Quality Management Plan (TILA278-201)

Quality document for Study TILA278-201.

Change History

1. Purpose and Scope

1.1 Purpose

This Quality Management Plan (QMP) defines the quality management system (QMS) established by Virtual Biopharma Inc. (the Sponsor) for Protocol TILA278-201, a Phase 2b, randomized, double-blind, placebo-controlled induction study of TILA-278 in moderate-to-severe ulcerative colitis (UC). The plan describes how quality was built into the design and conduct of the study, how risks to participant safety and to the reliability of trial results were identified and controlled, and how the Sponsor and its service providers discharged their quality responsibilities in accordance with ICH E6(R3) Good Clinical Practice (GCP), the quality risk management principles of ICH Q9(R1), and, for investigational medicinal product (IMP) quality, ICH Q10.

The QMP embodies the ICH E6(R3) principle that quality should be built into the scientific and operational design of the trial from the outset, that effort should be focused on the factors and processes essential to the credibility of the results and the rights, safety and well-being of participants, and that quality activities should be proportionate to the risks involved and should avoid unnecessary complexity.

1.2 Scope

This QMP governs all quality-related activities for TILA278-201 across the full trial life cycle: protocol design and feasibility, site selection and initiation, participant recruitment and consent, randomization and blinding, IMP management, data collection and management, safety surveillance and pharmacovigilance (PV), sampling and bioanalysis (pharmacokinetics [PK] and anti-drug antibody [ADA]), central endoscopy reading, statistical analysis, and reporting. It applies to the Sponsor, all functional lines, contract research organizations (CROs) and other vendors, and to the participating investigator sites (approximately 140 sites across 14 countries in North America, Europe, and Asia-Pacific).

1.3 Relationship to Other Study Documents

This QMP sits at the head of a set of subordinate operational plans and does not replace them. It cross-references, and is to be read together with, the Clinical Monitoring Plan (risk-based monitoring), Data Management Plan (DMP), Safety Management Plan / Pharmacovigilance Agreement(s), Statistical Analysis Plan (SAP), Medical Monitoring Plan, IMP Management / Pharmacy Manual, and the Trial Master File (TMF) Plan. Where a specific process is detailed in a subordinate plan, this QMP states the quality objective and control intent and references the operative document.

2. Regulatory Framework and Governing Standards

The QMS for TILA278-201 was designed to conform to the following standards and expectations:

Applicable national and regional clinical-trial regulations for each participating jurisdiction were layered onto these standards; where regional requirements were more stringent than ICH guidance, the more stringent requirement governed.

3. Quality Management System for TILA278-201

3.1 Quality-by-Design and Fit-for-Purpose Approach

Quality was addressed prospectively during protocol development. The design features most consequential to quality — the double-blind, placebo-controlled, three-arm parallel-group structure (1:1:1 randomization to TILA-278 High / TILA-278 Low / Placebo), stratification by baseline modified Mayo severity and prior biologic exposure, a defined 12-week induction period with visits at Weeks 0, 2, 4, 8, and 12, and a single, objective primary endpoint (clinical remission by modified Mayo score ≤ 2 with no individual subscore > 1 at Week 12) — were reviewed at cross-functional design workshops for feasibility, participant burden, and operational reliability before finalization. Data collection was limited to variables necessary to satisfy the estimands defined in the SAP and to characterize safety; procedures that did not serve a scientific or safety purpose were not added.

3.2 QMS Architecture

The QMS operates through six integrated elements, applied continuously across the trial:

1. Governance and defined accountability (Section 4);
2. Quality risk management, including quality tolerance limits (QTLs) (Section 5);
3. Prospective identification and control of CtQ factors (Section 6);
4. Deviation detection and management with root-cause analysis and CAPA (Section 7);
5. Vendor qualification and oversight (Section 8), including the IMP quality interface (Section 9);
6. Assurance activities — audits, inspection readiness, and management review (Sections 11–12).

The system is proportionate: monitoring intensity, source-data verification (SDV) targets, and oversight frequency were scaled to the risk level of each process, with the most rigorous controls reserved for the CtQ factors identified in Section 6.

