Information-Technology Criteria in CMO Selection and Management - Pharmaceutical Technology

Latest Issue

Latest Issue
PharmTech Europe

Information-Technology Criteria in CMO Selection and Management
A sponsor company must investigate the manufacturing automation and systems, laboratory automation and systems, information-technology infrastructure, and business applications of each potential contract manufacturing organization.

Pharmaceutical Technology

Managing CMOs through SLAs

The preselection assessment verifies that the CMO properly maintains electronic records related to the manufacturing batches and controls and has adequate IT infrastructure, systems, and communications in place. Once the preselection assessment is completed and a CMO is selected, the sponsor should establish SLAs for ongoing monitoring and improvement and negotiate the final contract.

Developing SLA-based contracts is the most critical and valuable work that a sponsor will conduct during the outsourcing engagement. SLA-based contracts are the only way to ensure that the sponsor and the service provider (CMO) have a clear understanding of the services required and being provided.

In the manufacturing, QC, and IT areas, record requirements are specified within the following regulations:
  • 21 CFR Part 210 "Current Good Manufacturing Practice in Manufacturing, Processing, Packing, or Holding of Drugs; General" (3)
  • 21 CFR Part 211 "Current Good Manufacturing Practice for Finished Pharmaceuticals" (4)
  • 21 CFR Part 58 "Good Laboratory Practice for Nonclinical Laboratory Studies" (5)
  • 21 CFR Part 11 "Electronic Records; Electronic Signatures; Final Rule" and its companion guidance "Electronic Records; Electronic Signatures—Scope and Application" Guidance for Industry, Part 11 (6, 7).

The failure to properly maintain the required records is a major source of regulatory noncompliance. IT good practices and standards can increase the effectiveness of the CMO's automated systems and applications and reduce compliance risks associated with records creation, maintenance, and retention. Therefore, the sponsor can reduce its risk by including several IT-related requirements as part of an SLA-based contract.

The sponsor can require the CMO to establish a plan and timeline for the remediation of substandard systems that pose a compliance risk and substandard practices that do not meet industry or regulatory expectations.

The sponsor can require the CMO to ensure that its IT infrastructure supporting business areas is qualified to meet industry and regulatory expectations. Meeting expectations includes the establishment of related IT procedures or work instructions to install, maintain, and support the infrastructure components.

The sponsor can require the CMO to ensure adequate management of change to the automation and systems configurations that have been agreed to at the initiation of the contract. Management can be demonstrated by establishing documented procedures for the management of:

  • Formal requesting of a change
  • Approval of a requested change by appropriate representatives of the sponsor and the CMO
  • Documented evidence of the implementation and testing or verification of the change
  • Tracking of all changes applied over the life of the contractual agreement.

Through periodic audits by a representative, the sponsor can monitor the CMO's continuous-improvement and compliance efforts. Areas to be monitored may include the following:

  • Status of CAPA plans and activities related to required remediations
  • Number or percent of CAPA items closed since the last audit or in a specified period of time
  • Number or percent of remediation projects that are tracking to schedule
  • Percent of qualified IT infrastructure
  • Percent of CMO employees trained in good IT practices, GXP awareness, good documentation practices, and applicable CMO policies and SOPs.

Table II: Recommended procedures for the support of qualification and validation.
The sponsor can require the CMO to establish documented processes and procedures for the qualification and validation of GXP-related automated equipment, automated laboratory instrumentation, and application or business systems. This documentation might include the following:
  • A policy and rationale for qualification and validation
  • A process or tool to help determine whether qualification or validation is necessary. This may include a GXP-assessment process or a risk-assessment process.
  • Standard processes or procedures to support qualification and validation (see Table II).

The sponsor may also require the CMO to establish a business-continuity plan and to agree on financial penalties it will pay for failed FDA audits.

The contract should provide for periodic, unannounced audits by the sponsor for the life of the agreement. In addition, the sponsor should insist on timing regular audits before specific milestones such as regulatory submissions or product launches. SLAs should establish that the CMO will maintain adequate product supplies to ensure that clinical-trial or other batch quantities are sufficient.

SLAs should establish detailed descriptions of the type and frequency of electronic data, records, and reports that will be provided to the sponsor. The failure to establish the timing of these reports in the SLA up-front often results in the sponsors paying extra for electronic reports that should have been part of the basic agreement or receiving electronic files that are incompatible with the sponsor's IT systems.


