CDMO Oversight and Quality Agreements

Outsourcing manufacturing or testing does not outsource the obligation to comply. That single sentence is the foundation of every quality agreement, and it is the one inspectors return to when a contract operation goes wrong. The product license holder, the Marketing Authorisation Holder in the EU, the application holder or the firm whose name is on the label in the US, remains accountable for the quality of every batch, regardless of how many parties touched it along the way.

A Contract Development and Manufacturing Organization (CDMO), a contract manufacturer (CMO), or a contract testing laboratory operates under your quality system as an extension of it, not as a separate island. The mechanism that makes that work is the quality agreement: a document, separate from the commercial supply contract, that allocates GMP responsibilities task by task. Get it right and an inspection of the contract site reflects well on both parties. Get it wrong and you discover during a 483 close-out who actually owned a control that nobody was running.

What follows is what the agreement must allocate, the regulatory basis for each obligation, how to build oversight that scales from a person-in-plant to a remote relationship, and the data integrity failure modes specific to contract labs and CMOs. This applies across drug substance and drug product, finished pharmaceuticals, biologics, sterile injectables, medical devices, combination products, and contract analytical testing. The modality changes the risk depth, not the principle.

The regulatory frame: owner accountable, responsibilities allocated in writing

Two documents anchor the expectation, and you should be able to cite both by name in an interview.

EU GMP Chapter 7, “Outsourced Activities” governs any GMP activity contracted out, including manufacturing, analysis, and certain qualification and validation work. Its core principles: there must be a written contract between the Contract Giver (the owner) and the Contract Acceptor (the contractor); the contract must clearly establish the duties of each party; and the Contract Giver is responsible for assessing the legality, suitability, and competence of the Contract Acceptor before any work begins, and for ensuring the principles of GMP are followed. Chapter 7 also forbids the Contract Acceptor from subcontracting any of the work without the Contract Giver’s prior written evaluation and approval, the “no silent subcontracting” rule that catches a surprising number of firms.

Put plainly, Chapter 7 makes the Contract Giver responsible for assessing whether the Contract Acceptor is legally permitted, suitable, and competent to carry out the outsourced work, and it bars the Contract Acceptor from passing any of that work to a third party without the Contract Giver evaluating and approving the arrangement first. (EU GMP Chapter 7)

FDA’s guidance “Contract Manufacturing Arrangements for Drugs: Quality Agreements” (the agency’s contract-manufacturing quality agreement guidance) frames the same expectation under 21 CFR Parts 210 and 211. It is explicit that the owner and the contract facility are both manufacturers under the CGMP regulations and both are responsible for ensuring the drug is produced in compliance. The guidance recommends a written quality agreement that defines each party’s manufacturing activities and clarifies how they will comply with CGMP. It draws a clean line: the commercial/business agreement handles price, volume, capacity, and liability; the quality agreement handles GMP roles, responsibilities, and the mechanics of compliance. The two should not be conflated, and a quality term buried in a master supply agreement tends to get lost. The guidance is also explicit that a quality agreement does not, and cannot, shift CGMP responsibility away from either party: a contract does not relieve the owner of its obligation to ensure compliance, and it does not relieve the contractor of its obligation to follow CGMP.

For combination products, the parallel concept lives in 21 CFR 820, now operating as the Quality Management System Regulation (QMSR), which incorporates ISO 13485:2016 by reference and took effect February 2, 2026, through purchasing controls and supplier evaluation. ISO 13485:2016 Clause 7.4 requires defined criteria for supplier selection, evaluation, and re-evaluation, with controls proportionate to the risk the purchased product or service poses, plus a written purchasing agreement that specifies what the supplier must notify the manufacturer about before changes. The principle is identical: responsibility flows down by contract, accountability does not transfer.

ICH Q10 (Pharmaceutical Quality System) closes the loop by treating outsourced activities and purchased materials as a management responsibility of the owner’s PQS, requiring oversight of the supplier’s performance over the life of the relationship, not just at qualification. ICH Q7 (Good Manufacturing Practice for Active Pharmaceutical Ingredients), Section 16, carries the same expectation specifically for contract manufacturers and contract laboratories handling APIs: written agreements, defined responsibilities, the prohibition on unauthorized subcontracting, and the owner’s right to audit.

Three threads run through all of these and are worth memorizing as the spine of the topic:

1. The owner stays accountable. A contract allocates work, never accountability.
2. Responsibilities must be in writing, party by party, with no gaps.
3. Oversight is continuous, not a one-time qualification event.

Commercial agreement vs. quality agreement: keep them separate

A frequent and avoidable failure is the firm that has one master supply agreement with a “quality” annex written by lawyers, and no standalone quality agreement reviewed and signed by both quality units. The two documents serve different masters and have different signatories.

The quality agreement should be a controlled GMP document with a version number, an effective date, a defined review period (commonly every two to three years, or on a triggering change), and a cross-reference to the commercial agreement for the avoidance-of-conflict clause. Where the two documents disagree on a quality matter, the quality agreement should prevail, and it should say so.

What a quality agreement must allocate

The agreement should read like a responsibility matrix, because that is what an inspector will reduce it to. The most defensible format is a RACI-style table covering every GMP touchpoint, with no row left to “to be determined.” R means who performs the work, A means who is accountable for the outcome, C means who is consulted, I means who is informed. The categories below are the ones that consistently matter. A ready-to-use starting point that already carries this structure, section by section, is the quality agreement template.

