No organization can outsource their responsibility for a compliance program even if they outsource the underlying processes. Even if you are outsourcing IT to an MSP or clinical research to a CRO, you are still required to establish and maintain a proper compliance program.