This creates a quality management challenge that is fundamentally different from managing an in-house production facility. When you own manufacturing, your QMS controls the process directly. When a CMO manufactures your product, your QMS must extend its oversight into an organization that has its own systems, personnel, priorities, and regulatory obligations — without the authority to direct day-to-day operations the way you would with internal staff.

This article covers how pharmaceutical companies establish and maintain quality oversight of CMO relationships, what the regulatory framework requires, and how the common failure points in CMO quality management can be addressed through systematic oversight.

The regulatory framework for CMO oversight

FDA’s 21 CFR Part 211 (cGMP for finished pharmaceuticals) places quality responsibilities squarely on the holder of the approved drug application. Section 211.22 requires the Quality Control Unit to have the responsibility and authority to approve or reject drug products manufactured, processed, packed, or held under contract by another company. The fact that manufacturing occurred at a CMO’s facility does not reduce this obligation.

FDA’s guidance document on contract manufacturing arrangements for drugs, published in 2016 and updated in subsequent years, states that both the contract giver and the contract acceptor have distinct and shared responsibilities, and that these responsibilities must be clearly defined in a written quality agreement. The agency expects quality agreements to specify which party is responsible for each cGMP activity, including material release, in-process testing, batch record review, deviation management, change control, and annual product review.

EU GMP Chapter 7 (Outsourced Activities) takes the same position. The contract giver must audit the CMO before authorizing manufacturing and at appropriate intervals thereafter, must provide the CMO with all information necessary to carry out contracted operations correctly, and must ensure the CMO understands its quality obligations. The CMO must maintain a quality system appropriate to the scope of its operations and must not subcontract any contracted work to a third party without the prior consent and evaluation of the contract giver.

ICH Q10 (Pharmaceutical Quality System) provides the overarching framework. It establishes that the MAH is responsible for the quality of products throughout the product lifecycle, including products manufactured at CMO facilities, and that this responsibility cannot be delegated through a commercial arrangement.

The quality agreement: the foundation of CMO oversight

The quality agreement is the primary document that defines how quality responsibilities are allocated between the MAH and the CMO. It is a regulatory requirement under FDA and EU GMP guidance, and its absence — or its failure to address required topics — is a recurring inspection observation.

A complete quality agreement addresses the following areas at minimum:

Scope of manufacturing activities. The agreement must specify exactly what activities the CMO will perform — synthesis, formulation, filling, packaging, labeling, testing, or some combination. Ambiguity about scope creates gaps in oversight accountability.

Material responsibility. Who purchases, tests, releases, and manages starting materials and packaging components? Who is responsible for supplier qualification of the CMO’s own material suppliers? These responsibilities must be explicit, not implied.

Testing and release. The agreement must specify whether the CMO performs in-process testing, finished product testing, or both; what test methods are used; and who has final release authority. FDA expects the MAH’s quality unit to retain final release authority for products marketed in the United States.

Deviation and CAPA management. The agreement must establish how deviations occurring at the CMO facility are communicated to the MAH, who investigates them, what timeframes apply, and how corrective actions are implemented and verified. The MAH must have visibility into CMO deviations, not just their outcomes.

Change control. Manufacturing changes at the CMO — equipment changes, process changes, facility changes, material supplier changes — can have regulatory implications for the MAH’s drug application. The agreement must require the CMO to notify the MAH of all changes that could affect product quality or regulatory compliance, with timelines that allow the MAH to evaluate whether a regulatory filing is required before the change is implemented.

Audit rights. The MAH must have documented rights to audit the CMO facility, including the ability to conduct for-cause audits when quality issues arise. Audit frequency, access scope, and response obligations should be specified.

Annual product review. FDA requires annual product reviews (APRs) for each marketed drug product. The quality agreement must specify which party compiles the APR and what data the CMO must provide to support it.

Regulatory inspections. The agreement should specify how CMO inspections by regulatory authorities are handled, including notification requirements and the MAH’s right to be informed of inspection outcomes and any observations related to the contracted product.

CMO qualification: what to do before manufacturing begins

Selecting and qualifying a CMO is a risk-based supplier qualification process. FDA and EU GMP requirements for supplier quality management apply to CMOs as critical suppliers — the consequences of CMO failure extend directly to product quality and patient safety.

CMO qualification typically follows a structured sequence that mirrors the qualification of any critical supplier, but with additional depth required by the manufacturing nature of the relationship.

Capability assessment. Before auditing, confirm that the CMO has the equipment, technology, process expertise, and regulatory history necessary to manufacture the specific product. A CMO experienced in oral solid dosage forms may lack the aseptic processing capability required for injectables. Capability mismatches identified late in qualification — or after manufacturing has begun — are expensive and time-consuming to resolve.

Regulatory history review. Review the CMO’s FDA inspection history through the FDA Establishment Inspection Report (EIR) database and EU GMP compliance data. Consent decrees, import alerts, warning letters, and significant Form 483 observations against the CMO facility are material risk factors that must be evaluated and documented before qualification approval.

On-site audit. An on-site quality systems audit of the CMO is a regulatory expectation, not a best practice option. The audit must evaluate the CMO’s quality management system, GMP practices, deviation and CAPA management, change control processes, laboratory systems, and documentation controls. Audit findings must be documented, communicated to the CMO, and resolved before commercial manufacturing begins.

Technical transfer. Manufacturing a pharmaceutical product at a new facility requires a formal technical transfer — the systematic process by which process knowledge, specifications, analytical methods, and in-process controls are transferred to the CMO and demonstrated through engineering batches. Technical transfer documentation becomes part of the qualification record and must demonstrate that the CMO can reproduce the product within specification.

