This is a ready-to-use periodic performance review for a CDMO, CMO, or contract testing laboratory relationship. Replace every <<FILL: ...>> placeholder with your own specifics, set your document numbers and dates, and route it through your normal document control, review, and approval. A worked filled specimen follows the template. Verify each cited regulation against the current source before you rely on it. This template is an educational reference for you to adapt to your own quality system, products, and regulatory context; it is not legal, regulatory, or professional advice.
This document is not a Product Quality Review or Annual Product Review, and it does not replace one. A PQR/APR grades a product across the batches made in a period. This document grades the relationship itself, whether the contract site is being overseen well and whether the oversight model still fits, using the audit history, the notification record, and the trend of quality metrics as its evidence. Where a CDMO manufactures multiple products for the same owner, one relationship-level document can cover all of them, with product-level detail left to each product’s own PQR/APR.
Document control header
| Field | Entry |
|---|---|
| Document title | CDMO Periodic Performance Review for <<FILL: CDMO / contract site name>> |
| Document number | <<FILL: RPT-ID, e.g. CPR-2026-009>> |
| Version | <<FILL: version, e.g. 1.0>> |
| Report date | <<FILL: date issued>> |
| Report period | <<FILL: from date>> to <<FILL: to date>> |
| Frequency | <<FILL: quarterly / annual, and basis>> |
| Document owner | <<FILL: role, e.g. Supplier Quality / External Manufacturing Lead>> |
| Contract site(s) covered | <<FILL: name(s) and address(es)>> |
| Products / activities covered | <<FILL: product names and the activity performed at this site>> |
| Quality agreement in force | <<FILL: number and effective date>> |
1. Purpose
This document records the periodic review of the relationship with <<FILL: CDMO name>> performed by <<FILL: COMPANY NAME>> for the period stated in the header. The objective is to assess whether oversight of this relationship is working: whether audits and their corrective actions are on track, whether the contract site is notifying the owner of events as the quality agreement requires, whether quality metrics show a stable or improving trend, and whether the current oversight model (person-in-plant, periodic audit, remote monitoring, or a blend) still matches the risk. The review closes with a risk rating and a decision to continue, increase oversight, or re-qualify.
2. Scope
This review covers the relationship with the contract site(s) named in the header for the period stated, across every product or activity that site performs for the owner. It draws on audit outcomes, the CAPA tracking register, change and deviation notifications received in the period, and the quality metrics dashboard. It does not repeat product-level batch review, which belongs to each product’s PQR/APR, and it does not re-open individual deviations or OOS investigations already dispositioned; it assesses their pattern and timeliness, not their technical conclusion.
3. Inputs to this review
| Input | Source / reference | Reviewed (Y/N) |
|---|---|---|
| Current quality agreement and any addenda | <<FILL: reference>> | <<FILL>> |
| Most recent audit outcome(s) and CAPA tracking status | <<FILL: reference, CAPA log reference>> | <<FILL>> |
| Change notifications received in the period | <<FILL: change log reference>> | <<FILL>> |
| Deviation and OOS notifications received in the period | <<FILL: log reference>> | <<FILL>> |
| Complaints linked to this site | <<FILL: complaint log reference>> | <<FILL>> |
| Quality metrics dashboard for the period | <<FILL: dashboard reference>> | <<FILL>> |
| Product-level PQR/APR contributions for the period, if issued | <<FILL: reference(s)>> | <<FILL>> |
| Prior periodic performance review and its open actions | <<FILL: prior document number>> | <<FILL>> |
| Regulatory inspection notifications and outcomes for this site in the period | <<FILL: none, or reference>> | <<FILL>> |
4. Relationship overview and oversight model
| Field | Entry |
|---|---|
| Relationship start date | <<FILL>> |
| Current oversight model | <<FILL: person-in-plant / resident-embedded / periodic audit plus document review / virtual-remote / blend>> |
| Basis for the current model | <<FILL: risk rating, product complexity, contractor maturity, stage of relationship>> |
| Current supplier qualification status | <<FILL: Approved / Conditionally approved / Suspended>> |
| Audit interval on file | <<FILL>> |
| Direct read access to contractor systems (Y/N, what) | <<FILL>> |
5. Audit and CAPA status
| Audit reference | Date | Type | Outcome grade counts | CAPA status | Overdue items | Effectiveness verified |
|---|---|---|---|---|---|---|
<<FILL>> | <<FILL>> | <<FILL: routine / for-cause / qualification>> | <<FILL>> | <<FILL: open / closed>> | <<FILL: none, or list>> | <<FILL: Y/N/N-A>> |
<<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
| Summary | Entry |
|---|---|
| Audits performed in period | <<FILL: count>> |
| Open items beyond target closure time | <<FILL: none, or list with age>> |
| Items closed on verified effectiveness, majors and criticals | <<FILL: count / count due>> |
| Next audit scheduled | <<FILL: date and type>> |
Cross-reference to Log: Supplier Audit CAPA Tracking to Closure for the finding-level detail this section summarizes.
