This creates a quality management challenge that is fundamentally different from managing an in-house production facility. When you own manufacturing, your QMS controls the process directly. When a CMO manufactures your product, your QMS must extend its oversight into an organization that has its own systems, personnel, priorities, and regulatory obligations — without the authority to direct day-to-day operations the way you would with internal staff.

This article covers how pharmaceutical companies establish and maintain quality oversight of CMO relationships, what the regulatory framework requires, and how the common failure points in CMO quality management can be addressed through systematic oversight.

The regulatory framework for CMO oversight

FDA’s 21 CFR Part 211 (cGMP for finished pharmaceuticals) places quality responsibilities squarely on the holder of the approved drug application. Section 211.22 requires the Quality Control Unit to have the responsibility and authority to approve or reject drug products manufactured, processed, packed, or held under contract by another company. The fact that manufacturing occurred at a CMO’s facility does not reduce this obligation.

FDA’s guidance document on contract manufacturing arrangements for drugs, published in 2016 and updated in subsequent years, states that both the contract giver and the contract acceptor have distinct and shared responsibilities, and that these responsibilities must be clearly defined in a written quality agreement. The agency expects quality agreements to specify which party is responsible for each cGMP activity, including material release, in-process testing, batch record review, deviation management, change control, and annual product review.

EU GMP Chapter 7 (Outsourced Activities) takes the same position. The contract giver must audit the CMO before authorizing manufacturing and at appropriate intervals thereafter, must provide the CMO with all information necessary to carry out contracted operations correctly, and must ensure the CMO understands its quality obligations. The CMO must maintain a quality system appropriate to the scope of its operations and must not subcontract any contracted work to a third party without the prior consent and evaluation of the contract giver.

ICH Q10 (Pharmaceutical Quality System) provides the overarching framework. It establishes that the MAH is responsible for the quality of products throughout the product lifecycle, including products manufactured at CMO facilities, and that this responsibility cannot be delegated through a commercial arrangement.

The quality agreement: the foundation of CMO oversight

The quality agreement is the primary document that defines how quality responsibilities are allocated between the MAH and the CMO. It is a regulatory requirement under FDA and EU GMP guidance, and its absence — or its failure to address required topics — is a recurring inspection observation.

A complete quality agreement addresses the following areas at minimum:

Scope of manufacturing activities. The agreement must specify exactly what activities the CMO will perform — synthesis, formulation, filling, packaging, labeling, testing, or some combination. Ambiguity about scope creates gaps in oversight accountability.

Material responsibility. Who purchases, tests, releases, and manages starting materials and packaging components? Who is responsible for supplier qualification of the CMO’s own material suppliers? These responsibilities must be explicit, not implied.

Testing and release. The agreement must specify whether the CMO performs in-process testing, finished product testing, or both; what test methods are used; and who has final release authority. FDA expects the MAH’s quality unit to retain final release authority for products marketed in the United States.

Deviation and CAPA management. The agreement must establish how deviations occurring at the CMO facility are communicated to the MAH, who investigates them, what timeframes apply, and how corrective actions are implemented and verified. The MAH must have visibility into CMO deviations, not just their outcomes.

Change control. Manufacturing changes at the CMO — equipment changes, process changes, facility changes, material supplier changes — can have regulatory implications for the MAH’s drug application. The agreement must require the CMO to notify the MAH of all changes that could affect product quality or regulatory compliance, with timelines that allow the MAH to evaluate whether a regulatory filing is required before the change is implemented.

Audit rights. The MAH must have documented rights to audit the CMO facility, including the ability to conduct for-cause audits when quality issues arise. Audit frequency, access scope, and response obligations should be specified.

Annual product review. FDA requires annual product reviews (APRs) for each marketed drug product. The quality agreement must specify which party compiles the APR and what data the CMO must provide to support it.

Regulatory inspections. The agreement should specify how CMO inspections by regulatory authorities are handled, including notification requirements and the MAH’s right to be informed of inspection outcomes and any observations related to the contracted product.

CMO qualification: what to do before manufacturing begins

Selecting and qualifying a CMO is a risk-based supplier qualification process. FDA and EU GMP requirements for supplier quality management apply to CMOs as critical suppliers — the consequences of CMO failure extend directly to product quality and patient safety.

CMO qualification typically follows a structured sequence that mirrors the qualification of any critical supplier, but with additional depth required by the manufacturing nature of the relationship.

Capability assessment. Before auditing, confirm that the CMO has the equipment, technology, process expertise, and regulatory history necessary to manufacture the specific product. A CMO experienced in oral solid dosage forms may lack the aseptic processing capability required for injectables. Capability mismatches identified late in qualification — or after manufacturing has begun — are expensive and time-consuming to resolve.

