Selecting a Contract Manufacturer (CMO)

Choosing where your medicine is made is one of the highest-consequence quality decisions a marketing authorisation holder, virtual pharma company or importer will take. Good CMO selection is not a procurement exercise won on price and lead time; it is a risk-based judgement about whether a third-party site can make your product to EU GMP, batch after batch, for years. Get it right and you build a stable, inspectable supply chain; get it wrong and you inherit the contract acceptor's deviations, recalls and inspection findings as your own.

Why CMO selection is a quality decision, not just a commercial one

Under EU GMP Chapter 7, the contract giver remains responsible for assessing the suitability of the contract acceptor and for ensuring the work is carried out in accordance with the marketing authorisation. Outsourcing manufacture never outsources accountability. The Qualified Person who ultimately certifies each batch must have documented assurance that the site is fit for purpose, and that assurance begins at selection, long before the first commercial batch is made.

ICH Q10 frames this as lifecycle management of outsourced activities: the pharmaceutical quality system extends across the supply chain, so the partner you choose effectively becomes an extension of your own QMS. A clean manufacturing licence tells you a site holds an authorisation; it does not tell you whether it can handle your process, dossier and timelines. Selecting on capability and culture, rather than on a glossy capability statement, is what separates a resilient relationship from a costly one.

Defining requirements before you approach the market

The most common selection failure is shopping before the specification is written. Establish, internally and in writing, exactly what you need the CMO to do before any site is contacted.

Map the technical and regulatory scope

• Product and process — dosage form, sterile or non-sterile, potent or biological material, batch sizes and scale-up needs.
• Regulatory footprint — the markets you supply and therefore the standards in play: EU GMP and MHRA expectations, and where product reaches the United States, the requirements of 21 CFR 210 and 211.
• Analytical and release model — testing in-house or subcontracted, stability capacity, and where QP certification and batch release will sit.
• Supply continuity — forecast volumes, sole-source risk, and whether a second source is realistic.

This specification becomes the yardstick for every later assessment. Without it, you cannot judge whether a site is genuinely capable or merely available.

A risk-based CMO selection framework

ICH Q9 expects assessment effort to be proportionate to risk, and that principle should drive how hard you look at each candidate. A site making a sterile injectable, where Annex 1 contamination control dominates, warrants far deeper scrutiny than one blending a low-dose oral solid. Build your evaluation around a consistent, weighted set of criteria so candidates are compared on the same basis.

Criteria that genuinely predict success

1. Compliance and inspection history — recent MHRA or other regulatory outcomes, warning letters, recalls and the trajectory of their findings over time.
2. Quality system maturity — the independence of the quality unit, and the real effectiveness of change control, deviation and CAPA management rather than the existence of SOPs.
3. Data integrity posture — whether paper and electronic records meet ALCOA+, with sound audit trails, access controls and validated computerised systems.
4. Technical fit and capacity — proven experience with comparable products, available capacity, and honest spare headroom rather than a site already running at its limit.
5. Subcontracting and supply chain — how the CMO qualifies and controls its own suppliers and any fourth parties handling testing, sterilisation or packaging.
6. Quality culture and transparency — willingness to share data, discuss past failures openly and engage technically rather than commercially.

The strongest predictor of a good partnership is not a flawless record but how a site behaves when something goes wrong. Ask to see a recent significant deviation and trace how it was investigated and closed.

Score candidates against these criteria, document the rationale, and keep the scoring. When an inspector later asks why a particular site was chosen, the assessment record is your defence. A structured approach to this assessment sits within wider supplier and vendor management, and our full range of consultancy services supports each stage.

Due diligence, audit and contract

Desktop review narrows the field; an audit decides it. For any critical site, an on-site qualification audit remains the expectation, because contamination control, personnel behaviour and the gemba reality of an aseptic area cannot be judged from a questionnaire or a screen. Walk the process from incoming materials through manufacture and release, and test whether what is written is what is done.

Selection is only complete when the relationship is documented. EU GMP Chapter 7 requires a written technical or quality agreement that unambiguously allocates GMP responsibilities between contract giver and acceptor — who controls change, who reports deviations, who handles complaints and recalls, and how the QP obtains the information needed to certify. Negotiate this in parallel with the commercial contract, never as an afterthought, so that quality expectations are locked in before the first batch.

Watch for these warning signs

• Reluctance to share inspection outcomes or recent deviation data.
• A quality unit that reports to operations or lacks the authority to stop a batch.
• Capacity claims that depend on the site winning no other new business.
• Vague answers on subcontracted activities and onward distribution under GDP.

Beyond selection: managing the relationship

Choosing a CMO is the start of an ongoing obligation, not the end of one. ICH Q10 expects outsourced activities to be monitored throughout the lifecycle, so build in periodic re-audit driven by risk, defined quality metrics and a regular review of performance against the agreement. Products, volumes, key personnel and ownership all change, and a site that was right at selection can drift. Treat the approved status as a living judgement that must reflect current, real-world performance.

Examples of how a structured selection and oversight programme prevents problems are set out in our case studies.

Key takeaways

Sound CMO selection is a documented, risk-based quality decision that protects patients and keeps you defensible before the MHRA. Define your requirements first, weigh candidates against criteria that genuinely predict performance, confirm capability through an on-site audit, and lock expectations into a Chapter 7 quality agreement before any batch is made. Then manage the relationship across its lifecycle under ICH Q10.

If you need independent, QP-led support to select, audit and qualify a contract manufacturer — or to strengthen oversight of an existing one — our team can guide the decision to EU GMP and GDP expectations. Contact Double Helix Pharma to discuss your CMO selection and supplier oversight programme.

Regulatory sources

This guidance reflects current UK and EU GMP/GDP requirements. Primary references:

• EU GMP Chapter 7 — Outsourced Activities
• EU GMP Part II — Active Substances (APIs)
• EMA — GMP/GDP Questions & Answers

Always confirm against the latest published version of each source.