Pharmaceutical and biopharmaceutical companies will continue to take advantage of the economic benefits of outsourcing the manufacturing of their clinical supplies and commercialized products. The goal of the contract manufacturing organization selection process is to find a stable business partner that manufactures the sponsor's product according to specifications, satisfies regulatory requirements for product manufacturing and control, and provides the sponsor with the information, data, and records needed to sustain the business relationship.

A thorough information technology assessment of the CMO candidates should be considered part of the standard project management for the CMO-candidate identification and selection process. Early identification of the CMO's IT capabilities and practices will enable the sponsor to avoid common problems such as erratic availability and retention of electronic data and batch-related information, incompatibility of CMO and sponsor information systems and data, hidden costs for upgrades of CMO technology components, and failure to meet regulatory expectations.

Working with a CMO business partner that has implemented and uses industry good practices for IT processes and controls will reduce the sponsor's compliance risks, provide the sponsor with the data and information they need, and allow the sponsor to focus on the core business functions that the sponsor has chosen to pursue.

Kathleen A. Pelley* is head of the life-sciences quality practice, and John Postle is head of the life-sciences enterprise practice at Court Square Group, 1350 Main St., 5th floor, Springfield, MA 01103, tel. 215.340.5779,

*To whom all correspondence should be addressed.


1. FDA, General Principles of Software Validation; Final Guidance for Industry and FDA Staff (Rockville, MD, 2002).

2. FDA, Pharmaceutical cGMPs for the 21st Century: A Risk-Based Approach (Rockville, MD, 2002).

3. International Organization for Standardization, "ISO–IEC 20000-1:2005 IT Service Management: Specification for Service Management" (Geneva, 2005).

4. ISO, "ISO–IEC 20000-2:2005 IT Service Management: Code of Practice for Service Management" (Geneva, 2005).

5. ISO, "ISO 9001:2000 Quality Management Systems—Requirements" (Geneva, 2000).

6. Information Systems Audit and Control Association, "COBIT 4.1 Control Objectives for Information and Related Technology" (Rolling Meadows, IL, 2007).

7. FDA, "Current Good Manufacturing Practice in Manufacturing, Processing, Packing, or Holding of Drugs; General," 21 CFR Part 210 (Rockville, MD, 2007).

8. FDA, "Current Good Manufacturing Practice for Finished Pharmaceuticals," 21 CFR Part 211 (Rockville, MD, 2007).

9. FDA, "Good Laboratory Practice for Nonclinical Laboratory Studies," 21 CFR Part 58 (Rockville, MD, 2007).

10. FDA, "Electronic Records; Electronic Signatures; Final Rule," 21 CFR Part 11 (Rockville, MD, 2007).

11. FDA, "Electronic Records; Electronic Signatures—Scope and Application," Guidance for Industry, Part 11 (Rockville, MD, 2003).


blog comments powered by Disqus
LCGC E-mail Newsletters

Subscribe: Click to learn more about the newsletter
| Weekly
| Monthly
| Weekly

What role should the US government play in the current Ebola outbreak?
Finance development of drugs to treat/prevent disease.
Oversee medical treatment of patients in the US.
Provide treatment for patients globally.
All of the above.
No government involvement in patient treatment or drug development.
Finance development of drugs to treat/prevent disease.
Oversee medical treatment of patients in the US.
Provide treatment for patients globally.
All of the above.
No government involvement in patient treatment or drug development.
Jim Miller Outsourcing Outlook Jim MillerCMO Industry Thins Out
Cynthia Challener, PhD Ingredients Insider Cynthia ChallenerFluorination Remains Key Challenge in API Synthesis
Marilyn E. Morris Guest EditorialMarilyn E. MorrisBolstering Graduate Education and Research Programs
Jill Wechsler Regulatory Watch Jill Wechsler Biopharma Manufacturers Respond to Ebola Crisis
Sean Milmo European Regulatory WatchSean MilmoHarmonizing Marketing Approval of Generic Drugs in Europe
FDA Reorganization to Promote Drug Quality
FDA Readies Quality Metrics Measures
New FDA Team to Spur Modern Drug Manufacturing
From Generics to Supergenerics
CMOs and the Track-and-Trace Race: Are You Engaged Yet?
Source: Pharmaceutical Technology,
Click here