key assumptions include a proactive quality by design approach to assess, mitigate, and manage risks • RBM is intended to improve upon the “traditional” monitoring model

24. Content 1 2 3 4

25. Section 2 Objectives At the conclusion of this section, attendees will be able to… • Identify Critical Data and Processes for Risk-Based Monitoring (RBM) application • Identify protocol risks

26. Section 2: Objective 1 Identifying critical data/Processes for RBM application

27. Critical Data/Processes – Possible Questions What are the data and/or processes which are critical to program and/or protocol success? What Critical Data must be collected in order to satisfy the objectives? What are the Critical Processes that must be done correctly to ensure subject safety, data quality, and/or GCP and regulatory compliance? Are there any Critical Processes in the program and/or protocol which are vulnerable to error?

28. Critical Data and Processes Critical Data Critical Processes Processes that underpin safety or quality Rationale: why is it critical? Safety/ethical treatment - seeking appropriate medical consultation, investigating clinically significant findings Data quality – blinding, event adjudication, controlling inter-rater variability Compliance – GCP, local regulations, protocol Data that support primary & key secondary objectives • Rationale: why is it critical? • Endpoint - primary or secondary • Safety - SAEs, events leading to discontinuation of treatment • Other (specify) Example: 1) AEs/SAEs 2) HbA1C Example: 1) Collection and reporting of AEs/SAEs 2) Collection, storage, shipment of labs

29. Examples of Critical Data/Critical Processes* *note these are only examples and may not be applicable to all studies in a therapeutic area

30. Section 2: Objective 2 Conducting risk Assessments

31. Background • 4 major questions: • What might go wrong? • What is the likelihood it will go wrong? • What are the consequences? • How easy it to detect? • Risk is defined as the combination of the probability of occurrence of harm, the severity of that harm and how easily that harm can be detected

32. Risk Assessment and Categorization Tool (RACT) Program Level RACT Protocol Level RACT **Categories** • Safety • Endpoints • IP • Technology • Operational Experience • Study Phase • Subject Population • Endpoints • Technology • Data Collection & CRF Source • Study Medication /IP • Blinding • Clinical Supply Chain • Protocol Complexity • Operational Complexity • Geography

33. RACT Completion Logistics Who? A cross-functional group involving various roles and team members (e.g. Data Managers, Monitors, Clinical Scientists) When? During study planning, before the protocol is finalized

34. Identifying Risks Program Level Protocol/Trial Level Do the new/unique tools and procedures differ from standard of care? Are there safety considerations as a result of comparator drugs or the indication? Any competing studies for the study population? Are any inclusion/exclusion criteria open to interpretation or unclear for study staff? Does the study complexity increase risks? • new/unique tools or procedures associated with the program? • specific safety requirements or adverse events of special interest? • any risks unique for the product such as storage requirements? • risks inherent to the indication and/or therapeutic area? • risks from a regulatory perspective?

35. Risks vs Issues What is the difference between a risk and an issue?

36. Evaluating Risks • Risk Level is determined by: • Impact • Probability • Detectability • The combined assessment of all of the components determines the risk level.

37. TransCelerate RACT snap-shot

38. Section 2 Summary • Risk assessment focuses on risks, Critical Data and Processes identified at the program, protocol and other risks (e.g., region/country/site) • Early and proactive risk identification and assessment is a core activity of the RBM methodology

39. Content 1 2 3 4

40. Section 3 Objectives At the conclusion of this section, attendees will be able to… • Discuss development of risk mitigation plans including Risk Indicators and Thresholds in decision-making • Document risk mitigations in function plans • Describe how to conduct monitoring activities in the RBM model – including central, off-site & on-site monitoring

41. Section 3: Objective 1 developing Risk Management Plans

42. Risk Management Planning How do we determine our risks? What helps us detect risk? How will we know to take action? How will we respond? • Planned Actions • Risk Indicators • Threshold Breaches • RACT

43. Risk Indicators & Thresholds

44. Risk Indicator Categories and Examples

45. Threshold Levels Different Threshold levels may be set • Drives different response levels • A visual, color-coded system may be used

46. Actions: Examples of Responses to Thresholds • Possibly no action needed beyond ongoing monitoring • Continue central and/or off-site monitoring • Assess other data remotely • Contact site to get additional information • Contact site to get additional information • Collect site documentation • Visit site to review documentation not available remotely

47. TransCelerate RBM Toolkit: Companion Guide to Risk Indicators

48. Example • Risk Indicator: Site has incorrectly administered IP more than expected. • Threshold: Rate of incorrectly administered IP at a site is > 2 standard deviations more than the average rate across sites. • Risk Detection: Central monitoring analytic to flag outlying sites. • Risk Mitigation: • Monitor to retrain the PI and/or delegate off-site on the importance of IP compliance to subject safety and data integrity. • SDR the process for administering IP at next site visit. • Other pre-defined mitigation efforts: • Edit check to query where data is missing. • SDV a sample of the subjects based on defined risk level.

49. Section 3: Objective 2 Planning risk mitigations

50. What is a Risk Mitigation Plan? Documented plan, typically in functional plans Assigns responsibility Actions taken to prevent or decrease the probability of a risk becoming an issue