Regulatory history review. Review the CMO’s FDA inspection history through the FDA Establishment Inspection Report (EIR) database and EU GMP compliance data. Consent decrees, import alerts, warning letters, and significant Form 483 observations against the CMO facility are material risk factors that must be evaluated and documented before qualification approval.

On-site audit. An on-site quality systems audit of the CMO is a regulatory expectation, not a best practice option. The audit must evaluate the CMO’s quality management system, GMP practices, deviation and CAPA management, change control processes, laboratory systems, and documentation controls. Audit findings must be documented, communicated to the CMO, and resolved before commercial manufacturing begins.

Technical transfer. Manufacturing a pharmaceutical product at a new facility requires a formal technical transfer — the systematic process by which process knowledge, specifications, analytical methods, and in-process controls are transferred to the CMO and demonstrated through engineering batches. Technical transfer documentation becomes part of the qualification record and must demonstrate that the CMO can reproduce the product within specification.

Qualification approval. The MAH’s quality unit must formally approve the CMO qualification before the first commercial batch is manufactured. This approval should be documented in the approved supplier list, with the qualification scope, approval date, next review date, and any approval conditions recorded.

Ongoing oversight: maintaining quality visibility after manufacturing begins

CMO qualification is the beginning of quality oversight, not the end. FDA’s expectations — and the practical requirements of managing product quality at arm’s length — require sustained oversight activities throughout the commercial relationship.

Periodic audits. The frequency of routine audits should reflect the criticality of the CMO relationship and the CMO’s performance history. A CMO manufacturing a single critical drug product with a history of deviations requires more frequent auditing than a well-performing CMO with a clean inspection record. Most companies audit critical CMOs annually or biannually, with for-cause audits triggered by significant quality events.

Batch record review. The MAH’s quality unit must review batch records for each batch manufactured by the CMO before releasing the product for distribution. Batch record review is not a formality — it is a substantive quality check that confirms the manufacturing process was executed as documented, that all in-process and final test results are within specification, and that any deviations were documented and properly evaluated.

Performance metrics. Tracking CMO quality performance against defined metrics provides early warning of systemic issues before they escalate to regulatory observations or product failures. Useful metrics include batch rejection rate, deviation frequency by type and severity, CAPA cycle time, laboratory investigation frequency, and on-time delivery of batch records for review. Monthly or quarterly review of these metrics against defined thresholds creates a structured basis for escalation and for CMO performance conversations.

Change notification monitoring. The quality agreement establishes change notification requirements, but those requirements must be actively monitored. A CMO that implements equipment or process changes without notifying the MAH — whether due to oversight or deliberate omission — can create regulatory compliance gaps that surface during inspections. Periodic CMO audits and active communication between quality teams on both sides reduce this risk.

Annual product review contribution. The APR for a CMO-manufactured product requires data from the CMO — batch yields, process parameter trends, laboratory investigation data, returned goods data, and complaint information related to manufacturing. Establishing data collection requirements and timelines in the quality agreement, then actively managing the CMO’s data submission, is a recurring annual obligation for the MAH quality team.

Common CMO quality failure modes

Quality teams managing CMO relationships report several recurring failure patterns. Understanding these failure modes helps quality managers design oversight programs that address the most likely risk points.

Quality agreement gaps. Agreements that fail to address change control notification requirements, deviation communication timelines, or APR data obligations create oversight gaps that surface during inspections. Reviewing quality agreements against current regulatory guidance — FDA’s 2016 contract manufacturing guidance and EU GMP Chapter 7 — at least every three years identifies areas where the agreement needs updating.

Inadequate deviation visibility. CMOs manage their own deviation systems. Without explicit contractual requirements and active oversight, MAHs may learn about significant CMO deviations only through batch record review — after the batch has already been manufactured. Requiring immediate notification of critical deviations, with defined response timeframes, gives the MAH quality unit the ability to make real-time manufacturing decisions rather than retrospective release decisions.

Change control circumvention. CMOs that implement process changes, equipment replacements, or starting material supplier changes without notifying the MAH create regulatory exposure for both parties. This is most commonly discovered during MAH audits or regulatory inspections. Enforcing change notification requirements through audit verification — rather than assuming compliance — is the most effective mitigation.

Technical transfer incompleteness. Rushed technical transfers — common when commercial timelines are compressed — result in process specifications, analytical methods, or in-process controls that are not fully characterized at the CMO site. Manufacturing problems that emerge post-launch often trace to incomplete technical transfer rather than CMO capability gaps.

Laboratory method discrepancies. When the CMO uses different analytical methods than those validated for the product, test results may be comparable or may not — and the MAH may not know which. Method equivalency must be demonstrated during technical transfer and documented as part of the qualification record.

