Clinical Monitoring Plan (TILA278-201)

Trial Master File operational document for Study TILA278-201.

Change History

Abbreviations

1. Introduction and Purpose

This Clinical Monitoring Plan (CMP) defines the risk-based monitoring (RBM) strategy for Protocol TILA278-201, a Phase 2b, randomized, double-blind, placebo-controlled, parallel-group 12-week induction study of TILA-278 in adults with moderately to severely active ulcerative colitis (UC). TILA-278 (Virtual Biopharma Inc.) is a humanized IgG1 bispecific monoclonal antibody combining anti-TL1A (TNFSF15) antagonism with IL-22 receptor agonism, administered subcutaneously (SC).

The CMP operationalizes the sponsor's quality-by-design and risk-based quality management (RBQM) framework in accordance with ICH E6(R3). It describes:

• the integrated monitoring model (central, remote, and on-site);
• the critical data and critical processes that are the focus of monitoring;
• the source data review (SDR) and source data verification (SDV) approach;
• the types and frequency of site visits and remote contacts;
• the Key Risk Indicators (KRIs), Quality Tolerance Limits (QTLs), and the issue-escalation pathway.

This CMP is a controlled Trial Master File (TMF) document. It is intended to be read together with the protocol, the Monitoring Manual/Visit Report templates, the Data Management Plan (DMP), the Safety Management Plan / Pharmacovigilance Agreement, the Statistical Analysis Plan (SAP), the Data Safety Monitoring Board (DSMB) Charter, and the study-level Risk Assessment and Categorization Tool (RACT). Where this CMP and the protocol differ on a clinical requirement, the protocol prevails; this CMP governs monitoring conduct.

2. Scope and Regulatory Basis

2.1 Scope

This CMP applies to all investigational sites participating in TILA278-201 and to all monitoring activities performed by the sponsor and its delegated Contract Research Organization (CRO) from site activation through site close-out. It covers monitoring of subject rights and safety, data integrity and credibility, investigational product (IP) management, and compliance with the protocol, ICH GCP, and applicable regulatory requirements.

The study is conducted at approximately 130 sites across approximately 15 countries, enrolling from a screened population of 1700 subjects, with 900 randomized 1:1:1 to TILA-278 High (299), TILA-278 Low (300), and placebo (301).

2.2 Regulatory and guidance basis

• ICH E6(R3) Good Clinical Practice, including Annex 1 and the principles of a proportionate, risk-based approach to trial conduct and monitoring.
• ICH E8(R1) General Considerations for Clinical Studies (critical-to-quality [CtQ] factors).
• ICH E2A / E2B(R3) and applicable expedited safety-reporting requirements.
• Regional GCP inspection expectations (e.g., FDA guidance on a risk-based approach to monitoring; EMA reflection paper on risk-based quality management in clinical trials).
• Sponsor SOPs for clinical monitoring, RBQM, protocol-deviation management, TMF, and issue escalation.

2.3 Guiding principles

Monitoring is proportionate to the risks to the reliability of study results and to subject rights, safety, and well-being. The sponsor prioritizes the prevention of important errors over their retrospective detection, concentrates effort on critical data and critical processes, and uses centralized analytics to direct on-site effort to where it adds most value. Monitoring intensity is not uniform across sites or over time; it is adjusted dynamically in response to accumulating risk signals.

3. Study Overview (Monitoring-Relevant Summary)

The stratification factors (baseline severity; prior biologic exposure) and the composite, endoscopy-dependent primary endpoint are the principal drivers of the risk profile and therefore of the monitoring focus (Sections 6–7). The modified Mayo score is the sum of three subscores — stool frequency, rectal bleeding, and the centrally read endoscopy subscore (each 0–3; total 0–9).

4. Roles, Responsibilities, and Oversight

The sponsor retains overall accountability for the quality and integrity of the trial data and for oversight of delegated activities. Delegation to the CRO is documented in the sponsor–CRO agreement and delegation log.

Oversight cadence: a cross-functional Risk Review Team meets at a defined interval (every 4 weeks during active enrollment, or ad hoc when a signal requires) to review KRIs, QTL status, aggregate deviations, and escalated issues, and to re-baseline site-level monitoring intensity.

Independent safety oversight is additionally provided by a Data Safety Monitoring Board (DSMB) operating under its own charter, which reviews unblinded safety data (including deaths, SAEs, adverse events leading to discontinuation, injection-site reactions, and laboratory safety parameters) at pre-specified intervals. Unblinded safety reports are prepared by an independent statistical group that is functionally separate from the blinded sponsor study team. Clinical monitoring under this CMP is performed by blinded personnel and does not access unblinded treatment assignments or DSMB deliberations; the DSMB's independent review complements, and does not substitute for, the sponsor's monitoring obligations.

