The research operations guide to biospecimen supply agreement obligations

Sample agreements look administrative until a program is asked to prove that every specimen it used was within the consent it was collected under.

What obligations does a biospecimen supply agreement create?

A biospecimen supply agreement creates four families of continuing obligation rather than a one-time transfer. First, use limits drawn from the consent the donor gave, which constrain the research questions the samples may answer and often the genomic analysis permitted. Second, handling and chain-of-custody duties covering storage conditions, identifiability and onward transfer. Third, reporting duties, typically periodic use reports to the supplier or biobank and notification of any incidental finding. Fourth, end-of-term duties to destroy or return remaining material and certify that it happened. Each has an owner, a trigger and evidence a sponsor or inspector can ask for.

Last updated: September 30, 2026 · Reviewed by the Aavenir Life Sciences & Pharma practice

Key takeaways

  • ✓The binding constraint is the donor consent the samples were collected under, not the commercial terms the parties negotiated.
  • ✓Consent scope has to be recorded as structured, queryable data if a program is to answer what a given sample may be used for.
  • ✓Destruction and return duties at end of term are the most commonly missed obligation and the easiest for an inspector to test.
  • ✓Onward transfer to a collaborator or CRO inherits the original consent limits; flow-down language rarely reproduces them accurately.

Biospecimen supply agreements are easy to treat as procurement paper. A quantity of tissue or serum is specified, a price is agreed, a delivery schedule is set, and the document goes into a folder. The samples then move into a laboratory system that tracks them as inventory, and the agreement plays no further part in the program until something forces a reconciliation.

The reconciliation, when it comes, is usually uncomfortable. A sponsor audit asks which consent each lot was collected under. A publication reviewer asks whether genomic analysis was permitted. A supplier asks for the annual use report nobody has produced. A donor withdraws consent and the program has to locate every aliquot derived from that collection. In each case the answer lives in the agreement, and the agreement has not been connected to anything operational.

The underlying issue is a category error. A biospecimen supply agreement is not primarily a supply contract; it is the carrier for a set of continuing use restrictions that originated with a donor, not with either commercial party. Managed as obligations with owners, triggers and evidence, those restrictions are straightforward. Managed as filed paper, they are undiscoverable at exactly the moment they matter.

The four obligation families a sample agreement creates

Reading a biospecimen supply agreement as a set of continuing duties rather than a transaction makes its structure clear. Four families recur across suppliers and jurisdictions.

  • Permitted use limits, the research scope, genomic analysis permission, commercial-use position and onward-transfer rights inherited from the donor consent, which bound everything else.
  • Handling and custody duties, storage temperature and excursion tolerance, identifiability level, re-identification prohibitions and the custody record the sponsor must maintain.
  • Reporting duties, periodic use or publication reports to the supplier, notification of incidental findings of clinical significance, and adverse-event style notifications where applicable.
  • End-of-term duties, destruction or return of unused material within a stated period, certification of the action, and retention of the custody record after the material itself is gone.

Each family has the same operational requirements: a named owner, a trigger that can be detected, a due date and an artifact that proves the duty was met. None of that is unusual. What is unusual is a program that holds all four families for all its sample lots in a single place where they can be reported on.

Consent scope is a data field, not a paragraph

A sentence in a filed agreement cannot answer whether a proposed sequencing run is within scope. The same restriction expressed as structured fields on the sample lot can answer it before the run is booked, which is when the answer changes the outcome rather than explaining it.

Controls worth putting in place first

Five controls address the failures that appear most often in sponsor audits and inspection findings involving human biological material.

  • Abstract consent scope on receipt. Capture permitted scope, genomic permission, commercial use, transfer rights and withdrawal mechanism as fields when the lot arrives, not when a question is asked. Abstraction after the fact is slower and reconstructs a judgment rather than recording one.
  • Gate intended use against scope. Require a documented scope check before a new analysis runs on an existing lot. This is a short workflow step, and it converts consent compliance from an after-the-fact assertion into a recorded control with a timestamp.
  • Restate limits in downstream agreements. When samples go to a CRO or collaborator, reproduce the specific use limits rather than incorporating the head agreement by reference. The downstream party operates on what its own contract says, not on a document it has never read.
  • Diarize destruction and reporting. Put end-of-term destruction, certification and periodic use reports on the obligation calendar with owners at the point the agreement is signed. These are the duties most often discovered overdue, and they are trivially avoidable.
  • Reconcile custody to agreement quarterly. Compare the laboratory custody record against the agreement's permitted quantity and term. Drift between the two, extra aliquots, expired terms, lots past their destruction date, is what an inspector will find if you do not.

A five-step implementation path

Step 1, Build the lot register

List every active sample lot with its supplier, agreement, quantity received and quantity remaining. Most programs find lots with no identifiable agreement and agreements with no identifiable lots; resolving those two lists is the bulk of the initial work and the source of most of the benefit.

Step 2, Abstract consent scope into fields

Work through the agreements and associated consent documentation, recording the scope fields on each lot. Where the consent is ambiguous, record it as ambiguous and route it for a decision rather than choosing the permissive reading, which is the interpretation that will be questioned later.

Step 3, Set the obligation calendar

Load destruction dates, reporting cycles and term expiries with named owners. Notification windows should reflect how long the action actually takes: a destruction certificate requiring supplier countersignature needs more lead time than a use report.