4. Governance, Roles and Responsibilities

4.1 Governance Structure

Overall accountability for the quality and integrity of TILA278-201 rests with the Sponsor. A Study Quality Oversight Committee (SQOC), chaired by the Sponsor Study Quality Lead and including Clinical Operations, Medical, PV, Data Management, Biostatistics, Regulatory, and IMP/CMC Quality representatives, met at defined intervals (at minimum monthly during active enrollment) to review the risk register, QTL status, quality metrics, significant deviations, and CAPA effectiveness. An independent Data Monitoring Committee (DMC) operated under a separate charter for unblinded safety surveillance; the DMC's independence and firewall from operational and analysis staff were themselves treated as controlled quality attributes.

4.2 Roles and Responsibilities (RACI)

Accountabilities are summarized below; delegated activities remained under Sponsor oversight and did not transfer accountability.

A = Accountable; R = Responsible; C = Consulted; I = Informed.

4.3 Delegation and Oversight

Operational delivery was delegated to one or more CROs and specialty vendors (Section 8). Delegation was documented in written agreements with defined quality obligations, key performance/quality indicators (KPIs/KQIs), and escalation pathways. The Sponsor retained oversight through vendor governance meetings, review of vendor quality metrics, co-monitoring/oversight visits, and periodic vendor audits.

5. Quality Risk Management

5.1 QRM Process

Quality risk management followed the ICH Q9(R1) cycle — risk identification, analysis, evaluation, control (reduction/acceptance), communication, and review — and ran continuously rather than as a single up-front exercise. The risk register was initiated at protocol finalization, formally reviewed at each SQOC meeting, and updated whenever new information (emerging deviations, monitoring findings, QTL signals, protocol amendments, or vendor performance changes) warranted reassessment.

5.2 Risk Assessment Methodology

Risks were scored using a Failure Mode and Effects Analysis (FMEA) approach on three dimensions — Probability of occurrence, Impact (on participant safety and/or result reliability), and Detectability — each rated 1–5, yielding a Risk Priority Number (RPN = P × I × D; range 1–125). Risks with RPN above the pre-defined action threshold (≥ 36) required a documented control plan; residual risk was re-scored after controls were implemented and either accepted with justification or subjected to further control.

5.3 Risk Register (Representative Entries)

5.4 Quality Tolerance Limits

Pre-specified QTLs defined the range of acceptable variation for parameters most important to result reliability and safety. A signal (breach of a secondary limit) triggered evaluation and, where confirmed as a systematic issue, a documented CAPA; breach of an absolute limit triggered immediate escalation to the SQOC. QTL performance was reported to the SQOC and summarized in the Clinical Study Report.

Observed primary-endpoint completeness exceeded the pre-specified 90% QTL in all three arms; the numerically lower completeness in the placebo arm was consistent with the higher discontinuation count driven by lack of efficacy (29 placebo vs 17/17 active) and was managed through the missing-data strategy defined in the SAP.

6. Critical-to-Quality Factors

CtQ factors were identified prospectively as those attributes without which the trial results would not be credible or participant safety could not be assured. Each factor was assigned an owner, a control strategy, and a monitoring signal.

7. Deviation Management and CAPA

7.1 Deviation Detection and Classification

Deviations from the protocol, this QMP, subordinate plans, or applicable regulations were captured through monitoring (on-site and centralized/statistical), site self-reporting, data review, vendor reporting, and audits, and logged in a controlled deviation-tracking system. Each deviation was classified by category (e.g., eligibility, consent, IMP, safety reporting, data, blinding) and by severity:

• Minor: no material effect on participant safety, rights, or data reliability.
• Major/important: potential to affect the safety or rights of participants, or the reliability of trial results, and therefore requiring formal evaluation and typically CAPA.
• Serious breach: a deviation likely to affect to a significant degree the safety or rights of a participant or the reliability and robustness of the data — subject to expedited escalation to the Sponsor, and to regulatory/IRB-IEC notification where required by regional regulation.

Important deviations were compiled for reporting in the Clinical Study Report per ICH E3.

7.2 Root-Cause Analysis and CAPA

Major/important deviations and confirmed QTL breaches triggered a documented root-cause analysis (RCA) proportionate to the issue. Corrective actions addressed the immediate nonconformity; preventive actions addressed the systemic cause to prevent recurrence, whether at a single site or program-wide. Each CAPA specified the action, owner, due date, and effectiveness-check criteria and timing. CAPA status and effectiveness were reviewed by the SQOC; a CAPA was closed only after its effectiveness check was met.