A few rows deserve more than a table cell.

Batch disposition: the two-tier boundary

This is the area most often muddied. In practice there are two distinct decisions:

1. Manufacturing disposition at the contract site. The contractor’s quality unit reviews the executed batch record, in-process and release testing, and any deviations, then concludes the batch was manufactured in compliance with the agreed process and specifications. The contractor issues a Certificate of Analysis and, where appropriate, a Certificate of Compliance/Conformance.

2. Final release by the owner. The owner’s quality unit, and in the EU, the Qualified Person under Article 51 of Directive 2001/83/EC and Annex 16 to the EU GMP Guide, performs final certification before the batch is placed on the market. The QP relies on the contractor’s work but does not blindly accept it; Annex 16 lays out the chain of confidence the QP must establish across all sites in the supply chain, and explicitly contemplates QPs at different stages relying on each other through documented arrangements.

The agreement must state who makes which decision, what package the owner receives to make the final call, and what the owner is not permitted to delegate. A common and defensible model: the contractor dispositions for manufacture and ships only after the owner’s QP/quality unit grants final release; quarantine status is maintained until that release. Spell out the data package, executed batch record (or a defined summary plus full record on request), CoA, deviation summary, and any open investigations, and the timeline for delivering it.

A worked release-package definition you can lift into an agreement:

For each batch, the Contract Acceptor will provide, within five business days of manufacturing disposition: the completed Certificate of Analysis against the agreed specification; a deviation summary listing all deviations with classification and disposition; a list of any open investigations affecting the batch; the executed master batch record (or a batch summary report with the full record available within two business days on request); and reprocessing/rework records, if any. The Contract Giver’s Qualified Person/quality unit retains sole authority for final certification and market release. No batch ships before final release except under a documented, pre-approved quarantine-with-restricted-shipment arrangement.

Cross-link: see batch disposition decisions and Qualified Person batch release under Annex 16 for the mechanics each party runs on its side of this line.

Change notification: define “notifiable” precisely

The most expensive failures here are silent changes. The contractor changes a supplier of a critical raw material, swaps a piece of equipment, moves an operation to a different suite, or “improves” a cleaning procedure, and the owner learns about it only when a batch fails or an inspector asks. EU GMP Chapter 7 places the obligation on the Contract Acceptor to inform the Contract Giver of anything that may affect product quality, and forbids subcontracting without approval.

A workable agreement does three things:

• Enumerates change categories that always require prior written approval before implementation: changes to the registered process, critical equipment, critical raw material suppliers, facility/location of a registered operation, analytical methods supporting release, primary packaging/container-closure, and any subcontracting.
• Defines a notification-only tier for changes assessed as having no product-quality impact, with a defined window (for example, notification within a set number of business days) and the owner’s right to reclassify.
• Forbids implementation of approval-tier changes before the owner concurs, and ties this to the owner’s regulatory filing obligations. Many such changes require a variation or supplement, and an unapproved-at-the-agency change can put product out of compliance even if technically sound.

A short change classification table you can hand to a contractor removes most of the argument:

The owner keeps the right to reclassify any notification-tier change as approval-tier. That single sentence prevents the contractor from grading its way around your oversight. See change control for validated systems and quality in technology transfer for how change and transfer interact.

Audit rights: written, unconditional, and including “for cause”

The owner’s right to audit is non-negotiable and must survive the commercial relationship’s friction. State the routine audit cadence (commonly risk-based: higher-risk sterile or biologics operations annually, lower-risk operations on a longer interval justified by risk assessment), the right to for-cause audits triggered by events (recurring deviations, an OOS trend, a serious complaint, a regulatory action at the site), and the scope of access, areas, records, raw data, and personnel. Include the contractor’s obligation to notify the owner of regulatory inspections of the site and to share inspection outcomes (for example, a 483 or inspection report relevant to the owner’s product) within a defined timeframe.

Resist letting the contractor cap audits at one per year regardless of cause. A for-cause right that the commercial team negotiated away is a gap an inspector will find. Negotiate these audit terms explicitly:

• Routine audit frequency tied to a documented risk rating, not a flat number.
• For-cause audit right with no annual cap and a defined response window for the contractor to host (for example, within 30 days, or sooner for a serious event).
• Access scope: GMP areas relevant to the owner’s product, batch records, raw electronic data and audit trails, training records, validation files, and the contractor’s own supplier-qualification files.
• Notification of any regulatory inspection touching the owner’s product, and sharing of the relevant findings (with commercially sensitive third-party content redacted) within a fixed number of business days.
• Notification of any serious GMP event (a critical deviation, a confirmed OOS on released product, a recall at the site) within hours, not at the next quarterly review.

Cross-link: conducting a supplier audit and audit finding classification cover how to run the audit itself and grade what you find.

