QP Oversight of Contract Manufacturing

Outsourcing manufacture to a CMO does not outsource the legal duty to certify. Effective QP oversight CMO arrangements are what stand between a slick technical agreement and a batch you can defend in front of an MHRA inspector. This article sets out how a Qualified Person should structure, evidence and sustain genuine control over contract manufacturing under EU GMP and the equivalent UK framework.

Why QP oversight of a CMO is different

When production sits inside your own quality system, the QP enjoys daily visibility of deviations, change control and people. When it sits at a contract manufacturer, that visibility has to be deliberately engineered. The certifying QP remains personally responsible under Annex 16 for every batch released to the EU or Great Britain market, regardless of where it was made or how many parties touched it.

The two failure modes are predictable. The first is distance: the QP signs against a certificate of analysis and a paragraph of summary, never having tested the underlying assumptions. The second is dilution: a supply chain with an API maker, a primary manufacturer, a packer and an importer, where each party assumes someone else owns the gaps. Annex 16 is explicit that the certifying QP must have assurance over the entire chain, not merely the final step in front of them.

The legal anchor

EU GMP Chapter 7 governs outsourced activities and frames the relationship as Contract Giver and Contract Acceptor. The Contract Giver is accountable for assessing the competence of the Acceptor and for ensuring GMP is applied; the Acceptor must not subcontract further without written approval. Read Chapter 7 alongside Annex 16 and ICH Q10, and the obligation is clear: the QP owns the outcome even when another company owns the equipment.

Building the technical agreement that actually controls risk

A Chapter 7 technical (quality) agreement is the spine of QP oversight. A weak one lists responsibilities; a strong one removes ambiguity about who decides. Every recurring quality decision should map to a named owner.

• Deviation and OOS handling — who investigates, who approves the root cause, and crucially the timeline within which the CMO must notify the Contract Giver before disposition.
• Change control — which changes the CMO may make autonomously versus those requiring prior written approval, with regulatory-impacting changes always escalated.
• Batch disposition — the boundary between the site QP releasing for compliance with the marketing authorisation dossier and the certifying QP performing final certification under Annex 16.
• Subcontracting — explicit prohibition on onward outsourcing of GMP activities without approval, closing the most common audit finding.
• Data and records — guaranteed, timely access to raw data, not just summaries, so ALCOA+ expectations on completeness and contemporaneity can be verified.

Treat the agreement as a living document reviewed against ICH Q9 risk principles, not a contract signed once and filed. When a process changes materially, the agreement is reviewed before the change is implemented.

QP oversight CMO in practice: the routine controls

Sound governance turns the agreement into a rhythm of evidence. Strong QP oversight CMO programmes rest on a handful of disciplines applied consistently rather than heroically.

1. Qualification before reliance. No CMO should manufacture commercial product before an on-site GMP audit confirms the quality system, premises and data integrity controls are fit for purpose. Initial qualification is a decision, not a formality.
2. A periodic audit programme. Re-audit frequency should be risk-based under ICH Q9, typically every two to three years for stable, low-risk operations and more often where dossier complexity, sterile manufacture under Annex 1, or prior findings warrant it.
3. Live deviation visibility. The QP should see significant deviations as they arise, not at year end. A monthly quality review call with a shared deviation and CAPA log keeps surprises out of the certification queue.
4. Product Quality Reviews. The annual PQR must consolidate data across the chain. Where the CMO drafts it, the Contract Giver QP reviews and challenges trends rather than rubber-stamping them.
5. The batch certification dossier. Before certifying, the QP confirms manufacture and testing followed the registered process, all deviations are closed or justified, and the supply chain integrity is intact under Annex 16.

If you cannot evidence how you reached assurance for a given batch, you have not exercised oversight — you have merely signed. Inspectors test the reasoning behind the signature, not just its presence.

Cross-border supply chains and the certifying QP

Post-Brexit, product manufactured in the EU and imported into Great Britain typically requires certification and, where applicable, an importation and re-testing assessment performed by a UK-based QP, supported by appropriate written confirmations. Where manufacture sits outside the EU and UK, importation testing obligations and reliance on registered third-country standards must be confirmed batch by batch.

For sterile and biological products, Annex 1 raises the contamination control strategy bar considerably, and the certifying QP must understand how the CMO's environmental monitoring, aseptic process simulations and CCS map onto the dossier. Oversight here is technical, not administrative. Where you operate to both EU GMP and a 21 CFR 210/211 expectation for a US-facing line, the agreement should make clear which standard governs which activity to avoid a hybrid that satisfies neither.

Common gaps that surface in inspection

Recurring weaknesses in QP oversight CMO arrangements are remarkably consistent across inspections and worth pre-empting.

• Stale technical agreements that no longer reflect the process, the sites involved, or current responsibilities.
• Summary-only data access, where the QP never sees raw chromatography or batch records and so cannot test ALCOA+ integrity.
• Undeclared subcontracting by the CMO, breaching Chapter 7 and invalidating the certifying QP's assurance.
• Audit programmes that lapse under commercial pressure, leaving qualification status unsupported by current evidence.
• Deviation backlogs at the CMO that the Contract Giver only discovers at PQR.

Each of these is closable with governance rather than capital. The discipline is in maintaining it when timelines tighten. Our case studies illustrate how structured oversight programmes have closed exactly these gaps, and our wider range of services shows how audit, QP and QMS support fit together.

Key takeaways and where to get support

Robust QP oversight CMO control is built, not assumed. It rests on a sharp Chapter 7 technical agreement, risk-based qualification and re-auditing under ICH Q9, live deviation visibility, and a certification decision under Annex 16 that you can fully evidence across the supply chain. Get those right and outsourced manufacture becomes a controlled extension of your quality system rather than a blind spot.

If you are appointing a CMO, inheriting a strained arrangement, or strengthening oversight ahead of an inspection, our contract QP, RP and RPi services provide named, experienced QPs who hold genuine control rather than nominal sign-off. Contact us to discuss how we can support your contract manufacturing oversight.

Regulatory sources

This guidance reflects current UK and EU GMP/GDP requirements. Primary references:

• EU GMP Chapter 7 — Outsourced Activities
• EU GMP Annex 16 — Certification by a Qualified Person and Batch Release
• EMA — GMP/GDP Questions & Answers
• EudraLex Volume 4 — EU GMP Guidelines

Always confirm against the latest published version of each source.