Multi-CMO networks: managing complexity at scale

Companies that use multiple CMOs — for different products, different dosage forms, or geographic manufacturing redundancy — face the same oversight obligations multiplied across each relationship. Quality teams managing five or ten CMO relationships simultaneously require systematic tools to maintain consistent oversight across the network.

Cloudtheapp’s supplier quality management application supports approved supplier list management, audit scheduling and documentation, deviation CAPA tracking across supplier relationships, and supplier corrective action request (SCAR) management with external collaboration features. The platform’s 60+ configurable applications allow quality teams to build CMO oversight workflows — qualification checklists, batch record review tracking, performance metric dashboards, and quality agreement status monitoring — without custom development or parallel spreadsheet systems.

If your organization manages CMO relationships and is evaluating how a unified QMS platform can improve oversight visibility, request a demo to see how Cloudtheapp supports CMO quality programs.

Conclusion

Pharmaceutical companies that manufacture through CMOs carry full regulatory responsibility for product quality on behalf of patients who will never know their medication was made at a third-party facility. The quality management challenge is maintaining meaningful oversight of a manufacturing operation that you depend on but do not control — through contractual requirements, systematic auditing, active batch record review, and structured performance monitoring.

The CMO relationships that consistently produce compliant products and clean inspection records are those where the MAH treats quality oversight as an ongoing operational discipline, not a periodic compliance exercise. Quality agreements that are actually enforced, audits that generate findings that are actually resolved, and performance metrics that are actually reviewed — these are what separate robust CMO quality programs from relationships that fail at the worst possible moment.

This post created by and appeared first on Cloudtheapp

A quality agreement is a written contract between a life sciences company and an outsourced partner, such as a contract manufacturer, supplier, or testing laboratory, that defines each party's GMP responsibilities. Regulatory frameworks including the FDA's 2016 guidance on contract manufacturing, ICH Q10, and ISO 13485 clause 7.4 all point to quality agreements as a foundational requirement. Without one, organizations face undefined accountability, audit failures, and supply chain breakdowns. This article covers what a quality agreement must contain, when it is required, common gaps that lead to FDA 483 observations, and how to keep agreements current through structured version control.

What Is a Quality Agreement?

A quality agreement is a comprehensive written contract between two or more parties involved in outsourced activities, such as contract manufacturing, testing, packaging, or distribution, that formally defines how each party will fulfill its obligations under applicable Good Manufacturing Practice (GMP) regulations.

The FDA's 2016 guidance document, "Contract Manufacturing Arrangements for Drugs: Quality Agreements," describes it as an agreement that "defines and establishes each party's manufacturing activities in terms of how each will comply with cGMP." In plain terms, a quality agreement answers one critical question: when something goes wrong, or when a regulatory action is required, who is responsible?

The document is not a commercial contract. It focuses specifically on quality-related responsibilities: testing, release, change control, deviations, corrective actions, audits, documentation, and regulatory notifications. It sits alongside the commercial agreement but serves an entirely different function.

For pharmaceutical, biotechnology, and medical device companies, a quality agreement is one of the most consequential documents in the supplier quality management program. Its absence, or its poor maintenance, is a recurring theme in FDA inspections and warning letters.

The Regulatory Basis for Quality Agreements

FDA 21 CFR Part 211 and the 2016 Guidance

The FDA's 2016 guidance on contract manufacturing arrangements formalized the agency's expectations. It describes which cGMP activities each party should own, how ownership should be documented, and how to handle situations where both parties share a responsibility. FDA inspectors routinely cite its absence or inadequacy as a basis for FDA Form 483 observations. (FDA.gov)

ICH Q10

The International Council on Harmonisation's Q10 guideline, "Pharmaceutical Quality System," requires that a pharmaceutical quality system extend to all outsourced activities. ICH Q10 calls for documented agreements that define quality responsibilities and that are periodically reviewed to ensure they remain current and effective. (ICH.org)

ISO 13485 Clause 7.4

For medical device companies operating under ISO 13485:2016, clause 7.4 covers purchasing and supplier controls. Its requirements for documented supplier arrangements, including quality requirements, change notifications, and records of conformance, map directly onto what a quality agreement contains. (ISO.org)

When Is a Quality Agreement Required?

The short answer: any time a regulated activity is outsourced to a third party.

Contract Manufacturing Organizations (CMOs). If an external party manufactures, packages, labels, or tests a drug product or medical device on your behalf, a quality agreement is required.

Contract Testing Laboratories. Any third-party laboratory performing release testing, stability testing, environmental monitoring, or microbial testing on behalf of a regulated company requires a quality agreement. FDA 483 observations have been issued specifically for the absence of quality agreements with contract testing labs.