Qualifying the contractor before the first batch

Chapter 7 and FDA’s guidance both put the burden of assessing competence on the owner before work begins. A defensible qualification has three legs:

1. Risk assessment of what is being outsourced. A sterile fill, a biologic, a cytotoxic or high-potency compound, or an implantable device carries different risk than a simple secondary-packaging operation, and the depth of qualification should scale to it. ICH Q9(R1) (Quality Risk Management) is the reference for documenting the rationale. See quality risk management.
2. On-site qualification audit by trained GMP auditors, covering the quality system, the specific operations to be performed, data integrity controls, and the contractor’s own oversight of its suppliers. A questionnaire is a screen, not a substitute. A desktop or remote qualification may be acceptable only for low-risk activities with a documented justification.
3. Technical and method transfer, with documented protocols and acceptance criteria, before routine production. Analytical method transfer in particular should follow a protocol with predefined comparative acceptance criteria; the relevant USP general chapters on validation and transfer of procedures (USP <1225> Validation of Compendial Procedures and USP <1224> Transfer of Analytical Procedures) and ICH Q2(R2) for method validation are the technical basis. See analytical method transfer and method validation essentials.

A practical qualification sequence:

1. Define the scope and the criticality of the outsourced activity.
2. Run a documented risk assessment (process, product, and data-integrity risk).
3. Screen candidates with a quality questionnaire and a review of inspection history, certifications, and any public regulatory actions.
4. Perform the on-site qualification audit; classify and track findings to closure or a justified risk acceptance.
5. Negotiate and execute the quality agreement and the commercial agreement.
6. Run technology and method transfer with protocols and acceptance criteria.
7. Approve the contractor in the approved supplier list with a defined scope, then run confirmation/engineering and validation batches before routine supply.

Qualification is not a one-time gate. ICH Q10 expects ongoing performance monitoring, periodic requalification audits, performance metrics, and a documented re-evaluation cadence tied to risk and to the contractor’s track record. See supplier and vendor qualification for the program-level view.

Acceptance criteria: how you know qualification is sound

• A documented risk assessment exists and the qualification depth matches the risk.
• The on-site audit happened (for any non-trivial activity), findings are graded, and critical/major findings are closed or formally risk-accepted with rationale.
• A signed quality agreement exists, dated, version-controlled, and signed by both quality units before the first GMP batch.
• Technology/method transfer is complete with met acceptance criteria.
• The contractor sits on the approved supplier list with an explicit scope, and a re-evaluation date is set.

Technology transfer: the handoff from sponsor to CDMO

Technology transfer is the moment the relationship either becomes real or reveals that it was never more than a signed agreement. It is where the sponsor’s process knowledge, built through development and often years of internal manufacturing, becomes the CDMO’s ability to reproduce that process, at scale, on someone else’s equipment, with someone else’s operators, and hit the same specification every time.

Why this belongs in the quality agreement discussion, not a separate project plan. WHO’s guidelines on technology transfer in pharmaceutical manufacturing (WHO Technical Report Series 1044, Annex 4, 2022, superseding the 2011 edition in TRS 961) define transfer of technology as a logical, documented procedure that carries a process, together with its documentation and expertise, between a sending unit and a receiving unit. ICH Q10 treats technology transfer as a stage of the product lifecycle the pharmaceutical quality system must manage, not an informal handoff that ends once the sponsor stops answering questions. For API manufacturing, ICH Q7 Section 16 folds transfer into the same contract-manufacturer expectations already covered in this article: written agreements, defined responsibilities, and the owner’s ongoing oversight. Treat the transfer as a controlled, protocol-driven activity with predefined acceptance criteria, the same discipline as a validation protocol, not a project-management milestone that quality signs off on after the fact.

This is a different transfer than the one already covered. Analytical method transfer, addressed in step 6 of the qualification sequence above and in analytical method transfer, moves a test method between labs. Technology transfer, the subject of this section, moves the manufacturing process itself: the unit operations, the equipment train, the critical process parameters, the in-process controls, and the raw material and component specifications. A CDMO relationship usually needs both, run on overlapping but separate protocols, because a method can transfer cleanly while the process it tests does not, and the reverse. See quality in technology transfer for the broader site-to-site and R&D-to-GMP mechanics this section applies specifically to a CDMO handoff.

What the knowledge transfer package contains

How the transfer runs, stage by stage

Acceptance criteria: how you know a transfer is actually done

• Every criterion in the comparability/confirmation batch protocol was set before testing began and is a number, not an aspiration.
• The receiving unit’s engineering batch deviations were documented, assessed, and either closed or carried forward as defined process risk, not silently absorbed into “the process now works.”
• CPPs and CQAs at the receiving unit fall within the sending unit’s proven acceptable ranges, or a documented, risk-assessed rationale exists for any adjustment.
• The regulatory filing impact was assessed and, where a variation or supplement is required, it is approved before commercial batches from the receiving unit are distributed.
• The master batch record executed at the receiving unit has been reviewed against the sending unit’s process description line by line, with every adaptation documented and justified.
• Both quality units signed the transfer protocol before execution and the transfer report before routine supply began.

Worked example: a CPP comparability table

An oral solid dose product transferring a wet granulation and compression process from an internal development site (sending unit) to a CDMO (receiving unit).

All three confirmation batches met every predefined CPP range and the CQA release specification. Conclusion: transfer successful, no conditions, receiving unit approved for routine supply once the regulatory variation, already filed and pending when the confirmation batches completed, received approval.

Roles

• Sponsor technology transfer lead / CMC. Owns the knowledge transfer package, the process description, and the CPP/CQA ranges; participates in the receiving unit’s gap assessment.
• CDMO technology transfer lead. Owns the receiving-unit gap assessment, adaptation of the batch record to local equipment, and execution of the engineering and confirmation batches.
• Both quality units. Approve the transfer protocol before execution and the transfer report before routine supply; own the acceptance criteria jointly.
• Regulatory/CMC. Assesses whether the transfer requires a variation, supplement, or other agency notification, and tracks it to approval before the filing-dependent gate opens.
• Analytical/QC on both sides. Run the parallel method transfer that a process transfer almost always depends on.