Step 4, Wire the use-approval gate

Add the scope check to the workflow that authorizes a new analysis. Keep it light, a lookup and an approval, so it is not routed around. A gate that adds a week will be bypassed; one that adds an hour will be used.

Step 5, Close the flow-down gap

Review the CRO and collaborator agreements currently carrying your samples and amend the ones that incorporate limits only by reference. This is the step most often deferred, and it is the one that puts the sponsor's accountability in someone else's hands.

See sample obligations in one record

Walk through consent scope fields, destruction calendars and custody reconciliation on real agreements.

Book a demo

Where this connects to the wider quality system

Biospecimen obligations behave like quality-agreement obligations: continuing duties, defined response windows, evidence retained for inspection. The same register that holds change-control notification windows and deviation timelines described in the sponsor’s guide to CRO master service agreements can hold sample destruction dates and use-report cycles, with the same owners and the same escalation. Programs that build a second, separate tracker for samples tend to find it decays, because it is maintained by people whose primary system is the laboratory one. Consolidating into the register the quality organization already reviews is usually the more durable choice, and it is also how obligation management for life sciences is normally scoped.

Obligations, triggers and the evidence each one needs

The table below maps the recurring obligations to the event that starts the clock and the artifact that closes it out.

ObligationTriggerTypical windowEvidence to retain
Scope check before new analysisProposed use of an existing lotBefore work beginsRecorded scope check with approver and lot reference
Periodic use report to supplierAnniversary or contract cycleAnnually, commonlySubmitted report and supplier acknowledgement
Incidental finding notificationFinding of clinical significanceDays, per agreementNotification record and supplier response
Consent withdrawal actionWithdrawal notice from supplierPrompt, per agreementAliquot list, destruction record, confirmation to supplier
End-of-term destruction or returnTerm expiry or study close30 to 90 days typicallyDestruction or return certificate, custody record retained

None of this requires a new system category. It requires treating the sample agreement as the source of continuing obligations it actually is, abstracting the consent scope into fields a program can query, and putting destruction and reporting duties on the same calendar as every other commitment. Programs that do this can answer a sponsor or inspection question about any specimen in an afternoon. Programs that do not usually discover the gap when the question is already on the table.

For related guidance, see The quality leader’s guide to pharma quality agreements, GxP supplier qualification, contract controls that hold and Controlled substance supplier agreements.

FAQ

Biospecimen agreement questions, answered

What is a biospecimen supply agreement? +
It is the agreement under which human biological material, such as tissue, blood, serum or derived nucleic acid, moves from a collecting institution, biobank or commercial supplier to a research sponsor. It covers quantity, specification and price like any supply contract, but its operative terms are the permitted-use limits inherited from donor consent, the handling and identifiability requirements, the reporting duties back to the supplier, and what must happen to unused material at the end. It is distinct from a material transfer agreement, which typically governs non-human research materials and carries no consent framework.
Why does donor consent limit what a sponsor can do with a sample? +
Because the donor's permission, not the supplier's ownership, is what makes the research use lawful and ethical. Consent forms vary widely in breadth: some permit any future biomedical research, some restrict use to a named disease area, some exclude genomic sequencing, some prohibit commercial use or onward transfer, and some require that findings of clinical significance be returned. A supply agreement cannot grant the sponsor more than the consent allows, so the consent scope is the real boundary and the contract is the mechanism for communicating it.
How should consent scope be recorded so it is usable? +
As structured fields on the sample lot rather than as a sentence in a filed PDF. The fields worth holding are permitted research scope, whether genomic analysis is allowed, whether commercial use is permitted, whether onward transfer is allowed and to whom, whether re-identification is possible, whether return of results is required, and the withdrawal mechanism. Once these are queryable, a program can answer whether a proposed analysis is in scope before it runs, which is the only point at which the answer is useful.
What happens if a donor withdraws consent? +
Most consent frameworks allow withdrawal, and the agreement should state what the sponsor must do when notified: commonly, stop further use of remaining material, destroy or return it, and confirm the action, while data already generated and aggregated may generally be retained. Two operational requirements follow. The sponsor must be able to locate every aliquot derived from a given donor lot, which means custody records have to be complete. And a notification route from the supplier has to exist and be tested, because withdrawal notices sent to a dormant mailbox achieve nothing.
Who owns the obligations once samples reach a CRO? +
The sponsor remains accountable to the supplier and, through it, to the consent framework. Passing samples to a CRO or an academic collaborator does not transfer that accountability, so the downstream agreement has to reproduce the same use limits, handling requirements and destruction duties. In practice flow-down language is often generic, referring to the head agreement without restating its limits, which leaves the CRO unaware of a genomic-analysis exclusion or a commercial-use restriction. Restating the specific limits is slower to draft and far safer to operate.
What evidence should a program be able to produce on request? +
For any specimen used: the supply agreement and the consent scope it carries, the chain of custody from receipt to consumption, the storage conditions maintained, the record that the intended use was checked against the consent scope, any use report submitted to the supplier, and, for closed lots, the destruction or return certificate. Programs that keep these as linked records in one system answer such requests in hours. Programs that keep agreements in one place and custody records in a laboratory system usually cannot reconcile the two without manual effort.

Track every sample commitment as live work

See how Aavenir turns biospecimen supply agreements into owned obligations with consent scope, reporting dates and destruction evidence in one record.

  • ✓Consent scope held as structured, queryable fields
  • ✓Destruction and reporting duties with owners and due dates
  • ✓Standalone or native on ServiceNow