How to Qualify and Audit a CDMO Under FDA GMP and ICH Q10 Requirements

Introduction:

Choosing the right manufacturing partner can make or break a drug product’s journey from development to market. CDMO qualification and audit is the risk-based process used to verify that a contract development and manufacturing organization can consistently perform outsourced activities in compliance with FDA GMP requirements and the ICH Q10 Pharmaceutical Quality System model — before a contract is signed and throughout the life of the relationship. Getting this process right protects patient safety, product quality, and regulatory standing, while getting it wrong can lead to recalls, warning letters, and costly supply disruptions. At ResolveMass Laboratories Inc., our quality and regulatory affairs team routinely supports sponsors through this exact process, including specialized peptide CDMO qualification programs, and this guide distills that hands-on experience into a practical roadmap.

Summary:

• CDMO qualification is a documented, risk-based evaluation of a manufacturing partner’s quality system, facilities, personnel, and regulatory history — not just a review of certificates.
• FDA CGMP requirements for drug manufacturing sit primarily in 21 CFR Parts 210 and 211, while ICH Q10 provides the lifecycle-oriented Pharmaceutical Quality System (PQS) framework regulators expect a CDMO to operate under.
• Qualification should always start by defining the exact scope of outsourced activity (API, drug product, sterile manufacturing, analytical testing, etc.) before deciding on audit depth.
• A proper audit combines desktop due diligence (documents, quality metrics, inspection history) with a risk-based on-site or remote audit of facilities, equipment, laboratory operations, and data integrity.
• Findings should be classified by risk (Critical/Major/Minor/Observation) and resolved through documented CAPA before final approval — a completed audit alone is not qualification.
• A written Quality Agreement is essential and should never be used to transfer away statutory GMP responsibilities.
• Ongoing monitoring — periodic re-audits, quality metrics, and triggered reassessments — must continue for the life of the relationship.
• Common mistakes include auditing only documentation, over-relying on certifications, ignoring data integrity, and failing to assess subcontractors.

1: Why CDMO Qualification and Audit Matters

CDMO qualification and audit matters because outsourcing manufacturing does not eliminate a sponsor’s quality responsibilities. FDA’s quality agreement guidance makes clear that the owner and contract facility must clearly define their respective CGMP responsibilities, and contract facilities remain fully accountable for complying with applicable CGMP requirements regardless of contractual language.

This accountability is built into 21 CFR Parts 210 and 211, FDA’s core CGMP regulations for drug manufacturing. If a CDMO fails an FDA inspection or releases nonconforming batches, the sponsor’s product approval, supply continuity, and reputation are all at risk. A rigorous qualification and audit program is the primary control a sponsor has over a facility it doesn’t operate directly — which is why organizations increasingly compare not just individual CDMOs but entire sourcing regions, such as when evaluating United States vs. overseas peptide CDMOs for regulatory predictability and audit accessibility.

2: What Are the FDA GMP and ICH Q10 Expectations for a CDMO?

FDA GMP establishes the regulatory foundation for manufacturing controls, while ICH Q10 provides a systematic quality-management framework spanning the entire product lifecycle. Together, they define both the minimum legal requirements and the maturity level a sponsor should expect from a qualified CDMO.

ICH Q10 centers on:

• Process performance and product quality monitoring
• Corrective and preventive action (CAPA)
• Change management
• Management review
• Continual improvement
• Knowledge management and quality risk management as enabling elements

It’s worth noting that Q10 sits within a broader ICH framework — Q7 for APIs, Q8 for pharmaceutical development, Q9 for quality risk management, Q12 for lifecycle management, and Q14 for analytical procedure development — so a thorough audit should consider whether the CDMO’s practices align with the relevant guidelines for the specific activity being outsourced.

3: How Should a CDMO Be Qualified Before an Audit?

A CDMO should be qualified through a staged process that starts with defining the exact scope of the outsourced activity, followed by document-based screening, before any on-site audit is scheduled. Jumping straight to a facility tour without this groundwork often means auditors miss activity-specific risks.

