Outsourcing manufacturing does not outsource accountability. When a batch fails, a deviation delays release, or a regulator questions process control, the sponsor remains responsible for product quality, supply continuity, and the decisions that support them.
Managing a CDMO relationship requires active oversight and governance, not vendor administration. This lifecycle-long discipline connects technical operations, quality assurance, regulatory strategy, and program leadership. Without it, emerging biotechs can lose critical development time, while established sponsors can put commercial supply and inspection readiness at avoidable risk.
This guide outlines a practical CDMO governance model, including decision rights, CDMO quality oversight, performance scorecards, Person-in-Plant support, and escalation practices. The framework can be scaled for lean development teams or complex global manufacturing networks, helping sponsors identify issues early and maintain alignment as programs progress.
It begins with the operating model that turns sponsor accountability into consistent, timely action across functions and sites.
How Sponsor Accountability Drives CDMO Oversight and Governance
Who owns a batch decision when manufacturing is outsourced? A CDMO can perform production, testing, and investigations, but it cannot assume the sponsor’s accountability for product quality or program risk. Under 21 CFR 211.22, the CDMO’s Quality Control Unit must have authority to approve or reject drug products. Commercial urgency cannot displace that authority.
Name five sponsor owners: CMC/Technical Operations for process decisions; Sponsor QA for quality-system oversight; Regulatory for filing commitments; Supply Chain for inventory and capacity; and an executive sponsor for unresolved business-risk decisions.
Use a RACI (Responsible, Accountable, Consulted, and Informed) to document decisions:
| Decision | Sponsor Accountable | CDMO Role | Consulted/Informed |
|---|---|---|---|
| Batch disposition | Sponsor QA | Quality Unit: site disposition authority | CMC consulted |
| Major changes | CMC/Technical Operations | Proposes and assesses | QA and Regulatory consulted |
| Deviations | Sponsor QA | Investigates | CMC and Regulatory consulted |
| Capacity decisions | Supply Chain | Consulted | Executive sponsor informed |
| Regulatory commitments | Regulatory | Provides evidence | Sponsor QA informed |
A Three-Tier CDMO Governance Model for Faster, Clearer Decisions
A batch is approaching manufacture, but a technical data gap, an open deviation, and an unconfirmed material delivery are competing for attention. A three-tier governance model keeps routine execution issues out of executive meetings while making sure material risks receive timely attention.
| Governance Tier | Role and Meeting Cadence |
|---|---|
| Tier 1: Joint Project Team | Meets weekly, or twice weekly during active manufacturing. Technical operations, project management, quality, supply chain, and relevant CDMO subject matter experts address:
|
| Tier 2: Joint Operations Committee | Meets monthly to review program health and performance scorecards. Functional leaders resolve:
|
| Tier 3: Joint Steering Committee | Meets quarterly for strategic decisions, including:
Executive sponsors should attend when decisions affect program priorities or commercial commitments. |
Unresolved Tier 1 items move to Tier 2. A material quality, supply, or regulatory risk should trigger an ad hoc executive escalation within 48 to 72 hours. Quality authority and the quality agreement’s decision rights must remain protected throughout.
Document the model in a written charter with named decision owners, quorum requirements, pre-read deadlines, action logs, and a defined deadlock path.
Why a Quality Agreement, Not the MSA, Prevents CDMO Quality Disputes
A detailed MSA cannot resolve a GMP dispute when it never assigns the underlying quality responsibilities. The MSA governs commercial and legal terms, including pricing, liability, intellectual property, and termination. The Quality Agreement establishes how sponsor and CDMO will fulfill GMP responsibilities in daily operations, consistent with FDA guidance on contract manufacturing quality agreements.
It should identify accountable parties and escalation paths for:
- Deviation notification, investigations, CAPA, and OOS/OOT results
- Change control and regulatory-impact assessments
- Batch record review, batch disposition, and sponsor release
- Complaints, recalls, audit access, training, record retention, subcontracting, and inspection communications
Replace ‘promptly notify’ with measurable commitments: notify the sponsor of a critical deviation or potential patient-safety issue within 24 hours, provide an investigation plan within an agreed number of business days, and set a target date for the final report.
Define change tiers and decision rights. Critical changes that could affect the validated state, product quality, or regulatory commitments require prior sponsor approval. Moderate changes require advance notice and documented assessment. Minor internal changes that do not affect the agreed control strategy can be reported periodically.
Teams developing or remediating governance can draw on Quality & Compliance support.
Build a CDMO Scorecard That Detects Risk Before a Crisis
Commercial Right-First-Time (RFT) batch performance or On-Time, In-Full (OTIF) delivery below 95% should prompt action before supply misses, repeat deviations, or release delays become routine. Governance meetings need leading and lagging indicators, not status updates alone.
Build a balanced scorecard across quality and operations:
- RFT batch performance and OTIF delivery
- Deviation notification timeliness and closure aging
- OOS investigation and batch-release cycle times
- CAPA effectiveness
Use 95% RFT and OTIF as starting targets, then set yellow and red bands for product phase, patient risk, manufacturing complexity, and supply strategy. A clinical program may warrant different bands than a sole-source commercial product.