Common mistakes that read as findings

• Engineering batches quietly treated as the confirmation/comparability batches, with no predefined acceptance criteria set before they ran.
• A “like-for-like” raw material substitution made at the receiving unit with no documented comparability assessment, discovered only when a CQA drifts.
• The regulatory filing impact assessed after commercial batches from the receiving unit were already distributed.
• No development risk assessment or known-deviation history included in the transfer package, so the receiving unit rediscovers a failure mode the sending unit already knew about.
• Transfer protocol approved by only one site’s quality unit, or approved after testing had already started.

Interview-ready: technology transfer

“Walk me through how you’d know a technology transfer to a new CDMO actually succeeded.” Predefined, numeric acceptance criteria set before any confirmation batch ran; CPPs and CQAs at the receiving site within the sending site’s proven acceptable ranges, or a documented rationale for any difference; engineering batch deviations closed or carried forward deliberately, not absorbed silently; the regulatory filing impact assessed and, where needed, approved before commercial distribution; and both quality units signing the transfer report before routine supply begins. A transfer that skips straight to “the batches look fine” without that trail is not evidence, it is an opinion.

A ready-to-use protocol for running this, with a filled specimen, is the technology transfer protocol.

Oversight models: person-in-plant to virtual

How closely you watch depends on risk, product complexity, the contractor’s maturity, and the stage of the relationship. The models below are points on a spectrum, and most programs blend them.

Person-in-plant (PIP). A representative of the owner is physically present during specified operations: campaign starts, critical steps, first batches after a change, or technology transfer runs. The PIP observes execution against the agreed process, flags departures in real time, and accelerates communication. PIP is expensive and is usually reserved for early relationships, high-risk products (sterile, biologics, advanced therapies, high-potency), or recovery from a quality problem. The agreement should define the PIP’s scope and authority: an observer who escalates, not a second operator who executes or signs the contractor’s records. Blurring that line creates its own compliance problem, because a PIP who signs or directs the contractor’s GMP records muddies who is accountable for the work.

Resident or embedded oversight. A lighter, longer-running version: a quality liaison who is on site frequently but not for every operation, often used during ramp-up or for a strategically important product.

Periodic on-site audits plus document review. The standard steady-state model. Routine and for-cause audits anchor the relationship; between audits the owner reviews batch records (or defined summaries), deviation and OOS reports, change notifications, and trended quality metrics.

Virtual / remote oversight. Increasingly common and, used well, genuinely effective, but it raises the data integrity stakes, because the owner sees what the contractor chooses to send rather than what an auditor on the floor would see. Effective remote oversight combines:

• A defined quality metrics dashboard reviewed on a fixed cadence (deviations by category and trend, OOS/OOT rate, right-first-time, on-time investigation closure, change notifications, complaint linkage). See quality metrics and KPIs.
• Periodic Product Quality Reviews / Annual Product Reviews as required under EU GMP Chapter 1 and 21 CFR 211.180(e), with the agreement stating who compiles which sections and how source data is provided. See annual product review / PQR.
• A periodic (quarterly or annual) performance review that steps back from any single product’s metrics or PQR to grade the relationship itself: audit and CAPA status, notification timeliness, a risk rating, and a continue, increase-oversight, or re-qualify decision. This is a different document from the product-level PQR contribution; see CDMO periodic performance review.
• Direct, controlled read access where feasible, for example audit-only access to the contractor’s electronic batch record or LIMS, or a documented mechanism to request raw data (chromatograms, audit trails) rather than only summary reports.
• A management review and escalation forum (a joint quality council) with defined membership, cadence, and decision authority. See management review under Q10.

A remote relationship is only as good as the owner’s ability to pull raw data on demand. If the agreement gives you nothing but the contractor’s curated summaries, you have outsourced your visibility along with the work.

Choosing the model: a quick rule of thumb

Roles and responsibilities

Inspectors expect named ownership, not “the quality team.” A clean allocation:

• Owner QA (supplier quality / external manufacturing). Owns the qualification, the quality agreement, change/deviation/OOS review, the audit program, and the performance review. The single throat to choke for the relationship.
• Owner Qualified Person (EU) / owner quality unit (US). Owns final batch certification/release and the Annex 16 reliance chain.
• Owner technical/CMC and validation. Owns specifications, process and method ownership, transfer, and the regulatory filing impact of changes.
• Contractor quality unit. Owns manufacturing disposition, site investigations, audit hosting, and notification to the owner.
• Contractor manufacturing/QC. Executes the process and testing per approved documents.
• Both procurement/legal. Own the commercial agreement and keep it from contradicting the quality agreement.

The mistake to avoid: a quality agreement signed only by procurement and a commercial counterpart, with no quality-unit signature on either side. If the heads of quality did not sign it, an inspector will ask who actually agreed to the GMP terms.

Cell and gene therapy CDMOs (CTDMOs): the contract network gets more complex

Everything above holds for a cell and gene therapy (CGT) product outsourced to a contract development and manufacturing organization, often called a CTDMO in this space. What changes is the shape of the network and the stakes of a broken link in it.

