What Contract Manufacturing GMP Audit Services Involve
Contract manufacturing GMP audit services assess contract manufacturing organizations against the GMP requirements that apply to the products they make on your behalf. The goal is to confirm that the CMO’s facilities, systems, and people meet the same standards as your own operation. When you outsource manufacturing, you do not outsource responsibility. Regulators still hold you accountable for the product.
That accountability is why CMO audits matter. A CMO may pass a paper review and still have weaknesses that only an audit will reveal. Our audits look at the full operation, from facility conditions to batch records to how changes are communicated back to you. They also look at the relationship itself, because a CMO that does not communicate openly is a risk even if its systems are sound.
Outsourcing has become the norm in the pharmaceutical industry, and regulators know it. They expect contract givers to have real oversight, not just a signed agreement. An audit program is the clearest evidence that oversight is real.
Regulatory Requirements for CMO Oversight
EU GMP Chapter 7 on Outsourced Activities
Chapter 7 of EudraLex Volume 4 states that the contract giver is fully responsible for ensuring that outsourced activities comply with GMP. An audit of the contract acceptor is a core control in meeting that responsibility. The quality agreement and the audit together form the backbone of oversight.
FDA 21 CFR 211 and Contractor Responsibilities
The FDA holds the contract giver accountable for contractor compliance. Documented oversight and audit evidence are expected. Investigators will ask how you know your CMO is compliant, and the answer needs to be more than a signed quality agreement. Data integrity expectations under 21 CFR 211.68 also extend to records the CMO generates and shares with you.
ICH Q7 and Contract Manufacturing of APIs
ICH Q7 requires written agreements and periodic audits of contract manufacturers. PIC/S Part II is equivalent to ICH Q7, so the same expectations apply where PIC/S standards are used.
ICH Q10 and External Provider Management
ICH Q10 treats external providers as part of the pharmaceutical quality system. Their performance must be monitored and managed, and audits are part of that management.
Health Canada and MHRA Considerations
Health Canada GUI-0001 requires raw material specifications to conform to the marketing authorization and analytical methods to give accurate and consistent results, which are things a CMO must be able to demonstrate. The MHRA Orange Guide adds material transfer controls and capacity monitoring to the list of hot topics, both of which matter when you rely on a CMO.
Annex 1 for Sterile CMOs
If your CMO makes sterile products, the revised Annex 1 requirements apply. Contamination control strategy, aseptic process simulation, and gowning qualification should all be part of the audit. Section 8.123 for lyophilisers took effect in August 2024.
Our CMO Audit Process
Contract and Quality Agreement Review
We review the quality agreement to confirm responsibilities are clear and complete. Gaps in the agreement often show up later as gaps in practice. We also check whether the agreement reflects current operations.
Risk Based Audit Planning
We plan the audit around the products made, the processes used, and the history of the relationship. Higher risk products and processes get deeper scrutiny. We also consider the CMO’s inspection history where available.
On Site or Remote CMO Audits
Most CMO audits benefit from an on site visit. Remote audits can cover documentation and systems but may miss facility and practice issues. We recommend on site for first audits and for sterile operations.
CAPA Verification and Follow Up
We help you evaluate the CMO’s corrective action plan and can follow up to confirm implementation. A CMO that responds well to findings is a better partner than one that resists them.
What We Assess at CMOs
Quality Agreements and Implementation
We check whether the quality agreement is complete and whether it is actually followed in practice. An agreement that sits in a drawer is not oversight.
Change Control Notification and Approval
Change control is a frequent weak point in outsourced arrangements. Changes made at the CMO must be communicated to you and approved where required. We check whether that communication works in practice.
Deviation and Complaint Handling
We check how deviations and complaints are investigated, whether root cause analysis is thorough, whether CAPA is effective, and whether you are informed as required.
Batch Record Review and Release Timelines
We review batch record completeness, review timelines, release documentation, and whether release happens within agreed timeframes.
Capacity and Business Continuity
We assess whether the CMO has the capacity to meet your demand and whether business continuity planning is in place. MHRA guidance treats capacity monitoring as a hot topic, and for good reason.
Technical Capability for Products
We check whether the CMO has the technical capability to make your products consistently, including equipment, processes, and analytical support.
Subcontractor and Raw Material Supplier Oversight
We review how the CMO manages its own subcontractors and raw material suppliers, because their weaknesses become your weaknesses.
Facility and Equipment Suitability
We check whether the facility and equipment are suitable for the products made, including HVAC, water systems, and cleaning validation.
Documentation and Data Integrity
We review batch records, logbooks, and electronic records for accuracy and completeness. Data integrity controls are part of this review, including audit trails and access controls.
Introducing GxP Cellators for CMO Audits
GxP Cellators audits CMOs on your behalf to verify they meet your standards. Our CMO audits assess quality agreements and implementation, change control notification and approval, deviation and complaint handling, investigation depth and root cause analysis, CAPA effectiveness, batch record completeness, batch record review timelines, release documentation, capacity to meet demand, technical capability for products, business continuity planning, subcontractor oversight, and raw material supplier oversight.
We bring coverage across FDA, EMA, Health Canada, MHRA, WHO, and PIC/S GMP frameworks, with a global presence that includes Saskatchewan, Calgary, Toronto, North Carolina, Indiana, and Frankfurt. Our auditors have regulatory inspection and industry quality experience, and we deliver clear, prioritized reports with practical remediation guidance.
We also provide pre approval inspection readiness audits for facilities and products that will be inspected before approval, for cause audits triggered by complaints, adverse event reports, regulatory observations, or significant deviations, and follow up and CAPA verification audits to confirm that issues have been resolved.
Protect Your Outsourced Manufacturing
Learn more at https://www.gxpcellators.com/gmp-auditing/. Contact or use https://www.gxpcellators.com/contact/ to discuss your CMO portfolio.
Frequently Asked Questions About Contract Manufacturing GMP Audits
How often should we audit our CMO?
First audits are usually done before the first commercial batch. After that, most companies audit every two to three years, or more often for high risk products or when issues arise.
Can you audit a CMO on our behalf?
Yes. We audit CMOs on behalf of the contract giver and report directly to you. We can also attend audits with your team if you prefer a joint approach.
What should a quality agreement include?
A quality agreement should define responsibilities for production, quality control, deviations, changes, complaints, recalls, and audits. It should also specify communication channels and timelines, and it should reflect current operations.
How do you check whether a CMO communicates changes properly?
We review change records and compare them with your records. We also interview staff on both sides to see whether communication works in practice, not just on paper. MHRA expects prospective assessment of changes, so we check for that.
Do you audit sterile CMOs against Annex 1?
Yes. Sterile CMO audits include Annex 1 requirements, including contamination control strategy, aseptic process simulation, and gowning qualification. Lyophilisers are assessed against Section 8.123.
What if the CMO is in another country?
We audit CMOs globally and handle logistics, language, and local requirements. Our presence spans North America and Europe, with partner support for other regions.
How do you assess CMO capacity and business continuity?
We review capacity data, demand forecasts, and business continuity plans. We also check whether the CMO has experienced capacity constraints and how they were managed.
How do I request a CMO audit?
Email or use https://www.gxpcellators.com/contact/. Our services are described at https://www.gxpcellators.com/gmp-auditing/.