5. Risk Assessment and Critical-to-Quality Factors

A documented RACT was completed at study start-up and is maintained as a living document. Risks are scored on likelihood, impact (on subject safety and/or data reliability), and detectability, and are mapped to mitigation and to specific monitoring activities. The CtQ factors below anchor the monitoring focus.

6. Monitoring Strategy

TILA278-201 uses an integrated, risk-based monitoring model combining continuous centralized analytics, scheduled and triggered remote monitoring, and targeted on-site monitoring. The three components are complementary: central monitoring identifies where risk is concentrated, and remote/on-site monitoring resolves and prevents it.

6.1 Central (statistical) monitoring — continuous

Central monitoring is performed continuously on accumulating data by the RBQM analyst and Data Management, independent of site visits. It includes:

• KRI dashboards with site-level and study-level thresholds (Section 9), refreshed on a defined cycle (weekly during active enrollment);
• cross-site distributional and outlier checks (e.g., variability and digit-preference in modified Mayo components; improbable data patterns; duplicate or unusually uniform data);
• data-quality metrics (query rate/aging, eCRF entry lag, missingness of endpoint components, visit-window compliance);
• safety-signal surveillance at aggregate level (blinded-pool AE/SAE rates by arm, adverse event of special interest [AESI] clustering);
• QTL monitoring against study-level parameters (Section 9.2).

Central-monitoring output directly informs the site risk score and the triggering of remote or on-site actions.

6.2 Remote monitoring — scheduled and triggered

Remote monitoring comprises off-site review of data and, where permitted by local regulation and site agreements, remote access to redacted/certified source documents. It is used to:

• perform remote SDR and, where authorized, remote SDV of critical data between on-site visits;
• follow up open action items and confirm CAPA effectiveness;
• conduct interim contacts with sites showing acceptable risk profiles, reducing on-site burden;
• respond rapidly to central-monitoring triggers without waiting for the next scheduled visit.

Remote monitoring does not replace on-site verification of activities that require physical presence (e.g., IP storage/temperature logs and drug accountability, Investigator Site File [ISF] completeness, facility/equipment checks).

6.3 On-site monitoring — targeted

On-site monitoring is deployed on a risk-adjusted schedule and for-cause. It focuses on the CtQ factors of Section 5: consent, eligibility/stratification, primary endpoint source, IP management, and safety. Sites with higher risk scores (e.g., high enrollment, new/inexperienced sites, KRI signals, or unresolved issues) receive more frequent and more intensive on-site attention; low-risk, low-enrollment, well-performing sites may be managed predominantly remotely with a defined minimum on-site presence.

6.4 Dynamic adjustment

Each site carries a risk score derived from baseline attributes (experience, enrollment volume, complexity) and dynamic signals (KRIs, deviation trends, issue history). Monitoring intensity — visit frequency, SDV extent, remote vs. on-site mix — is reviewed at each Risk Review Team meeting and adjusted accordingly. All adjustments are documented with rationale.

7. Critical Data and Critical Processes

7.1 Critical data (subject to the highest monitoring intensity)

• Informed consent (presence, correct version, dating, process).
• Key inclusion/exclusion criteria — including baseline infection screening (tuberculosis; hepatitis B and C; HIV; stool assessment for enteric pathogens, including Clostridioides difficile) — and both stratification variables (baseline modified Mayo severity; prior biologic exposure).
• Randomization record and IP/kit assignment (IRT).
• Primary endpoint components: subject-reported stool frequency and rectal bleeding subscores and the centrally read endoscopy subscore contributing to the modified Mayo score at Week 12.
• All SAEs, deaths, and AESIs.
• IP administration records, accountability, and temperature/cold-chain data.
• PK and ADA (immunogenicity) sample collection records.

7.2 Critical processes

• Consent and re-consent management.
• Eligibility confirmation and randomization/stratification via IRT.
• Blinding maintenance (including matched injection number/volume) and controlled unblinding.
• Endoscopy acquisition and transfer to the central reader; reconciliation of central-read results.
• IP receipt, storage, dispensing, administration, return/destruction, and excursion handling.
• Safety data capture, expedited reporting, and SAE reconciliation.
• eCRF completion, query resolution, and data cleaning ahead of database lock.

8. Source Data Review and Source Data Verification

The study uses a risk-based, targeted SDV model rather than 100% SDV of all data. Source Data Review (SDR) — the qualitative review of source for evidence of GCP-compliant conduct, protocol adherence, and safety reporting — is performed at every monitoring contact and is not limited to the fields subject to SDV.

8.1 SDV framework

SDV percentages for non-critical categories are increased for a given site when central monitoring, KRIs, or deviation trends indicate elevated risk, and may be reduced for consistently high-performing, low-risk sites. Any change from the default is documented.