Why the network, not just the site, matters. An autologous CAR-T or TCR-T product does not have a warehouse of interchangeable stock behind it. The starting material is a specific patient’s cells, collected at a specific apheresis site, on a specific day, and if that batch fails, there is frequently no “make another one from inventory” option, only a recollection, with everything that means for a patient who may already be conditioned for infusion. The contract network for one such product routinely spans an apheresis or collection site, a courier and cryogenic shipping provider, the CTDMO’s manufacturing site, sometimes a separate viral vector or plasmid supplier feeding the CTDMO, and the treating clinical site, each a distinct legal party, each touching the same patient-linked material. A quality agreement written for a conventional small-molecule or biologic CMO relationship, one sending unit, one receiving unit, a defined lot, does not map cleanly onto that.

Where a standard quality agreement needs CGT-specific allocations

A worked example: an OOS on a single-patient batch

A CTDMO’s potency assay returns an OOS result for a CAR-T batch manufactured from one patient’s apheresis material, with the patient already scheduled for lymphodepleting chemotherapy in five days.

1. Detection and Phase I. The CTDMO’s lab secures the raw data and opens a Phase I investigation for assignable lab error, exactly as the standard OOS process in this article describes.
2. Same-day notification, with the clinical timeline stated explicitly. Because a delayed release affects a scheduled patient, the quality agreement should require the notification to state the clinical timeline impact, not only the technical result, so the sponsor’s clinical and quality teams triage it with the right urgency from the first message.
3. Joint, expedited Phase II if needed. Both quality units, and where the assay is non-compendial and still maturing, an assay subject-matter expert, assess whether the result reflects a true product failure or an assay limitation. The agreement should name who can authorize an expedited joint investigation meeting rather than defaulting to the standard investigation calendar.
4. Disposition, with the patient constraint on the table. The two-tier disposition boundary in this article still applies, manufacturing disposition at the CTDMO, final release at the sponsor, but the agreement should also state, in advance, whether and how a risk-based, physician-informed release ahead of full investigation closure could ever be considered, rather than leaving that decision to be improvised under time pressure.
5. Downstream notification. If the batch cannot be released, the treating site and the patient’s care team need to know immediately, which means the agreement’s notification clause must reach beyond the sponsor’s quality function to whoever owns clinical communication.

Roles specific to the CGT network

• Apheresis/collection site. Assigns the chain-of-identity identifier and performs the first custody handoff; it is itself a contracted party the sponsor must qualify and hold to the same quality-agreement discipline as the CTDMO.
• Cryogenic courier/logistics provider. Owns chain of custody and continuous condition monitoring for the transport legs; qualification and audit rights should extend to this party explicitly, not be assumed to travel automatically with the CTDMO’s agreement.
• CTDMO quality unit. Owns manufacturing disposition and the potency/identity investigation, same as any CMO, with the added weight of a non-fungible batch.
• Sponsor clinical operations. A stakeholder in the quality agreement’s notification clause in a way that does not exist for a conventional CMO relationship, because a release delay is also a patient-scheduling event.

Common mistakes that read as findings

• A CGT program’s quality agreement built from a standard small-molecule template, with no single-patient-batch disposition provision and no vein-to-vein ownership clause.
• Chain-of-identity and chain-of-custody obligations left entirely to a standard operating procedure with no contractual allocation across the collection site, courier, and CTDMO, so a break in the chain has no clear contractual owner.
• A viral vector or plasmid supplier feeding the CTDMO that the sponsor never independently qualified, discovered only when a vector-related quality issue surfaces.
• No pre-agreed process for an expedited joint investigation, so a patient-scheduling-critical OOS runs on the standard investigation calendar by default.

Interview-ready: CGT and CTDMO oversight

“How does outsourcing to a CGT CDMO differ from a conventional CMO relationship?” The batch is frequently a single patient’s material with no remanufacture fallback, so chain of identity and chain of custody must be allocated across every party in the network, not just documented at one site. The quality agreement should name who owns each leg of the vein-to-vein clock, state in advance how an expedited, patient-scheduling-aware investigation runs, and extend qualification and audit rights to the collection site and courier, not only the manufacturing site. See cell and gene therapy data integrity for the data-integrity detail this section assumes.

Data integrity risks specific to contract labs and CMOs

Data integrity is the area where contract relationships fail in ways an internal operation might not, because the incentives and the visibility differ. The expectations are set out in MHRA’s “GXP Data Integrity Guidance and Definitions” (2018), FDA’s “Data Integrity and Compliance With Drug CGMP” guidance (2018), PIC/S PI 041 (“Good Practices for Data Management and Integrity in Regulated GMP/GDP Environments”), and WHO’s data integrity guidance, and the ALCOA+ principles (Attributable, Legible, Contemporaneous, Original, Accurate, plus Complete, Consistent, Enduring, Available) run through all of them. See ALCOA+ in detail and data integrity foundations. The risks below show up disproportionately at contract sites.

Testing into compliance and selective reporting. A contract lab paid per passing batch has a structural incentive to make results pass. The classic failure modes, unexplained reinjections, “trial” or “test” injections run before the official sequence, samples renamed and rerun, peaks reintegrated until they pass, are exactly what inspectors hunt in chromatographic audit trails. Mitigation lives partly in the agreement (the owner’s right to review raw data and audit trails for its product, the requirement that all data generated be reported, an explicit prohibition on testing into compliance) and partly in oversight (periodically pulling the full audit trail for a batch and reconciling it against the CoA). See chromatography data system integrity.

