GMP Audits for Contract Manufacturers (CMOs)

Outsourcing manufacture to a contract manufacturing organisation does not outsource the obligation to ensure quality. A well-run CMO GMP audit is the mechanism by which a marketing authorisation holder, virtual pharma company or importer demonstrates that a third-party site operates to EU GMP and that product released onto the market is fit for patients. This article sets out how to scope, conduct and follow up these audits so they withstand both commercial and regulatory scrutiny.

Why a CMO GMP audit is non-negotiable

Under EU GMP Chapter 7, the contract giver remains responsible for assessing the competence and compliance of the contract acceptor. The Qualified Person who certifies each batch must have documented assurance that the manufacturing site is suitable, and that assurance is built on audit evidence rather than reputation or a valid manufacturing licence alone. A clean MIA tells you a site holds an authorisation; it does not tell you whether your product, process and dossier are being handled correctly.

The principles of ICH Q10 reinforce this: the pharmaceutical quality system extends across the supply chain, and outsourced activities must be monitored throughout the lifecycle. The audit is therefore not a one-off entry gate but a recurring control whose frequency should be justified by risk.

Risk-based scoping before you set foot on site

ICH Q9 expects audit effort to be proportionate to risk. Before agreeing a date, define what the audit must actually answer. A site making a sterile injectable carries a materially different risk profile from one blending a low-dose oral solid, and Annex 1 expectations for contamination control will dominate the agenda in the former case.

Factors that shape the scope

• Product and process complexity — sterile versus non-sterile, biologics, potent compounds, novel delivery systems.
• Regulatory history — recent inspection outcomes, warning letters, recalls or significant deviations.
• Maturity of the relationship — a first qualification audit is broader than a routine periodic re-audit.
• Criticality to supply — sole-source sites and products without alternatives warrant deeper assurance.

Document the rationale. When an inspector later asks why a site is audited every three years rather than annually, the risk assessment is your answer.

Conducting the on-site CMO GMP audit

An effective audit follows the product and the data, not just the SOP index. Walk the process from incoming materials through manufacture, packaging, testing and release, and test whether what is written is what is done. Auditors who only review documents in a meeting room miss the gemba reality where most genuine risk lives.

Core areas to interrogate

1. Quality system and governance — change control, deviation and CAPA effectiveness, management review, and the independence of the quality unit.
2. Data integrity — apply ALCOA+ to both paper and electronic records. Examine audit trails, access controls, system validation and the handling of out-of-specification results.
3. Contamination control — for sterile products, assess the contamination control strategy expected under Annex 1, including environmental monitoring, aseptic process simulation and personnel behaviour.
4. Materials and supplier management — qualification of starting materials, supply-chain traceability and onward control of the CMO's own subcontractors.
5. Premises, equipment and validation — qualification status, calibration, cleaning validation and prevention of cross-contamination.
6. Personnel and training — competence, hygiene and a demonstrable quality culture.

An audit finding is only as valuable as the objective evidence behind it. Record the batch number, the document reference, the observation seen on the floor — not a vague impression.

Grade observations consistently as critical, major or other, and make the criteria explicit so the contract acceptor and your own management interpret them the same way. For complex sterile or biologic sites, a deeper methodology and the structure of a focused GMP audit programme are explored further in our consultancy services.

From findings to a closed, defensible CAPA

The audit report should reach the contract acceptor promptly and demand a corrective and preventive action plan with realistic, dated commitments. Resist accepting "retrained the operator" as a standalone fix; ICH Q10 expects root-cause analysis and preventive measures that address why the system allowed the failure. Track each action to verified closure, and confirm critical remediations through evidence or a follow-up visit rather than a tick-box email.

Crucially, the findings must feed the QP's batch certification decision and the technical or quality agreement that underpins the relationship. Chapter 7 requires a written contract that unambiguously allocates GMP responsibilities; the audit frequently exposes gaps between what the agreement says and what actually happens.

Common pitfalls that undermine a CMO GMP audit

• Treating the audit as a formality — a templated checklist with no risk focus generates paperwork, not assurance.
• Ignoring subcontracting — CMOs often outsource testing, sterilisation or packaging; unaudited fourth parties are a frequent blind spot.
• Weak data-integrity scrutiny — failing to interrogate audit trails and computerised systems against ALCOA+ remains a leading source of regulatory action.
• No vendor lifecycle view — qualifying a site once and never returning, even as products, volumes or personnel change.
• Auditing only against EU GMP — where product reaches the United States, expectations under 21 CFR 210 and 211 should also be considered, and GDP guidelines apply to onward distribution.

Examples of how a structured programme resolves these issues are set out in our case studies.

Key takeaways

A robust CMO GMP audit is a risk-based, evidence-led control that protects patients and keeps the marketing authorisation holder defensible before the MHRA and other regulators. Scope it to the product's risk, audit the process rather than the binder, hold the contract acceptor to genuine root-cause CAPA, and treat oversight as an ongoing lifecycle activity under ICH Q10.

If you need an independent, QP-led audit of a contract manufacturer — first qualification, periodic re-audit, or for-cause investigation — our team can scope and deliver it to EU GMP and GDP expectations. Contact Double Helix Pharma to discuss your supplier oversight programme.

Regulatory sources

This guidance reflects current UK and EU GMP/GDP requirements. Primary references:

• EU GMP Chapter 7 — Outsourced Activities
• EudraLex Volume 4 — EU GMP Guidelines
• EU GMP Chapter 9 — Self Inspection
• MHRA Inspectorate Blog

Always confirm against the latest published version of each source.