8.2 Interaction with central monitoring

Central monitoring reduces reliance on manual SDV for errors that are more efficiently detected in aggregate (e.g., outliers, missingness, inconsistent distributions). On-site SDV/SDR is reserved for verification that requires source access and for confirming/resolving central signals. The two approaches are explicitly complementary and jointly documented in the site's monitoring record.

9. Key Risk Indicators and Quality Tolerance Limits

9.1 Key Risk Indicators (site-level)

KRIs are tracked continuously; each has a defined threshold that triggers review and, where warranted, remote or on-site action. Thresholds below are the study baselines and are risk-adjusted per site.

9.2 Quality Tolerance Limits (study-level)

QTLs are pre-specified parameters, above which a systematic issue affecting subject safety or the reliability of study results is deemed possible; a breach triggers documented evaluation and, if confirmed, corrective action recorded in the RBQM/TMF record. QTL breaches are reported in the Clinical Study Report.

QTLs are distinct from KRIs: KRIs manage operational, site-level risk; QTLs are secondary limits on parameters critical to the study as a whole. Approaching a QTL (a defined warning band) prompts proactive review before the limit is breached.

10. Site Visit Types and Frequency

The first on-site IMV is prioritized to confirm early that consent, eligibility, stratification, randomization, and IP handling are being executed correctly, given their downstream impact on the primary result. Subsequent frequency is governed by the site risk score: higher-risk/higher-enrolling sites are visited more often on-site; lower-risk sites may be managed predominantly through remote contacts with a defined minimum on-site cadence. All visits generate a Monitoring Visit Report (MVR) and a follow-up letter within the timelines defined in the Monitoring Manual (MVR finalized within 10 business days; site follow-up letter within 5 business days).

11. Program-Specific Monitoring Considerations

• Injection-site reactions. Injection-site reactions are the principal drug-attributable finding on active SC drug; monitoring confirms consistent solicitation, grading, and reporting of local reactions and their reconciliation with the safety database.
• Infection surveillance. Because TL1A antagonism dampens TH1/TH17 inflammation, serious and opportunistic infections are treated as AESIs; monitoring confirms complete capture, timely reporting, and follow-up to resolution, and verifies that protocol-required baseline infection screening (tuberculosis, hepatitis B and C, HIV, and stool assessment for enteric pathogens including Clostridioides difficile) was completed and appropriately actioned before randomization.
• Cold chain and device. The prefilled syringe/autoinjector is temperature-sensitive and administered SC at Weeks 0, 2, 4, and 8; monitoring verifies storage logs, excursion management/quarantine, device accountability, and administration records.
• Endpoint objectivity. The endoscopy subscore is centrally read; monitoring verifies acquisition quality, timely transfer, and reconciliation of central-read results against the eCRF, and tracks the unevaluable-endoscopy rate against the corresponding QTL.
• Blinding integrity. Double-blind conduct is protected through IRT reconciliation, maintenance of identical injection number and volume across arms, monitoring of any unblinding events, and separation of blinded monitoring from the unblinded statistical group supporting the DSMB.
• Immunogenicity. ADA sampling compliance is monitored because ADA may affect PK, efficacy, and safety interpretation.

12. Issue Management and Escalation

Issues are graded by their actual or potential impact on subject safety, rights, and data reliability, and escalated on defined timelines. Central- and site-monitoring findings feed a single issue log maintained in the TMF.

Level 3 outcomes may include intensified/for-cause monitoring, a directed QA audit, site suspension or termination, notification to IRBs/ECs and regulatory authorities where required, and serious-breach reporting per applicable regional obligations. Confirmed QTL breaches and their evaluations are documented in the RBQM record and reported in the Clinical Study Report. All escalations, decisions, and CAPA (including effectiveness checks) are documented with rationale in the TMF.

13. Documentation, Quality Management, and Version Control

• TMF. All monitoring outputs — MVRs, follow-up letters, the issue/CAPA log, KRI/QTL records, risk-review minutes, and RACT versions — are filed in the TMF contemporaneously and are inspection-ready.
• Quality management. This CMP is part of the study RBQM system. QA conducts risk-based, independent audits; findings are managed through CAPA distinct from routine monitoring.
• Metrics and reporting. Monitoring performance (visit completion, SDV completion, issue closure, KRI/QTL status) is reported to study governance at the Risk Review Team cadence.
• Amendments. This CMP is version-controlled. It is reviewed when the protocol is amended, when the risk profile changes materially, or when accumulating data warrant a change in monitoring intensity. Substantive changes are documented with rationale, approved by the Sponsor Clinical Lead, and version-controlled in the TMF.

14. Approval

This Clinical Monitoring Plan is approved by the Sponsor Clinical Lead, the Sponsor Medical Monitor, the RBQM/Central Monitoring lead, and Quality Assurance for Virtual Biopharma Inc. and the delegated CRO. Signatures and dates are maintained in the controlled-signature version filed in the TMF.