Audit trails disabled, shared, or unreviewed. Inspectors routinely find audit trails switched off on chromatography or balance software, instruments running under a single shared “admin” login, or audit trails that are technically on but never reviewed. EU GMP Annex 11 (Computerised Systems) and 21 CFR Part 11 require that electronic records be attributable to unique individuals and that audit trails be available and reviewed. The agreement should require unique user accounts, audit trails enabled on all GMP-relevant systems, and a documented audit-trail review process, and the owner should verify these during qualification and audits, not assume them. See audit trail design and review and 21 CFR Part 11 and EU Annex 11.

Orphan, hybrid, and uncontrolled data. Paper printouts treated as “original” while the underlying electronic data is discarded; results captured in uncontrolled spreadsheets; data on local instrument drives that never enters a managed system. PIC/S PI 041 is built around the complete data lifecycle and the distinction between static and dynamic records. For dynamic records (a chromatogram you can reprocess), a printout is not the original. The owner’s qualification audit should map, for each critical test, where the true raw data lives, who controls it, and how it is backed up and retained. See static, dynamic records and true copies and hybrid paper and electronic records.

Subcontracted and “off-the-books” testing. A contract lab quietly sends a test it cannot perform to a third lab, or a CMO routes an operation to an unqualified subcontractor. This violates the Chapter 7 no-subcontracting-without-approval rule and breaks the data integrity chain: the owner cannot vouch for raw data it has never seen from a site it has never qualified. The agreement must prohibit it explicitly and the owner should periodically confirm that all testing happens where the agreement says it does.

Retention and post-termination access. When a relationship ends, the owner still needs the records, for complaints, recalls, and inspections that may come years later. The agreement must fix the retention period (at least matching the owner’s regulatory retention obligations) and guarantee access to records, including raw electronic data and the means to read it, after termination. A contractor that goes out of business or migrates off a legacy system can strand years of GMP records if this was never negotiated. See data migration validation and backup, restore and disaster recovery validation.

ALCOA+ failure modes at contract sites: a working map

None of the failure modes below are unique to contract sites in principle, but they concentrate there because the incentive structure differs, a contract lab paid per passing batch has a reason to make results pass that an internal lab, paid regardless, does not, and because the owner’s day-to-day visibility is lower. This table exists to make the contract-site version of each ALCOA+ attribute concrete enough to look for on purpose, rather than trusting that “the site is GMP-certified” already covers it.

The ALCOA+ in detail article covers each attribute in full; this table is the contract-site application of it.

A practical data integrity checklist for contract sites

• For each critical test, is the true raw data identified, and does the owner have a right to it (not just the summary)?
• Are audit trails enabled on all GMP systems, and is there a documented, performed audit-trail review?
• Are user accounts unique and role-controlled, no shared admin logins?
• Is there a written prohibition on testing into compliance and on reporting only passing results?
• Is all subcontracting prohibited without prior written approval, and verified in practice?
• Are retention periods and post-termination access defined and sufficient?
• Can the owner pull a full batch’s raw data and reconcile it to the CoA on demand?
• Is system time synchronized and protected, so contemporaneous timestamps can be trusted? See time stamps and system clock control.

A worked example: tracing one event through the agreement

Walk a single OOS through the relationship to see whether the agreement actually functions. The contract lab gets an OOS on assay for a released-pending batch.

1. Detection and Phase I (contractor). The contract lab’s analyst flags the OOS, secures the original data, and the contractor’s quality unit opens a Phase I laboratory investigation to check for assignable lab error, per its SOP and USP/FDA OOS expectations. The agreement says the contractor runs Phase I.
2. Notification (agreement-driven). Because the agreement defines an OOS on the owner’s product as a same-day notification event, the owner’s supplier-quality contact is informed within the agreed window, with the raw data and the Phase I status, not after Phase II concludes.
3. Concurrence and Phase II (joint). If Phase I finds no assignable cause, a Phase II investigation extends to the manufacturing process. The agreement says the owner concurs on hypothesis testing and on any decision to invalidate the original result. Neither party invalidates a result unilaterally.
4. Disposition (boundary). The contractor cannot release the batch. Manufacturing disposition stays at the contractor; final release stays with the owner’s QP/quality unit. If the OOS stands, the batch is rejected, and the agreement defines who notifies whom and the destruction/return path.
5. Data integrity reconciliation (oversight). During the next audit, the owner pulls the full chromatographic audit trail for that batch and reconciles every injection against the reported result, confirming no unreported reinjections or reintegrations sit behind the CoA.

If any step in that chain has no owner in the agreement, that is the gap. See OOS investigation process and deviation management for the underlying procedures.

Dispute escalation, agreement termination, and transition-out

A quality agreement earns its keep most when the relationship is working. It earns its keep hardest when the relationship is ending, on purpose or otherwise, because EU GMP Chapter 7 and FDA’s contract manufacturing guidance do not suspend the owner’s accountability just because a termination notice has been sent. Product already in the market, and any batch still in the CDMO’s hands, remains the owner’s responsibility until it is disposed of, transferred, or destroyed under the same GMP discipline that applied on day one.

The escalation ladder

Most contract relationships that end badly did not fail suddenly. They failed through a series of issues that were each individually tolerable and never systematically escalated. A defensible quality agreement defines the ladder before it is needed.