6. Notification timeliness
The quality agreement defines specific windows for the contractor to notify the owner of events. This section measures whether it did.
| Notification type | Agreement window | Notifications due | Received on time | Late (count, average days late) | Not received |
|---|---|---|---|---|---|
| Deviations affecting owner product | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
| OOS / OOT results | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
| Change notifications (approval-tier and notification-tier) | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
| Regulatory inspection at this site | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
| Serious GMP event (critical deviation, confirmed OOS on released product, recall) | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
A single late notification of a serious event, even if every other window was met, is weighted more heavily in section 9 than a pattern of minor administrative delays. State which it was, not just the count.
7. Quality metrics trend
Present each metric against its target and its trend for at least the current and prior two periods, so a single good quarter cannot mask a worsening direction.
| Metric | Target | This period | Prior period | Two periods prior | Trend |
|---|---|---|---|---|---|
| Deviations by category (list top categories) | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL: improving / stable / worsening>> |
| OOS / OOT rate | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
| Right-first-time rate | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
| On-time investigation closure | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
| Change notification timeliness (from section 6) | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
| Complaints linked to this site | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
Commentary: <<FILL: explain any metric trending against target, tie it to a specific driver, e.g. a staffing change, an equipment issue, a new product introduction; a metric out of target with no explanation is treated as unresolved>>
8. Complaint and recall linkage
| Complaint / recall ref | Date | Description | Linked to this site’s activity | Investigation status | CAPA linkage |
|---|---|---|---|---|---|
<<FILL>> | <<FILL>> | <<FILL>> | <<FILL: Yes / No>> | <<FILL>> | <<FILL>> |
9. Risk rating
| Field | Entry |
|---|---|
| Risk rating this period | <<FILL: Low / Moderate / Elevated / High>> |
| Risk rating prior period | <<FILL>> |
| Direction of change | <<FILL: improved / unchanged / worsened>> |
Rationale: <<FILL: state the rating in terms of the specific evidence above, e.g. "Elevated: two majors from the Q1 audit remain open past their target date, and OOS rate has trended upward for two consecutive quarters with no assigned root cause." A rating with no evidence trail behind it is not defensible.>>
| Rating | What it reflects |
|---|---|
| Low | Audits and CAPA current, notifications on time, metrics stable or improving, no open majors/criticals |
| Moderate | One or two isolated gaps, each with a credible corrective action in progress and no repeat pattern |
| Elevated | A repeat pattern in any single area (late notifications, a metric trending against target, slow CAPA closure), or an open major past its target date |
| High | A critical audit finding unresolved, a data integrity concern, repeated failure to meet notification windows, or a regulatory action at the site affecting the owner’s product |
10. Decision
| Field | Entry |
|---|---|
| Decision | <<FILL: Continue current oversight / Increase oversight / Initiate re-qualification / Escalate>> |
| Basis | <<FILL: tie directly to the risk rating and section 9 rationale>> |
| Specific oversight change, if any | <<FILL: e.g. add a for-cause audit, shorten the audit interval, add person-in-plant for the next campaign, require weekly rather than monthly metrics submission>> |
| Owner of the change | <<FILL>> |
| Effective date | <<FILL>> |
| Review point to confirm the change is working | <<FILL: date and what will be checked>> |
Where the decision is anything other than “continue current oversight,” this document itself becomes the trigger record for the escalation ladder; log it in Log: CDMO Dispute, Escalation, and Transition-Out Tracking at the “pattern recognized” stage rather than waiting for a separate event to start that record.
11. Actions from this review
| Action no. | Action | Owner | Due date | Linked record (CAPA / audit / escalation log) | Status |
|---|---|---|---|---|---|
<<FILL: 1>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
<<FILL: 2>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> | <<FILL>> |
12. Next review
| Field | Entry |
|---|---|
| Next review due | <<FILL: date, per the frequency in the header>> |
| Trigger for an earlier review | <<FILL: e.g. a for-cause audit, a critical finding, a data integrity event, a termination notice>> |
13. References
EU GMP Chapter 7, Outsourced Activities. FDA guidance, Contract Manufacturing Arrangements for Drugs: Quality Agreements. ICH Q10, Pharmaceutical Quality System, ongoing supplier performance monitoring. 21 CFR 211.180(e) and EU GMP Chapter 1 (Product Quality Review / Annual Product Review, for the boundary this document respects). ICH Q9(R1), Quality Risk Management (basis for the risk rating in section 9).
Confirm the current version and clause numbers of each reference before issue.
