Managing CMOs through SLAs
The preselection assessment verifies that the CMO properly maintains electronic records related to the manufacturing batches
and controls and has adequate IT infrastructure, systems, and communications in place. Once the preselection assessment is
completed and a CMO is selected, the sponsor should establish SLAs for ongoing monitoring and improvement and negotiate the
Developing SLA-based contracts is the most critical and valuable work that a sponsor will conduct during the outsourcing engagement.
SLA-based contracts are the only way to ensure that the sponsor and the service provider (CMO) have a clear understanding
of the services required and being provided.
In the manufacturing, QC, and IT areas, record requirements are specified within the following regulations:
21 CFR Part 210 "Current Good Manufacturing Practice in Manufacturing, Processing, Packing, or Holding of Drugs; General" (3)
21 CFR Part 211 "Current Good Manufacturing Practice for Finished Pharmaceuticals" (4)
21 CFR Part 58 "Good Laboratory Practice for Nonclinical Laboratory Studies" (5)
21 CFR Part 11 "Electronic Records; Electronic Signatures; Final Rule" and its companion guidance "Electronic Records; Electronic
Signatures—Scope and Application" Guidance for Industry, Part 11 (6, 7).
The failure to properly maintain the required records is a major source of regulatory noncompliance. IT good practices and
standards can increase the effectiveness of the CMO's automated systems and applications and reduce compliance risks associated
with records creation, maintenance, and retention. Therefore, the sponsor can reduce its risk by including several IT-related
requirements as part of an SLA-based contract.
The sponsor can require the CMO to establish a plan and timeline for the remediation of substandard systems that pose a compliance
risk and substandard practices that do not meet industry or regulatory expectations.
The sponsor can require the CMO to ensure that its IT infrastructure supporting business areas is qualified to meet industry
and regulatory expectations. Meeting expectations includes the establishment of related IT procedures or work instructions
to install, maintain, and support the infrastructure components.
The sponsor can require the CMO to ensure adequate management of change to the automation and systems configurations that
have been agreed to at the initiation of the contract. Management can be demonstrated by establishing documented procedures
for the management of:
- Formal requesting of a change
- Approval of a requested change by appropriate representatives of the sponsor and the CMO
- Documented evidence of the implementation and testing or verification of the change
- Tracking of all changes applied over the life of the contractual agreement.
Through periodic audits by a representative, the sponsor can monitor the CMO's continuous-improvement and compliance efforts.
Areas to be monitored may include the following:
- Status of CAPA plans and activities related to required remediations
- Number or percent of CAPA items closed since the last audit or in a specified period of time
- Number or percent of remediation projects that are tracking to schedule
Percent of qualified IT infrastructure
- Percent of CMO employees trained in good IT practices, GXP awareness, good documentation practices, and applicable CMO policies
The sponsor can require the CMO to establish documented processes and procedures for the qualification and validation of GXP-related
automated equipment, automated laboratory instrumentation, and application or business systems. This documentation might include
Table II: Recommended procedures for the support of qualification and validation.
A policy and rationale for qualification and validation
- A process or tool to help determine whether qualification or validation is necessary. This may include a GXP-assessment process
or a risk-assessment process.
- Standard processes or procedures to support qualification and validation (see Table II).
The sponsor may also require the CMO to establish a business-continuity plan and to agree on financial penalties it will pay
for failed FDA audits.
The contract should provide for periodic, unannounced audits by the sponsor for the life of the agreement. In addition, the
sponsor should insist on timing regular audits before specific milestones such as regulatory submissions or product launches.
SLAs should establish that the CMO will maintain adequate product supplies to ensure that clinical-trial or other batch quantities
SLAs should establish detailed descriptions of the type and frequency of electronic data, records, and reports that will be
provided to the sponsor. The failure to establish the timing of these reports in the SLA up-front often results in the sponsors
paying extra for electronic reports that should have been part of the basic agreement or receiving electronic files that are
incompatible with the sponsor's IT systems.
Pharmaceutical and biopharmaceutical companies will continue to take advantage of the economic benefits of outsourcing the
manufacturing of their clinical supplies and commercialized products. The goal of the contract manufacturing organization
selection process is to find a stable business partner that manufactures the sponsor's product according to specifications,
satisfies regulatory requirements for product manufacturing and control, and provides the sponsor with the information, data,
and records needed to sustain the business relationship.
A thorough information technology assessment of the CMO candidates should be considered part of the standard project management
for the CMO-candidate identification and selection process. Early identification of the CMO's IT capabilities and practices
will enable the sponsor to avoid common problems such as erratic availability and retention of electronic data and batch-related
information, incompatibility of CMO and sponsor information systems and data, hidden costs for upgrades of CMO technology
components, and failure to meet regulatory expectations.
Working with a CMO business partner that has implemented and uses industry good practices for IT processes and controls will
reduce the sponsor's compliance risks, provide the sponsor with the data and information they need, and allow the sponsor
to focus on the core business functions that the sponsor has chosen to pursue.
Kathleen A. Pelley* is head of the life-sciences quality practice, and John Postle is head of the life-sciences enterprise practice at Court Square Group, 1350 Main St., 5th floor, Springfield, MA 01103,
tel. 215.340.5779, firstname.lastname@example.org
*To whom all correspondence should be addressed.
1. FDA, General Principles of Software Validation; Final Guidance for Industry and FDA Staff (Rockville, MD, 2002).
2. FDA, Pharmaceutical cGMPs for the 21st Century: A Risk-Based Approach (Rockville, MD, 2002).
3. International Organization for Standardization, "ISO–IEC 20000-1:2005 IT Service Management: Specification for Service
Management" (Geneva, 2005).
4. ISO, "ISO–IEC 20000-2:2005 IT Service Management: Code of Practice for Service Management" (Geneva, 2005).
5. ISO, "ISO 9001:2000 Quality Management Systems—Requirements" (Geneva, 2000).
6. Information Systems Audit and Control Association, "COBIT 4.1 Control Objectives for Information and Related Technology"
(Rolling Meadows, IL, 2007).
7. FDA, "Current Good Manufacturing Practice in Manufacturing, Processing, Packing, or Holding of Drugs; General," 21 CFR Part 210 (Rockville, MD, 2007).
8. FDA, "Current Good Manufacturing Practice for Finished Pharmaceuticals," 21 CFR Part 211 (Rockville, MD, 2007).
9. FDA, "Good Laboratory Practice for Nonclinical Laboratory Studies," 21 CFR Part 58 (Rockville, MD, 2007).
10. FDA, "Electronic Records; Electronic Signatures; Final Rule," 21 CFR Part 11 (Rockville, MD, 2007).
11. FDA, "Electronic Records; Electronic Signatures—Scope and Application," Guidance for Industry, Part 11 (Rockville, MD,