What triggers formal escalation or termination

• A pattern of critical or major deviations that a corrective action plan has not resolved.
• A for-cause audit that finds the quality system out of control, not an isolated gap.
• A confirmed data integrity breach: falsified, manipulated, or selectively reported data.
• A regulatory action at the contract site, a warning letter, an import alert, a consent decree, that affects the owner’s product.
• Repeated failure to meet the notification windows the agreement defines, so the owner is structurally kept in the dark.
• A business-driven termination for convenience: capacity reallocation, acquisition, site closure, or a strategic decision unrelated to quality performance. This still requires the same transition discipline; a friendly exit is not a low-risk exit.

What a transition-out plan must cover

Acceptance criteria for a transition-out

• A successor site, or the owner’s own facility, is qualified and technology-transferred before the outgoing CDMO’s last committed batch, not after.
• Bridging stock, sized against the qualification timeline plus margin, is in place before the notice period’s supply obligation ends.
• The regulatory filing change is approved, not merely submitted, before commercial distribution from the successor site.
• Every record and raw-data category the owner is entitled to has been pulled, verified for completeness, and confirmed readable, while the outgoing CDMO is still obligated and available to help.
• Every batch and investigation open at cutover has a named owner for completion, regardless of which side of the termination date it falls on.
• The termination and transition are documented end to end: the triggering event, the escalation history, the transition plan, and its execution, in case an inspector asks why the relationship ended.

A worked example: termination for cause

A CDMO fails a for-cause audit after three consecutive quarters of missed deviation-notification windows, and the audit finds the site’s own trending had identified the same pattern internally without escalating it to the owner.

1. Pattern recognized. The owner’s quarterly metrics review shows notification timeliness degrading for two consecutive quarters; a for-cause audit is triggered rather than waiting for the next routine cycle.
2. Formal notice to cure. The audit report is issued with major findings tied to the quality agreement’s notification clause; a written notice to cure is sent citing the specific clause and a 60-day cure period.
3. Cure period fails. The corrective action plan the CDMO submits does not address the root cause, an under-resourced quality unit; a follow-up check at day 45 shows two further missed notifications.
4. Termination for cause. The owner issues a termination notice per the agreement’s termination clause, triggering the transition-out plan that had already been drafted as a contingency when the pattern was first recognized, not started from a blank page after the notice.
5. Transition execution. A pre-qualified successor site, identified during the owner’s original dual-sourcing risk assessment, receives an accelerated technology transfer; bridging stock covers the qualification window; records and raw data are pulled from the outgoing CDMO within the cure period, while cooperation is still contractually obligated.

The detail that makes this defensible is step 4: the transition plan existed before the termination notice was sent, because the pattern in step 1 was itself the trigger to start contingency planning, not the termination decision.

Roles

• Owner QA / supplier quality. Owns the escalation ladder, the decision to trigger for-cause activity, and the transition-out plan.
• Owner technical/CMC. Owns the successor-site technology retransfer and the regulatory filing impact.
• Owner regulatory affairs. Owns the variation/supplement submission and tracks it to approval before cutover.
• Both quality units, through the notice period. Continue to run deviation, OOS, and disposition exactly as before; a notice period is not a quality holiday.
• Legal/procurement. Owns the termination mechanics and the survival-clause language, in coordination with, not instead of, the quality unit’s transition plan.

Common mistakes that read as findings

• No survival clause, so audit rights and record access effectively end when the commercial relationship does.
• Transition-out planning started only after the termination notice, instead of when the risk pattern first appeared.
• Batches or investigations open at the cutover date left with no named owner on either side.
• Bridging stock never built, turning a planned transition into an unplanned shortage.
• A successor site distributing commercial product before the site-change filing is approved.

Interview-ready: dispute, escalation, and termination

“What happens to your access to a CDMO’s data after you terminate the relationship?” It depends entirely on what the quality agreement says before termination, not on goodwill afterward. A defensible agreement has a survival clause that keeps audit rights, confidentiality, and record/raw-data access alive past termination for the full retention period, and the owner exercises that access, pulling and verifying the records, while the relationship still carries contractual weight, not months later when the CDMO’s obligation to cooperate has become a matter of interpretation.

A ready-to-use log for tracking a relationship from a routine issue through escalation and, where it comes to that, termination and transition, is the CDMO dispute, escalation, and transition-out log.

What inspectors actually look for

When a regulator inspects a contract relationship, at either site, a recognizable pattern of questions emerges:

• Is there a current, signed quality agreement, and does reality match it? They will pick an activity and trace who actually performed it against who the agreement says owns it. A mismatch, a control the agreement assigns to one party that neither is running, is a classic finding.
• How was the contractor qualified, and is qualification current? Expect them to ask for the qualification audit, the risk assessment, and evidence of ongoing oversight, not just an initial approval.
• Are deviations, OOS, and changes flowing as the agreement requires? They will look for site events the owner should have been told about and was not, and for changes implemented without the owner’s approval.
• Batch disposition chain. Who released, on what basis, and did the owner’s quality unit/QP have what it needed? Annex 16 makes the QP’s reliance chain a focus in the EU.
• Data integrity at the contract lab. Audit trails, shared logins, raw data location, and any sign of selective reporting. This is now a default line of inquiry, not an exception.