Qualification approval. The MAH’s quality unit must formally approve the CMO qualification before the first commercial batch is manufactured. This approval should be documented in the approved supplier list, with the qualification scope, approval date, next review date, and any approval conditions recorded.

Ongoing oversight: maintaining quality visibility after manufacturing begins

CMO qualification is the beginning of quality oversight, not the end. FDA’s expectations — and the practical requirements of managing product quality at arm’s length — require sustained oversight activities throughout the commercial relationship.

Periodic audits. The frequency of routine audits should reflect the criticality of the CMO relationship and the CMO’s performance history. A CMO manufacturing a single critical drug product with a history of deviations requires more frequent auditing than a well-performing CMO with a clean inspection record. Most companies audit critical CMOs annually or biannually, with for-cause audits triggered by significant quality events.

Batch record review. The MAH’s quality unit must review batch records for each batch manufactured by the CMO before releasing the product for distribution. Batch record review is not a formality — it is a substantive quality check that confirms the manufacturing process was executed as documented, that all in-process and final test results are within specification, and that any deviations were documented and properly evaluated.

Performance metrics. Tracking CMO quality performance against defined metrics provides early warning of systemic issues before they escalate to regulatory observations or product failures. Useful metrics include batch rejection rate, deviation frequency by type and severity, CAPA cycle time, laboratory investigation frequency, and on-time delivery of batch records for review. Monthly or quarterly review of these metrics against defined thresholds creates a structured basis for escalation and for CMO performance conversations.

Change notification monitoring. The quality agreement establishes change notification requirements, but those requirements must be actively monitored. A CMO that implements equipment or process changes without notifying the MAH — whether due to oversight or deliberate omission — can create regulatory compliance gaps that surface during inspections. Periodic CMO audits and active communication between quality teams on both sides reduce this risk.

Annual product review contribution. The APR for a CMO-manufactured product requires data from the CMO — batch yields, process parameter trends, laboratory investigation data, returned goods data, and complaint information related to manufacturing. Establishing data collection requirements and timelines in the quality agreement, then actively managing the CMO’s data submission, is a recurring annual obligation for the MAH quality team.

Common CMO quality failure modes

Quality teams managing CMO relationships report several recurring failure patterns. Understanding these failure modes helps quality managers design oversight programs that address the most likely risk points.

Quality agreement gaps. Agreements that fail to address change control notification requirements, deviation communication timelines, or APR data obligations create oversight gaps that surface during inspections. Reviewing quality agreements against current regulatory guidance — FDA’s 2016 contract manufacturing guidance and EU GMP Chapter 7 — at least every three years identifies areas where the agreement needs updating.

Inadequate deviation visibility. CMOs manage their own deviation systems. Without explicit contractual requirements and active oversight, MAHs may learn about significant CMO deviations only through batch record review — after the batch has already been manufactured. Requiring immediate notification of critical deviations, with defined response timeframes, gives the MAH quality unit the ability to make real-time manufacturing decisions rather than retrospective release decisions.

Change control circumvention. CMOs that implement process changes, equipment replacements, or starting material supplier changes without notifying the MAH create regulatory exposure for both parties. This is most commonly discovered during MAH audits or regulatory inspections. Enforcing change notification requirements through audit verification — rather than assuming compliance — is the most effective mitigation.

Technical transfer incompleteness. Rushed technical transfers — common when commercial timelines are compressed — result in process specifications, analytical methods, or in-process controls that are not fully characterized at the CMO site. Manufacturing problems that emerge post-launch often trace to incomplete technical transfer rather than CMO capability gaps.

Laboratory method discrepancies. When the CMO uses different analytical methods than those validated for the product, test results may be comparable or may not — and the MAH may not know which. Method equivalency must be demonstrated during technical transfer and documented as part of the qualification record.

Multi-CMO networks: managing complexity at scale

Companies that use multiple CMOs — for different products, different dosage forms, or geographic manufacturing redundancy — face the same oversight obligations multiplied across each relationship. Quality teams managing five or ten CMO relationships simultaneously require systematic tools to maintain consistent oversight across the network.

Cloudtheapp’s supplier quality management application supports approved supplier list management, audit scheduling and documentation, deviation CAPA tracking across supplier relationships, and supplier corrective action request (SCAR) management with external collaboration features. The platform’s 60+ configurable applications allow quality teams to build CMO oversight workflows — qualification checklists, batch record review tracking, performance metric dashboards, and quality agreement status monitoring — without custom development or parallel spreadsheet systems.

If your organization manages CMO relationships and is evaluating how a unified QMS platform can improve oversight visibility, request a demo to see how Cloudtheapp supports CMO quality programs.

Conclusion

Pharmaceutical companies that manufacture through CMOs carry full regulatory responsibility for product quality on behalf of patients who will never know their medication was made at a third-party facility. The quality management challenge is maintaining meaningful oversight of a manufacturing operation that you depend on but do not control — through contractual requirements, systematic auditing, active batch record review, and structured performance monitoring.

The CMO relationships that consistently produce compliant products and clean inspection records are those where the MAH treats quality oversight as an ongoing operational discipline, not a periodic compliance exercise. Quality agreements that are actually enforced, audits that generate findings that are actually resolved, and performance metrics that are actually reviewed — these are what separate robust CMO quality programs from relationships that fail at the worst possible moment.

This post created by and appeared first on Cloudtheapp