CMO / CDMO managementContract Manufacturing Organisation / Contract Development & Manufacturing Organisation

• Sponsor (a.k.a. Marketing Authorisation Holder, NDA/BLA holder, brand owner, Specification Setter) — owns the product, the regulatory submission, the spec, and the legal accountability.
• CMO — contract manufacturer; executes commercial GMP manufacture per the sponsor's process + spec.
• CDMO — same as CMO plus development services (formulation, process development, scale-up, analytical method development, clinical-supply manufacture).
• Many large global players (Lonza, Catalent, WuXi, Patheon/Thermo, Recipharm, Samsung Biologics) operate as full-spectrum CDMOs.

• ICH Q7 Chapter 16 (API) — contract manufacturer responsibilities, written agreement, evaluation, audit, no subcontracting without sponsor approval.
• EU GMP Chapter 7 (Outsourced Activities) — Contract Giver remains responsible; written contract; defined responsibilities; QP release retained.
• 21 CFR 200.10(b) — both sponsor and CMO are responsible for compliance with US drug law; FDA may inspect either.
• FDA 2016 Quality Agreement guidance — non-binding but defines best-practice content; FDA inspectors routinely cite missing or weak QAs as a 483 observation.
• PIC/S PI 042 — internationally harmonised expectations across PIC/S regulators.

The QA is the GMP-specific document distinct from (and superseding, on quality matters) the commercial Master Services Agreement. FDA 2016 guidance defines minimum content:

• Scope — products, presentations, sites, services in scope.
• Responsibilities matrix (RACI) — every GMP activity assigned to sponsor / CMO / both, including raw-material qualification, in-process control, batch record review, release, stability, complaint handling, recall, regulatory reporting, retained samples, change control, deviation handling, supplier audits.
• Manufacturing controls — process, equipment, environmental monitoring, calibration, validation, training.
• Quality controls — testing methods, sampling, release criteria, OOS handling.
• Documentation + records — batch records, certificates, audit trails, retention periods.
• Change control — notification + approval thresholds; sponsor approval mandatory for any change affecting filed information.
• Subcontracting — explicit consent required for further sub-tier outsourcing.
• Right to audit + right to access records; right to be present at agency inspections; notification timelines for 483 / Warning Letter / Form 482.
• Term + termination — including handover of master batch records, retained samples, stability inventory.

• Initial qualification — capability questionnaire, paper review, GAP analysis vs sponsor SOPs, on-site qualification audit; gap CAPAs closed before commercial work starts.
• Tech-transfer — process / analytical / packaging knowledge handover; engineering runs; PPQ at CMO under sponsor protocol; comparability if scale or equipment differs from clinical lots.
• Routine oversight — periodic on-site audits (typically 12–24 month frequency, risk-based), quarterly business reviews including KPI scorecard, ongoing review of CMO batch records before sponsor release, annual product review participation, complaint + deviation co-investigation.
• Exit — orderly disengagement: master batch records returned, retained samples transferred, stability inventory handed over, regulatory filings updated to remove the CMO site.

Typical CMO performance KPIs reviewed quarterly:

• On-time-in-full (OTIF) batch delivery vs schedule.
• Right-first-time (RFT) — % batches released without deviation, OOS or re-work.
• Cycle time — receipt of materials to release.
• Deviation rate + repeat-deviation rate.
• Investigation closure time (target 30 days).
• Complaint rate from the field traced back to CMO.
• Inspection outcomes (483s, Warning Letters, MHRA / EMA inspection results).
• Training completion + turnover at the CMO.

Scorecard trends feed the annual CMO requalification decision and any tier-rating change.

• CMO release + sponsor secondary release — CMO QA releases against the master batch record; sponsor QA performs an independent release review before market distribution.
• Sponsor-only release — CMO performs all manufacturing + QC but does not release; the sponsor QA reviews the executed batch record and releases.
• QP release (EU) — the legally responsible Qualified Person at the MAH (or at the contracted QP site) performs the Article 51 batch certification before placement on the EU market. The CMO QA's release is necessary but not sufficient.

FDA establishment registration + drug listing (21 CFR 207) requires every facility involved in manufacture (including CMOs) to be listed under the relevant NDA / ANDA / BLA. EU MA dossier Module 3.2.A.1 lists every manufacturing site by activity. A CMO change requires a regulatory filing (Type IB / Type II in EU; CBE-30 or PAS in US, depending on impact). Sponsor change-control workflow MUST capture the filing-trigger assessment before any CMO change is implemented.

• Quality Agreement = commercial MSA with quality clauses bolted in — auditors will reject.
• RACI gaps — "both" left unresolved on critical items so neither party actually executes.
• Sub-tier CMO not disclosed; sponsor's site list out of date with the regulatory filing.
• Audit frequency relaxed under cost pressure; tier-rating drift uncaught.
• CMO change-control notification thresholds set so high that sponsor learns about a like-for-like equipment swap only at the next annual review — and discovers it required a filing.
• Tech-transfer comparability scope too narrow — process variant accepted, regulatory filing not updated.
• Field complaint root cause assigned to CMO without joint investigation evidence.
• Inspection notification clock blown — sponsor finds out from FDA's public 483 release.