Step 1: Define the Scope of Outsourced Activities

Define scope by identifying precisely what the CDMO will perform — API manufacturing, drug substance or drug product manufacturing, sterile manufacturing, oral solid dosage, analytical testing, stability studies, packaging, or technology transfer. The audit scope should reflect the actual operation being outsourced rather than a generic corporate-level review. For example, sponsors evaluating a partner for CGMP peptide manufacturing services need an audit scope built around peptide synthesis, purification, and impurity control — not a generic small-molecule checklist.

Step 2: Perform Initial Supplier Screening

Initial screening means collecting objective information across a defined set of qualification areas before the formal audit begins.

4: What Should Be Checked During a CDMO Quality Audit?

A CDMO quality audit should examine the systems that directly influence product quality: the quality management system, manufacturing operations, and laboratory/analytical controls — verified against actual practice, not just written procedure.

Quality Management System — Assess quality policies, document control, training management, internal audits, management review, quality metrics, and product quality review, along with whether the quality unit has real independence from operations.

Manufacturing Operations — Review master batch records, in-process controls, process parameters, equipment qualification, cleaning validation, cross-contamination controls, line clearance, yield reconciliation, and batch release procedures. Auditors should compare written SOPs against actual shop-floor practice.

Laboratory and Analytical Controls — This area is especially critical when the CDMO performs release, stability, or characterization testing. Review analytical method validation, reference standards, instrument qualification, calibration, OOS/OOT investigations, raw data, and chromatographic records.

5: How Important Is Data Integrity in CDMO Audits?

Data integrity should be treated as a core audit area because regulatory compliance depends on records that are attributable, contemporaneous, original (or true copy), and accurate. Auditors need to evaluate both electronic and paper systems using objective evidence — not interview answers alone.

Key questions to verify:

• Are audit trails enabled and periodically reviewed?
• Are user accounts individually assigned with controlled access privileges?
• Can users modify or delete data without traceability?
• Are electronic records backed up and chromatographic files retained?
• Is there evidence of undocumented testing or repeat analysis?

6: How Should Deviations, OOS, OOT and CAPA Be Evaluated?

Deviations, OOS, and CAPA should be evaluated by looking for patterns across a representative sample of records — not by reviewing isolated events in isolation. Repeated deviations tied to the same equipment, method, or process parameter often signal a systemic control problem rather than a one-off error, even when each individual CAPA appears closed.

CDMO Audit Checklist

A structured checklist keeps assessments consistent across multiple CDMOs. Core categories include:

• Regulatory & Quality System: registrations verified, inspection history reviewed, quality organization and internal audit program assessed
• Facilities & Equipment: layout, equipment qualification, calibration, preventive maintenance, cleaning validation, cross-contamination controls
• Manufacturing: batch records, process controls, material traceability, line clearance, batch release process
• Laboratory: method validation, reference standards, instrument qualification, OOS/OOT system, raw-data controls
• Quality Systems: deviation management, CAPA, change control, complaint handling, data integrity, product quality review
• Outsourcing: subcontractor identification and qualification, Quality Agreement, change notification, audit rights

7: How Should Audit Findings Be Classified?

Audit findings should be classified by their potential impact on product quality, patient safety, and regulatory compliance, using categories that drive proportionate action.

A completed audit is not the same as qualification. After findings are classified, the sponsor should request a CAPA response, evaluate root-cause analysis, verify supporting evidence, and formally document the qualification decision — escalating to a follow-up audit for high-risk deficiencies before granting approval.

Why Is the Quality Agreement Essential?

A Quality Agreement is essential because it establishes, in writing, who is responsible for each specific GMP activity — eliminating the ambiguity that leads to missed deviation notifications or unclear batch release authority. FDA specifically recommends written quality agreements for contract manufacturing arrangements.

A strong Quality Agreement should address batch release responsibilities, specifications, deviations, OOS investigations, CAPA, change control, complaints, recalls, stability, document retention, data integrity, audit rights, and subcontracting. Importantly, contractual language should never be used to transfer away a CDMO’s statutory GMP responsibilities.