7.3 Escalation

A defined escalation ladder routed potential serious breaches, safety signals, and repeated or systemic deviations from vendor/site level to the SQOC and, where warranted, to Sponsor senior management and regulatory/ethics bodies within required timelines.

8. Vendor and Service Provider Oversight

8.1 Qualification and Contracting

All vendors performing trial-related activities were qualified before engagement through documented capability, quality-system, and (where risk warranted) audit assessment. Responsibilities, standards, KQIs, data-handling and data-integrity obligations, subcontracting controls, and audit/access rights were fixed in written agreements and, for safety, in pharmacovigilance agreements. Delegation did not transfer Sponsor accountability.

8.2 Oversight Model

Oversight was risk-based and continuous, combining scheduled governance meetings, review of vendor quality metrics against KQIs, issue and CAPA tracking, and periodic for-cause or routine audits.

9. Investigational Medicinal Product Quality (ICH Q10 Interface)

The IMP for TILA278-201 is TILA-278, a recombinant humanized IgG1 bispecific monoclonal antibody (anti-TL1A [TNFSF15] antagonist arm plus IL-22 receptor agonist arm), presented as a sterile subcutaneous solution in a single-use prefilled syringe/autoinjector, together with matched placebo. IMP quality was managed under the manufacturer's ICH Q10 Pharmaceutical Quality System and is described in the CTD Quality module; the clinical QMS interfaced with that system as follows:

• Release and certification: Each batch of active and matched placebo was released against approved specifications by a Qualified Person (QP)/authorized person prior to use. Specifications covered identity, purity and product-related impurities (aggregates, charge variants, glycosylation, and bispecific chain-pairing variants), and both functional activities — anti-TL1A neutralization and IL-22R agonism — consistent with ICH Q6B and Q5E comparability expectations.
• Viral safety and process control: The CHO-derived drug substance was purified by protein-A capture, polishing chromatography, and dedicated viral-clearance steps, with control aligned to ICH Q5A.
• Blinding-relevant presentation: The matched placebo device was designed and controlled so that active High-dose, active Low-dose, and placebo presentations were indistinguishable to sites and participants, protecting the CtQ blinding factor (Section 6).
• Cold chain and accountability: Distribution used a validated cold chain with continuous temperature monitoring; excursions triggered automatic quarantine and QA disposition before any further use. Site-level receipt, storage, dispensing, and returns were reconciled through the IRT and pharmacy accountability records.
• Complaints and recalls: Product technical complaints (including device/injection issues) were routed to the manufacturer's quality unit, trended, and, where they intersected safety (e.g., injection-site reactions — the principal drug-attributable finding on active SC drug), cross-referenced with PV.

10. Data Integrity and Computerized Systems

Data governance applied ALCOA+ principles (attributable, legible, contemporaneous, original, accurate, plus complete, consistent, enduring, and available) across EDC, IRT, eTMF, and bioanalytical/imaging systems. Computerized systems used in the trial were validated for their intended use, with access controls, audit trails, and change control. Data flow — from source at the site, through EDC, to the locked analysis database — was defined in the DMP, with audit-trail review focused on CtQ data. Database lock followed completion of data cleaning, medical coding (MedDRA/WHODrug), SAE reconciliation, and resolution of critical queries, and was formally authorized. Statistical analysis followed the pre-specified SAP with estimand-aligned handling of missing data, consistent with the observed differential discontinuation pattern.

11. Audit and Inspection Readiness

11.1 Internal Audit Program

An independent, risk-based audit program — executed by Sponsor QA independent of operational delivery — covered representative investigator sites (prioritizing high-enrolling, high-deviation, or otherwise higher-risk sites), the CRO and specialty vendors, key processes (PV, data management, IMP, central reading), and the TMF. Audit findings were graded, communicated, and tracked to CAPA closure with effectiveness verification, and were reported to the SQOC.

11.2 Trial Master File

The TMF was maintained as an inspection-ready, contemporaneous, and complete record throughout the trial. TMF completeness and timeliness were tracked as quality metrics; periodic TMF quality reviews confirmed that essential documents were present, current, and reconciled against activities performed.