14. Revision history
| Version | Date | Author | Summary of change |
|---|---|---|---|
<<FILL: 1.0>> | <<FILL: date>> | <<FILL: author>> | Initial issue. |
15. Approvals
| Role | Name | Signature | Date |
|---|---|---|---|
| Author (Supplier Quality / External Manufacturing) | <<FILL>> | ||
| Reviewer (Technical / CMC) | <<FILL>> | ||
| Approver (Quality Assurance) | <<FILL>> |
Filled specimen
The following shows the same document completed for an illustrative contract sterile fill-finish supplier, so you can see the level of detail an inspector expects. The company, site, and numbers are illustrative; replace them with your own.
| Field | Entry |
|---|---|
| Contract site | Halvergate Sterile Manufacturing, Leeds, United Kingdom |
| Report period | 01 January 2026 to 31 March 2026 (Q1) |
| Frequency | Quarterly, per risk rating Moderate to Elevated |
| Products covered | Product A (2 mL vial), Product B (10 mL vial) |
| Quality agreement | QAG-2025-041, effective 14 March 2025 |
| Oversight model | Periodic on-site audit plus document review, with a metrics dashboard reviewed monthly; no person-in-plant currently assigned |
Audit and CAPA status: One for-cause audit conducted 18 to 19 February 2026 (triggered by the notification-timeliness pattern below), 2 major and 1 minor outcome. CAPA responses received on time; corrective actions in progress, due 30 June 2026; effectiveness checks not yet due. No overdue items.
Notification timeliness: Deviation notifications: 6 due, 4 on time, 2 late by an average of 5 days. Change notifications: 9 due, 9 on time. Serious GMP event: 1 due (a confirmed OOS on a released-pending lot), received 3 days after the agreement’s same-day window, which drove the for-cause audit.
Quality metrics trend: OOS/OOT rate 2.1% this quarter versus 1.4% and 1.2% in the prior two quarters, worsening. Right-first-time rate 94.8%, stable. On-time investigation closure 78%, down from 91% and 89%, worsening. Commentary: Halvergate attributed the deviation-notification delay and the investigation-closure slippage to a quality unit staffing gap after two analysts left in December 2025; two replacement hires started 10 February 2026, not yet fully trained.
Risk rating: Elevated, worsened from Moderate last period. Rationale: a serious-event notification breach drove a for-cause audit within the quarter, and two metrics (OOS/OOT rate, investigation closure timeliness) show a two-quarter worsening trend with an identified but not yet resolved root cause (quality unit staffing).
Decision: Increase oversight. A person-in-plant will be assigned for the next two manufacturing campaigns at Halvergate, and the metrics dashboard submission frequency moves from monthly to biweekly until investigation closure timeliness returns to target for two consecutive reporting periods. Owner: External Manufacturing Lead. Effective 01 May 2026. Review point: Q2 document, checking investigation closure timeliness and confirming the new analysts are fully trained and independently qualified.
Actions: (1) Verify effectiveness of the for-cause audit CAPA once due, owner Supplier Quality, due 15 July 2026. (2) Confirm person-in-plant coverage is scheduled for the next two campaigns, owner External Manufacturing Lead, due 01 May 2026. (3) Track investigation closure timeliness biweekly and escalate if it has not improved by the Q2 review.
This document logged its own decision, “increase oversight,” as a pattern-recognized entry in the escalation register the same day it issued, so the trail from the metric trend to the person-in-plant decision is traceable without anyone having to reconstruct it later from separate documents.
Common inspection outcomes this document prevents
- A CDMO relationship reviewed only through the product-level PQR/APR, with nothing that ever grades the relationship, its audit status, or its notification record as a whole.
- A quality metrics dashboard that exists but was never assessed against a target or a trend, so a two-quarter worsening pattern went unnoticed until an audit or an inspection surfaced it.
- Late or missing contractor notifications tracked nowhere, so a pattern of breaches is invisible until a serious event forces a for-cause audit.
- A risk rating asserted with no evidence trail behind it, so the basis for “the relationship is fine” cannot be reconstructed.
- An oversight model (person-in-plant, remote, periodic audit) that never changes regardless of what the metrics or the audit history show.
- A periodic review on file with no decision recorded, or a decision that does not match its own evidence.
- Prior review actions silently dropped rather than carried forward and checked at the next review.
How to adapt this document
- Set your document number, owner, contract site, and review period in the header, and set the frequency to your risk-based interval (commonly quarterly for elevated or new relationships, annual for a mature, low-risk one).
- Point every input in section 3 to your real audit, CAPA, change, deviation, complaint, and metrics records.
- Set the metric list in section 7 to the ones your quality agreement and metrics program actually track; do not report a metric here that nobody reviews elsewhere.
- Calibrate the risk rating table in section 9 to your own risk management procedure so the rating maps consistently across every contract site you review this way.
- Where the decision in section 10 is anything other than continue, open or update the entry in Log: CDMO Dispute, Escalation, and Transition-Out Tracking the same day, so the escalation trail starts from this document rather than from a later, harder-to-reconstruct event.
- Confirm every citation in section 13 against the current published version before issue.