Common findings and how they read in a 483 or inspection report

• Quality agreement absent, expired, unsigned by a quality unit, or contradicting the supply agreement.
• Responsibilities ambiguous or in conflict, a control owned by neither party in practice.
• Inadequate oversight: no periodic audit, no metric review, qualification “archived” rather than maintained.
• Changes at the contract site implemented without owner notification or approval.
• Deviations/OOS not escalated to the owner per the agreement.
• Data integrity at the contract lab: disabled or unreviewed audit trails, shared logins, unexplained reinjections.
• Unauthorized subcontracting, work routed to an unqualified third party.
• Owner cannot demonstrate it can access the contractor’s raw data.

See FDA warning letter patterns and 483 and warning letter response for how these are written up and answered.

Interview-ready: questions and how to answer them

“Who is responsible for GMP compliance when you outsource manufacturing?” Both parties. The owner and the contract facility are each manufacturers under CGMP (21 CFR 210/211) and under EU GMP Chapter 7. A contract allocates the work; accountability for compliance does not transfer. The owner remains accountable for product quality and for assessing and overseeing the contractor.

“What is the difference between the quality agreement and the supply agreement?” The supply (commercial) agreement covers price, volume, capacity, and liability and is signed by business officers. The quality agreement covers GMP roles, responsibilities, and the mechanics of compliance (deviations, OOS, changes, disposition, audits, data integrity, retention) and is signed by the quality units. They must not contradict each other; where they do on a quality matter, the quality agreement should prevail.

“What is the ‘no silent subcontracting’ rule?” EU GMP Chapter 7 (and ICH Q7 Section 16) forbid the Contract Acceptor from subcontracting any of the contracted work to a third party without the Contract Giver’s prior written evaluation and approval. It matters because the owner cannot vouch for data or work from a site it has never qualified, which is both a GMP and a data integrity failure.

“Walk me through batch release for an outsourced product.” Two tiers. The contractor’s quality unit makes the manufacturing disposition (executed record, in-process and release testing, deviations) and issues the CoA. The owner’s quality unit, and in the EU the QP under Article 51 of Directive 2001/83/EC and Annex 16, makes the final certification and market release, relying on a defined data package but not blindly. The product stays in quarantine until final release.

“How do you oversee a contract site you cannot easily visit?” Remote oversight built on a metrics dashboard reviewed on a cadence, defined PQR/APR contributions, a documented right and mechanism to pull raw data and audit trails on demand, change/deviation/OOS notification triggers, and a joint quality council for escalation. The hard requirement is the ability to reach the contractor’s raw data, not just its summaries.

“What data integrity risks are higher at a contract lab than in-house?” The incentive to make results pass (testing into compliance, selective reporting), reduced day-to-day visibility, and the temptation to subcontract quietly. Mitigation: contractual right to all raw data and audit trails, a written prohibition on testing into compliance, verification of unique logins and audit-trail review during audits, and periodic reconciliation of a full batch’s raw data against the CoA.

“What would you check first if asked to review a quality agreement?” Is it signed by both quality units and current? Does every GMP activity have a single clear owner with no gaps (especially disposition, change notification, deviation/OOS flow, audit and for-cause rights, data integrity and raw-data access, retention and post-termination access)? Does it contradict the supply agreement? Does reality match what it says?

“How often should a contractor be audited?” Risk-based, not a flat number. Common practice is annual for higher-risk operations (sterile, biologics) and a justified longer interval for lower-risk work, plus an unconditional for-cause right with no annual cap, triggered by deviation trends, OOS trends, serious complaints, or regulatory action at the site.

Practical tips

• Sequence the quality agreement before the first GMP batch, never after. A retroactive agreement is a finding waiting to happen.
• Make the heads of quality sign it. If only procurement signed, you do not really have a quality agreement.
• Build the change classification table into the agreement so the contractor cannot grade its way around your oversight, and keep the owner’s right to reclassify.
• Negotiate raw-data access and post-termination retention up front. These are nearly impossible to add after a relationship sours or the contractor exits a system.
• Keep qualification alive: a metrics review and a periodic audit cadence, not a binder from three years ago.
• Reconcile, do not assume. Periodically pull a full batch’s audit trail and tie it to the CoA. That single habit catches most contract-lab data integrity problems.
• Walk a real event (an OOS, a change, a deviation) through the agreement once a year to confirm every step still has an owner.
• Run technology transfer as a protocol-driven activity with acceptance criteria set before testing, the same discipline as analytical method transfer, not a project-management milestone quality signs off on after the fact.
• For cell and gene therapy CDMOs, extend qualification, audit rights, and chain-of-identity/custody obligations to the collection site and the courier, not only the manufacturing site.
• Write the transition-out plan, and identify a contingency successor site, before you need one. The pattern that eventually triggers a termination is usually visible in the metrics quarters before the termination notice is sent.

Related reading: supplier and vendor qualification, conducting a supplier audit, quality in technology transfer, batch disposition decisions, Qualified Person batch release under Annex 16, supply chain data integrity, ICH Q7 API GMP, cell and gene therapy data integrity, and ATMP GMP for cell and gene manufacturing.

The cleanest defense is also the simplest to state: a current quality agreement that matches what each party actually does, a qualification file that is alive rather than archived, a flow of deviations/OOS/changes that demonstrably reaches the owner, a disposition chain with a clear final-release boundary, and the ability to reach into the contractor’s raw data when you need to. Outsourcing the work is routine. Outsourcing the accountability is impossible, and the quality agreement is how you prove you never tried.