Raw Material and Component Suppliers. High-risk or critical suppliers, including those providing components that directly contact the product or affect patient safety, warrant formal quality agreements.

Distributors. Companies that store or distribute finished drug products or medical devices under regulated conditions should have quality agreements covering handling, storage, documentation, and incident reporting.

What a Quality Agreement Must Contain

An effective quality agreement defines responsibilities with enough specificity to prevent disputes and enable compliance. Standard elements include:

Scope and purpose. A clear description of the products or services covered, the applicable regulatory standards, and the purpose of the agreement.

Responsibilities matrix. A detailed allocation of who owns each cGMP activity, including manufacturing, testing, release, labeling, storage, and shipment. Each activity should be assigned to the Owner, the Contract Facility, or jointly owned, with no ambiguity.

Change control. A section specifying how changes at either party are communicated and approved before implementation. This connects directly to the process change notification process each party must maintain.

Deviation and CAPA management. Who investigates deviations at the contract facility? Who approves the root cause investigation and the resulting deviation CAPA actions? The quality agreement must answer these questions explicitly.

Regulatory notifications. Timelines for notifying the owner of regulatory inspections, warning letters, import alerts, or significant compliance findings at the contract facility.

Audit rights. The owner's right to conduct for-cause or periodic audits of the contract facility, including notice requirements and access to records.

Data integrity and record access. Who maintains batch records, testing records, and electronic data? How will the owner access records in the event of a dispute, investigation, or regulatory inspection?

Term and termination. Duration of the agreement, renewal provisions, and exit provisions covering what happens to in-process batches, records, and materials if the relationship ends.

Common Gaps That Lead to FDA 483 Observations

Outdated documents. A quality agreement signed three years ago that has never been reviewed since. The CMO has changed its manufacturing process, updated its equipment, or changed personnel, none of which triggered a formal review or amendment to the agreement.

Missing coverage for contract labs. Many companies maintain quality agreements with their CMOs but fail to execute them with the contract testing laboratories those CMOs use.

Vague responsibility assignments. Language such as "the parties will cooperate" or "as appropriate" in the responsibilities matrix is not sufficient. Inspectors look for unambiguous ownership of each cGMP task.

No change notification provisions. Agreements that do not define how and when the contractor must notify the owner of changes to processes, equipment, or facilities leave the owner unable to assess impact before the change occurs.

No periodic review schedule. Agreements with no defined review frequency are effectively frozen documents that quickly become obsolete.

How to Maintain Quality Agreements with Version Control

A quality agreement that is signed once and filed away provides little ongoing compliance value. These documents require a structured lifecycle: creation, approval, periodic review, amendment, and retirement.

Establish a review cadence. The standard industry practice is an annual review of active quality agreements, with triggered reviews any time a significant change occurs at either party. ICH Q10 explicitly calls for periodic review of outsourced activity agreements.

Tie amendments to change control. Any change at the contract facility that affects a responsibility defined in the quality agreement should initiate a formal amendment.

Maintain a version history. Each version of a quality agreement should carry a version number, effective date, a summary of changes from the prior version, and signature lines for both parties.

Align with your document management system. Quality agreements are controlled documents. They belong in the same document control system as SOPs, validation protocols, and batch records.

Cloudtheapp's Documents app provides a centralized, FDA-validated document management environment where quality agreements can be drafted, reviewed, approved with electronic signatures, version-controlled, and automatically archived. Periodic review tasks can be assigned to responsible owners with due-date notifications, eliminating the risk of agreements becoming stale without detection.

Manage Quality Agreements at Scale with Cloudtheapp

For pharmaceutical, biotech, and medical device teams managing a complex supplier network, quality agreements are not a one-time task. They are living documents that require active governance: creation, approval, periodic review, amendment tracking, and integration with deviation management, change control, and SCAR processes.

Cloudtheapp's AI-powered, FDA-validated Quality Management platform gives life sciences organizations a single environment to manage the entire quality agreement lifecycle alongside every related quality process. From supplier qualification to document control to CAPA, every activity connects.

Ready to see how Cloudtheapp can bring structure and control to your supplier quality program? Request a Demo at cloudtheapp.com.

Conclusion

A quality agreement is more than a compliance checkbox. It is the operational backbone of every outsourced quality relationship in a regulated life sciences organization. When it is well-written, current, and integrated into a broader quality management system, it protects the organization from regulatory risk, supply chain disruptions, and accountability gaps. When it is absent, outdated, or vague, it becomes one of the most common sources of FDA 483 observations and warning letters.

This post created by and appeared first on Cloudtheapp