u/ThrowRA_con7273737

During a monitoring visit, the CRA identified what appeared to be the PI’s signature being written by our lead CRC/manager on an essential regulatory document. The CRA asked me directly about it, and he said it was serious and would have to be escalated.
There is no independent HR or compliance department at my site, and I’m worried about retaliation if I report it myself.
If the CRA says he’s escalating it, should I just let the sponsor/CRO handle it, or do I have an obligation to report it elsewhere if nothing happens?
Has anyone dealt with something similar?