8: How Often Should a Qualified CDMO Be Re-Audited?

There is no universal re-audit interval — frequency should be determined through a documented, risk-based approach rather than a fixed calendar rule. Factors that should influence the interval include product risk, sterile vs. non-sterile manufacturing, regulatory history, prior audit findings, OOS/OOT trends, CAPA performance, significant manufacturing or personnel changes, and the supplier’s business criticality. A CDMO with unresolved quality concerns warrants tighter oversight than a stable partner with a strong compliance history.

Common Mistakes in CDMO Qualification

The most common qualification mistakes reduce the effectiveness of the entire program even when an audit report looks thorough on paper:

• Auditing only documentation — well-written SOPs don’t guarantee consistent implementation on the floor
• Focusing only on certifications — certificates shouldn’t replace a detailed system-level assessment
• Ignoring data integrity — a manufacturing-only audit can miss significant electronic-record risks
• Treating CAPA closure as the end — administrative closure doesn’t confirm the root cause was fixed
• Failing to assess subcontractors — contractors performing critical testing or manufacturing must also be evaluated and auditable

9: How ResolveMass Laboratories Supports CDMO Qualification and Audit

At ResolveMass Laboratories Inc., our analytical and regulatory quality teams work directly with sponsor companies to plan, execute, and document CDMO qualification and audit programs aligned with FDA GMP and ICH Q10 expectations. Our technical support spans analytical testing and characterization, method development and validation, impurity profiling, stability-related testing, HPLC/GC/LC-MS-based investigations, and CMC-related analytical support — connecting supplier oversight to real analytical evidence rather than treating an audit as a checklist exercise.

This is particularly relevant for sponsors sourcing through a North American peptide CDMO, where impurity profiling, sequence-related substances, and synthesis-specific data integrity controls require specialized audit expertise beyond a generic GMP checklist. For companies weighing where to locate manufacturing, our guidance on choosing a peptide CDMO in the United States can also help align sourcing strategy with audit accessibility and regulatory oversight expectations.

Conclusion:

CDMO qualification and audit should be treated as a documented, risk-based lifecycle activity — not a one-time supplier assessment completed before contract signing. Effective qualification combines scope definition, regulatory due diligence, quality-system and laboratory review, data-integrity verification, risk-classified findings, a clearly defined Quality Agreement, and continuous post-approval oversight. The central question a sponsor must always be able to answer with documented evidence is simple: can this CDMO perform the contracted activity under appropriate GMP controls, and can we demonstrate ongoing oversight of it throughout the product lifecycle? If your organization needs experienced support navigating CDMO qualification and audit, the team at ResolveMass Laboratories Inc. is ready to help.

Frequently Asked Questions:

Reference

• Kendrick BS, Gabrielson JP, Hunt D, Christie M, Bowen S, Vessely C, Rogers RS, Cleveland C, Maluf K, Roach S, Ritter N. Quality risk management and data integrity in R&D laboratories supporting CMC lifecycle of biological products. Journal of Pharmaceutical Sciences. 2024 Nov 1;113(11):3123-36.https://www.sciencedirect.com/science/article/pii/S0022354924004210
• Lowdell MW. Considerations for manufacturing of cell and gene medicines for clinical development. Cytotherapy. 2025 Jul 1;27(7):874-83.https://www.sciencedirect.com/science/article/pii/S1465324924009411
• Gottipati VK. Mastering Quality Assurance in Pharma: A Comprehensive Guide to cGMP, Risk Management 2025. YASHITA PRAKASHAN PRIVATE LIMITED;.https://books.google.com/books?hl=en&lr=&id=StZlEQAAQBAJ&oi=fnd&pg=PA9&dq=How+to+Qualify+and+Audit+a+CDMO+Under+FDA+GMP+and+ICH+Q10+Requirements&ots=AUPIk_pYIJ&sig=PzHqmzr9tF3RPWyHcmAdn3oLmTQ

About the Author

Priyal Darji