11.3 Inspection Readiness and Management

Inspection readiness was treated as a continuous state rather than a pre-inspection activity. The Sponsor maintained an inspection-management procedure defining roles, logistics, document-provision controls, and communication discipline for regulatory inspections of the Sponsor, vendors, or sites. Site staff and vendors were prepared to demonstrate GCP compliance and traceability of the CtQ factors, in particular eligibility determination, blinding integrity, IMP accountability, safety reporting, and the provenance of the primary-endpoint data. Inspection findings would be handled through the same RCA/CAPA machinery described in Section 7.

12. Quality Management Reporting and Continual Improvement

Quality performance was reported on a defined cadence to the SQOC and, in summary, to Sponsor management, using a consolidated set of KQIs: QTL status, deviation trends by category and severity, open/overdue CAPAs and effectiveness outcomes, vendor KQI performance, audit findings, and TMF completeness. Emerging signals fed back into the risk register (Section 5), closing the QRM loop and driving proportionate adjustment of controls and monitoring intensity over the life of the trial. A management review at study close assessed overall QMS effectiveness, captured lessons learned, and informed quality planning for subsequent TILA-278 studies. The methods, QTL outcomes, and important deviations summarized here are reflected in the Clinical Study Report in accordance with ICH E3.

13. Records, Document Control, and Approval

This QMP is a version-controlled document under the Sponsor's document-management system. Revisions were made through controlled change management with documented rationale, re-approval, and communication to affected parties. The plan was reviewed and approved by the Sponsor Study Quality Lead, the Clinical Lead, the Medical Lead/Pharmacovigilance, and the Biostatistics Lead prior to implementation, and re-approved upon material amendment. Records generated under this plan are retained in accordance with ICH E6(R3) retention requirements and applicable regional regulations.

Appendix A. Abbreviations

ADA, anti-drug antibody; ALCOA+, attributable/legible/contemporaneous/original/accurate plus complete/consistent/enduring/available; CAPA, corrective and preventive action; CHO, Chinese hamster ovary; CRO, contract research organization; CtQ, critical-to-quality; CTD, Common Technical Document; DMC, Data Monitoring Committee; DMP, Data Management Plan; EDC, electronic data capture; FMEA, failure mode and effects analysis; GCP, Good Clinical Practice; ICF, informed consent form; IEC, independent ethics committee; IMP, investigational medicinal product; IRB, institutional review board; IRT, interactive response technology; KPI, key performance indicator; KQI, key quality indicator; LS-mean, least-squares mean; mAb, monoclonal antibody; MedDRA, Medical Dictionary for Regulatory Activities; PFS, prefilled syringe; PK, pharmacokinetics; PV, pharmacovigilance; QA, quality assurance; QMP, quality management plan; QMS, quality management system; QP, Qualified Person; QRM, quality risk management; QTL, quality tolerance limit; RACI, responsible/accountable/consulted/informed; RCA, root-cause analysis; RPN, risk priority number; SAE, serious adverse event; SAP, statistical analysis plan; SC, subcutaneous; SDV, source-data verification; SQOC, Study Quality Oversight Committee; SUSAR, suspected unexpected serious adverse reaction; TEAE, treatment-emergent adverse event; TL1A, TNF-like ligand 1A (TNFSF15); TMDD, target-mediated drug disposition; TMF, Trial Master File; UC, ulcerative colitis; WHODrug, WHO Drug Dictionary.

Appendix B. Governing References

ICH E6(R3) Good Clinical Practice; ICH E3 Clinical Study Reports; ICH E8(R1) General Considerations for Clinical Studies; ICH E9 / E9(R1) Statistical Principles and Estimands; ICH E2A Clinical Safety Data Management; ICH Q9(R1) Quality Risk Management; ICH Q10 Pharmaceutical Quality System; ICH Q5A–Q5E and Q6B (biotechnological products); ICH S6(R1) Preclinical Safety Evaluation of Biotechnology-Derived Pharmaceuticals. Program-specific subordinate documents: Protocol TILA278-201, Clinical Monitoring Plan, Data Management Plan, Safety Management Plan / PV Agreements, Statistical Analysis Plan, IMP Management/Pharmacy Manual, and TMF Plan.

Values annotated denote program-specific operational parameters — for example, final vendor identities, site and country counts, and internal quality-metric outcomes — that are controlled and maintained in the referenced operative plans, quality records, and the Trial Master File rather than fixed within this plan.