Document each metric’s definition, source, owner, calculation, and reporting cadence in the quality agreement or governance charter. Include pause-the-clock rules if sponsor review affects investigation or CAPA closure.
For a red metric, require a root-cause review, recovery plan, named owner, and due date. Escalate repeated red results, missed recovery dates, or material quality risk from Tier 2 to Tier 3. This supports ICH Q10 management review and continual improvement.
Use a Person-in-Plant Model Without Crossing GMP Boundaries
During a PPQ campaign, a sponsor representative notices an unexpected hold time and an operator question requiring context. A Person-in-Plant (PIP) provides visibility during technology transfer, engineering runs, PPQ, and high-risk campaigns, but serves as eyes and ears, not hands.
The PIP observes, asks questions through the agreed CDMO channel, records context in an observation log, and joins debriefs. They do not operate equipment, direct operators, alter GMP records, or initiate a deviation.
Before deployment, document requirements in the Quality Agreement or MSA, including site onboarding, gowning qualification, health requirements, confidentiality, access limits, and the prohibition on unauthorized recording devices.
On shift, a CDMO host or escort should accompany the PIP in defined observation zones. Use shift handovers and a short end-of-day debrief. For an immediate concern, notify the designated CDMO lead; the CDMO begins formal deviation handling, and Sponsor QA receives notifications under the Quality Agreement.
For broader planning, see our guide to CDMO technology transfer.
Prepare Your CDMO Governance Model Before the Next Critical Batch
Reliable CDMO relationships are established before a campaign begins, not during a deviation, delayed release, or supply disruption. The goal is a governance system that connects accountability, quality controls, performance data, and on-site visibility so risks reach the right decision-makers early.
Use this pre-batch readiness sequence:
- Assign sponsor owners and decision rights across Technical Operations, QA, Regulatory, Supply Chain, and executive leadership.
- Approve JPT, JOC, and JSC charters that define meeting cadence, quorum, action tracking, and escalation paths.
- Finalize the Quality Agreement before critical GMP activity with clear notification timelines, change-control tiers, investigation expectations, and batch-release responsibilities.
- Launch a phase-appropriate KPI scorecard and review it monthly, including recovery actions for metrics that fall below target.
- Deploy a Person-in-Plant only when campaign risk justifies it, with documented access, observation boundaries, and communication rules.
Treat governance as dynamic rather than fixed. Increase oversight during technology transfer, PPQ, commercial launch, recurring deviations, capacity constraints, or inspection findings. These pressure points test whether the operating model can turn information into timely decisions.
Teams reassessing a current partner or preparing to select one can explore CDMO selection and management support.
Frequently Asked Questions
Can a sponsor delegate final quality and regulatory responsibility to a CDMO?
No. A sponsor can allocate manufacturing, testing, investigation, and documentation activities to a CDMO, but it remains accountable for product quality, regulatory commitments, and effective oversight. The CDMO Quality Unit retains site authority to approve or reject product under GMP requirements. Sponsor QA therefore needs documented access to records, escalation rights, and approval controls.
How often should sponsor and CDMO teams meet?
Meeting frequency should match the program’s phase, manufacturing activity, and risk level. A practical baseline is weekly working-team meetings, monthly operational reviews, and quarterly strategic governance meetings. Increase the cadence during technology transfer, PPQ, active manufacturing campaigns, significant deviations, supply constraints, or inspection preparation.
What should be in a CDMO quality agreement?
A CDMO quality agreement should clearly assign GMP responsibilities and define notification timelines. It should address deviations, OOS and OOT results, CAPA, change control, batch disposition, record retention, audits, subcontractor oversight, recalls, and inspection communications. Measurable commitments, such as 24-hour notification for critical events, prevent ambiguity during urgent situations.
What are the most important CDMO quality oversight KPIs?
Key CDMO oversight KPIs include Right-First-Time batch performance, deviation notification and closure timing, OOS investigation cycle time, CAPA effectiveness, batch-release timing, and On-Time, In-Full delivery. Metric definitions, data sources, and trend reviews are as important as the targets themselves. Repeated performance deterioration should trigger a root-cause review and a documented recovery plan.
What can a Person-in-Plant do on the GMP floor?
A Person-in-Plant can observe manufacturing activities, ask questions through approved site channels, document non-GMP observations, and participate in shift or campaign debriefs. They cannot operate equipment, direct CDMO operators, modify GMP records, or bypass the site’s deviation process. The CDMO must formally assess and document any potential deviation.
When should a sponsor escalate a CDMO issue to executive governance?
Executive governance is appropriate when an issue creates material patient, product-quality, regulatory, supply, or financial risk that operations cannot resolve. Common triggers include repeated KPI failures, a critical deviation, unresolved capacity conflicts, major scope or cost disputes, and significant inspection actions. Escalation should include a clear decision request, risk assessment, owner, and recovery timeline.
